API tools faq
paste
Advertisement
paladin316

Docs_d1da9815230c9091d9b7fed1a2d9b753_2019-08-20_12_05.txt

paladin316
Aug 20th, 2019
1,651
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 253.00 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Shellcode"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_d1da9815230c9091d9b7fed1a2d9b753.html?q=mJ2Xxgp"
  7. * File Size: 253952
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Pen Test, Template: Normal, Last Saved By: Pen Test, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Thu Jun 13 19:02:00 2019, Last Saved Time/Date: Thu Jun 13 19:02:00 2019, Number of Pages: 9, Number of Words: 3515, Number of Characters: 20042, Security: 0"
  9. * SHA256: "39dfb59bfdc599071a3990c1eafbb018e578e7caaadfd8492639a2783fd8b32e"
  10. * MD5: "d1da9815230c9091d9b7fed1a2d9b753"
  11. * SHA1: "31597c285ba4405996d1767d0a0123d63ee5f4b5"
  12. * SHA512: "4e22f7680e5f1fb867a1f6137bc79c1f7ed00b1abe6cd72cab8be69c39d90eba9bf80ae4aee33922edd6a3af63833af6a3be4f158cddb9d6eb7a8b83f7bdbca2"
  13. * CRC32: "00ED8660"
  14. * SSDEEP: "6144:ajj6ez4tCs1iaj1hlv8r2aW6RorB5K7z1a9py6cKR:Sj6ez4tCs1iuzGr2N6RoV5sz1yw6cK"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe",
  19. "rundll32.exe"
  20.  
  21.  
  22. * Executed Commands:
  23. "C:\\Windows\\splwow64.exe 12288",
  24. "C:\\Windows\\\\SysWOW64\\\\rundll32.exe"
  25.  
  26.  
  27. * Signatures Detected:
  28.  
  29. "Description": "A process attempted to delay the analysis task.",
  30. "Details":
  31.  
  32. "Process": "rundll32.exe tried to sleep 1680 seconds, actually delayed analysis time by 0 seconds"
  33.  
  34.  
  35. "Process": "splwow64.exe tried to sleep 600 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38. "Process": "WINWORD.EXE tried to sleep 274 seconds, actually delayed analysis time by 0 seconds"
  39.  
  40.  
  41.  
  42.  
  43. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  44. "Details":
  45.  
  46. "IP": "52.109.20.1:443"
  47.  
  48.  
  49. "IP": "52.109.20.4:443"
  50.  
  51.  
  52. "IP": "92.123.51.45:443"
  53.  
  54.  
  55. "IP": "104.18.24.243:80"
  56.  
  57.  
  58. "IP": "184.25.56.196:80"
  59.  
  60.  
  61. "IP": "40.91.122.234:443"
  62.  
  63.  
  64. "IP": "72.21.91.29:80"
  65.  
  66.  
  67. "IP": "23.222.163.54:443"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  73. "Details":
  74.  
  75. "ioc": "iso690.xsl"
  76.  
  77.  
  78. "ioc": "ontent.inf"
  79.  
  80.  
  81. "ioc": "ist.glox"
  82.  
  83.  
  84. "ioc": "architecture.glox"
  85.  
  86.  
  87. "ioc": "ieee2006officeonline.xsl"
  88.  
  89.  
  90. "ioc": "e.gu"
  91.  
  92.  
  93. "ioc": "gb.xsl"
  94.  
  95.  
  96. "ioc": "iso690nmerical.xsl"
  97.  
  98.  
  99. "ioc": "harvardanglia2008officeonline.xsl"
  100.  
  101.  
  102. "ioc": "ext.glox"
  103.  
  104.  
  105. "ioc": "mlaseventheditionofficeonline.xsl"
  106.  
  107.  
  108. "ioc": "chicago.xsl"
  109.  
  110.  
  111. "ioc": "gosttitle.xsl"
  112.  
  113.  
  114. "ioc": "quations.dotx"
  115.  
  116.  
  117. "ioc": "sist02.xsl"
  118.  
  119.  
  120. "ioc": "pictureorgchart.glox"
  121.  
  122.  
  123. "ioc": "rame.glox"
  124.  
  125.  
  126. "ioc": "rid.glox"
  127.  
  128.  
  129. "ioc": "..3b"
  130.  
  131.  
  132. "ioc": "rocess.glox"
  133.  
  134.  
  135. "ioc": "gostname.xsl"
  136.  
  137.  
  138. "ioc": "adial.glox"
  139.  
  140.  
  141. "ioc": "chevronaccent.glox"
  142.  
  143.  
  144. "ioc": "rc.glox"
  145.  
  146.  
  147. "ioc": "content.inf"
  148.  
  149.  
  150. "ioc": "iew.thmx"
  151.  
  152.  
  153. "ioc": "nline.xsl"
  154.  
  155.  
  156. "ioc": "set.dotx"
  157.  
  158.  
  159. "ioc": "ccent.glox"
  160.  
  161.  
  162. "ioc": "turabian.xsl"
  163.  
  164.  
  165. "ioc": "ype.thmx"
  166.  
  167.  
  168. "ioc": "ividend.thmx"
  169.  
  170.  
  171. "ioc": "etropolitan.thmx"
  172.  
  173.  
  174. "ioc": "rings.glox"
  175.  
  176.  
  177. "ioc": "uotable.thmx"
  178.  
  179.  
  180. "ioc": "erlin.thmx"
  181.  
  182.  
  183. "ioc": "rop.thmx"
  184.  
  185.  
  186. "ioc": "eadlines.thmx"
  187.  
  188.  
  189. "ioc": "arallax.thmx"
  190.  
  191.  
  192. "ioc": "avon.thmx"
  193.  
  194.  
  195. "ioc": "adge.thmx"
  196.  
  197.  
  198. "ioc": "ircuit.thmx"
  199.  
  200.  
  201. "ioc": "g.n9"
  202.  
  203.  
  204. "ioc": "roplet.thmx"
  205.  
  206.  
  207. "ioc": "vent.thmx"
  208.  
  209.  
  210. "ioc": "rail.thmx"
  211.  
  212.  
  213. "ioc": "eathered.thmx"
  214.  
  215.  
  216. "ioc": "amask.thmx"
  217.  
  218.  
  219.  
  220.  
  221. "Description": "Performs some HTTP requests",
  222. "Details":
  223.  
  224. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  225.  
  226.  
  227. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  228.  
  229.  
  230.  
  231.  
  232. "Description": "The office file has 2 macros.",
  233. "Details":
  234.  
  235.  
  236. "Description": "Network activity contains more than one unique useragent.",
  237. "Details":
  238.  
  239. "Process": "rundll32.exe"
  240.  
  241.  
  242. "User-Agent": ""
  243.  
  244.  
  245. "Process": "rundll32.exe"
  246.  
  247.  
  248. "User-Agent": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAM2)"
  249.  
  250.  
  251.  
  252.  
  253. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  254. "Details":
  255.  
  256. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p*\\x10\\xbdi\\xee\\xad\\xa1\\x8c\\xe2\\xc8>\\x08~\\x06\\xd0$\\x9f\\xfa+e\\xfb\\xb0y\\xc8\\x91z\\x0fzh\\x08\\x98\\xe5\\xd5b\\xa5l!\\x83|@\\xff1p#\\xc7\\xf9\\xe6\\xbbm%\\xba\\xaf\\x00\\x813\\x08f\\xa4yw\\xc8r\\xa2\\xf4\\xe4\"\\xad\\xd6@5\\xf6\\xf3b\\x917;.\\xb8\\x9f\\xf6t\\x91\\xa3\\x83\\xd4\\xed\\x0ce,\\xa6\\xef\\x11`3e\\xac\\xfe\\xd8\\x08u>\\x88\\x87\\x04u\\x1e\\xe7:\\xdb\\x10)eo\\x0eoc\\xd9i\\xc5\\xcf\\xa0m\\xc1\\x10\\xac\\xd7c\\x05\\xfe/u\\xfa\\x8ak\\x84\\xc4\\x89\\xa1\\xb3\\x14s&/q\\xe5\\xd7\\x9e\\x1du6a\\xd05\\xe5`j\\x1c\\xd6\\xff&\\xbee\\x17\\xb8\\x08\\xb7\\x1a3\\xe3-\\xaan\\xc9\\xd7\\x12m:c\\xa6<\\xa1\\x8e2$\\xaac\\x955\\x92\\xd2\\xa228\\x1dp\\xe3\\xe0o;\\x03q\\xd1\\x12\\x86\\xac\\x95fq\n\\xd8/\\xba\\xf5\\x93j\\x8cz\\xb9\\xe9|\\xfc\\xa0\\xf9\\xdb\\xd1\\xefw\\xc1\\x94qh;\\xb7ur\\xbf:\\xd9\\xd79\\xf5\\xc7+j0\\xcf\\xaae\\xe9\\xdf"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01\\xdf\\x1d\\xb3\\x9c\\xbc\\x9d\\xb3\\x08\\xf3\\xfad\\xfe(d`\\xa2\\x1e\\xa3\\xb4\\x00ar\\xf3\\\\xe1\\xa9\\xf3\\x9fh\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xc9\\xde\\xf4\\xf3'g\\x15a\\xc77\\xebl\\xcc\\x99\\xf9\\x806\\x92o\\xb9\\xdd\\x0e1\\xcc\\xff\\xbf\\x12\\x08\\x9a,j/\\xcaj\\xc7\\x06\\xad\\xac\\x81\\xdc\\x1b)\\xee\\xc7\\xbb\\x9e^\\x04\\xfd\\xa4l\\xd7%+m\\xb8z%\\x9c\\xa9\\xdc\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xfd\\x89\\xfb\\xb1\\x03\\xe8\\xec!w\\xb4\\xf4\r\\xb5\\x1d#d\\xfau\\xc1\\x02!e\\xab\\x8d\\xe6\\xc0\\x9f\\xb2\t\\x19ph\\xbd\\x08\\xc8\\xb4v\\xb7(\\x1f\\xeb,89\\xeb0z"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01\\xdf\\x1em\\x90u\\xa3\\xc8\\x11\\xbc\\xd4n'\\xc2\\xd7\\xf7m'<.\\xf6gmb2\\xd5`\\xa1\\x90z\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x04jd~\\x80\\x9c\\x03\\xc0\\xd6$x\\xdf\\xa6\\xf2tmj6o\\xd9\\x100\\x112\\xe2\\x90;\\xc6\\x17rro\\xcb\\x97\\xec\\x80f\\x0f8\\xc6_nc=_j\\x0eb\\xb6\\xe2$\\xd4\\xfb\\xc2s\\xc3\\xccf\\xfbk\\xa08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\x8b\\x8b\\xfb<$\\xee\\x8b\\x86\\x18\\x87\\x12\\xa6\\x92\\x1b\\xe5\\x84\\xc6a\\x8a \\x1d\\xe5\\x80\\x1a\\x83\\x06d\\x10\\xdc\\xa0\\xbf\\xf1\\x84e\\x7f\\xef\\xd7\\xb2\\xca\\xc8(>\\xd0\\xa3\\xab)"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x90\\xe7\\xd8\\xd6\\xe7\\x9dn\\x05\\xad^n\\xf4\\xa6q\\xc9\\x88\\xee\\xef\\xd74o\\xfc\\xbaf\\xd8\\x98;\\xab\\xbb\\x8fzq\\xb46\\x08mn\\xca\\xc9\r|?\\x1f\\xa5a\\xb6\\x8ax\\xd6*\\x19\\xdcp\\x0fq\\x10\\xfbv\\x16\\x8f\\x1f\\x0f/\\xc1\\xea\\x19\\x95\\xc0\\xd5\\x81\\xabw\\xc1\\x15fykx\\xa8\\xca\\x87\\x84\\xc0c\\xc8j:\\xd6)n\\x01cl>\\xfa\\x01\\xc8x\\xfc\\xd5n)\\xf0\\x14\\x93oqyesl\\x9c\\xba\\xf8\\x810o(\\xdd\\x12o\\x05 \\xc4\\x80\\\\xa3\\xb1j;\\x14\\?p\\xc8)\\x90\\xd3\\xb7wf\\xa6\\xcf\\xf7\\x9a!0p\\xbeh\\x1f\\xb7\\xca\\xd3\\x9c\\xb9\\xe2\\xb2\\xfc\\x811\\xbbb\\xc2y\\x93\\xcc\\xd6\\xfc\"\\xeb\\xfe6\\x17\\x10\\x8b\\xda\\xb3\\xf9s\\xd3\\xa1\\xed%\\xfd\\xe8\\xfb$\\x8b`\\x9fv\\xe2\\xac.\\x87\\xcbs\\xf5\\x10\\xca4\\x85\\x12\\x02 \\x12\\x06\\x99\\xfd\\xc7ga\\xb9\\xaf\\xaa\\x9fe\\x99\nx\\xa4\\x88j\\xe4\\xa1\\xbb\\xa7\\xb8r\\x009\\xeb4\\x93\\xce\\x97\\x90\\xb7\\x9bw\\xa4p\\x03v\\xb6\\xe1"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf5\\xa8su\\x1a\\xae\\xe0\\xf7\\xb8\\xb5:g\\xcf0j)\\xa5\\xc1\\xb8\\xf5b\\x80\\x98\\x0e\\x9a\\xaf!\\x8d\\x90q\\x87z\\xa8\\x909\\xa3w\\xd3\\x96\\x83\\x960\\xf9=\\xcb\\xe3\\x80\\x1a\\x83\\xb2\\x00\\x947\\xfe\\xc8\\x9f\\x87g\\x0b\\x81+?u\\xdf\\xdb\\x11p\\x03_\\xc0\\xf9\"\\xa5\\x07\\xbc\\xef@hj\\xaes\\xf9s\\x98m\\xd5\\x8c\\x87\\xadrll%\\xe7\\xd3#\\xf67w6\\x0f\\xddt\\x93f\\xf9\\xa0\\x99p\\xf0\\xd3\\xca\\x93\\xaa\\x83\\xb1`\\xaf9\\xe4?\\xa2gx\\x17\\x063\\x98\\xf9\\x81\"\\x19\\xb1)\\x134.\\xa0\\xe3l\\xbd\\x15\\x14\\xb2\\x12o\\xe5~:\re\\xba\\xaf\\x98\\x0fj\\x86\\xd2.\\xea\t\\x81$d\\xb0!<\\xc4\\xf1y\\xd5v\\x05\\xa3/\\xd8\\x03p\\xbb\\x196\\xd3\\x19kk\\xe2\\x1f\\x0f\n;a\\x1f=c0\\xfa,\\xcb\\xc6\"\\xc1\\x91\\xea\\x16\\x02fgr\\xcc\\xcf^l\\xab\\xdf\\x87\\\\xe2fe\\x87\\xe2\\x06@o\\xce\\xdcwpw4\\xf5\\x9b\\xa6\\x93\\x04\\xfe8\\x91\\xd2\\xc0\\xd9\\xdb_+\\x03\\x08\\xee\\xf8\\xbd"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x9f\\xf9\\xc7\\xa7\\x9c\\xaf\\x17z\\xbf\\x08\\xa5\\xd1\\x90\\xacl\\xb6l\\x95&\\xf1\\x9b\\xdc\\xe1\\x1a\\x81\\xe0\\x8e\\x87\\x98o\\x12\\xa0q\\x9ag\\xee=h_\\xa1#o\\x03\\xc5\\xda\\x1d\\xd0\\xfa\\xf5\\xadf\\xdc\\xdb\"c*\\xff\\x8f\\x9dj\\xf1\\x06z\\xa6\\x05\\xc7i\\xe82^t\\x16\\x9c\\xe0\\x14\\xb6_\\xf1\\xcf\\x85\\x04\\xb1\\x8d!\\x17\\x05y\\xd0\\x7f:\\xc9\\x9cy\\x878\\x86\\x1ea\\xd0\\x079\\xbcs,\\xc1\\xd0\\x8f\\xc1\\x10w\\x1b\\x01\\xe1%\\xd5\\xaf\\x9c\\xda\\xc67!\\xc8?\\x0f\\x07nz\\xd8\\x01\\xec\\xf4\\xe2\\xfa\\x86q\\x90\\xdc\\xca\\x834p\\xe7\\xd3\r/4\\xab\r\\x95\\x9d\\xd3\\x99\\x93+\\xc9q\\xb1\\xa9\\xbc&\\xae)\\xf4\\x83\\xa1\\xdd2\\xbdt\\x81d\\xdet\\xda\\xac\\x9f*\\x03\\xf4\\xa6fg\\xa9\\xaew\\x1b.\\xdd\\xa0!\\xde%\\x0e\\x81\\xd1qb:\\xbdr\\xe4\\x86o8\\xd7\\x8ad\\xd5\\xff\\x85\\x19!\\xbf\\xfbe\\x97u\\x93\\xa6\\xb1\n\\xcf\\x9c \\xe9ny\\x91\\xc4\\x83ypd$qx\\xabw\\xbfz\\xbc,\\xa5_\\x9c\\xbd\\x1b"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01\\xdf'\\xdd\\xd8)\\x12\\x1c\n\\x1a6)\\x15\\xcf\\x08\\x1d\\xdc,s\\xd4\\xe2e\\xd3#\\xa2\\x85t\\xb54\\\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01\\xdf(\\xd1\\xb5 \\x85\\xb1\\xb6\\x14&j\\x97\\xf2d\\x87l-\\x1f+\\xe2\\xa6;\\x92x\\xe34|\\xc4'4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04kd\\x12u\\xa5~\\xefquo\\xe5m\\xf3\\xe0\\xeb\\xb9\\xe3;\\xaeb\\xf0~\\xdc;r\\x0c3\\xd2d\\x9a1\\x87\\xb1.\\xd3xj\\xd5\\xf4\\xa0=2~l\\x82qth\\x9b:\\xa9\\xbc\\x00\n\\x94\\x96w\\x11\\x85\\x8c\\\\x08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbcxt\\xeft\\xd2\\xd2o+\\x8f\\xeetc\\x85\\xe3\\xfc?\\xd8\\xd1\\x9e\\xc6\\xa6\\xb8\\x0e\\xbb\\xbe\\xe32\\xfd\\xf3\\xe5\\xa9,\\xda_\\xc0\\xe7h-\t\\x1etlyr\\xf7\\xb8\\xec"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\xa3\\x87(b\\xban\\x94\\xd7\\xb1.\\xf6\\x84\\xc4\\xa7\\xf7 v\\xb8p\\xe3\\xf86\\xb4\\x1en*u,cj\\xafj\\x950\\x84,0wx\\xc9ogz\tb\\xad\\x93;g4k\\x08\\x06e\\xd2\\x08\\x87u z\\xc2\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\xa37z\\xa8\\xf7\\xa6\\xf3\\xeb\\x82\\xa5\\xb4\\x07\\xa8s\\xf5\\x84\\xb1\\x10\\xaf\\xdf6\\xbd\\x84\\x1c\\x9a\\x1a\\xc6\\xbe'\\xdcv\\xd7\\xf7\\xc9\\x80tv\\xb1<\t$\\x0f77w1"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x05\rb\\xcc\\xda.n\r\\xc2l\\xf9\\xe4\\x0bn#\\x0f\\xa9\\x07j\\xb9\\xdc\\xb7\\xb80#\\xd2r\\xcc\\x04\\x99\\^\\xa5fl\\xd6$\\x16u\\xbf\\x8au\\x97/s\\x9e#\\xbc\\xeaq\\x89\\va-\\x1c6sg\\xd51\\xe7\\xfdj\\xa4\\xdd\\x16\\x95\\xf0\\xae\\xd3\\xea\\xdd\\xc8\\xdcn\\xe9$\\xe2\\x08:~\r\\xfe\\xd1\\x84\\xb5ya`\\x0cd\\x9a\\x13pb\\xffoo\\x16@\\xef\\x17\\xb2\\x03d\\xcf\\xf66s1/\\x89(\\x0f\\x9ds\\xc2\\xd3\\x0e(\\xcb;\\x95u\\xac\\xa0\\xaa\\xdb\\x07\\xd7r\\xcd\rj+\\xee\\xfe\\x90\\xa0\\xc8\\xc7\\xad\\x1cb\\x10\\xe4\\xf6\\xd6\\xa0\\x12\\xfdyw\\xed\\xbd\\x00\\xad\\x1c\\x8d\\xb0<\\x96\\xa86\\x95\\\\x16l\\x88\\x1b\\x05 \\xe1\\xebi\\xa0\\xa1>\\xf7\\xd6\\x92d\\x98\\x19\\xff8\\xb6\\xc3.\\xbeo\\x7fh\\x06\\x86\\x00\\xdc \\x05z\\xb6\\xc5ot\\x1d\\xadj\\xdd\\x1d\\xd8\\xd4\\x9b7\\xab\\x9al\\xb7\\x0f\n\\x15\\xaa\\xb5?\\xabzg\\xe5\\x80\\x19\\xd8\\x98m\\xac\\x0c\\xa8\\xb4&4poo\\x8e\\x83e\\xe3\\x0f\\x8b\\xc5w"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x8e\\xb4y\\x15\\x00\\xb2\\xc6\\x04\\x8e\\xfa\\xeff\\x9e\\x8b\\xac\\xa9c\\xca\\x1f \\x11hx9\\x1b\\xeb\\xac\\x95\\xd4\\xa8\\x01\\xa2(q\\xbb\\xee\\xfa\"\\xe8\\xc8<tt\\xa2\\x85q\\xe0\\x14;\\xd3\\x9fy\\x07\\x1d\\xf5\\xc3\\xce1i9\\xdf~\\x91t\\xec\\xf0\\xa2rv\\xad\\x86\\xaa\\x8f?\\x1b8\\xffe\\x1d\\x9a\\x89\\xfe\\xb6\\x88\n\\xfd\\x98k\\xefz=\\x98\\x04x\\x1f$ll\\x93\\xce\t\\x83r\\xbc\\x7fb=1\\x90x\\xb6w\\x97f\\xd8l1y\\xe5b\\xd5ljm\\x13\\x87\\xf1q\\xb2e\\xbe`\\xbc\\xc7\\xca\\x97\\xect\\xe3\\xc8\\x1a\\x05\\x80\\x9a6\\x82\\xf4\\xf0\\x91\\xd5d\n\\xd9\\xf2a)`\\xff\\xc8\\x1f,r\\xbe!\\xdbg&\\x03\\xc8\\x8e\\xd2p\\x96\\xae)\\xa2\\xe0\\xbc\\xd0>m\\xc2\\x01/\\xe2ll)\\x07\\x0e\\xb4\\x12u\\x8d\\xa3\\x1d\\xa5\\xd0=\\xb1j\\xad i,\\x83\\xe5+\\xe7*\\x95\\xa1v\\x02\\xb6s\\x889+^z\\x14\\x0e\\x834\\x869\\x82\\xab#\\xbdj\\x03\\xd3\\x90\\xbc\\xd1\\xe5,\\x8c0+~\\x86'\\xbe'\\x8a\\xe6"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw@\\xfb\r\\x10\\x9fk\\x95\\xdb\\xc2\\xc7~\\x9e\\xbdj\\xe9\\xa4l\\xbd?\\xb7a_\\xb0\\x0e\\xd6\\x11\\xce\\x1a\\xe5\\x00\\xb4r\\xdez\\x96\\x84\\xc3p\\xc1aq\\x1a\\xf3\\xaa\\x904h\\xfb\\x08/boez&\\x0f\\x12\\x1a\\x1d\\xab\\xee$\\xbc\\xa22\\xdcil0\\x81\\x04-!!|\\x15,6\\x9f?\\xdfp\\x84<\\xba\\x13\\xaf\\xc9\\xb0\\x880\\x96i\\x94\\x1f<%\\x1dt)\\xa2\\fi\\x87w\\xcbt\\x1d\\xa0\\xa5\\xd6\\xf7(lyy0\\xfb\\xe5|\\xea\\xc3`\\xe8\\xe0\\x0c\\x15\\xa1\\xb8d\\x12\\x82\\x9f~\\xd4$v\\xf2\\xa5\\xcf\\xe7\\xbfi^\\xd8\\xfbn\\xd4f\\x9chaf\\x1b\\xee=\\xe39h\\xb7.\\xb2t-$c%\\x93\\xc7\\xa4o\\xd5\\xf2\\x7f\\xc8v\\xef\\x8f\\xb0\n\\xbb\\x03\\xaf\\x8en\\xa9\\x80\\xf1c\\x18\\x03\\xbc\\xed\\x1d\\xd4\\xf6\\x12\\x1c\\x07\\x9dnv\\x90b\\xac\\x17\\xc2\\xa6\\x8f\\x1ey\\x15c\\xbfga\\x03>\\xf5\\xef\\xd3\\x96\\xaa)5|\\xfa\\xc5\\x03l6\\xbc\\xffk\\xa6\\xf7+\\xdai\\xc3\\xda\\xd0"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x94\\xd7\\xfb5\\x96\\x84c?\\x91\\x92\\xc9t\\xdc\\x12f\\xb3\\xed\\x8c\\xc7\\xc2n\\x00\\x12\\xe5\\xc9\\xde\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(9\\xe4x\\x8eo/x\\x12\\xae\\xe3\\x11|\\x08eu\t\\x1c1\\xd9c\\x16\\xc4\\xbdv\\x94*_(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x94_o\\xc7\\xc6y\\xfc\\xfd\\xe5\\xc7\\xbf\\xfd\\xe1m\\xe1ua\\xcf\\x9d\\xb87)\\xdd\\x04\\x0bh\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(4\\x84=\\x9a\\xfb\\x18\\x19\\xe8\\x93\\xcdr9\\xa7\\xdc~\\xfat\\x9am\\xa64\\xfd\\xae\\x10\\x9a\\xb1\\xfae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xaf7g\\xc0\\x83:/\\xdb\\xc4u-\\xf7s\\x14t\\xa7y\\xd9c0\\x04!f\\xe2\\xa2\\x87\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xca\\xa3|\\x1e\\xab<;\\x8b\\xe2\\x05=1\\xd7\\x91=\\x16\\xa8r\\xa5\\xcc\\xc1\\xf5~2\\x0f~e:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf($\\xbe\\x9d\\xc9+\\x0b\\xc6trts\\xc5(\\xea\\x93\\xaf\\xff\\xff\\x97\\xed|\\x8fq\\xb8\\xb3\\x0c,\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xda\\xe3\\xdc\\xcf \rkd\\xfe\\x14\\xc9r\\x94\\xd4\\x18hp\\x04z\\xa4>cd\\xf1\\x12\\x0b-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xe6\\xbf\\xfd\\xd6\\x82\\xae&\\xd0\\xfao8\\x96)\\x84\\xacj\\x12\\xc5\\x94\\xfczz\\xfb\\xa9#\\\\x8a\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(o\\x08\\x12\\xea<\\xf7\\x9d\\x9c\\x9d\\xc3\\xe8n(\\xbd\\r\\xfa1\\xda\\xb4\\xacm\\xbb\\xd7dw\\x1bn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xbe\\xde!\\xe6df!\\xdfw\\xdc\\xab\\x85\\xf0\\x0e\\xa55\\xfa$\\xdb\\xff\\x90\\x01\\xe9'o\\xe4\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xa7h\\x012\\xcd\\x82\\xcb*\\x1f,d\\xd4\\xb6|\\x02\\xc0\\xd7nex\\x8bwdp\\xd9\\x92=\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x00\\x94p\\xfcz\\xf1\\x08\\xdb\\x95\\xe6ka\\x89\\xdbsia\\xdf\\xe8n\\xa4\\xb4\\xecf\\xbb\\xfd\\xef\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xb3_\\xf3\\x8a,\\xc9w\\xa7\\xa5\\x81d\\xd9k\\xad\\x14\\xb6\\xad\\xbf\\xae.6\\xca\\xcf\t\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xa9\\xe6t\\xee\\x87\\xeb\\xb4\\x1ejw\\xbf\\xb6\\xd1\\xd64\\x0e:fl\\x1c\\xaef\\x1b\\xfa\\xc0\\x8f\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x07\\xb2d\\x9b\\xcab3s\\x87\\xb1\\x0boq\\xa7\\x03d\\x96v\\xfd\\x07\\xd8\\xd4jgi!\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x18\\xab\\x84\\x88\\xefs?\\xc6!\\x08\\xb4\\xaf8\\x02\\xd2\\x14\\x9fms\\xef\\x06y\\x9f\\xa9\\xf6_n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xb7:4f=\\xc7t?f4\\x9d\\x10i\\xcd\\xca\\xf0\\xbc\\xed\\x1a\\xf4\\x80\\x9c\\x8e3\\xf7\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xf2j+\\x1ds\\x0f(\\x95\\xca\\xf5\\xb1\\xc9oz\\xd7\\xb4\\xe5\\xb4\\xfcl\\x98ssfq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xd3\\xa0\\xfag\\x7fuq\\x9b\\x025\\xeec\\xcb\\x89\\x01w\\x81\\xbd\\xec+\\x84\\xcc\\xfbyu\\xbch\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x1d'\\xe8\\x9d\\xedh\\x17x p\\x07\tmq\\x96\\x02zp\\xf3\\xc7\\x1exq\\x89\rsp)\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xc0^(\\x86\\xe3\\x93f\\xf3u\\xa5\\xa9\\xbe'\\xfd\\xe7\\x98\\xe0\\x1fdp\\x1cz\\xe8\\xb5=\\xa0o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xae\\xd5\\xf4q9\\x93\\xe0\\x92j\\xd6\\x17l\\x15\\xac\\x9f\\x93\\xcb\\xa9du\\x85\\xed\\xba\\xf6\\x1c\\xc8\\xcd\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xac+\t\\xd2\\x89\\x8e$\\x10\\x9a\\x9fu/l\\xbf@\\xc0\\xa9\\xf3x\\xb0.\\x8c7\\x8c\\xdab\\xd4\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xe9\\xa8w*\\x08oh^\\xda\\x05\\x8f\\xb7\\xaa\\x87p\\x0e\\xaa\\x19\\x95\\xfd\\xac\\x14r\\x86\\xa2x=r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(b\\xf4\\xac+b^\\xb7\\x96b\\xf2=3\\xf2\\xc3\\xbd\\xf3jskbm\\x8a\\x97\\xfej\\xbc\\x01\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x12\\xc2<\\xd4x\\xe0f\\xaf\\x17\\xe6\\x18\\xe5\\xdcs\\xc2\\x06\\xd3v\\x19*^\\x9c\\xaa\\xdebs\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(i\\x17\\xd8s\\x01u\\x08\\xfb\\x14h9n\\xedo\\x18\\x17;m\t_\\x86:cn\\xfe\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\x1d\\x04\\x07\\xc8hdf5\\xf8\\x0f\\xc3m\\xb6'\\xdc\\xd8\\xf8\\xdd3\\xfce\\x84hw\\xd0\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xad\\xbez\\xc3\\xc61ppx\\xec\\xb5x\\xd6t\\x97\\xc0gd\\xea\\xbb\\xf8\\xf73\\xfck\\xc8x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcck\\$\\x1e$\\x14\\xfb\\xe6g\\xdc\\xc9=\\xa6\\xd4d\\x85\\x80\\xb696\\x10\\xd5u\\xc5\\xec\\xec\\x94\\x81\\xf0\\x99\\xa7\\xcb\\xbc\\x92(\\xf8\\x0bm\\x14\\x88o\\x8f\\x8f\\xb2\\xa1^\\xca\\xa5\\x8c\\xc1d\\xa0x\\x9b\\xb2\\x8c\\xbb\\x12\\xfc9\\x161\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\x8e4\\xa2\\x8bea'\\xa5\\x00\\x99\\x84\\x17\\xd9\\xa0\\xf9m\\xa1q\\xd1#\\xd2\\xdc\\xeec!g\\x156\\xb6\\x8e\\xc5\\xdf\\xd1vl\\xac \\x93\\x8774\\x96\\x91\\xbd\\xe2i"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xf9\\xbb\\xf7p\\xe1\\xd2\\x89\\xf1\\xa2\\xb6\\xad\\xd4\\xeb\\x98;\\xab9\\xf50\\x82k\\xb8c\\x89\\xa5\\x93p\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xb5\\x97\\x1ai.\\xa3\\xfa\\x16k%\\xaf\\xa6\\xf3\\xf4\\xe0\\xfc\\x0ev\\xa9~\\xba\\xdcx\\xc5\\x96\\xee\\xd9\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(<\\xae\\x15\\x8a\\xef\\x1b&k\\xa8w\\xdda\\x98\\xcb\\xe0\\x9bp\\xb9l\\xb8&9\\xe7\\xc9\\x8d\\x94u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/n\\xa8k\\xba\\xf6\\xe5\\xb7\\xcf\\x07\\x7f\\xa8\\xb9\\xe7_/w \\x03\\x7f\\x9c\\xdbc\\xe5\\x82\\xb4\\xd6!\\x93\\xb5lc\\x0f\\xa7\\xf8\\xfe\\xd1jq\\x9b\\x1a+k\r\\xd6\\x1d\\xbf\\x96\\x80\\xd1xh\\xc9j\\x17a\\x8f\\x99\\xae\\x0cxw\\x06\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\xae\\xe7\\xc07\\xff4\\xef\\xa8q\\x8f\\xe7\\xa2\\xed\\xfbd\\x8f\\xe6\\xc5l\\x9b\\xd9btc\\xe5\\xd1\\xf1\\x8c\\xab\\xb09'\\x84\\x00om\\xbc/\t\\xc0tteq\\x84\\xf4\\x14"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c\\xfe\\xd0\\x9e\\xe9\\x8c\\xba\\x1e67k\\x8d\\x953\\xf6\\x88\\x92\\x05\\x83\\x0f\\x97s1`\\x8f\\xf8(\\xcb;k\\xd5\\xa7\"#r*\\xce\\xaf\\x92\\xff\\xf2i\\xa1\\xce\\xbb\\xdb\\x99m\\xbd& \\xe3\\xf6\\x05o\\x9c\\x1f\\x90\\x1a;\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xf7\\x85\\xff-u\\x96\\x89\\xa4\\xe8/\\x10\\xf6\\xb6\\x04i\\x89\\xb5\\xebgb\\xecp\\x7f\\x95\\x1c\\x8f\\xdb\\x04\\xbe\\xb8\\xb1\\xdbr\\xa6b\\xe9r\\x96\\xd0_s)\\x97\\x92)\\xed"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94m|6\\xc4\\xb5\\xe3?1\\x1e~\\x1f)\\xb2z6\\xc5\\xbd\\x9b\\x13\\x01f8\\x14\\xe9+\\xfc\\xc5\\x88\\xe43\\x03\\xc0\\x1a\\xba\\x89\\x86\\x9e7\n\\xe5\\x92\\x84=$\\x91\tfw\\xb1\\xc6\\x84\\x8b\\x87;\\xdc\\x10d\r\\xb4\\xfe$\\x05\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8em%@o\\xb0\\xd2\\xed\\xbb\\xde:\\xb8\\xa7&?\\x1ce\\xb5\\x15\\xdc?\\x05\\xfa\\xa8\\xd2\\x1b\\x9bu\\xcfc\\xbb,\\x15\\xa7\\x12\\x13\\x1e\\xfbu\\\\x02\\xe9\\x05\\xaa.\\x18\\xe1\\x84"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04za\\x88\\xcd\\x81\\xa2\\x96-\\xf9\\x84$:82d\\x1a\\xf2j\\x18\\xda\\xdf@\\xf7!l\\xce\\xf9\\xd8\\x14\\xf1\\xac\\\\x8e\\x96igbph\\xf3.\\xf1b\\xb5\\x8f\t\\xfd\\x84?4\\x97\\xaaa\\xddze9\\xa27\\xccvy\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\xc0\\x1b\\xef~\\x9dt\\xfc\\xbaf\\x18\\xcc\\xb6\\x1d&9b\\x07s\\xcc\\xecu\\xfb\\x15\\xc5\\x99\\xce%\\xa4\\xd5u\\xaa*\\xe6\\x15\\xb6\\xf0\\x0e\\x92\\xf9\\xa6/\r\\xdf\\xb4\\xfb\\xb6l"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04:e\\xa1\\x9f\\xfe\\x86\\x9e\\x8b\\xc0\\x92\\xb9\\x91+\\xdf\\xd9\\x89v\\xf9\\xa9%\\xfcrjr\\xc5\\xeb1\\xe4\\xe8\\x1bh\\xb1m\\xc67#\\x05\\xbb\\x08\t\\xc3\\xcf+\\xe4\\x0b\n\\x01\\x0e\\x8c\\xd7\\x9cf\\xd4qt\\x85g\\xde\\xb7\\x14^\\xb5h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5!\\x07\\x19\\x02\\xce%\\xab\\x89\\x93\\x99\\xba9\\x99l\\x87\\xac\\x17q\\x1b\\\\xd9%\\x94#(\\xb3\\x1a\\x8a\\x89c!\\xbc(\\xe0\\x17\\xd6\\xac\\xaem\\xbb\\x97\\x07\\x02\\xa36\\xbf5"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xc3\\xc4\\x81\\x7f\\xcfn88r\\xc8r|t%\\xcf6d$\\xce\\x8b\\x1c\\xe5\\x94\\xf4\\xc3\\x0e^z\\xb4f\\xd1\\xeefn\\xb5 \\x04\\xda,\\x80\n\\x85\\x1a\\xec\\x1ex\\x16yy\\xdefw\\xb6'@7x\\xfc\\x99^\\x15\\x82\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000byr;%>e|\\x19x\\xf6\\x1b\\xe7\\x1f\\xba\\xb79\\x1a\\xcb\\xa6\\xe5n\\xbf\\xb0t)v\\x03$4\\x86r\\xa4\\xb1$\\xe1\\xa4\\xf8\\x96>\\x01\\xbe\\x0f\\x8fz\\x0c"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\xce\\xf3\\x06\\x89e?\\xda\\x7f\\xd4\\xe7\\x15\\xed\\xc9\\x0e\\x1e\\x92q\\xe3\\x9f^\\xd3\\xbe$\\x9c\\x89=\\xee7\"\t\\x0b<\\x9bw\\x00\\x0f\\xf7\\xe5\\x05#l/\\xd1\\xfao\\xfa\\xc2\\x80hl\\x070\\xd3x\\xe9v\\xe4=\\x81\\x01\\xec\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8m\\xa2yf:;\\xd4b\\xb2\\xde\\x0c\\xd1av<\\x87k\\xf9\\x06||\\x19\\xa7\\x9b\\xa9\\x1c\r+0\\xfd\\xa5\\x02\\x99\\x07\\xb8s\\xc4fpbb\\xe1\\xf3\\x17\\x80\\xa5"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6|\\xd3$1|!\\xd5\\xed\\x13\\xe3\\xd5\\xf8\\x86\\xf3\\x88\\xf9j\\xf4\\x85w\\xe4^wq\t\\x0c\\x08\\xb8g\\xd8\\xef\\xf6\\x16\\xad\\x95\\x96\\xa9ac\\xe5\\x98\\xb2q\\xe7\\xdb\\x1bh\\xf4\\x1d\\xd2\\xb8\\x02j\\xc6#\\x11\\xba2\tk\\x9a\\xd8\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92\\x03\\xa6\\xf3i\\x1e\\xd4\\x82\\x06)\\xd9\\x9a\\xf0;:\\xabwj\\x00z\\xaf\\xc2\\x93=c%f\\xe4r'\\xb6f\\xeb\\x0b\\x9d)\\xa4\t\\xeb\\x93\\xd8;\\x95\\xe5\\xd9\\xedg\\xf1"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x148\\xa6\\x04\\x9e\\x08\\x93\\xf4b'\\xf99\\xabi*\\xeca.\\x18\\x8c\\xca\\xb1\\x95\\xb2s\\x89\\x9a\\xc6\\xe9?\\\\xb06w\\xcd\\xaa@,\\xado\\xf2.\\xf7\\xe3\\xe7(x\\x83\\\\xdc\\xb3\\xca\\x0f?\\xb2o\\xc0\\x97\\xd4\\x08\\mu\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v#\\xfd\\xeb\rlki\\xe7\\xfc\\xaf\\xfb\\xed\\x04\\x9f\t\\x90\\x84*\\xc7\\x1a\t\\xd9|\\xd2\\xb9z\\x1a\\x9e\\xac\\xb3\\x12\\xcf\\x1ev\\xd8\\xf6o\\xee\\xc2\\xf85\\x1f\\xb3\\xd7tx\\x08"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ny\\xee\\x19\\x88\\x84\\x18t\\xfe\\x99`wy\\xb3r\\x9ds\\xd09\\x05\\x82\\xe4\\x01\\xac\\x85\\x1eq\\xf9`\\x11\\x8b\\x81#\\x1at3\\x18\\xa7#\\xda,\\xcd\\xe3\\xae/\\xd0kl\\xc2\\xa3\\xb7@\\x8e\\xe0\\xf8\\xf9\\x06\\x19\\x1et\\x9ac\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-\\xf9\\xa2\\x7f\\xcb\\xb1y'\n\\xa8\\xd1<\\x15=\\xbc;\\xda\\x13y\\x05\\x0e\\x16\\xb2?n\\x05_ah\\x18\\xcd\\xa3#\\xb3\\x1cxi/gp\\xc8(\\x08\\xea\\xa1'\\x859"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\x8a\\xea+\\x16\\x94.\\x9f\\xe0n+\nm\\x02mm\\x11w\\xd2\\x0b\\x9c3t\\xe0\\xeax\\xf5%qb\\xed\\x08\\xf6\\xaa\\xa7\\xf5e\\x93d/;0\\x1c\\x08\\x9az\\xc1\\xd4\\x04\\x82b&\\xf3\\x8f\\xcd\\x8a\\xbe\\xb4\\x1b=\\x19\\xe5,\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0eg\\x8d94/\\xed\\xb5\\x12\\xb6y\"*q\\xaf\\xae\\x1at\\x9d\\xbb\\x93\\xddts\\xcc1\\x17\\x9c(\\xf3\\x1e!\\xc2cq\r\\xeb\\xef\\x1bz\\xeb\\x0f\\xb4\\xba+\\x9e\""
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\x1b\\x18/\\xe2\\x18\\x88\\x12+\\xf5\\x8f/\\x0b\\x1fy\\xa5/\\x91\n!m\\x96b\\x0e\\x05t\\xa27\\xf9\\xab\\xd9\\xc9\\xe8\\xaa\\xd1\\xc5\\xc92\\x97\\x96\\xce\\xa9f\\x81\\xfd\\xfb\\xea\\xcd\\x11\\xe7\\x9a\\x97\\xdfi\\xe6\\xbe\\xde\\x1fi#\\xaf\\xa1\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\x18vy\\x80\\xea\\xbf#\\xbdx\\x03\\x058\\xee\\xee\\xea#\\xe7\\xabcw\\xf7q\\xfe\\xbb\\xee\\x85l\\x06p\\xb9\\x84\\x18\\x90q\\x85yv\\xb2\\xb8\\xc8\\xf1\\xd9x \\xf9\\xc3\\x16"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\xfd\\xfcv\\xd5\\x13\\xc2\\x13b\\xf5\"\"\\x0c$\\xb862\\xd9?s\\xb2\\xb07i\\x80\\xbe\\xe2\\xc1\\xb1\\xaf\\x9dx\\xe0js\\xa9\\x08\nr\\x11(\\x0b\\xe0\\x023\\x14\\x9e\\xa1\\xeeo\\xbf\\xc9\\x95\\x7f\\x1b&\\xb1\\xc4\\xfb\\xb0qj\\x97\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c\\xa8\\xda\\x17\\xc6h\\xc4\\x95hr3\\xe9\\xf3,\\xc8c\\xc5\\x9b\\xb3d:\\xab\\xcc\\xfd\\xe2\\xc0\\x19n\\x8a\\xb3\\x94r\\x03\\xb5v)\\x8a\\xc2\\xe5\\x1b\\xa3\\xc9\\x1d/e\\xc6(\\xdc"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\x06\\xce\t\\xcd\\x04\\xc5o\\x0b\\x8e\\x0f\\x19\\xdc\\xf1\\xed\\xe3\\xc1\\x03,\ro\\x9a\\x1f\\xa3\\xae\\xac\\x1c\\xa7\\x85\\x89\\xe7_eg\\x1a\\xfe by\\x1a\\xab\\\\x91t\r\\xd7\\x8c\\xa1(p\\xee\\xe3\\x10\\xe1\\xf5\\x81b\\xcb;\\xf9\\xdc@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x11!z*\\xc4\\x1c\\xde\\x93q^h\\x0f\\x82`\\xe2\\x10t\\x85\\xc4z\\x9a\\xa1\tr\\xbc\\x8e\\xc9>\\x18+\\xcd\\xad\\xcda&%\\x8d\\xc5\\x07\\x00b\\xd2\\xb8\\x84\"k"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xa7\\x07\\xf7\\x03\\x00c\\x16\\xdc\\xa4\"\\xdf^\\xf54\\xdbty\\x89+\\xe1f\\x18\\x8b\\x9d~q\\xc9\\x89v\\xb1\"\\xd4gl\\xf2)\\xa1ycu/\\x9cw\\x86\\xa9o)\\xda\\xd4\\x95\\xb9.\\xabf\\x92\\xb3\\xc5\\xc3\\x17\\xf6$$\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4k\\x812\\x98\\x83sqw\\xc31\\xb5\\x00\\xf0\\x1c\\xa7a\\x93\\xf0\\xc47\\xce\\xe0\\xba1\\xfb\\xe8\\xe8\\xb4\\x04\\xcb\\xb8\\x9e\\xb6=\\xa6\\xd0_\\x81\\xe3\\x88\\xba\\x1e\\xc6\\xc8\\xcb"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\x92\\x17v\\x8b\\xda \\xef\\xe6\\x01\\xfe\\x0c\\x8b(\\xe6t\\xefw'o\\xce\\x16\\xf90\\x04u\\xde~\\xce\\xc3|\\xd5\\x19\\xbb/\\xe8\\>l!\\x8b\\xaehj\\xdf\n\\xcd\\xf4\\xa7\\x0bm\\x9fx\\xa4\\xd2e\\xcfd!\\xbc\\xe6w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x04\\x99@5\\xa2\\x11\\xc6\\xc8z\\xfdw\\x025hy\\xaa|\\xb2\\xbe\\xd7c\\xd4\\xe7\\x1e\\x9e\\x11\\xeb\\x0c\r\\x03ts\\xa4j\\xa7\\x85\\xd5\\xdagd\\x86)\\x8e\\x85e\\xa4\\xbb\\x7f"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t3\\xd6\\x814\\xcf\\x03ut\r\\xa8\\xab\\x95$\\xa9\\xb8:\\xa7\\x91s\\x0e\\xcc\\x1c\\x7f\\x07db\\x82\\xc9c\\xfag)\\x92\\xe3\\xea\\xc7\\x00\\x86s\\xdcq%d\\xa6\\x89\\x95\\xa5&\\xb4\\xfc\\x9ai\n\\xdb\\xd6\\xb0\\x05\\xc3\\xb5\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\n\\xa0\\x83\\x95w\\x8c\\xb41pt\\x9a\\xf8\\xff\\xbf\\xeef\\x89\\xb69e\\x91\\x1b\\xf3\\xf7z\\x95 !\\x1d\\x8dv\\x9a\\x1e\\xd8z\\xa2\\x0c\\xeb\\x8a\\x97\\x16u_a\\xa8\\x14"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xd4\\xcf\\xf1\\x89\\xc3z\\xf5f\\xfe\\xdde\\xa5\\x96o\r\\xa3\\xfc\\xbf.\\x8d\\xf3#\\x04\\xa9(\\xff\\xb8\\xf7\\x97\\xd2\\x93\\xdf\\x18k\\xbc\\x17\tj\\x13\\xca%\\xca\\xa0\\x94gsd\\x81\\xb5>\\xff\\xff\\x9c'h\\xf0\\xcbk\\xc5\\xc0\\xcag\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1bh~\\x89m\\xcb\\x92x\\xab(\\x98\\x8c\\xbbu\\xf3\\xdebu9y\\xfaf\\x03\\xfe\\xb6\\x1a\\xae\\xec4\\x8a=\\xc8\\xef\\xa1\\xfc\\xf8\\xb0\\xac\\xa9\\xdatavd\\xc3\\xd2r\\xa4"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r\\xe2\\x07\\xa1\\xc5\\xe1r\\xc7\\x00k\\x9c\\xe0\\xa7'\\x8e\\xb4k\\xc4\\xa6\\x84\\x99y\\xc6\\xb1dh1lv\\x98gm\\xeb\\xb47\\xcb\\xfd\n\nt\\x89\\xe4\\xfa\\xf8\\x8e:\\xa0\\xc9\\xfc\\x07l\\xbe\\xd8\t\\xceb\\xca\\h\\x8b\\xa4\\xfb\\xc9\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\x8d\\xcd'\\x87\\x8c,\\xd3\\xd7\\xa5\\xd1\\xf8\\xca\\xdc\\xad\t\\xdfg>\\xca\\xee\\x0b\\x7f\\\\xa4i\\x92\\xf4zm\\xa4\\xa2\\xfbb\\xbdj\\xf6r\\xb8\\x8fo\\xac(j\\xe3\\x12ow"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\d\\x1by%\\x83\n\\xe0\\xe8c\\xf4a\\xa8a\\xad\\xaa6t\\x0c#\\xcf@\\xd8\\x90\\x01\\xb0s\\x95\\xf1m~g\\x8e\\x18c\\x01\\xb5i\\xc8s\\x80;\\xbd\\xa2>\\xc3p\\xbc\\xa0\\xba\\xab\\xea\\xab\\xa5t\\x96<\\x15\\x8c1fzb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\xfd\\xe4\\x18\\xa4\\x10\\xc9\\xd4dwh\ne07\\x01\\x01\\x80k\\xe4%=\\xd9\t7\\xf7\\x9fe\\xbf\\x91\\xcd\\xa81k|\\xda\\xced\\xe9\\xfd\\x8c\\xf4c\\xc0\\xbetq\\xce"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x049i^ \\xf8p\\xfa\\xa4\\xdfu*m\\xb2\\xde\\xafn\\xcb\\x1cf\\x03:\\x87\\xfe\\x0b\\xbf\\xc3\\x00h\\xc90bo\\x1d~\\x96\\x95\\xfb\\xf5km\\x97\\xf3\\vb5\\xe5v\\xf1\\xf9\\xe9\\xf0?\\xc4m\\x00hr\\x8e\\x8b\\xef~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\xa9\\x8d\\xbf#\\xac\\xa6\t\\xd1\\x8c\\xe2\\xc2i\\xe3z\\xd6u\\xf7g\\x13\\x07s\\xe8\\xc8)\\xce\\x0b\\xaf'o\\xa3\\xeff\\xeal-\\x7f\\xb3\\xdb\\xb4b\\xd5\\xbfs\\x90\\xb4\\xc4"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b&\\xc7\\xa4g\\x91m\\x98\\xae=\\xc9\\x85\\x14\\x97\\xb6\\xce\\xea\\xa3\\x08\\xac\\xc2g\\xde\\x9a\\xb5\\xa2\\xdb\\xd4%\\x82\\x07`y`!\\x9b\\xd4\\x05\\xeev\\xdd\\xa4u\\xc6\\xac\\xc2\\xb5\\x8e\\x98\\xf8\\xedj\\xb1l-\\x8f,\\xf7\\x04fn7\\xb3|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ro\\x9e\\xdc9f\\x95c^\\xc9gk\\xefqf\\xca\\x0b\\xc6_\\xb5\\x06\\xd06=~\\x84\\xf4\\xb3h\\x00\\xc5wv\\x1c\\xba\\xf3\\xe9zns\\xd5\\x8c\\xc0g\\xa0\\xa1"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l9et\\xf3\\xa7v\\xf6\\x91 \\xdd \\xdam\\xbb\\xd6\\xa5\\xd1\\xf3z&\\xe51f\\xb1\\xec\\x14\\xc6'\\x1c\\x08\\x1a\\x9d\\x18\\xe4q3\\xfe\\x0e\\xa2\\xbfe@\\xad\\x8b(\\xbclmx^f\\xed\\xa4o_j_lr\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xfd\\xa4*\\xa3\\x1e$ql\\xa9\\xd1j\\xc1\\xaa\\xfb\\xa2\\xed\\xa1\\xbb\\x0f'h@p3\\xb4\\xe5\\x0f\\xe9\\xfa\\x1cq\\x90\\x8f!he\\x0b\\x96wk\\xd4\\x03\\x94)\\xa3\\x1b"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x92\\x9b\\x07~\\\\x94xy\\xa3\\xe4b\\x0b\\xa3'kh\\x9f\\x05gw\\xcfm\\x05\\xe1\\xb0\\x1fw\\x1ebpp6\\x98,\\x81\\xe0_\\x16\\x93\\xa1t_\\x05?\\xcb\\xdc\\x1d\\xe3\\xb7\\xdb\\xa2\\xc9\\xd3\\xf9\\xebc$\\x00\\x81\\xcb\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8d\\x15\\xe9o\\xddt\\xa5(?\\x19e\\x11\\x07\\xf0\\x8b\\xf4\\xc6\\xd6l\\xdc*x\\x1c$\\xc4\\xb8v\\xbd\\x84\\xf2\\xd9u\\x18\\xe8|,\\x14yq\\xbf\n2\\xe2\\xc0\\xf5k"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\xc6\\x87\\xd5h\\xe0(\\x14\r\\xbe\\xc0p\\x8b=\\xc4%e\\x95\\x8c\\xab<;\\xae\\xe81\\xac;/s\\x01r\\xc5\\xf8\\xb5\\xaaip\\x03\\xc4\\x18\\x8a\\x1a\\x8d\\xf5g)\\xf0\\x06\\xe5\\xf0\\xc3(\\xc7x\\x8c\\xca\\xe4(\\xa2;\\x81\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\x8a\\xf9\\x13\\x9d\\x96ki\\xb9,\\xa0d\\xe9-\\xdb\\xb0\\xaa\\x88\\xae\\xad\\xbd\\x85;wer\\\\xbd\\x97\\xc5\\xdd\\xdc\\xaev\\xc3t!\\xfa\\xdfd\\xf0\\xce\\x85v\\xd0\\xcb\\x9c\\x88"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe31\\xa6\\xab\\xcdm~\\xf4x\\x90\\xe4\\xe1nv ,\\xd5'\\xfb\\x04\t\\x96\\x12\\xf3\\xc7\\x90r\\x8e\\xa0\\xa7k\\x04/\\x99>\\xf0\\x0c5\\x06o\\x0e\n\\xc4\\xa3 \\xe0x\\xdbn~_\\xf0\\x9b\\xc4j\\x9a\\x1dc\\x08f&\\xf2\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xa38@(f\\xf1b\\xf7\\xdc\\x15\\xd4hl/q\\x14\\xe3\\xd3\\x978\\xec<\\xed\\x97\\x14\r\\xe6:\\xdf\\xda\\x18\\x88\\x1b\\x82\\xb4\\x0c^\\xec\\xa9s\\xb0'x\\x92\\x89"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\x8a\\x81\\x81\\xbb\\xee\\xab\\xcf\\x80x\\xddb6=\\xc5\\xa8\\xdd\\x8c\\xed\\x90\\xa8\\x91\\x01\\x1dc\\xb0\\xe5\\xe3r\\x8c\\x8a\\xd9$\\x00\\xf1zn\\xe6\\xd7\\x1a-\\x1bt\\x8ex\\xd1\\xf4g\\x19r\\xc6\\xdacj\\xd8\\xee\\xbde\\xf6q&\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xf7\\x08\\xfe\\xcf\\x08\\xc6\\x8a\\x96\\x99\\xe0\\xff<i\\xcb\\xb2\\xcc\\x82@9\\xf4\\xe0\\xa6\\xe0\\x95\\x16\\x0fx\\x9c@odn\\xee\\xd1\\x1b.\\x0eu\\xf9\\xce\\xa0pc8\\xdaf"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xce)=\\x94y\\xb8.\\xef\\xe0\\x87\\xb6\\x97b\\xedyn*\\xf4\\xe3p\\xce\\x85\\xa2\\x9e\\xaf\"\\x96\\x1cb\\x10\\x8f\\x9crgg\\xc1\\xde\\x85\\x95\\x05j\\x1e\\xcf4\\xff\\xd6$\\x03\\xden\\xb9r\\xee\\xac\\x93w\\xa7\\x15\\xd3\t$\\x8cxb\\x00\\xf0\\xb2\\xe6\\xd9yy\\x10\\xd7\\xcc\\xfb\\xbd\\xc5\\xdb\\xb9\\x85|k\t\\x97\\xe0\\xc2kttmt|\\xbd\\x11\\xc5\\xcfy\\x9do\\xcc\\xe6\\xdc\\x1d\\xd9)\\xe0\\x9e\\x00q\\xddwxs\\x8b\\xe5\\xfa\\xdd\\x97\\x1f1\\x19\\x9a\\x0f\\xca\\xf6\\xf3\\xd48\\xcb\\xeec\\xd4\\xdem\\xe7\\xd6\\xf2\\xbc\\xdc\\x92d\\xac\\xf7j\\xca\\x10\\xb1#suqjm\\xaf\\x88\\xe8\\xf97\\x98\\xed?m\\x84f\\xd7\\xcfrq\\x00\\xb7\\x00\\x1e\\xeejrt\\xff\\xf6\\x8f\\x07\\x1dk7!t\\x9f5@\\xfdiv&\\x0c\\x19f_\\\\xf6\\xf1\\xe0\\x7f\\x08\\xf4 \\x87@\\xcf\\xd9\\x0ce\\x83_\\x9c\\xa4pda\\x80\\xd7\\xccn\\x91k\\x146\\x15\\x99\\x13p\\xe0;\\xc6v\\xa5\\xde^\\xad\\xfd\\x03\\xfc\\xdc\\x81\\xb5\\x028\\x90h\\x01"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100h8\\xba\\xbemr@d\\x9e\\x88r\\xdb=\\x147\\xba\\x8c\\xf3\\xdbv\\xe4wb\\xf7\\xb5\\x81\\x9f\\x87\\xdf\\x9a\\x82\\xadng \\x8em\\xcdk\\x14\\xaa \\x08,\\xc8<\\xd0|\\xe5z\\xb9\\xaadj\\x9c\\x08e\\xea=\\xb2\\xbb\\x97\\x11\\xf9\\x11\\x00\\xe5\\xde\\xe4\\x7f\\xfd\\xe9\\xddpl(0\na\\x83>kd`g\\xa4<\\xb3\\xec|\\x0e\\xfd\\x90\\xa9c\\xc50n\\xf5\\xd9\\xd6?~e>42\\xa3\\x9ft\\x0b5\\xf5\\xe9\\xdf/\\xbf;\\xf0\\x0b\\xe8\\x9eb\\xfb\\xbb\\xceca\\xbc\\x84i~\\xbfw\\x19\\xd2\\xe4\\x1c\\xecw\rx\\xba \\xc5\\xdf\\xd18\\xbep\\xf5\\xab\\=\\x92\\x9e\\x19\\xa2\\xa8\\xd9\\xaf\\xa1q\\xc9?\\x9e\\xb6\\xe1\\xd4g\\xd0\\x97\\xc0&\\xef39\\xb1\\xe4m\\xb94\\x8d\\xa6\"d\\x9c-\\xbc\\x15\\xa8l\\xd7\\xb0~m_\\x11\\x02`\\x97\\xa8\\x9c\\x98\\xe3a\\xc7\\x8b\\x88\\x8fh#g\\xee\\x8c\\xb5t*\\x8fph\\x8d2\\x17y\\xb5c\\x1c\\x8b\\xf9\\x0b\\xd7\\xc1\\xfa\\x16\\xabt\\xaf\\x9a\\x1c \\x0b\\xf7i3%\\xed"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\n)\\xbc\\xe7\\x1el\\x99\\xdd\\x8b\\xd9wa\\xcco\\x88\\xc3=\\x831\\x07s\\x8a\\xf4\\x8fp\\x0e\\xd8\\xbc\\x15,\\x89\\xf0m\\x18z\\x99\\x12\\xe4z\\xd2\\xdaa\\x87\\x98\\xb9px\\xd2\\x1b\\x13\\xd6\\x0c\\x87y\"\\x9e\\xd34%rt\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe89\\xf4\\x7f\\x13g\\xd3\\xd1g\\xefe\\xe8y$\\xc1w?\\x03z\\xb0\\xbbl7r\\xe5\\xbf\\xa0\\xe7`\\xaa\\xd3p\\xc6\\x94\\x14\\x87\\x1e.uig\\xf1t\\x18i\\xce\\x0e\\xd3"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\x88\\x1a\\xe4\\xc6\\x98o\ta\t\\x1au-cv\\xcafv\\x04\\xf7v\\xc8*ru$\\x1dn\\x8f\\x8f\\xac\\x97yo\\xbb\\x01\\xc7\\x12e\\xeb\\xa8\\xc2\\x03i\\xc0\\x90d\\xfc\\xd8o3e\\xb6i\\xabn)\\xd0\\xd0\\xd3\\xb8\\xd2/*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\xc7\\xad\\xa1i/\\xb4t\\xe2\\xd3\\xa5x\\x8d\\xdc\\x111\\x95\\x87\\xefyno\\xf7\\xcbrz\\xa2\\x92\\xc6q4\\xba\\x0c\\xf1\\xe3\\x81v\\xebvtd\\xae\\x151r\\x93\\xa7"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa74\\xba\\xea\\xd5\\x18\\x15\\xb2w\\x9f\\x05=\\xb5\\xff\\xbf\\x86l\\x16 \\xda\\xc4(\\x95\\xd1v\\xb5\\xd7\\xaf\\x06\\xca\\xdd\\x1b)j\\xeb\\xeb\\xff#\\xc5\\x03\\xe3:c\\x1aoj\\xba\\x84\\xc9\\x97|\\xd7\\xd6\\x160x\\x14\\x86\\xef\\x81q\\xaa\\x96e\\xeb+y%3\\x9c\\xf6\\xbe\\x8c#\\xbe8\\xc8\"\\x1a\\x87\\xd6\\xae\\x06\\xb1m\\xaf1$\\x00\\xba\\xafc\\x1ey!\\x02\\x84\\xfci\\xc1\\xf4l\r\\xfc\\xe32\\x18kgb<\\xb2~\\x8b_7\\xe9~\\xa1>\\xc5\\xafve\\xc3\\xbe\\xd3\\xfd\\xde\\x81\\xd7\\xe1\\xec\\xa00\\xb9\\x1fv\\xbeai\\xe6\\xc0p\\x8fc\\xf1\\x95\\xa2q\\xff*\\x05\\x90\\xf2\\x02\\x02\\xdf\\xa8v\\xfc`d\\x91m \\xd1h\\x96t\\xf9\\xb6\\xd3\\xd6%\\xff\\x11\\xb5\\x04\\xeaw\\\\x8f#\r\\xecn\\xfc\\x98\\xaf\\xcb\\xbdn\\x92\\xb9\\xf1\\xf5\\xccng\\xfds5!\\xa8l\\xdc7\\x1d\\x9f\\x1a\\x81\\xaa\\xb0\\x9c\\xe2p\\x8c2\\x83\\xd8\\x8f`;\\x89\\xb0\\xe9\")j\\x85\\xd4i\\xc68e5\\xd9i\\xb0\\xb9\\x97\\xc8*"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048\\xdcz#\\x84\\x1e\\xecn``\\xccwc\\xf9e\\xa4/\\x04\\xe8s\\x0f\\xfe`d\\x89\\x1c\\xeeg\\x8dc`,\\xee\\xb4\\xbd\\xbd\\xc3\\x92\\xc8\\x88v\\xf08\\xfcf\\x17\\xdd\\xc0\t\\x8b\\xa6r\\xc4\\xbc\\xc5\\xc4\\xc8xc\\x08\\xbf\\x98\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb8\\x08w\\xff\\x13\\x1e\\xafak\\xe6o\\xd6d\\xcf%q\\xab\\xb4\\xff\\xc1\\xc5u/&\\xef\\xa1\\xdc\\xae\\xad\\xfc\\xf9\\x97\\xc3n6i\\xc0\\xd3bju\\xd2-\\x8f\\x8f0"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3\\xee\\xff\\x10u\\xb1\\x05\\x93\\xdb2\\x98\\xfd\\xa9\\xf0o\\xdab\\x89\\x07t\\x90f\\x90a\\xcf,\\xa0\\x85y\\xa5\\xfe\\x18zw\\xdb\\xe0\\xc1\\xc3!\\x9a\\xcfapww-\\xf6\\xe9#^\\xce\\xd2\\xe0|\\x9a\\x1a\\xd6vm\\xb8>\\x81\\x9a\\x99\\x81d-\\xc2o'\\xfe\\x1d\\xcc'\\x867\\xfd\\xc7t\\xe0f6\\xf5\\xd1\\xbbc\\xb1\\xcf\\xbc\\xba\\x1a\\x0e\\xd9\\xb6?w\\xfe\\xdd\\xe6\\x8e\\x9c<u,$\\xc2g\\x98\\x0b\\xb6c\\x9a\\x0f>\\x1e\\xbf\\xdb\\x9by\"\\xe6\\xe6k\\xd52m\\xb2\\x1a/\\xdft\\x9a\\xde\\x8a3\\xfe\\xe12\\xf5y\\xe8\\xe6\\xff\\xb9 i&\\x97\\xb6v\\xf6i\\x0b\\xf2h)\\x90,i\\x8d\\xe3\\xfch\\xdd\\xe0\\x04\\xa3r7\\x14z\\xd9\\x1d\\xec\\xc0-7\\x8ej\\x05)o7\\x1f\\x0f\\x97ea\\x81s\\xb0\\x1c\\xae\\xc3|5\\xc0\\x07!\\xc9\\xb8\\x1c\\xd0+\\x16\\x00i\\x89\\x01m'\\xdb\\xfaw\\xed\\xb9\\xc1$'\\x87\\xb1\\xf8e\n\\x0f!\\x83\\x08\\x97\\x18&jmd\\x8a:0'\\xa7\\xca\\x84\\x16/y5\\xdd"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\x9c\\x05\\xb1\\x8a\\x12%o\\xb8\\xe4\\xf6\\x8dp6vw?\\x12\\x90h\\xf2\\x9a\\xbb\\xeb\\x85\\x87\\x98\\x08n\\xa8\\x80\\xf9\\xe7w\\x7f\\xdf\\xe6?\\xe8\\xf6z\\x98\\xcft\\xfc\\xf8\\x8a\\x16\\xf6\\xee\\\\xb5\\xc6\\xf1q\\x87dg\\x88\\xce^\\xcb\\x1c\\x8f\\xef;\\xffsf\\xbfk\\xc3\\xfa\\xee\\xc0y\\x8f\\xc9\\xe9\\xce\\xef\\xe1n7\\xb0p\r\\xfb\\x071\\x1e\\x9c\\x1a\\x11\\xd2j\\x9a\\xe8\\x06\n\\x01\\x1ee1t\\x80i\\xc5\\xcd\\x01e\\xb7\\xa4\\x00\\x7f\\xf3\\xd0i~3k\\xf09\\x81@l\\x04\\x93\\xdd\\xf7d\\xdf\\xf6\\xa6^\\x93\\xa1\\x0cl\\xa87)l\\xa6c\\xe0\\xcedw\\xff\\xa4q\\xd2\\x07+~\\xe5\\x80\\x05\\x9b\\x07\n\\xc4/\\x88\\xc6\\x88wj\\xf3\\x04\\xca\\x16\\xd6\\xff\\xed\\xe1\\x96\\x05\\x08\\x03\\xec\\x18\\xff\\xa8\\xc6\not\\xe5s|=r\\xe9|\\x91\\x97jh\\x8f=\\xack\\xd5\\xec\\x8a\\xa3h\\x83\\xa7\\xde-\\x90f\\x9erc\\xad/\\xa1\\x13\\xe6c\\xbd\\x8ew\\x9f\\xcc\\xc3\\x7f\\xdc\\xc7\\x90m\\xabk\\xcc\\xbfa^st\\xc0\\xe8!\\x14"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$^b\\x17\\xe5\\xae\\x18\\x1b6\\x94v\\x17lf\\x91\\\\x89\\x13n4\\x04\\xbe\\xd2\\xbf\\x17\\xa9>\\x07\\x1c\\xf6\\xfc\\x08ix\\x15\\x80?\\x18rw@?\\xd7\\x14\\xd7i\\xe8nl\t\\xa2\t\\xafo\n|\\xed\\xdf\\x88\\x999\\x00\\x85e\\xb8\\x9e\\xcf\\xf1\\x9c\\xf3b\\xa4\\xea&\\xa8\\x91tu\\x82$s(\\xa0\\xd7\\xc0ie\\xe1&\\xd0f\\x0f\\xd1\\x81j5\\x86#'jy$\\x06\\xf2\\xf5\\xde#r\\x1es\\xcc\\xb4t:\\xdf\\xa1\\x9a\\xe1\\xf0 z)\\xc8\\xa9\\xa6\\xe9\\x9b4\\xfb\\xed\\xef\\xb7?\\xec\\x1d94\\x03r\\xee4\\xe7?m\\x15\\xe5v\\x8aycs\\xc7o\\xc6\\x1d4_\\x9d\\x97wg,\\x97j\\xf9\\x05\\xbc\\xf1\t\\xa5\\xa4\\xacl4y\\x86\\xd7e\\xad\\x06hy1l\\x85\\x8c\r\\x9d\\xefvk\\xeaq\\xd8\\xc4\\xb9m\\xe7;\\xa5\\xd0\\xcc\\xd6_uu\\xb3\\xbeq\\xb60(\\x7f\\x89\\xdci\\xa2=1v\\x91g\\xd4\\xe4\\xe1sn\\x82\\x8d\\x83\\x1e\\xc9\\x93\\xbc\\x02\\xd0\\x92\\xbf\\xdd\\xf1&.l\\xa1#\\xb8\\x8e"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd7\\xdb\\x98\\xfe\\xcft\\x8fg\\x83\\xf9mco\\xe9\\x14n\\xa9\\xbb\\x1ft\\xc6\\x9e(\\xa1\\xd0\\xd8\\xb9\\x85\\xdafs\\x1f4kf,\\xf0r\\xb0\\x91\\x1dz\\x0b\\xa3h\\xe7\\xb2\\xc2\\xcd\\xab\\xf0\\xa9\\x8f\\xbfl\\xd8\\xf11\\xa4\\x7f\\xa6v\\xe8\\xea\\xb5!b\\x9f*\\x147\\xda\\xbb\\x0e\\xbb\\x8b\\xdb\\xf8?k\\xd0\\xd9\\x9c\\xb84f\\xb3;\\xa4\\x04s\\xcd \\xbc\\xcf\\x84t\\xa0\\xd9\\xc1\\xc0\n\\x00\\x93\\x1d\\xb4\\x8f1s\\xc6\\xa7sq\\xe1v\\xae\\x86\\xe3\\x07\\xea\\\t\\xe3\\xa7\\xd0s\\xd1\\x8b7pe\\x90\\xa6\\x11\\x08x\\xe9\\x7f\\xcb .\\xb5\\xf0?u\\xb1_\\xbc\\x0ez4\\x83\\xbf\\xab\\xfbc\\xfej\\xda\\xb5x\\xf3\\x15ha\\xfc2\\x07\\x03\\x8a\\x8eq0?\\xd1on;-\\xec\\xf8\\x1b\\xa4\\xef*s9k\\xa9`@-0\\xf0\\x1dn\\x82\\x84\\x85dr\\xff\\x0b\\xb6\\x8c\\xdb=\\x86\\xe3j:w\\x8f\nk\\x1d\\x05\n\\x9f\\xdc@b\\xa4\r\\x15\\xb3\\xb3\\xf8\\xf8\\xadpp\r\\xb9w\\xe7\\x0bru\\xbfr\\x92\\x93\\x97\\xf4\\xf2\\x02\\x9c"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xde\"\\x99$\\x99\\x8d\\xd4\\x1e\\xf0k\n\\x81 \\xe0\\xc7p\\xb1\\xfbcx\\xdd(\\xd3\\xd5\\x18n g\\x1ex^\\xbe\\xfa\\x1d\\xfe\\xf2\\xca\\xcf\\x05\\x9af\\x0b\\x0bv\\x0b|$\\x96:\\xc0c\\xc9q\\xa2\\x98\\xeb\\x8e\\x84\\xd2\\xf9\\xbb\\x93\\xfag\\xdc\\x07\\xd2,ls(y\\xf0\\x8f`\\xd7\\x8f\\x8e\\xee\\x19td;\\xa1\\x96\\xda1\\\\x03\\x13\\xfb\\xb5w\\xc6:\\xdd\\x16\\x94\\xbc\\x12\\xbae\\x13v\\x83cy\\xa0\\x13\\x0e:$\\xdaj\\x88i\\x99%wo\\x9f8g\\xed\\xab\\xa5\\xb8\\x9ev\\xcb\\xde\\x91\\xd4f5\\xed\"\\xa8\\xb3\\xb2a\\xd2\\xfb\\xb9<oc\\x88,l\\xe7\\xcb*\\xe1=\\x17n\\xad\\xacg\\xbc\\xe2\\x1dlm\\x85\\xe7\\xd8\\xfa=\\x15\\x9f\\x90`\\x1a&\\xa6\\xaa#\\xb6!\\x8b\\xcb&v\\xa1\\xdf\\x10\\xfc\\x9d(^r\\xfdg\\x1a\\x14\\xa0\\x96\\xd9\\x92\\x90;\\x87\\x14z\\x10\\xfaj\\xa3\\xa8\\x00\\x16\\x81\\xa4\\\\x02_\\xfdz#\\x9bg\\x02jv\\x908\\x10~\\xaecjs\\x12\\xbf\\xf1\\xfb\\xf9\\xd9<8\\x90\\x1a\\xbe\\xa4\\x11\\x87"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1\\xad\\x89\\x94\\xb5\\xed\\x02+\\xa5_v\\x9bd\\xcb4\\xc4e\\xf1\\xae\\x8f\\xbb\\x8a!n+\\xce\\y\\xfc\\xdc\\x93\\x84\\xd0\\xcf\\x01@\\x15\\x08\\xeay\\x15\\x93\\x91\\x97\\xc9p\\x89#aw\\xb4\\x184\\xc7\\xa7\\xcfa\\x87$h<\\x9e\\xe0\\xa4\\xdf-\\x92\\xb5\\xae\\xf4\\x1c\\x90\\x82\\xc1vwtp\\xa3\\x93\\x17r\\x9a\\x89\\x9e\\xa6\\x9c\\xf57\\x93\\xf1\\xc5\\x1ed?#!\\xba+\\x9d\\x11\\xe1q\\xa5\\x8d\\xc0\\x12\\xab\\xac^\\xf9\\xf2\\xbd\\xc9k\\xae\\x9b\\x11\\xb8wt\\xc0m\\xed\\xc3z\\xdf\\x9f\\x8ee\\xb8\\xfcb$\\xda\\xde\\x98\\xfb\\xaf\\xf7\\x84f\\xe8hj\\x17\\x1bt\\xe9k\\xe9i\\xe2\\x9b(\\xbc\\xd7m\\xae\\xff4,\\x85\\x8b|du\\xaf\\xeay\\xf3\\xc5o\\xa1;l\\x92\\x86\\xb3%\\xe3\\xf7(u\\xcc\\xdf\\x08\\x11\\xb8\\x12\\xf1\\xc5\\x06\\xf3(\\xbak\\x89\\xfa\\xc0\\x82\\x94z\r\\xd1\\xc59\\xe0y\\xa7|\\xe1\\x1f\\x17\\xe0\\xd7\\xca\\x80e\\xe4\\x07\\xb76\\xcb\\xa9\\x88\\x98|\\x85!i.6\\xa2h\\xbf$\\xd3\\xc7\\x96,\\xdf\\xfaf&hj"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\x93z\\xd2\\xf9\\m#\\xc0\\xfbl\\x17\\x1c7\\xa1d\\x96\\x07\\x85\\xb8\\xc6x;\\xc0\\xe4\\xd8(\\xd7\\x9f6z\\x8b\\xaa\\xe67\\xb7\\xc7\\x88\\xe93\\xee\\xde\ro\\xf4n\\xa9r\\x17\\x8d\\xf9\\xf7\\x81\\x03^\\xe2\\xe9\\xd1\\xdb\\xf8s\\x90i\\x00\\xaf\\xd7\\xff\\xa4lmy\\x1d\\x87\\x897\\xb8>\\xbf\\xda\\x16\\xc8\\xff\\x81\\xf2\\xf5\\xfc\\xde\\xc7\\x0c\\xb1p\\xca\\x06k!\\xf0\\x99\\x95\\xab\\xf0\\xcem\\xddbu\\x8c\r\\x99\\xe5\\xda\\x9en\\x07\\xe8t\\x03\\xb8:sd\\xactcu\\x95\\xd3\\x98\\x19\\\\xa7\\xe7\\xea~r\\xfe\n\\x00\\x0b\\xe5\\xcem\\xf9\\xe3g.p.\\xb4s\\x97\\x8c=y:\\xef7\\x81\\xbf\"e\\x1e\\x82:&h\\x87i\\xbe\\xacku\\xb0,\\xaf@\\xc1\\xa4e.\\xd0\\x8d\\x1d4\\xeb\\xac0\\xa7\\xc9c\\x04\\xf9\\xbd19\\xba\\xb0^:%\\x97\\xd5\\xd2\\x07\\xad\\x1c\\x12\\xd1\\xb9\\xa4\\x96\\x92?\\x81\\xc7\\x12\\xf0\\xed\\xa84h\\xc6\\x1c\\xea\\xe5\\xf5\\xfa\\xc1(,\\xc9\\x1ah\\x03p\\x9bp\\xd0ft\\xf5\\\\xe3|-\\x1e_\\x98"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0105\\xd1\\xae\\x1f\\xc3n8\n\\x86\\x12!l\\xd5\\xe5.\\xa7\\xcf@\\xe8wq|\\x86\\xde\\x93\\x9e\\xed\\xcd\\xf2\\xb1\\xc0\\xb2\\x8b\\xd4\\x01\\x84\\xec7\\x883\\xf607\\xf3\\xcd\\xcd\\xab\\xfa\\x91\\xfcs\\xb7\\x0byt\\xef\\x0c\\xb3\\xb5\\x96\\xe3\\xf6\\xee\\x8f\\xded\\x97 \\xcd(\\xd9\\xda\\x1c\\xeb(.n\\xe8\\x93-f\\xf29!\\xee\\xf5\\x1c\\x8fi\\xa8\\xddji~\\xe8`\\xb9xn\\x11v\\xc9\\xff\\s\\x940<u3\\xaa\\x88n\\x14;\\xdfi\\xae\\x84;\\xca\\xd56\\xb1\\x82\\xf6ak\\xc0\\x06 )\\xe1\\xb9\\xe0w\\xf9|g\\xdac.\\xe7\\xbf\\xff\\xcb\\xd8\\xd4\\xa7\\xd7\\xb8\\x94\\xbd\\x10\\xf0\\x8c~\\xeb\\x16\\xc9\\xe7$9\\xed\\xcey\\x0f\\x0e\\x18\\x99i#\\xb6l~e)\\xb9u\\xc2=e`s\\x06>\\x86\\xb2\\x95\\x0c\\xa7\\xb5\\x9e\\xb2\\x17\\xb7\\xfd\\xe9\\xb0\\x90\\xbe\\x7f\\x00@\th\\xdc\\xfe\\xc8\\x90@\\xc6\\x1f3\\x96:jc8\\xe6\\xa5\\x07\\xb6\\xa7im\\xcd\\x93.ma\\xe9\\xa8\\x13\\xac\\x82 p\\x85s\\x19\\xc9\\xc3?v\\x18\\xe5p\\xcf"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x07\\x0f$6\\xd6:\\xb9y\\xcec\\xc5uz\\xf3nh\\xa4o\\xd9\\x12\\xab\\xbb\\xf7if9\\xeam\\x99\\x85\\xef\\xa0.\\x1a\\xa2\\x8f\\xedj\\xe0\\x00\tf\\xb0\\x9a\\xc3\\x8f\\x88\\x0cw\\x17\\x0c\\xb1\\xec\\x89\\xf1\\x84\\xa4\\xfep\\x8b\\xfd\\x94\\x00\\x16\\xafd*\\xaboz6\\x1c\\x04%\\xc2^\\xc3\\xfb\\xee\\xef\\x18\\xbb\\x15\\xb94\\xb2\\xd7\\xf3 \\x1d(\\xe314\\xb5_\\xb1\\xff\\x00^\\xa9p\\xe6p\\xa5~\\xaa\\xe1\\x80=\\x81w\\xb0\\xa1\\xffsy\\xa2\\x91\\xeeh#7\\x977\\xca \\xd8 4\\x8b.\\xd2\\xd1\\x08\\xe1\\x98\\xbd\\xa7\\xcb\\xe3\\xf8\\xc1,8>\\x1fu\\x94\\xa1\\xb81\\x054f\\x9f\\x8d\t\\xde\\x9dx\\xebp\\xec\\xb5\\xc4\\xb9\\xa6'q\\x95\\x9e\\xb6j\\xff\\xae\\x91f\\x1f\\x18\\x88\\xfd\\xa4\\xbe\\xa6\\x1fn\\xc6-\\x82\\x0co\\x95=\\\\x088~5h97\\xf0\\xc0\\xab\\xbdtt\\xe7\\x81\\xfaf\\x1b\\xe0\\xc1\\xe4\\x933\\xdf1\\zq3n\\x94e\\xefs\\xa2\\xe3!\\x07\\x91\\x18\\xff\\xfe\\x05m\\xc1z\\xe2\\xae\\xf5\\x9ad\\x19"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xbdu(\\xd7\\xb7|\\x15\\x9dx\\x8c\\xc3\\x9d\\xc8z\\xd1\\xb2\r\\xe7\\xb3\\xc5\\x0e\\xb3\\xc7@p\\x1f\\xaf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf(\\xdd\\x95d\\xad\\xa2\\xf41\\xe6\\x7f\\xe0\\x1a\\xde\\xfa\\xf9;\\xed\\xb7c4\\x95\\x03_\\x86\\xd0 \\xc6\\x90\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\n\\x98\\xe1\\xd7\\xb4g\\xfd\\xf0\\x9f\\xcf^mw\\x0b\\x05yd(\\x84e\\xbb\\x81k\\xefl\\xc6\\xdf\\x86\\xf9w\\x06\\xf7\\xf3\\x0f\\x90zr\\xccc\\xea\\xa4\\xe8c\\xfed\\xbb\\x9cgk\\xbd\\x14\\x94\\xab\\x95&`\\xfcv\\xdex'\\xa8\\xc6f/\\x9c\\xe4\\x88s\\xf2\\xfe\\xf66j\\xc6\\x8bp\\x85\\xc1\\x96\\x8d$i\t\\x8f\\xf9\\x1d\\x02\\x9e\\xcfu\\x87\\x8b\\xcd\\x93\\xa3y\\xa0t\\xa6o\\xdb\\xd6z\\x84\\x96\\xd4\\x87\\x0e\\x88\\x95 jp\\x00\\xd8\\xe1\\xbb\\x14`t\\xf2y%\\x83#\\xb2\\xc6q6\\x17\\x18\\xee\\xc3\\\\xcf\\xb6\\xdex\\x87\\xb2\\x87q\\x8a:\\xe5k\r'\\xeb\\x8f\\xa2$\\xfai\\x16#\\xd8\\xef\\xd1\\x1a\\x12\\xcfbmr\\xe1\\xf3:\\xb4d\\x9a\\xaf\\x86\\xdf2\\xa4\\xef\\xbc\\x08\\xbb\\xa09s\\x17l\\xa4yy\\xb8\\xa2/\\xf7.>\\xb1\\x88\\xfaik\\xfe\\xf6ma\\x89)a\\x16\\x9by\\xb7p\\x82\\xd2kyre^k\\xa6\\xdb\\x9d\\xa7(fp&t\\x0bl\\xc5>\\xe6\\x1a\\xcb\\xdc\\x80\\x8c-xvb>"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb0g\\xda\\x8b\\xb5\\xc8<\\x04y\\xe0\\x92t1\\xc9\\xd7\\x14~\r\\xf2\\xbd7\\xad\\xb2t\\xd2x\\xf0\\xc7d\\xd1\\x10\\x84\\xe5u\\xa0\\xd9\\xdfj|\\x8f\\xb8>\\xa7\\x10q\\xca\\xb7\\xba\r\\x8f\\x18g\\x14\\xd8\r\\x19_.\\xa21\\x18\\x8b\\xe3i\\xfe\\xfbx\\x1bf\\xbb\\xebp\\xf7n\\xcc/\\xe1^\\xdf?\\x99\\x07\\xcd\\xba\\xf0\\x86v\\xe6\\x07\\x00\\xfds\\xd5\\x12\\xe8\\xa4p\\xc5o\\xad\\xa9\\xc7&\\x91x\\x90`\\xfbn\\xc6\\x1b\\x88r\\x0cu\\x97h\\xad\\xea/+\\xee\\x08\\x95on\\xa6\\xd7\\xc7\\xe2\\x9d\\xae\\x14|\\x03n\\xa4\\xa4qs\\x96\\xff\\xb6\\xf9\\x07#\\xa9\\x93f\\xac\\x0f\\x80\\xb1\\xd8\\x93lu\\xcbs\\x94-tu2\\xfd\r\\x1cq$\\x00\\xcf_\\xe0\\x08/\\xffm\\xd1\\xa6\\xcc\\xacv\\xf7\\x1d\\xc3\\xb0|\\xaa\\x88\"s@\\xd6\\x8bq\\xe4\\xfa\\xf0\\xd0\\xe2\\xb4r\\xc0_,h\\x83\\xe1v\\x9c\\x04o\\xb2\\x19\\xa0\\x97\\x0e\\xaa\\xad\\xc4\\xd7\\xc4\\xb2\\x10\\x0bbkc\\xc5\\xfa\tz`\\x82|\\x9f)\\x0f\\x89\\x04c\\xd4\\xb73\\x99="
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xb3\\x10\\xd84fi\\x91\r\\xdb\\xd3\\x9e\\xfejs\\x06xi\\x9e\\xb8\\x1f\\xaf!ud\\xdad\\xbbh\\xe9w9\\x1a\\x1a\\xcc\\x056?\\xb0\\x02\\xb4\\xb8\\x9dm\\xf1p\\xc3\\x0c\\xc7\\xc3%y\\xab\\x9b\\x05f\\x80\\xdf80\\xeb\\xf3$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\x87\\xef\\xf1\\xea>\\xc4\\x92\\xd0z\\x95|\\xdf\\xe1\\xb2+\\xcbc#x\\xfb5\\xa3t\\x03t\\xc5\\x1d\\x0e\\x98\\xcc\\xaa5\\x89\\xad\\xe4\\x07h\\xa3k\\xe8a\\xcb\\xee\\xdc\\xb9j\\x9f"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x11\\xe0\\xd6 \\xc6\\xc4\\xf6p+\\x9e\\xa2\\xa7b\\xe9\\xde\\xad\\xa3\\x9d\\xd8\\x88/\\x0f\\xc4\\x04rx\\x00h\\x03\\xc2\\x94m\\x15\\xa3\\x8e\\x94\\xdd:g\\xd6\\xf5\\xdf\r\\xc4\\\\xba&i\\xee1gx\\xa6r\\x8d\\x7f\\xbd\\x05l\\x037\\xc52\\x9d\\xc47a4wz|\\x0b\\xe4\\xfauo~\\xf5\\xa6w\\xa4\\xe9\\x96&\\x84\\xf5\\x9b\\xa4\\x8b\\xe3\\xd94\\xdcws\\x1b\\xc1\\xe4\\x9a\\xcf\\x7f\\xf1\\xee\\xfdwm\\x15\\xbe\\xfb\\xdc=a\\x1d\\xebd\\x8e\\xd5\\x8eaj_\\xdd\\xe3\\xd0\\xdd\\x15k\\x81\\xd3:\\x18nu\\xb2\\xd8\\x97c*2\\xa8\\x04a*j\\x99\\xa2\\xd6\\x0e) >@\\xeb,/\\x05\\x84u\\xb7i\\xcab\\xdd\\x8b\\x94\\xe8\\xb8n\\xf1\\xf9\\x86\\x94\\xbe\\xd7:\\xaf\\xaa_\\xce\\xc33\\x87&\\xe8\\x8dz\\xf9k\\x1cz\\x81\\xc2\\x87k\\xa0\\xb9\\xd5\\xbc%\\xe8n`\\x079\\xf5\\x95\\xa3\\xdf\\xb6\\xe4c>>\\xf20\\x9da\\xc0y\\xb5\\xbf)\\xdb\\x12\\xe4\\xc9ut3\n\\xd0\\xe8\\xb7\\x90\\xf7\\x91\\x81\n\\x98\\x1e\\x99\\x04a`y\\xa1m\\xfc"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10l\\xd1\n\\xcb\\xbc\\xd2%\\xd6\\x80\\xfd\\xb7\\x8a\\x94y\\xc5\\xbe\\xf5\\xf10\\xa6\\x82\\xfa\\xa8 qbjd_\\xcf\\xd1\\x18\\xc3y\\\\xc5\\xabyj\\x05\\x18\\x84\\x0e\\xfe\\x86\\xee\\x98\\xf14\\xaej\\xfb\\x9e\\x16\\x84\\xe6\\xcf\\x1a\\x12\\xccm5\\xcf\\xdc$\\x0e\\xcbn\\x1f\\x00\\x7f\\xc1bd\\xb88\\xd4v\\xae/j\\xe0\\xe4\\xbbs\\x95\\x198-q\\xd46a\\xbb$m\\xc6`\\xdf\\xfb\\xddt\\xc2r\"jzjiu\\x04*\\x7f\\xddy\\x07j\\xc0\\x9a\\x81\\xe8\\xe4\\x9c\\xba\\x95te\\xa5fp\\xcb\\xee\\x04vh\\xcf36\\xde\t=*\\xf24l,`\\x85\\x8d\\x98\\x7f\\xc9r\\xb3\\xfd\\xa2n\\xf4i\\x1d\\xbbm7\\xf4\\xd1\\xdd\\x94s\\x06\\xf8\\xd0\\x93(\\xbe;\\x05\\x83\\xd3/i\\xf6\\x8bm\\xe4-\\x8c\\x9e>\\xe9\\x8b\\xdb\\x8e@\\xed9\\xc8j\\x82\\xa8t\\xd0\\x19g \\x04^\\xe0\\xf5\\x84\"\\x04\\x07\\xfbp\\xf0r\\xcc\\xf0.\\xb7\tc\\xb8\\xb5\\xf4!g\\xf9\\xf6\\xaf\\x9dc\\xe4\\x14\\x04c\\xf2ney|\\xc5v\\x07\\xcc\\x11\\x82\\x0c"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;\\xb8\\x92\\xbe#\\x94\\xd3\\x88\\xc4\\xc3\\xe9\\x02\\xeea\\xe2\\xd7\\xbf\\xfa\\xc9a\\xe5\\x93\\xaaq#\\xb9%u\\x03>\\xe6\\xd76$\tmt\\xb3%\\x9b\\xd4\\x16\\8\\x9bq\\xf8#\\xca\\xb7s\\xcf\\x97\\xe2r\\x99\\xbc5\\xe3`*\\xdfm \\\\x15c\\x8fo\\xc8\\x0b(\\xed=?y\\xc5@\\xe1q4\\xda\\xa2\\x08:\\xdc\\xd0\\x94\\xc13\\\\xe8\\xed\\xf8f\\xbeur\\x83\\xd1\\xf5\\x83\\xfdn\\x8d\\x1fn\\xef\\x01\\xd6\\xd8\\xe2xg\\xd9\\xb2+\\xab\\xbb\\x8b\\x9f\\x01\\x91\\x101\\xb30\\xa2f\\x83\\x87wd#\\x12h\\xd5%\\xb1\\xa9\\xf7\\xb4q\\x8e\\x93\\xd4\\xcfk\\xad\\x84b\r\\xca\\x92p\\xcb9\\x9f\\xa8%\\x19\\xa6xmc\\xd1y\\xaf,\\xcah9\\xb7\\xb7~\\xaa\\x92_\\xc3\\xb6u@\\xb7\\x1fty\\x87\\x1a: z-\\x08\\x19\\xfb\\xf48b\\xb2\"y&\\x1e\\xe62\\xf3\\xed,\\xb9\\xc9&@ue\\x1f\\x82\\xa0\\x8bx\\xeec\"\\x8b\\xfd\\xd9\\x88b\\xea\\x1a\n\\xad\\xe0v\\xa1\\xcc\\xc4x\\xd1\\xf6\\xd1\\x0b\\xb9\\xa3\\xfa\\xa5gmt"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\xe7+1_5t*\\x1e\\xa4\\x8cu\\xda\\x07fu\\x8e\\x85\\xc8\\xee\\xc2\\xa0\\x1e\\xfe\\xf5v\\xa7b\\xd2d\\x96?,3\\x9f\\xd2%\\x1f\\xe4\\xdc\\x08\\xb8\\xe6\\x10\\xb0\\xf6\\xb8/$|\"\\xdc\\x89\\xde\\xbb5\\x04\\xafmu\\x9a\\xa2\\x80\\xe2\\x8d\\xd8\\xa5\\x13\\xa66\\x96\\x04\\x94\\xc8\\xd6 xr\\x1b\\x9a\\xaby\\i\\xf7\\xb3\\x9b\\xfe'\\xbb\\xe7s\\x0cs\\xc7\\x9c\\x13f\\xed\\xce\\x9e\\xcbj\\x93\\xb3\\x97\\xf2|\\xcd\\xd71\\x81\\xae\\xbc7^\\x1c!\\xe0(\\x93\\x94\\xa7\\xd1i\\xb9\\x15\"\\xab\\x9b\\x1e\\xd5\\xa0\\x00\\x82\\xe7y\\xf4\\xe80\\x8al\\xcb,vy\\xb4\\xc3\\xad!\\xffze\\xa7\\x04\\xe3\\x03\\xd1b\\xcaq:\\x11\\x17q\\xc3\\xa0j4\\xca\\x0c\\x8d\\xb6f\\x84\\xa3\\x97\\xac\\x15\\xf2\\x1fj\\x86.\\xe8h\\x9ay\\x1d<\\xd1g\\x9ep\\xfeqj\\x1f\\xde5n?\\xdfia\\x00~w\\xe5\r;\\xb8\\x8e\\xcb\\x9a\\x94+\\xa6)\\xb2\\xac\\xfej\\x94\\xb1fv\\x7fc\\x85\\x10\\x12=\\xe1i\\xfd\\xf98a\\xa1\\x07z=p\\x01o^"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xd9\\x9d\\xe8vp=\\xe5\\xf3v6\\x1a\\xad\\x9fd\\xf0\\x0c\\x8b\\x7f\\x90\\xd6\\xd5\\xed\\xc8\\xe2\\x05\\xc7\\xb6\\xd6\\xa8\\xf2&\\xd9\\xa0\\x9cp\\x14r`\\x0b\\x9a%\\xa1;#\\xd5\\x94q\\xab\\xd1\\xab\\xe6\\xb9\\xee!r\\xe7=v<xw\\x1d\\xf0\\x97\\xc4\\xfdl\\x83*g\\xbf\\xb8\\\\x9b\\xb5\\xc8\\x0c@@\\x8c\\xa8\\x10)\\xd5i\\x99\\xd0d\\xb4\\xcd6d\\xc2\\xa3\\xfe\\xaa\\xec'\\xf7\\x8b\\xa8\\x89\\xd2a\\x05\\xecsmdd\\xbau\\xde\\xcf\\x99\\x8a\\xab\\xb7\\x9d\\xd3\\x0c\\x0b\\x11\\xa5\\x89\\x94\\xf5\r\\xb6\\xb4ux\\x8f\\x8c\\xeb\\xf6\\x81\\xe44\\xfc\\x93b\\i!o\\x1cs\\xad3\\x92y.\\xf4\\xe7\\x84\\xcb45\\x01\\x80\\xe3\tp\\x1f\\xc8\\x9c\\x9dh\\x13\\xa9d\\xfb8\\xee\\xb2\\xf1\\xbd+\\x16\\x15\\x8c9\\xd3\\xd0\\xcf\\x0c\\x8d\\x80\\xe8o\\xf5?%\\x16\\xb6\\x03\\x10\\x1a\\xfc\\x13\\xaes0\\x92\\x8c\\xb1u\\xed\\x86\\xc5qs\\xc4\\x0eh\\x8a8l\\x97p\\x1c\\xdfk\\xcf\\x08\\x81\\xe4\\xa9\\xc2\\xbe\\x1at5\\xb6\\x99\\xa0\\xcf\\x05nc\"g"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4\\x8ec$\\xa1\\xa02\\xd0(\\xb6\\xb4:\\xf7\\x10\\x7f\\xc8\\x92\\x80\\xa2i\\xc0\\xd3(\\xdf\\xa9v\\xce`\\xb8\\x063\\xcap\\x83\rh\\x8e\\xc4w\\xca|'n\\x03r\\x19\\xb4\\xec\\xb2v\\x96b^\\xdd^\\x17\\xec\\x98\\xa1\\xbc\\xa2\\x82ek\\x86&\\xb4\\xe7\\xa8xzg\\xdd\\xf6\\xc5\\x19\\xa3\\x7f\\x0fr\\x04\\xaa\\xf6\\xb2\\xf3v\\xb6vc<\\xf0\\xe9\\xf9>\\xf3\\xc9o\\xb5:\\x9fb\\x8d\\x90\\xdfh\\x82\\x8e\\x18ef\\x8a\\xee\nh\\xd4\\xbb\\xcb\\xf5\\xdb26o.\\xc1\\xad\\xb5\\x9by\\x96\\xb0xwk\\xc7_4h \\xc7\\x14\\x15\\x1ahw\\x80\\xa6\\x0e\\xe2s\\xba7\\x04\\xc0\\xb4\\x80\\xffh\\xda\\x9d\\x19%\\x91\\xcbs,-9\\xea76\\x9e\\x9e\\xe8\\xd8$\\xd3\\x0c\\x99\\xc5t\\x98dd6y(x\\xd9\\x98\\x96\\xa1\\xc63s^\\xc0\\x16c(\\x93u;\\xc0l\\x9e\\xc9m\\x10km\\x97\\xd5xgdy\\xec\\xd2\\xd1\\xfa@om;?a\\xf9\\x86&\\x9a!\\x9e$vp\\xbf\\xca5\\xf5\\xfb\\xcc\\xae6\r "
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\xd5yf\\x91\\xe9\\x0ep\\x0cn\\x91\\x1fu\\xec\\xb7z4k\\xbdaa_ 4a\\xecj\\x91\\xd3v\\xae!_\\xa8\\x94\\x05\\x92\\xe4\\xe7\\x1e\\xc4\\x81j\\x13\\xb0g)\\x95l\\x9eu\\x7f\\x95\\xaf\\x91(\"\\xddr+\\xf6<\\xa7\\xae\\x14sqh\\xfez'\\x06\\xa9x\\xf5&qq.\\xaf\\xf3s\rp\\x08wp\\x88\\xc3\\xe4\\x86`\\xea\\x1ei\\x9f\\x86q\\xf7m\\x87\\xf2\\x0c\\xf2\\xb1\\x8a\\xa8\\xb3\\x12i\\xe7\\xc6\\x17v\\x8c%c\\x04\\xc0c\\x0c\\x18\\xf9\\x8f\\xd6r\\xdb5_;\\xae/\\xeb\\xa0\\xf6>%xc\\xfe\\x17l\\xe8\\xf7*\\xcb\\x06\\xb7\\xce\\x99\\x10%n\\x0f\\xe4\\x863\\x11\\xbe\\xb0\r)9\\x1b\\xc3\\xc0l\\x17\\xfa\\xdao\\x8e\\xec\\x1f\\xb3p\\x9b\\x16\nw,\\x0f\\x83|\\xbe\\xb3\\xed4)\\xcf\\xf8\\x03\n\\xf7\\x14\\xbah\\x121\\xa1\\x98^\\xe9\\xc6kgn\\xfem\\xa4\\xe3\\x8a;gd\\xc6\\x92\\x91\\x88\\x94+\\x13\\xbe\\xbb\\xcd\\xd7\\xa1\\xe5u\\x14$\\xbd\\x17v\\xd7\\xa8\\x83l<\\xb9\\x1c\\xacz\\x1dc9b\\xe3$"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\x80q\\xa3c\\xa4\\xd1@\\xc9j\\x98^\\xbdz\\xe6\\x05\\x1f;\\\n\\xfc_\\xbdc\\xd3\\xec\\xce5\\x8cms\\xc4h(\\xfd\\x98w?#\\x9b\\xb4\\x81\\xcftr\\xfcaa\\xdak\\xf5-\\xb5 \\x8a\\x15\\x7fb\\xfby7\"\\x88\\x87\\x9a\\x8b\\x97\\xd0\\xd5\\x99+$\\xf9\\x19\\xa6\\x14\\x9d\\xf8\\xfeg\\x0f\\xfc\\xbc\\x90\\xcec\n\\xa3\\xf5\\x95kq\\xe0\\xe2o\\x9d'\\xb2\\xb7\\x87\\xb8t\\x8b<\\xedw\\xbe)r\\xfe\\x04\\x8e|7\\x8b\\xe8i\\xc1\\xc0gh\\x1d\\x7f\\xd7\\x1c\\x06#\\x13?\\x18\\xfb\\xce\\xec\\xf5\\xf2b\\x90 \\xfd\\xc0z\\xdb\\xd4\\x8b.8\\xbdz\\xc3\\xa6s~\\xfe\\xa2\\xfc\\xa2\\xff>\\\\x07b\\xc8\\x8c=\\xa5\\xb5\\x0f\\xd0\\xc0\\xc8\\xebnl\\xc6-\\x13\\xf4\\xac`z\\xb3\\xa1\\xa2\\x97\\xc5\\x96\\xd7\\xb9\\xfc/v\\x97\\xcc\\xa0\\xda\\x91\\xab\\xf1-\\xdb\\xa1\\xbe\n\\x87\\xb8\\x96\\xa6\\xb7\\xd5\\xe2@\\x85\\xe1\\x96m\\xcb&\\x9dt\\x7f\\x96k\\xdfj\\xd1\\xf6\\x1681\\x8ewpw|oy\\x0c\nn?\\xd5n\\xddfv\\xc4\\xd9"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xe1\\xb5\\xe1\\x0ez\\xf68\\xb5\\xe5\\x83b\\x99\\x90\\xc4\\xa2\\x10\\x9d8h\\x17\\xc2\\xfa*\\x8c\\xa3\\x10\\x94\\xb39\\x1dwn\\x16\\x8b\\x04\\xad5\\x1b\\x85\\xcc\\x8bf\\xce\\xb3\\xe7n\\x14\\xe2d\\x1b\\xe3\\x06\\x02\\xf7^\\xe4\\xa3\r\\xbe\\xa5+\\xee\\x03p\\xad\\xbf\\xdc\\x88fey\\xd5\\x02\\xf6\\xdc\\xd0\\xf3\\xb7\\xbc\\x9c\\xd8\\x9b\\x98\\x14\\xe3|n\\xd1\\xc0\\x0e\\xbe\\x01\\xa4;\\xb6\\xee\\x0e:!\\x85\\x18ds\\xcd\\xe5a'\\x89\\xf5\\xbf \\xfa\\xc5\\xed\\xfa\\xca-\\x06r\\xdaz\\x06\\x98\\x90\\xe2\\x0b\\x9f\\x16\\x93\\xd7\\xcc\\x85\\x86\\x1f'\\x0c\\x0f\r\\x00\\x86\\xa6\\xc2\\x93\\x1b\\x1f\\x12a\\x11\\x81\\xc8`\\x82!;j3\\xb7z\\xf1\\x95\\xd5\\x1f\\x00\\xfd\\xad*`|\\xcd\\xbf\\xc4i\\xab*\\x8d \\xa9\\xc3u\\xca\\xc9l\\x0e\\x04\\xd3z\\x08\\x98\\xa2\\xdd\\x12\\xf3\\x19rt\\x89\\x8b\\xc6\\xab,\\x06\r\\xfa!\\xb8j\\xae\\x1f\\xbf\\xfa\\xce&*\\xbd(\\x98@\\xbc%\\x02\\x9f8l\\x96\\x8e^\\x14\\x94\\x98|e%\\xb7/\\xa0\\xdd\\x11o\\xbb\\xd2s\\xad-h\\x16?"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\x90\\xa5\\xb8\\x9en\\x044m7\\xdc\\xac\\xb5\\xcd\\xcd\\x1d\\xe6\\x1f)\\xd6fs\\x9a\\xcc<\\xaa\\x80\\xc3\\x88\\x90\\xdak\\x91\\x86\\xf2z\\xd8\\x18sn\\xc5\\x9e\\x02\\x8b\\xb7\\xf6\\x97\\xabv\\xf0ty\\xf9\\x01\\x01\\xb5\t\\xf3\\xa3\\xa4\\xfd\\xce\\x01\\x01\\xe3\\xe4\\xb7d\\x807\\x0b:\\xfd_dp\\x8a\\xe43\\x8f\\x86\\xf0^w8\\xf0\\x16vz\\x18b=0\\xac\\xf6\\x91?-\\x15e\\xab=g\\xe1\\xf8\\x92\\x9a\"\\x86\\x94\\xbd\\xcd\\xbfz\\x87\\xccf.\\xad\\xbc-\\x15j\\xbd+\\x10x.\\x07\\xccp\\x83\\xe1\\xbf!9\\x17\\xa7s\\xb8;\\x1b\\x05e\\x958p\\xc7\\xd7\\xc3\\x9fx\\xc0a\\x14\\xf2\\x15\\x92f\\xc2\\xe6\\x91)g3\\x87\\x98\\xfe\\xe6lt\\x08\\xd4;o\\xcf\\xf1\\xdab\\xda\\x921\\x03\\xd7v\\xa3<x;\n\\x1a\\x80q\\xe1`\\x8a\\xacvf\\\\x1c\\xa8\\x87\\xec\\xf1ft\\xdd\\xcc\\xc7\"\\x06\\x1dhb\\xcbwo\\x07s\\xafv\\xea-\\xc2\\xccm\\xa3=\\xea \\xe4\\xa3\\xd4\\xe4\\xda\\x97\\xae;d\\x924pw\\x148\\xc3a"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0n-\\xbe\\x9a\\xf1\\x0fc\\x9f\\xfav\\xc5\\x076\\\\x06\\xa2j\\xf3f\\xeb\\xefy\\xec\\x06\\xc6\\xca\\xdb\\xfb$\\xdf\\x9e\\xe9c>\\xa4'\\xd2z\\x15\\x80\\xf7\\x05$\\xdb@9\\x063a\\xd5\\xac\\x8a\\xf0u&du\\xafnt\\xddj\\x08qr\\xe2_\\xd4\\xf7f\\xa3zw\\xe9kj\\xc6\\xe26\\x01fs\\xed\\xc0\\xd2\\x99\\xe3\\xab\\x16.\\x86\\xe8|\\x91\\xfbc\\x9d\\x92\\xdexu\\x06\\x89\\xb2\\x8e\\xf7\\x89\\xcc:\\x9a\\x0e\\x8f1\\x04k\\x85$_9l\\x8ec\\xaf(\\xf5/\\x82\\x93\\xba\\x10\\xc1\\x13*@\\x18g,*\\x9a\\xd9f\\x1fr\\x93x\\x01\\xc1\t\\xca\\xc0\\xc0(ec\\x14\\xfb\\xd8\\xc7\\x943\\xc7\\x89gxj\\xbap\\x0f\\x8b\\x877\\x06p\\x85\\x1dk_\\x11\\x9a\\xfc\\xbf\\xcd\\xdd\\xec\\xe4\\xef\\x9a\\xc0(\\xcf\\xca\\xe9\\xf0\\xcd#\\x8ew\\xf6\\xfev\\xca\\x17\\xe0\\xaf\\x13\"\\x88\\xac\\xfb)\\xddux\\xb0\\xc2\\xf3ti\\x03\\xd9\\xac!\\xe2\\x9f(\\xbd\\xd12\\xaf\\x1ce)\\xaf\\xb3\\xbf\\x8d\\xc4\\xea\r*\\xe8q\\x0f\\xff\\xb5"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4c\\x9b|av%y\\x95\\x84\\xa5\\xef\\xb0b\\xc0l\\xfe\\x00\\xd7_\\xaf\\xc1p\\x8ec\\xc34\\s\\xaa\\x0b\\xd5w\\xa6cgz%\\xb1!\\xf6k\\xa4\\xb5)\\xba.)c\\xde\\x9b$\\xb45\\xfc\\xcb3\\xb8\".^\\xbc\\xab\\xdb\\x8b\\x97\\xb5\\xe78o\\x1b\\x12\\x1ac\\xb7n\\x94\\xf3\\xd2\\xb7\\xe5h\\x81b.j\\xf0z\\x8ax\\xde3h\\xbf\\xcf\\x9f3\\xe2&\\\\xa0\\x1bp\\x8f\\x94\\xf3\\xffg\\xce\\xfck\\xb6\\xcc\\xe9\\xa6\\x05\\x84\\xef?\\x1e\\xabu\\xdbo\\xffm\\x8b\\x08\\x88x\\xe0\\x83,\\xa7j\\xa6\\xef\\x01\\xc0\\xe8\\x90i\\x805\\xdd\\xb2@9j s\\xe1\\x8e)\\x18e\\x89\\xb7ys\\xa1\\xb3q\\xb72gm\\x7f.j`\\xe1\\xe2i\\xe2\\xfaf\\x9a\\xcc\\nn\\x06\\xb9\\x93\\xf4\\xc7\\x8d\\x90\\x0c\\xed\\x93.\\x9a\\xef\\xc3\\xc3|\\xe5\\xd1\\xa7\\x94\\xc2@pa\\xd1\\xact\\xac\\xc2\\x0f\\x8d\\xb6\\x89\\xe5\\x08\\xb1e.-.i\\xf8\\xd1!w\\xc6\\xf5\\xebwn$\\xdf\\x7fn_g$\\xd0c\r\\x85h\\xb7\\x959"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05\\xb25\\xbaw\\xd6\\x07\\x89\\xfex\\xc6q@\\x86\\xd4m \\xea\r*\\x16p\\xc9\\xf2x\\xba\\xfa\\!-\\x7f8\\x19v\\xf7.\\x92+\\x02l \\xf7\\xf5\n&\\x15)r\\xdd\\x19n\\x8e\\x08\\xbc\\xc1v\\x8c7i\\xa1\\xbe\\xa9zk8\\xed\\x12\\x1c\\x96\\xd8\\xf3u@w\\x881\\x9e\\x13\\x91t\\xf3\\xf4\\xe0n\\x12\\xc88\\xf5\\xb7\\x1en7t\\x9d\\xcd\\x04+\\xc7\\x8c\\x93\\x05\\x17\\xf9\\xc4l\\x07\ns\\xf7-a(\\x97^\\xf3%\\x11\\x9b\\xf0\\xb3\\xe6t\\x97\\x96\\x94\\x0fs\\xdc4\\x1ebn\\xb1\\x11\\xc9\\xf8s?\\x04\\x96\\xc7u2\\x94p\\xe0\\x10\\x94\\x92\\x9e\\xa0\\xee\\x16\\xf7\\x86\\xae\\x13s\\xf1\\xd2\\xf0\\xd5s\\x8e\\xe2\\xc8\t\\xd9eer\\xbb\\x8f\\x1d(?n\\xc2\\x80\\xfb\\xfe s\\xc2\\xd8\\xcb\\x93\\xfd\\xb8\\xdd\\x8bxjz\\xff\\xcf\\xc6e+c6\\xc3\\\\xc6\\x82\\xbc\\xa1xu\\xf4\\xab\\xa2\\x191k\\xe7\\xa3\\xf0\\xf2\\x19\\x92\\x92-\\xbf\\xa3\"th\\x93v\\xbcb\\xc1\\xa0\\xb9\\xae\\xc1\\xe4\\x96\\xdd\\x9d$\\x87%"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\x84\\x05r\r\\x9d\\xea\\x0bl\\xd9\\x02<wpq\r\\xe9\\x07\\x1a\\xfe\\x04\\x83\\x80\\xaa\\x12\\x1f\\x92pr@\\x0b;\\xdb_<\\xcb\\xf55\\xef\\xc0htti\\xd4&\\xf5dd\\xfe\\x83n>\\xaee*\\x89x&\\x16b>g\\x08\\xfc\\x92|\\\\x85tp\\xf9\\xf5h\\xd07\\xd5\\xd5\\x94\\xdb\\xb7\\xb5\\xa4f$\\xaa\\xf2'#w\\xd8\\x9d\\x82\\xab\\xa1\\xca\\x934e\\xee\\x89v\\x8a\\x03\\x85\\x02\\xca`\\xa6\\xa2'\\x1c\\x19 \\x05p\\xbd\\x94\\x17\\xf1\\xeb\\x08\\xde\\x92\\xbdtx\\x18\\x95\\x02nr\\x1d\\xea*\n\\xaf\\xc6\\xa7o$a\\xee\\x94\\xe90\\xfb\"_\\xa2cr\\xdc\\xe4\\x14\\xa4\\xd5\\xad\\x81\\x82t\\xb7\\xdax\\x17\\xda\\xc0\\x89<*\\xce\\xd2\\xd1\\xb0b8\\x99\\xe0?\\xf5\\xd2\\xfe\\xf9\\xd7\\xfd\\x81\\xf00b-\\x02\\xa1w\\xb6\\xb8h\\xa7\\xaf\\xba\\xc6\\xd6\\x84\\xf4&\\x9e\\xad% x\\xd4\\x1b5\\xb4\\xca\\x88\\xa1r8p\\xb1\\xdd\\x99\\x86q\\x9c\\xe1,&k\\x99\\xb4\\xe0\\xab\\xb2\\x93\\xa5\\xfdeu&\\xff\"o\\xb3^i\\x8d"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xba\\xd1\\x05\\xc74\\xa9l3\\x05k\\xc4\\x18`\\x8f6\\x9f\r\\x17\\x93#\\xbe\\xe3,\\xbb&g\\xde\\xe3\\x8c\\xaez\\x9cj\\x8c\\xce\\xf8dv\\xca7k?\\xcc4\\xdav\\x10\\x1e;\\xdbx\\xdf&\\x9b\\x12\\x0b\\xc6\\x00\\xce0e\\x10\\xa3\\x18\\x10\\x88d\\xa8u\\xfa\"wy\\xb8\\xfc\\xc2\\x8b\\x98~\\x99\\xc9\"j*@\\xf2\\xc5\\xb4\\x16\\x98m\\xb3\\xf3\\xc1b\\xd2\\xd1\\x00\\xe8<1\\xb9i\\x98~\\xb4vr\\xb4\\xa5\\xc6\\xfdi\\x0b&:\\xfaz=\\x01\\xc6\\xe0\\x1f\\xb0\\xf4%\\x08\\x8eyt\\x06\\xe9\\xcf1i\\xb1\\x80\\x97x\\x85\\x00\\xc1a\\x9c\\x12\\xc6qh\\x92\\xcb\\x97\\xaf?tz`,\\xdds\\xbe\\xb8\\xc5\\x96c\\xbc\\x83\\x1e\\xd1\\xf0b\\xb7\\x91x\\xfb\\xd6\\xd3\\x84f\\xe5\\xcaa-\\xf0\\xb7n\\xb8\\x84\\xfe\\xaa((`\\xd5\\x85\\xd0z\\xf9\\xdc\\x7f\\xac\\xf6\\xf38\\xa0\\x87\\x11\\x0b\\x19\\xa3r\\xa8o\\x86\\xec\\x12\\x13\\xd3f\\xc4%\\xf0\\xc7\\xefdj\\x15\\xae\\xc5h\\x02\\xfd\\x89\\xbb< \\xdd\\xefc\\xd3\\i\\xf2i\"\\\\x8d1\\xcb"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x02\\xf6\\xe9q\\xc0`s%)2\\x9e\\xa9\\x00\\xe1l\\xffnq\\x8er\\x02&52\\x16\\xe3\\xbc\\x92\\x97\\xee*y\\xbb^\\x9d\\xa5\\xee\\xb4\\x90\\x02`\\x86\\xd5\\x91\\xfe.a\\x8c\\xc9&x\\x9539\rv\\xa3\\x1d`\\x10\\x8f\\x01\\xecj\\xa3\\xbe\\x86>\\xde\\xec-v=-,ml\\x82l\\xc8\\x8e=\\x18\\x8e\\x04y\\x10\\x0fnape\\xb1\\xd7\\xd3\\xa0\\xa2\\xfd)\\xad\\x04\\x8aq\\xd1\\xe3\\x85\\x07\n\\xdf\\xb0h\\x04:yq\\xe6s\\x0f\\x90\r6\\xbbx4\\xfdr\\xc8\\xe0\\x06\\xcb\\x8e8':'\\x89a\\x04\\xaf\\xb3\\xb9\\x86\\x95-\\x14\\xc3\\x85l\\xbb\\xdb\\xad6\\x9d\\xeen\\x97\\xcb\\x10\\x868\\x80\\xe6\r\\x0812vq!ef\\xe4\\xd0-t)\\xe2*\\x87\\x91\\x99y<.\\xa5yb`e\\x96\\xc6\\x06\\xa7\\x92\\xe2\\xf1a\\xcah^5\\xe8613|f%\\x8e\\xa3\\xc6j\\xcb\\x9c\\xd1\\xae\\xe8\\xf3va\\x8a\\x94\\x86q\\x96y\\xfb\\xad\\x82r\\x0c\\x98\\x11\\x7f\\xb6\"\\xc2\\x1a\\xaa\\xe7-\\xbf"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe\n\\x95$\\xb8\\x8cp\\xebt\\xcc\\xf7\\x95$vy$o^\\xde@\\x84\\x7f\\xce\\xa4\\xe3\\x04w\\xef\\xf7\\xbb\\x8c2\\xb3g\\x0f\\x83(\\xe43+\\xae\\x04\\x97\\xef\\xc9\\x12\\xc6\\xf0\\x03\\x8a\\x1c\tb\\\\x9b:\t\\xc7i\\x80ewi\\\\xccr\\x19q+?\\x9e\\x8f\\x81\\xe7\\xd1~\\xa0\\x8f\\x89\\xe5\\xe0\\x85f\\xad\\xbc\t\\xf4\\x9f\\xdf\\x07\\xcc-s\\x8a\\xd7\\x98\\xc1#l\\x8f\\xe53p\\xb7\\xb3\\xbd\\x18a\\xae\\x95\\x9d\\xcd\\xa6xj\\xf3vzp\\xc3\\xe1r\\xc0\\xd4)\\xa2\\x01\\x0c\\x90\\xe5\\xebno\\xc7_+o\\xfb'\\xa33\r\\x88\\x9a/\\xcdsj\\xed\\x99\\xc1_\\xfa\\x9f\\x86:\\xc4\\x7f\\xaf\\x9a\\x02\\xa78r\\xc4\\xadn&\\xb6vj'\\xd5\"54\\x19q\\xa7\\x18>\\x96\\xa9\\x8f\\x1b\\x1b\\xab\\xe2\\xfef\\xf3\\x82>\\x9f\\xc3\\xf0\\xc1\\xccq\\xa9\\x99`\\x19\\xcc\\x8ct\\xe7\\x04>2\\xf6a\\x9c\\xa2\\x05\\x1e\\xa3\\x91&s\\xcbp\\x88_\\xd5\\x11v`q4\\xea_\\x91q\\x8f\\x9e\\xd8\\xec\\x15\\x06\\xb9h\\xb5\\xe3\\x1d"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3\\xc7\\x0e\\xdd\\x8d\\xd6*t\\xd5\\xe4\\x94m\\x9c\\xf2\\xaf%\\xda*\\x13\\xc7\\xdf\\xec\\x8d\\xe8\"\"\\xea\\xc8*a\\x9dvbd\\xb7f\\xcc\\xc8z\\x13$\\x14\\x14\\xb5\\xff\\x02&\\xb4\\xfe\\x96\\xf3\\x99v\\xf0\\xec\\xfa\\xcc\\xecds\\xd4s\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i(\\x08\\xdf\\x14%aj\\xae~\\x83q_\\x10\\xd6km\\x05\\xa2w\\xca0\\x1d3\\x84\\xb8f?\\xfa1\\xdb\\x89:\\x15;\\xf0\\xd5p\\xab-\\xab\\x933\\x93\\x00\\x8f("
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86~\\xb9\\xb532\\xfa3\\x92\\xc5d\\x8ck>\\xc5:\\x1ci\\x9f\"\\xb9\\xec\\xce\\xd0\\xe3y\\x94.u\\xa5z\\x04 \\xa9t1\\xb6c\\x92\\x94 >\\xe8j\\xc2v\\xe4\\x89\\xbc\\xe8|8\\x0b\\xec\\x08\\xdb\\xbe\\x12n\\xe3t&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000d\\xb9\\xb1\\x1c\\xbe\\x92q0\\xbf\\xe2j\\x02\\xcd\\xe8\\x82\\xc8~\\x93\\xa8\\x1d\\xc2>\\x07\\x91\\x80\\x9b\\xce\\xc4\\xbf\\xcc\\x91\\x86\\xeb9\\xbcb\\x04\\x00\\xf6\\xe8\\xae\\x86c\\xde\\x1d\\x19"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xeb\\xdd\\x02\\xb1w\\x8b'\\xa8\\x92\\xea\\x94\\xf1\\xcfqx\\xd1\\xf7\\xd3\\xb8\\x08\\xc8\\xd8\\xc8\\xda\\xf7x\\xf0\\xb19\\xc3\\x0b>^\\xd4y\\x95\\xe2\\x10\\xa3m\\xce\\x84\\xf8-\\x1d\\x94\\xdcs\\xb7\\x91r\\xe8\\xb1\\x98\\xdb\\xb9\\xe61\\xd5\\xc5>\\xc9\\x15+x\\xf9b\"+0-%\n\\x19\\xfd\\xdc\\x0e*\\x8b\\xc6\\xd2\\xf7\\xc7\\xbcs\\x02\\xd5\\x17\\xb4\\xe7\\xa22\\xf3\\x04u\\xa9\\x06\\xf5\\x154\\xf9\\xc76\\x92\\x97\\xd0\\x10,\\xbf\\xc9f\\xe3\\x01i\\xa3\\x91\\x0ba%\\x8cj\\xbdi\\xc8b\\xedh\\xb9\\xe8\\xde\\xe3kw\\x99\\xfb\\xd4d4\\x14\\x92e\\xe3\\xfe \\xd1\\x14\\xac<\\xfe\\xfe\\xe5\\xe6\\xae\\xee\\xc8\\x92\\xd0k\\x81\\x94v\\xa7iu\\xde\\xaf \\xf4\\xabe\\xfa\\xf1\\x00n\\xd2k\\xc5\\x11\\xc9g\\x01?:w\\x02\\x98\\xd2>\\x16\\xb3\\xc8r)z\\xb5\\xebug\\xe7\\xc1sy`w\\x80\\xc9\rn\\xebx h\\xc9\\x02\\xae\\x18\\xc4\\xe9\\xe5\\x97\\xc9x/<+\\xaf\\xcb\\x8b>\\xe3v\\xc3\n\\xc4\\xeb\\xcd\\xfb\\xbe\\xd8\\xe1\\xef\\xed"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8/\\xc8|\\x11\\xeb\\xcbd\\xe8\\xd9\\xe8\\x02\\xe3\\xa7\\xa65j\\xb78v\\x12*\\xbf\\xd6p\\xfc\\xcd\\x98\\x95ttv\\xe0\\xe1\\x02\\x9at\\x07r\\x16t_|\\xdavr\\x95\\xaf\\xdc\\xafe\\xf3\\xfa\\x05\\x9b\\x0e\\xb4)\\xcai\\x85l\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1h\\x0cbq\\xd2\\xdej\\x06\\x8b\\xd8a\\xf8g\\xa0\\x8ev\\xaeyf\\xe0l\\xb4\\x8a2\\xdc\\xe2ai\\xfd\\x90\\x1db\\x97\\x87\\x90\\xc4.\\x10\\xbd\\xd0\\xb7\\xd5a\\x08\\x11w"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf)nj\\xe5\\xbcqi0\\xca\\xc8\\x8cl0\\x0f\\xafs\\xe7k\\xb69\\xc0\\x9a\\x13\\xd9\\xa8`'\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf)%\\xdf%g\\xcf\\xf2\\x8c\\x8b<\\x1c\\xdf\\x1d+/e\\x8d~h\\xbb\\xc3s\\x8b\\xa1\\xd6s\\xb9\\xf8\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf)z\\x1f\\x9c\\xb3cg\\xe1\\x9f\\x96\\xd1c\\x91!\\xa7\\xef\\x1b|\\x7f\\xfc\\xe4\\xe1\\x91\\xc4\\x1c\\xb5b\\xff\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\x7f\\xfai\\x99\\x13\\x12b\\x8ee\\x11\\x0f\n\\x01t\\x05$\\xb8\\xfb\\xb0hly\\xb0\\xc9\\xa0\\x1e\\xda\\xf0*\\x07l\\xb3\\xe90xl\\xe2s4\\xb0\\xd8\\xb2\\x0f\\x1f\\x1a9\\x9a\\xc4a\\x94\\xa4\\xb1\\x04\\xf9xl\\xb4\\xc6^\\xbc\\xc1\\x8d$\\xdc\\xdeff\\xa2\\x99\\x96\\xf1\\x02\\xc2%ba\\xca4\\x1f\\xed\\xc2\\x97\\x9csg\\x80\\x9fmv\\x98w\\x9c\\xcf\\xee\\xa8\\x88\\x82\\xb7$\\x93\\x01!\\xa8;\\xae\\xab\\x89_oz8\\xc2k\\xef.\\xca#b\\x1e\\x16=\\x1bw\\xcbm\\xae\\x895\\x8a\\xb54\\x10\\x98\\xa7\\xa8\\xd7b\\xbc\\xf3i\t\\x00\\x1a\\xffd\\xd1\\xa7\\x9e|z\\x96\\xec\\xe5\\x96pm6\\xca\\x0b>6\\xefilf\\xcbs\\xecf\\x83\\xd4y\\x11\\xfdb\\xc9\\xb7\\xebr\\x9ec\\xfc\\xf3%\\x9d.bt\\x1d\\x86&92\\xf4\\xa7\\xed\"p\\x84\\xe5\\xbeb\\xd8\\xf8s\\xe9\\x8d61w\\x94\\xcdp$a\\xd7?t\\x81\\x9df\\x02\\xbb\\x11j\\x95\\xd4\\x19z3\\x1b\n\\x14\\q\\xdd\\xe4o\\xe3`\\xda\\xdd\\xb8v"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\x809\\xe4n&\\x17\\xdd\\xff\\xeb\\x013\\x91\\xa7f\\xee\\xa6k\\xead\\xb8a\\xa0\\x9f\\xd9\\xb2\\x0brn\\x01\\x9b\\xf4\\x80\\xffb\\xc8\\x0c\\x18\\xbaj\\xf8zs`\\xbb\\x8ct\\x17\\x89\\x9ei\\xce\\xea\\x1bc$\\x95\\xec\\xe9\\x1c\\x80m\\xc5\\xea4\\xa7\\x82\\xae\\x97`\\x82\\x19\"d\\x16o\\x89\\xfak|\\xa6\\xc6\\xbb\\xeb\\xb6\\xbam\\xd1\\xe3'p7v\\xa6_ 8b\\xde\\xf3j\\xb1\\x03,\\xd7@!\\\\xac\\x8c|\"u\\xd2*\t\\x8b\\x15$\\xa7\\xe7\\xfcj\\x91\\xb1\\xeb\\x0c\\x03\\xa4\\xa5\\xcc\\xd4z\\xb4y\\xbc\\xf3\\x86\\x96\\xc1\\xaf3\\xe5\\xeb\\xdf\\x050&\\xec\\xaf\\xcc\\xb0\\xc6@\\xa4\\xf4z\\x89h\\xda\\xdcv\\xcc\\xa1\\x8e\\x13\\x94r\\xf7>@-\\xa8z\\x83f\\x07\\x8f\\xe9m\\xd6\\xa7\\x14\\x08\\x06\\x9e\\x15~\\xfb\\x1cr\\xf5\\x1bi\\x83\\xbds\\x19.z\\x89\\xd2=\\xc6i\\x12a\\xd1\\xb5\\x10ut\\x1ey\\x04\\xf5x\\x18*\\xd0\\xf9\\xb1u\\xf1\\x07\\x9f\\x13.\\xa8\\xfc\\x07\\xd1\\xc6\\xb2\\x87\\x18\\x89\\x001\\xba&z\\xdc\\xfe\\xfa\\xb3"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\\\xee\\x8c\\x10\\x14\\xa1_\\75i\\xc8\\xce$\"\\xe3^u\\xe0\\x9f\\x8d\\xf3\\x9a\\xf12\\xe4\\x93+\\x0b1\\xb0v\\xd8\\xae\\x9f\\xdc\\xc34~'&\\xe6\\xb7c\\xbb\\xf0\\xc4m\\xb3\\x8azpbe\\x90\\xc45)\\xa8\\xfc\\xec\\xdde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nt\\xf3.\\xf0y\\xcf\\xd3\\x96\\x02\\xef\\xd17\\x99\\x984\\xcf\\xfb\\xcb\\xf1cm\\xad\\xe6\\xea\\xb5w\\xd8\\xa7p\\xff\\xfd\\x98\\xac4\\xc1#x\\x94av\\x9evs\\xdawpi"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>kx\\x94b\\xba\\xb1\\x1b:\\xff_z\\x88\n_\\xcd\\x8eq\\xa1-\\xf1\\x93\\x12-!\\xe7\\x96\\x87\\xff\\xfd\\x14h\\x10\\x8f\\x89\\xccp\\xf1\\x8e\\xb3\\xa6n\\x14\\x1e\\xa4\\xd6\\x8c\\x19\\xd4\\xce\\x94\\x12h\\xafh\\xbe\\x82\\xab\\x7f?\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\x8azq4a\\x0f\\xd2\\xde\\x81hp\\x15\\xdd\\x10jn\\x11\\xd9\\xad;x\\xc2\\xa8\\x1d\\xca\\xfd\\x8c\\xd7\\xf3\\xfbo\\x9d \\xfeu\\x82\\x7f9t\\x99\\xbe,\\x16\\xdb9"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8p~n\\x08(p\\xf3\\xf7\\xeem\\x0f9\\x88o\\xa0=\\xbd\\xdc\\xa9\\x1f\"\\xaf\\x9f\\\\xa9\\xf4\\xa8(\t\r\\x98\\x05\\x85\\x0f\\x02f\\x10\\xf1\\x0ef\\x0b7\\xe2\\xb1p\\xe5:)\\x12\\xcb\ryw\\xe2z1\\\r\\xbed\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\xaf\\xec8z\\xab\\xe7\\xb2/\\xb2\\xb4u\\xd7=\\xadr\\xfab\\xa7\\xd4\\x1c\\xfaj\\xe3\\x19\\x1d\\xd8y\\xe9\\xadl\\xf9\\xce9z\\x99\\x1ds\\x00/\\x94qg!\\x8c:\\xf0"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"\\x89\\xbfz\\x85u\\xd4n\\xdf\\x94\\xe5$\t\\xe3\\xb2\\xd1\\x13>w\\xa6i\\xf9\\xd8\\xa7\\xeat>\\xdc\\x97m\\xd3\\xe7\\\\xdd=,\\x80x\\xb7*\\x0f!\\xc1\\x98\\xe1\\xfc\\xb6\\xe1\\x8c\\xd5\\x94\\x02\\x0f\\x80ob41d\\xceg9\\xe6\\x03s\\x8b\\xa9>k=\\x18\\xb6\\x1c\\xf1c\\x02\\xf9\\xbe*\\x9e\\x12pfl\\xb4\\xf9\\xc8t\\x03\\x9fhd\\x13f4?\"\\xe2\\x1d5v\\xe0\\xd8\\x99\\xe6\\xb2o&\\xeek\\xb3\\xbe\\xc6\\xd6\\xea\\x8c7\\x01\\x9be\\xe1\\x9a/\\xe9\\xb9\\x91\\x01\\xab\\x9d\\xa7\\x99\\xcd\\xd67\\xe4\\xdc?\\xb5\\x95d\\x8c\\xee\\xa1\\xaf\\x0e\\xa0z\\xc2xj<\\x02c\\xfc\\xa2\\xd3`\\xb8\\xae\\x7f\\x9dd\\xcbs\\xab\\x8e\\xe3\\x0b\r\\xab*\\xc9`\\xadq\\xa4\\xa1\\xfb\\xc5\\xe6\\x08x\\xcb(_\\xd5r\\xef\\xdc\\xc0\\xe4\\x99\\xfa\\xc7\\xd0;\\x0f\\xa9\\xf6ij\\x95\\xfd8\\xac\\xce\\xae\\x89\")\\x88)\n\\x02\\xe2'\\x17\\xb7\\xf8\\xe1?1\\x92z\\xaf\\xb1\\xa8\\xa5\\xf5o'\\x94f\\x08*\\xf1\\x18%u\\x87gz|\\x14\\xb9\\xe5'"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\xb1q\\xe9c\\x80c\\xe6\\xd8\\xe8\\xd1bw%\\xba\\xd3\\xadp/\\xb6\\x9fy\\x05=h>n\\xd5\\xa7t^tz\\x0c\\xb0\\x9e@ e\\xed\\xa2)\\xdf<\\xaa\\xb5\\xd0/\\xed\\x8b\\\\x16\\xfd\\xfai\\x13p\\x82\\x93\\xb3u=\\xbf\\xfc\\xc0\\xe0\\xf1\\x98\\xcf\\xa5\\xe5va\\xa2\\xe7\\x82ip\\x8begq\\xd0mw\\x97\\xb2 \\xaa\\xcfac\\xbe\\x92r\\xc2\\xc5\\xdf\\xc6@\\xc1>\\xb9f'\\x8b\\x06\\xd0\\xb4\\xee\\xd0\\x01\\xc0\\xff\\xb9\\xd2\\xf4\\xca\\xeb\"\\xd1+w\\xab\\xf9wwgfp\\x01>&r\\x8c\\xf4\\xb7\\x04\\x87\\xbd/\\xe2\\xfcf\\xa4\\x8e\\x11\\xd1r\\x9c>7\\xe4v>\\xbf\\x18c\\xa1\\x06\\xc1\\xa8\\xb0\\xacc\\x1a\\x80\\xfb8\\x8f\\xcd8\\x0es\\x17kd\\xd7;q$\\xe4f\\xdf\\xd7\\xcf\\xc7\\x80\\xd5\\xac\\x0c\\x8c(x\\x06\\xd8\\x83(n\\xcd.\\xdc\\xf1\\xee\\x991\\x9b\\xa6\\xc2\\xc6e\\x8dl\\xf5\\xa81\\x8a\\xd0\\x8e>-\\x16\\xc4\\xbc\\x9a9\\xa29b\\xe3o\\xf6zv0\\67\\x84t>\\xd1\\xfa\\x96\\xe4\\x15sm"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xb47\\x07k\\xfa;~o\\xe0,v\\xb5\\x99\\xcan\\xbaka\\xe8\\x97\\xe3\\x07\\xe1\\x0c\\x94\\x88\\xf1\\xd9\\xd3\\xd4p<g?\\xb64\\xaf\\x0b\\xf9\\xef\\xb4\\xd2\\xad\"$rf2\\xc63\\x90y\\xbd\\xa4jm.\\xbe\\xa4%\\xf7\\xd7z\\x1fn\\xb1j(\\x8d\\xd9\\x94`\\x06=\\x9d\\xf0\r\\xfb\\x14\\xd1nwxv\\x19\\xba\\x13\\xad\\x1e\\xcdp\\xd7\\x17\\xce\\xb1\\xce?\\xbbds\\xa7\\xa1\\x87o\\xb2\\x1cjdx\\xab\\xbabo\\xda\\xb0\r\\xd6\\x93q\\x19\\xd0\\x8a\\xe7>|\\xec\\x07o\\xc0\\x03\\xb6=l6\t\\x1b(e\\x16\\xb3\\x83\\x9b\\xd0\\xd5\\xf7\\x0fc\\x1b\\xa1s\\xe8s\\xe9g\\x97\ta\\xaamh\\x83\\x88 \\xd1\\x14\\x83g;\\xfb\\xd5\\xa8u\\xdecn\\xc5\\xfc\\x1ev\\x11jwv\\x9f2\\x13\\x87ni\\x89\\xac\\xa8\\xd1\\xdamji\\xa7f\\x80\\x80\\xb00ski\\xffrc\\x16\\xd7\\xd2\\x1f\\x90\\xb1\\xcet\\xcd\\x81`\\xf1iki\n:p5\\x06\\x16\\x96\\x9f<\\xd7y\\x00v\\xcdd\\xfb\\xcb(\\xc5\\xd7`\\x15\""
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ej\t\"\\x89<\\xfew\\xe2\\xb1\\x81\\xc8\\x8d\\x045\\xed\\xd7\\x81\\xdb\\x83\\x80\\x0f\\xfc\\xb0\\x87\\xb7\\\\xcd\\x15\\x9e\\x11\\xeb j\\x9f\\xc4l\\x13\\xcc\\x8d\\x1e\\xd4\\x7f\\x1e\\x89<\\xb4\\xe9\\x89^\\xb2\\x1b !\\xb1\\xac\\xab\\x8coly\\xf0\\xb8\\xae\\xe7bl\\xa5\\xef1\\xb2\n\\x89\\x80\\xe4\\xbc\\x87u\\xfd\\xa4\\xb9?\\x07\\xd6\\x97\\xce\\x19\\xc0 \\x87\\x01\\xa2\\xa7\\x83\\xfct\\x12\\x0c-8:\\x01\\xe42\n\\xe9\\x8f\\x05\\xfbg\\xdb\\xa3\\x93\\xb2cs\\x8c\n\\xa7?%\\x1d2\\xfa\\xfe|c/\\x8a\\x90\\xaa\\xaaq\\xb7`#\\xe4\\xb9\\x19\\x7fd\\xd3z_\\xe7\\xcbo\\x08>\\xfa\\xba\\xb5\\xdb\t,\\xb3\\\\x1e\\xfb\\x1b\\xea?m/\\xcd\\x7f#dh\\xfc\\x81\\x0f\\x9ff4\\xa5\\x89\\xc9\\x84f\\xbc\\xe2\\xe9\\xa3`\\xb4/s\\xf9\\xec\\xd9\\xf4j\\x08\\x96\\x83i\\x88\\xc1\\xc8\\x83\\xf5\\xdd\\xc8 zc\\xf8\\xa2\\xca\\x12\\xcdb\\xca\\xc2#\\xca<\\xbe\\xbc7\\x83y\\xc1\\xfa\\xda\\x0ci\\xbd\\x95on\\xe9~\\xde\\xb8hv~~\\x96\\xb4j.\\x1e"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf*\\x82\\xd9y\\xbat)\\x10\\x10\\xff\\xd6\\xa68\\xca:1/\\x01\\xc5s\\xaa@\\xdf\\xe2\\x97uh\\xd45\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc\\x0b\\xae\\x8b\\xf8\\xa4e\\xa2k\\x1dl\\xbd\\x9b\\x97\\xf1\\xfa\\xc2\\x9b\\x9b0\\xbd\\x8c\\xc5\\x1c\\x91\\xc1\\xc98\\x11\\xd5r\\x14\\xf2'\\xa2\\x9f\\xaa\\x10f\\xe5\\x17\\xf5\\xbd\\x87\\x10>\\x85\\xef\\xf2g\\xf5=\\xcc36\\xe3\\xee7\\xe7\\xd1\\xb9y\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\xdc-n\\xday\\xd7.\\xfa\\x14\\x16xe\\xdci\\x01.\\xb1\\xd0o\\x94r@\\xbd\\xa3i\\xae\\xf2z\\xd5w\\xfc\\xfb^t\\x85rh\\xeb\\xfd\\x18\\x836e\\x06"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01\\xdf*\\xdd\\xaf\\xb1\\xa1\\xd6\\xf7\\xd8\\xe7\\x18(\\xc2\\x85\\xb6\\x82\\\\x97\\x929\\x0f.n.i\\x97\\x9b$f\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8\\\\xff\\x1f\\xe1|\\xb2=\\xce\\x14n\\xacni\\xb6\\x14s*\\xa1i\\xdaw\\x8e\\xf5\\x11\\x8c\\xfb \\xefzf\\xf3\\xca\\xbb \\x16\\x01\\xea\\xdf\\x083\\x17b\\xdb\\xa5\\xaa\\xab\\x92ss\\xa5\\xa2\\x17\\x07\\xad4\\xff\\xfd+\\x0c\\xe6\\x05\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99?\\xec\\xf0\\xc5\\xc3=\\xc4\\x83\\x87\\x96\\xd4\\xe6\\x11\\xa5\\xb0^\\x8av\\xf2$\\x8fnu\\x15\\x88\\x08\\xd6\\xe1\\xd3\\xae\\x99y\\xd6\\x91\\x96k\t\\x9f\\xafb7\\xc6i/\\x9at\\xf4"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xbd\\xea\\xa4\\x13n\\xdd\\xc4\\xd4\\xb4\\x99\t\\x19\\x95\\xe26y\\x99\\xa5\\x02\\xc7>\\x0e\\x93\\xec\\xe0bk\\xb1\\x8e<\\xb8-k\\xa8\\x83\\xa9\\xcc\\x10\\xeca\\xd8\\xbf\\xa3\\xc6\\xfb,\\xc5kt\\x81\\xde\\x05\\x86v\\xc5\\xe5s\\x96\\x05\\x1f\\x06\\x1bqy%\\xcek\\xeb\\xe0\\x9a\\x16\\x92/\\xd4\\xe9\\xa9@\\xb9f@\\x9d\\x90\\xbac\\x8f9\\xfd\\x92msz\\x7f$>\\xf3h\\xb1\\x0e&l\\x1602d\\xbe\\xf7b\\xa0\\xeb\\xf2\\xa2\\xde\\xa8\\xb8\\x98\\xee\\\\x1cck\\xc5*\\xf0\\x8fx\\x9f\\x0b\\xcf\\xbe\\x8b\\x04m\\xf7\\xce\\x86\\xf0\\xe6\\x85o\\xcer\\xc9~\\xb7\\x04\\x13g\\xd1kefns\\x058\\xedy\\x16\\x8ci\\xaa_\\x85\\x8a\\xf4\\xce6u\\xb3\\xe1\\xcd\\x81\\xf6\\xe9 \\x8bt(7\\x85<\\xc3\\xce\\x98\\xe2\\x19g\\x8b\\xcc\\x9e&\\xf8\\xa7d\\x829\\xe2\\xa5\\xfd\\x00\\xdf\\xd3\\xc5q\\x18\\xc8r\\x88\\xb9\\xaa\\x8b\\x896\\xbf\\xaa\\x96\\x84\\xf4\\xe4\\x95\\x14f~\\x9a'\\xf1k#\\x8f\\x7f_y\\xd1\\x83\\xf8\\xa2\\x13\\xc3\\x93d;\\xc2\\x86\\xd1"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`e\\x8f\\x9a5\\xfd=g\\xbf\\xeab\\xf6\\xae\\x16\\xed\\x19/n*d\\xbd\\x15\\xcf\\xa4\\x1a\\xed\\x9as\\x96\\x9d\"iod7\\x17\\x9a2\\x86w\\x84-\\xe3\\x84\\\\xc1\\x90\\x9b5\\xc7j\\xae\\xf82a\\xd2\\x8a\\x9e\\xc0\\x07\\xcc\\xb0x\\xc0i\\xdav.nzyk\\xc4\\x14\\xf1\\xe5\\x8c#k\\xb9\\x0b\\x87\\xee\\xff\\x0b\\x86\\xcc\\xaf\\xdf\\xa7\\xaaq\\xad\\xee\\xa2t\\xf1\\xf3u1 \\xa8ol\\xe2\\x0e\\xc7*\\xbb\\x9a\\xa5\\xc3\\xe2\\x7fu|\\x0ck\\x07\\xe3\\xd2wf\\x15\\x88\\xc30\\x16\\x88yv\\x82wh\\xda\\x803\\xf4%\\xeb\\x94\\x93\\xdc/\\xbd\\xa7\\x8b~\\xe1,qd\\xcegc\\xa6r\\xb0\\x88\\xb5\\x8dksn\\x0b\\xafas!`1\\x17\\xd1\\x04\\xa3\\xdf\\x005\\xf9\\xfa\\xcb34\\xc3\\xbc\\xbe\\xbbl\\xa3\\xf1\\xb5\\xa0\\x16f\\xaf\\xc4\\xc1\\xa4\\x81\\xec\\x9d\\xdd\\xba\\xfe \\xd8t\\x01\\xdd\\x17\\x1br\\xc9/\\xb6xx\\x92\\xd6l\\xbe\\x1bttx\\xc6\\xbf\\x85\\xef\\xac\\x99\\x8ay\\x1b\\xcc\\xfc\\xf3w\\xf6\\xfb\\x1b\\x90\\xb0\\xca\\x9e\\xf44"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: tue, 06 aug 2019 05:01:25 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  677.  
  678.  
  679.  
  680.  
  681. "Description": "Creates a hidden or system file",
  682. "Details":
  683.  
  684. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_d1da9815230c9091d9b7fed1a2d9b753.html_q_mJ2Xxgp"
  685.  
  686.  
  687. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  688.  
  689.  
  690. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0004.tmp"
  691.  
  692.  
  693.  
  694.  
  695. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  696. "Details":
  697.  
  698. "MicroWorld-eScan": "W97M.ShellCode.A"
  699.  
  700.  
  701. "CAT-QuickHeal": "W97M.Donoff.B"
  702.  
  703.  
  704. "McAfee": "RDN/Generic Downloader.x"
  705.  
  706.  
  707. "AegisLab": "Trojan.Script.Generic.a!c"
  708.  
  709.  
  710. "Baidu": "VBA.Trojan-Downloader.Agent.cez"
  711.  
  712.  
  713. "F-Prot": "New or modified W97M/ShellCode"
  714.  
  715.  
  716. "Symantec": "W97M.Downloader"
  717.  
  718.  
  719. "ESET-NOD32": "VBA/Kryptik.C"
  720.  
  721.  
  722. "Avast": "VBA:Dridex-P Trj"
  723.  
  724.  
  725. "ClamAV": "Doc.Macro.Injection-6355574-0"
  726.  
  727.  
  728. "GData": "W97M.ShellCode.A"
  729.  
  730.  
  731. "Kaspersky": "HEUR:Trojan-Downloader.Script.Generic"
  732.  
  733.  
  734. "BitDefender": "W97M.ShellCode.A"
  735.  
  736.  
  737. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  738.  
  739.  
  740. "Endgame": "malicious (high confidence)"
  741.  
  742.  
  743. "Sophos": "Troj/VbShlCde-A"
  744.  
  745.  
  746. "Comodo": "TrojWare.VBS.Crypt.BN@8aystx"
  747.  
  748.  
  749. "F-Secure": "Heuristic.HEUR/Macro.Downloader.PATA.Gen"
  750.  
  751.  
  752. "DrWeb": "W97M.DownLoader.631"
  753.  
  754.  
  755. "McAfee-GW-Edition": "BehavesLike.Dropper.dg"
  756.  
  757.  
  758. "FireEye": "W97M.ShellCode.A"
  759.  
  760.  
  761. "Emsisoft": "W97M.ShellCode.A (B)"
  762.  
  763.  
  764. "SentinelOne": "DFI - Suspicious OLE"
  765.  
  766.  
  767. "Cyren": "W97M/ShellCode"
  768.  
  769.  
  770. "Avira": "HEUR/Macro.Downloader.PATA.Gen"
  771.  
  772.  
  773. "Antiy-AVL": "Trojan/Script.Agent.gen"
  774.  
  775.  
  776. "Arcabit": "W97M.ShellCode.A"
  777.  
  778.  
  779. "ZoneAlarm": "HEUR:Trojan-Downloader.Script.Generic"
  780.  
  781.  
  782. "Microsoft": "TrojanDownloader:O97M/Bartallex.AA"
  783.  
  784.  
  785. "AhnLab-V3": "VBA/Downloader.S12"
  786.  
  787.  
  788. "ALYac": "W97M.ShellCode.A"
  789.  
  790.  
  791. "Ad-Aware": "W97M.ShellCode.A"
  792.  
  793.  
  794. "Rising": "Macro.Agent.bn (CLASSIC)"
  795.  
  796.  
  797. "Ikarus": "Trojan.VBA.Crypt"
  798.  
  799.  
  800. "Fortinet": "VBA/Kryptik.AL!tr"
  801.  
  802.  
  803. "AVG": "VBA:Dridex-P Trj"
  804.  
  805.  
  806. "Qihoo-360": "heur.macro.download.1d"
  807.  
  808.  
  809.  
  810.  
  811. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  812. "Details":
  813.  
  814. "target": "clamav:Doc.Macro.Injection-6355574-0, sha256:39dfb59bfdc599071a3990c1eafbb018e578e7caaadfd8492639a2783fd8b32e, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Pen Test, Template: Normal, Last Saved By: Pen Test, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Thu Jun 13 19:02:00 2019, Last Saved Time/Date: Thu Jun 13 19:02:00 2019, Number of Pages: 9, Number of Words: 3515, Number of Characters: 20042, Security: 0"
  815.  
  816.  
  817. "dropped": "clamav:Doc.Macro.Injection-6355574-0, sha256:39dfb59bfdc599071a3990c1eafbb018e578e7caaadfd8492639a2783fd8b32e , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0004.tmp, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Pen Test, Template: Normal, Last Saved By: Pen Test, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Thu Jun 13 19:02:00 2019, Last Saved Time/Date: Thu Jun 13 19:02:00 2019, Number of Pages: 9, Number of Words: 3515, Number of Characters: 20042, Security: 0"
  818.  
  819.  
  820. "dropped": "clamav:Doc.Macro.Injection-6355574-0, sha256:665a5924d6f5e798e4073c11dbd38a9e9695a2c026b223a4adb6173a135a6b95 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_d1da9815230c9091d9b7fed1a2d9b753.html_q_mJ2Xxgp, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Pen Test, Template: Normal.dotm, Last Saved By: user, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 06:08:00, Create Time/Date: Thu Jun 13 22:02:00 2019, Last Saved Time/Date: Tue Aug 20 23:03:00 2019, Number of Pages: 9, Number of Words: 3514, Number of Characters: 20034, Security: 0"
  821.  
  822.  
  823. "dropped": "clamav:Doc.Macro.Injection-6355574-0, sha256:78e2c511573ac4ba53e20ae599dedd799ae453c6b04bff312ab923e7bf3b3245 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRA0005.wbk, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Pen Test, Template: Normal.dotm, Last Saved By: Pen Test, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Thu Jun 13 22:02:00 2019, Last Saved Time/Date: Thu Jun 13 22:02:00 2019, Number of Pages: 3, Number of Words: 3514, Number of Characters: 20034, Security: 0"
  824.  
  825.  
  826.  
  827.  
  828. "Description": "Martian Subprocess Started By Office Process",
  829. "Details":
  830.  
  831. "office_martian": "c:\\windows\\syswow64\\rundll32.exe"
  832.  
  833.  
  834.  
  835.  
  836. "Description": "The office file created a suspicious child process.",
  837. "Details":
  838.  
  839. "Processes": "WINWORD.EXE -> splwow64.exe"
  840.  
  841.  
  842. "Processes": "WINWORD.EXE -> rundll32.exe"
  843.  
  844.  
  845.  
  846.  
  847.  
  848. * Started Service:
  849. "osppsvc"
  850.  
  851.  
  852. * Mutexes:
  853. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  854. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  855. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  856. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  857. "Local\\WinSpl64To32Mutex_1cec0_0_3000",
  858. "CicLoadWinStaWinSta0",
  859. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  860. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  861. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  862. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  863. "Local\\!IETld!Mutex"
  864.  
  865.  
  866. * Modified Files:
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_d1da9815230c9091d9b7fed1a2d9b753.html_q_mJ2Xxgp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF012B6AB598BDF49D.TMP",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_d1da9815230c9091d9b7fed1a2d9b753.html_q_mJ2Xxgp",
  870. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  871. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS7C2CA4F2-8740-4F82-BBC4-24897775058C.tmp",
  872. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  873. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  874. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  875. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEF58.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEF59.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFD980F73B-75CC-4A06-B264-5B9B5DCA9E6C.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd",
  880. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\CE1C8AF3.wmf",
  881. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\688AE058.wmf",
  882. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_d1da9815230c9091d9b7fed1a2d9b753.asd",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9D733C8D84101573.TMP",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab17C1.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1801.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1821.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1832.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1842.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18A1.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18B2.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18E2.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F3.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18E3.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F5.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F4.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1925.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1926.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1938.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1937.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1958.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1959.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1989.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19F7.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A96.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AC5.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AC6.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A46.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AD7.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B07.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B66.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B86.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B87.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C26.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C05.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C06.tmp",
  920. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  921. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D9E.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E4B.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1F56.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1F95.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1FD5.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20C0.tmp",
  928. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab213F.tmp",
  930. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD212E.tmp\\gb.xsl",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD224B.tmp\\mlaseventheditionofficeonline.xsl",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD212E.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  935. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar216F.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab22E8.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD224B.tmp\\Content.inf",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2358.tmp\\TabbedArc.glox",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22E9.tmp\\iso690.xsl",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22FA.tmp\\gosttitle.xsl",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22E9.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab23E6.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2358.tmp\\Content.inf",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar23F7.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2465.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2477.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2497.tmp",
  949. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24B7.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2466.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C9.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2519.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251C.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251D.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251B.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab252F.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2543.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C8.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2541.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251E.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24E9.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251A.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2530.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2545.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD251F.tmp\\chicago.xsl",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2542.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22FA.tmp\\Content.inf",
  969. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2566.tmp",
  971. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25E6.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2556.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2544.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2685.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2723.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2753.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25A6.tmp\\ieee2006officeonline.xsl",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\cab27B3.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2712.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25E6.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2845.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar25E5.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2832.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD251F.tmp\\Content.inf",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2844.tmp\\content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2833.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25A6.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2844.tmp\\Metropolitan.thmx",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2866.tmp\\ThemePictureAlternatingAccent.glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2754.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2846.tmp",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2793.tmp\\Berlin.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2635.tmp\\HexagonRadial.glox",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2963.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2975.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2A04.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2803.tmp\\gostname.xsl",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2974.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2866.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2914.tmp\\APASixthEditionOfficeOnline.xsl",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2635.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28A6.tmp\\VaryingWidthList.glox",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2914.tmp\\Content.inf",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B5F.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2A05.tmp",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28A6.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C7C.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C4C.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A25.tmp\\content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C7D.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A35.tmp\\TabList.glox",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A35.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2803.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DF6.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DF7.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A25.tmp\\Wood_Type.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2986.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2793.tmp\\content.inf",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EC4.tmp\\content.inf",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CCC.tmp\\InterconnectedBlockProcess.glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F53.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E65.tmp\\chevronaccent.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EC4.tmp\\Quotable.thmx",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C2B.tmp\\Content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CCC.tmp\\Content.inf",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F64.tmp\\content.inf",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F64.tmp\\Dividend.thmx",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F32.tmp\\content.inf",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E65.tmp\\Content.inf",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2FE2.tmp\\Headlines.thmx",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3031.tmp\\Element design set.dotx",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F33.tmp\\turabian.xsl",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F32.tmp\\View.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3031.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2FE2.tmp\\Content.inf",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD316B.tmp\\Crop.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3227.tmp",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F33.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3257.tmp\\ThemePictureAccent.glox",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3257.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33CF.tmp",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD33EF.tmp\\content.inf",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD33EF.tmp\\Parallax.thmx",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35E4.tmp\\Badge.thmx",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F5.tmp\\content.inf",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F5.tmp\\Savon.thmx",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370F.tmp\\Circuit.thmx",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35E4.tmp\\Content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387A.tmp\\iso690nmerical.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37BC.tmp\\architecture.glox",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387D.tmp\\CircleProcess.glox",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387C.tmp\\harvardanglia2008officeonline.xsl",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387A.tmp\\Content.inf",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BF.tmp\\RadialPictureList.glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BE.tmp\\content.inf",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387B.tmp\\pictureorgchart.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383A.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD389E.tmp\\ThemePictureGrid.glox",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387C.tmp\\Content.inf",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38F0.tmp\\content.inf",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BF.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37BC.tmp\\Content.inf",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BE.tmp\\Slate.thmx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387B.tmp\\Content.inf",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387D.tmp\\Content.inf",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38F0.tmp\\Droplet.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38C0.tmp\\ConvergingText.glox",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3AA8.tmp",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD389E.tmp\\Content.inf",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383B.tmp\\sist02.xsl",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3AD8.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38C0.tmp\\Content.inf",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A0A.tmp\\PictureFrame.glox",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A98.tmp\\content.inf",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A98.tmp\\Main_Event.thmx",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A0A.tmp\\Content.inf",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C90.tmp\\content.inf",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C50.tmp\\Feathered.thmx",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383B.tmp\\Content.inf",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C90.tmp\\Vapor_Trail.thmx",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370F.tmp\\content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E08.tmp\\BracketList.glox",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E08.tmp\\Content.inf",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4183.tmp\\Insight design set.dotx",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C50.tmp\\Content.inf",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4183.tmp\\Content.inf",
  1135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab578D.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD581B.tmp\\content.inf",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD581B.tmp\\Damask.thmx",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0003.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC5166D13-3179-4FD7-8CEF-45A7FD17079C.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0004.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF52297BB62E1F1512.TMP",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAA5EFB467F79AEDB.TMP",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRA0005.wbk",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF27132E946CF6C92E.TMP",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1149. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS683A4DBA-149B-44DD-B2DE-46CBDAFFDECB.tmp"
  1150.  
  1151.  
  1152. * Deleted Files:
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEF58.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEF59.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_d1da9815230c9091d9b7fed1a2d9b753.asd",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444fn=Basis.eftx",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444fn=Basis.xml",
  1162. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444fn=Basis.xml",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1F56.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1F95.tmp",
  1165. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  1166. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  1167. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD212E.tmp",
  1169. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  1170. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  1171. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  1173. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  1174. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD224B.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22E9.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22FA.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab213F.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2358.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar216F.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD212E.tmp\\gb.xsl",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1821.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab23E6.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD251F.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar23F7.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25A6.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22E9.tmp\\iso690.xsl",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2358.tmp\\TabbedArc.glox",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25E6.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2635.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2465.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24C9.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24B7.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251C.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24C8.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C26.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251E.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24E9.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2466.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1832.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2541.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2793.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2566.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2803.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2844.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251B.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2543.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2544.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2866.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD22FA.tmp\\gosttitle.xsl",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2519.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD224B.tmp\\mlaseventheditionofficeonline.xsl",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2542.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar251A.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28A6.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2685.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2914.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab251D.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab252F.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2753.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A35.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2712.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2530.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A25.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD251F.tmp\\chicago.xsl",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1926.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2845.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2545.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F3.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2832.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2754.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2556.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2846.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2833.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C2B.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F5.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar25E5.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2A04.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CCC.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2A05.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E65.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EC4.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25E6.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2974.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2986.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A46.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F32.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F33.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F64.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C4C.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C7D.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2FE2.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3031.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD25A6.tmp\\ieee2006officeonline.xsl",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1842.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2866.tmp\\ThemePictureAlternatingAccent.glox",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD316B.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AD7.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2914.tmp\\APASixthEditionOfficeOnline.xsl",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28A6.tmp\\VaryingWidthList.glox",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1D9E.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3257.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B86.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2635.tmp\\HexagonRadial.glox",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B07.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A35.tmp\\TabList.glox",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1801.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD33EF.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2C2B.tmp\\rings.glox",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3031.tmp\\Element design set.dotx",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1A96.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F64.tmp\\Dividend.thmx",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2844.tmp\\Metropolitan.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E4B.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B87.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\cab20C0.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E65.tmp\\chevronaccent.glox",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AC6.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35E4.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F5.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2793.tmp\\Berlin.thmx",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2803.tmp\\gostname.xsl",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2497.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C06.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F32.tmp\\View.thmx",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1C05.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370F.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CCC.tmp\\InterconnectedBlockProcess.glox",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1AC5.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EC4.tmp\\Quotable.thmx",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37BC.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383A.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387D.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387B.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD389E.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383B.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387C.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BE.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cab22E8.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BF.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38C0.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A25.tmp\\Wood_Type.thmx",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1FD5.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F33.tmp\\turabian.xsl",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3257.tmp\\ThemePictureAccent.glox",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2FE2.tmp\\Headlines.thmx",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38F0.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab19F7.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F5.tmp\\Savon.thmx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2963.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B66.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A0A.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\cab27B3.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A98.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD33EF.tmp\\Parallax.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2723.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD316B.tmp\\Crop.thmx",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BF.tmp\\RadialPictureList.glox",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35E4.tmp\\Badge.thmx",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C50.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C90.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2477.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3AA8.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1925.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C7C.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3AD8.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387D.tmp\\CircleProcess.glox",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387A.tmp\\iso690nmerical.xsl",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387B.tmp\\pictureorgchart.glox",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E08.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18E2.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1989.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383B.tmp\\sist02.xsl",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD389E.tmp\\ThemePictureGrid.glox",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1959.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18F4.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38F0.tmp\\Droplet.thmx",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38C0.tmp\\ConvergingText.glox",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2B5F.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E08.tmp\\BracketList.glox",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18E3.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38BE.tmp\\Slate.thmx",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A0A.tmp\\PictureFrame.glox",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370F.tmp\\Circuit.thmx",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1958.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DF7.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4183.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37BC.tmp\\architecture.glox",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD383A.tmp\\Equations.dotx",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A98.tmp\\Main_Event.thmx",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1938.tmp",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DF6.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD387C.tmp\\harvardanglia2008officeonline.xsl",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\cab18B2.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C90.tmp\\Vapor_Trail.thmx",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C50.tmp\\Feathered.thmx",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3227.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\cab33CF.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4183.tmp\\Insight design set.dotx",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F53.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD581B.tmp",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD581B.tmp\\Damask.thmx",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\cab578D.tmp",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1365. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRA0005.wbk",
  1366. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS7C2CA4F2-8740-4F82-BBC4-24897775058C.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_d1da9815230c9091d9b7fed1a2d9b753.html_q_mJ2Xxgp",
  1368. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1369. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS683A4DBA-149B-44DD-B2DE-46CBDAFFDECB.tmp",
  1370. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC5166D13-3179-4FD7-8CEF-45A7FD17079C.tmp",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0004.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\688AE058.wmf",
  1373. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\CE1C8AF3.wmf",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRE7F4.tmp.cvr",
  1375. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFD980F73B-75CC-4A06-B264-5B9B5DCA9E6C.tmp"
  1376.  
  1377.  
  1378. * Modified Registry Keys:
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"w(",
  1380. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1640. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769",
  1641. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0",
  1642. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\(Default)",
  1643. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\FLAGS",
  1644. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\FLAGS\\(Default)",
  1645. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0",
  1646. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0\\win32",
  1647. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0\\win32\\(Default)",
  1648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\HELPDIR",
  1649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\HELPDIR\\(Default)",
  1650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1651. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0",
  1652. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\(Default)",
  1653. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\FLAGS",
  1654. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\FLAGS\\(Default)",
  1655. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0",
  1656. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0\\win32",
  1657. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\0\\win32\\(Default)",
  1658. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\HELPDIR",
  1659. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\C3E31379-5920-42B3-B76B-1F55A430B769\\2.0\\HELPDIR\\(Default)",
  1660. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1661. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1662. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1663. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1664. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1665. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1666. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1667. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1668. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1669. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1670. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1671. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1672. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1673. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1674. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1675. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1676. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1677. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1678. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1679. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1680. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1681. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1682. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1683. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1684. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1685. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1686. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1688. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1689. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1690. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1691. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1692. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1693. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1694. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1695. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1696. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1697. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1785. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1786. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1787. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1788. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1789. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1790. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1791. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1792. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1793. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1794. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1795. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1796. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1797. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1798. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1799. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1800. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1801. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1802. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1803. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1804. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1805. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1806. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1807. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1808. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1809. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1810. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1811. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1812. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1813. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1814. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1815. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1816. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1817. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1818. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1819. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1820. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1821. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1822. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1823. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1824. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1825. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1826. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1827. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1828. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1829. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1830. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1831. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1832. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1833. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1834. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1835. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1836. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1837. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1838. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1839. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1840. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1841. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1842. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1843. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1844. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1845. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1846. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1847. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1848. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1849. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1850. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1851. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1852. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1853. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1854. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1855. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1856. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1857. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1858. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1859. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1860. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1861. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1862. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1863. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1864. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1865. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1866. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1867. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1868. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1869. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1870. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1871. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1872. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1873. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1874. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1875. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1876. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1877. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1878. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1879. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1880. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1881. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1882. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1883. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1884. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1885. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1886. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1887. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1888. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1889. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1890. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1891. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1892. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1893. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1894. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1895. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1896. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1897. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1898. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1899. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1900. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1901. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1902. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1903. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1904. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1905. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1906. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1907. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1908. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1909. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1910. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1911. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1912. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1913. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1914. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1915. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1224FBD",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1224FBD\\1224FBD",
  1919. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1920. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1921. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1922. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1925. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1224FBD\\13FCEE8",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  2285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  2286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  2287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\272DA69",
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\272DA69\\272DA69",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  2294.  
  2295.  
  2296. * Deleted Registry Keys:
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\"w(",
  2302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\t<&",
  2303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  2304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  2305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  2306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  2307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1224FBD\\1224FBD",
  2308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1224FBD\\13FCEE8",
  2309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\272DA69\\272DA69",
  2310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  2311.  
  2312.  
  2313. * DNS Communications:
  2314.  
  2315. "type": "A",
  2316. "request": "www.duffelblogspace.com",
  2317. "answers":
  2318.  
  2319. "data": "173.230.133.135",
  2320. "type": "A"
  2321.  
  2322.  
  2323.  
  2324.  
  2325.  
  2326. * Domains:
  2327.  
  2328. "ip": "173.230.133.135",
  2329. "domain": "www.duffelblogspace.com"
  2330.  
  2331.  
  2332.  
  2333. * Network Communication - ICMP:
  2334.  
  2335. * Network Communication - HTTP:
  2336.  
  2337. "count": 1,
  2338. "body": "",
  2339. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2340. "user-agent": "Microsoft-CryptoAPI/6.1",
  2341. "method": "GET",
  2342. "host": "ocsp.digicert.com",
  2343. "version": "1.1",
  2344. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2345. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2346. "port": 80
  2347.  
  2348.  
  2349. "count": 1,
  2350. "body": "",
  2351. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2352. "user-agent": "Microsoft-CryptoAPI/6.1",
  2353. "method": "GET",
  2354. "host": "ocsp.msocsp.com",
  2355. "version": "1.1",
  2356. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2357. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2358. "port": 80
  2359.  
  2360.  
  2361. "count": 5,
  2362. "body": "",
  2363. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2364. "user-agent": "Microsoft-CryptoAPI/6.1",
  2365. "method": "GET",
  2366. "host": "crl.microsoft.com",
  2367. "version": "1.1",
  2368. "path": "/pki/crl/products/microsoftrootcert.crl",
  2369. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2370. "port": 80
  2371.  
  2372.  
  2373. "count": 2,
  2374. "body": "",
  2375. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2376. "user-agent": "Microsoft-CryptoAPI/6.1",
  2377. "method": "GET",
  2378. "host": "crl.microsoft.com",
  2379. "version": "1.1",
  2380. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2381. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2382. "port": 80
  2383.  
  2384.  
  2385. "count": 1,
  2386. "body": "",
  2387. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2388. "user-agent": "Microsoft-CryptoAPI/6.1",
  2389. "method": "GET",
  2390. "host": "crl.microsoft.com",
  2391. "version": "1.1",
  2392. "path": "/pki/crl/products/microsoftrootcert.crl",
  2393. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 06 Aug 2019 05:01:25 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2394. "port": 80
  2395.  
  2396.  
  2397. "count": 1,
  2398. "body": "",
  2399. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2400. "user-agent": "Microsoft-CryptoAPI/6.1",
  2401. "method": "GET",
  2402. "host": "crl.microsoft.com",
  2403. "version": "1.1",
  2404. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2405. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2406. "port": 80
  2407.  
  2408.  
  2409.  
  2410. * Network Communication - SMTP:
  2411.  
  2412. * Network Communication - Hosts:
  2413.  
  2414. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!