Create a new version of paste:

[*] MalFamily: "Shellcode"

[*] MalScore: 10.0

[*] File Name: "Docs_920b8022cf38fb202b76f11fe9844e73.doc"
[*] File Size: 8564
[*] File Type: "Rich Text Format data, version 1, unknown character set"
[*] SHA256: "5387e2bd608c6817eb35e58b962c75e8c9ba2bc2351035428351f714eb1ff621"
[*] MD5: "920b8022cf38fb202b76f11fe9844e73"
[*] SHA1: "fdb47ea5bfc0bafb2cc80cf236b485cb1f866cec"
[*] SHA512: "190798f4961f83112e9fdfdeb3489ec93eb1af45737b95ce7a43c5c03b5fb7fab4bdc13b23c3e8dc762e3204ff1828487341479ea14f5b94f7bc19e6d92bd5d5"
[*] CRC32: "3187C24B"
[*] SSDEEP: "96:M8B+vRmOluOtcH88jH7F0vmqXTys1O9x8mpAfjgK4rNys0+jJOoz:MseRZjyc8jbkTmmmiONys0GJH"

[*] Process Execution: [
    "WINWORD.EXE"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
        "Details": [
            {
                "IP": "65.52.98.231:443"
            },
            {
                "IP": "104.93.33.19:443"
            },
            {
                "IP": "104.93.189.220:443"
            },
            {
                "IP": "52.109.92.24:443"
            },
            {
                "IP": "104.18.25.243:80"
            },
            {
                "IP": "184.84.243.209:80"
            },
            {
                "IP": "72.21.91.29:80"
            },
            {
                "IP": "52.109.16.4:443"
            }
        ]
    },
    {
        "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
        "Details": [
            {
                "ioc": "chevronaccent.glox"
            },
            {
                "ioc": "ontent.inf"
            },
            {
                "ioc": "chicago.xsl"
            },
            {
                "ioc": "quations.dotx"
            },
            {
                "ioc": "architecture.glox"
            },
            {
                "ioc": "iso690nmerical.xsl"
            },
            {
                "ioc": "gostname.xsl"
            },
            {
                "ioc": "ieee2006officeonline.xsl"
            },
            {
                "ioc": "e.gu"
            },
            {
                "ioc": "ist.glox"
            },
            {
                "ioc": "gosttitle.xsl"
            },
            {
                "ioc": "sist02.xsl"
            },
            {
                "ioc": "gb.xsl"
            },
            {
                "ioc": "turabian.xsl"
            },
            {
                "ioc": "set.dotx"
            },
            {
                "ioc": "harvardanglia2008officeonline.xsl"
            },
            {
                "ioc": "rc.glox"
            },
            {
                "ioc": "iso690.xsl"
            },
            {
                "ioc": "mlaseventheditionofficeonline.xsl"
            },
            {
                "ioc": "rocess.glox"
            },
            {
                "ioc": "adial.glox"
            },
            {
                "ioc": "asis.thmx"
            },
            {
                "ioc": "content.inf"
            },
            {
                "ioc": "rings.glox"
            },
            {
                "ioc": "ext.glox"
            },
            {
                "ioc": "rame.glox"
            },
            {
                "ioc": "nline.xsl"
            },
            {
                "ioc": "pictureorgchart.glox"
            },
            {
                "ioc": "etropolitan.thmx"
            },
            {
                "ioc": "ividend.thmx"
            },
            {
                "ioc": "rame.thmx"
            },
            {
                "ioc": "ccent.glox"
            },
            {
                "ioc": "eadlines.thmx"
            },
            {
                "ioc": "adge.thmx"
            },
            {
                "ioc": "ype.thmx"
            },
            {
                "ioc": "ircuit.thmx"
            },
            {
                "ioc": "g.n9"
            },
            {
                "ioc": "roplet.thmx"
            },
            {
                "ioc": "amask.thmx"
            },
            {
                "ioc": "esh.thmx"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            }
        ]
    },
    {
        "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
        "Details": [
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0k\\x9a\\x1e\\x0e\\x0f\\xa6i\\x94v \\xeb\\x82+\\x0f\"\\xe0>\\xb1op\\x8d\\xe5\\xee\\x97x\\x10\\x8b\\xdf~\\x92r\\xd7l\\xba\\x89egz \\xbfv\\xa2\\xf4l\\xf7f\\xcb< ;\\x8f\\xe1u\\xc0k\\x9at\\x9d\\xbc\\xe7\\xb1\\xaa\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\x1fr{h\\xef@\\x10*\\xdeg\\xc9}\\x16^\\xd2\\xac?o\\x8e\n|\\x07\\xfb\\xcbu\"f\\xc0\\x1f\\xc3\\xc3\\x92\\x97\\xb0\\x96s\\xa1\\xabv\\x06\\x92\\xdescr,\\x0c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pu\\x18\\x95\\xbc\\xa8_\\x10k&\\x83,\\xda\\x8c\\x90\\xcd\\x13'0\\xb0\\xeb\\xc3\\xbf\\x9d\\xbe\\xfc\\x15\n\\xb4s\\xf7\\xcb\\x7fh\\xb5t\\xc1\\x0fp-k\\xc8s\\x16\\x19@\\xf6\\xa8\\xbd)\\x07\\xae\\xc3d\\xa7*u\\xee\\xbb+\t\\xe9\\xacb\\xb0'sdip\\xf5\\x88.\\x00\\x07\\x0f\\x11\\xa4j\\xc5{\\xe7\\x80\\xdb\\xd5p\\xf8\\xe5$iou$\\x9d6kzb\\xe2e\\x98\r\\xd2\\xb0\\xa7\\x10\\xaa1s\\xa5(\\x80\\xee\\xf5\\x137\\xd3\\xe1\\xc7\\x8d\\xe6\ta\\xfc\\xb7\\xacg\\xc2\\xf2l\\x90w)\\x13\\xc8\\xeex\\x05\\xf2\\x16\\xce\\x92k\\xd1#t@\"q8\\x9aeah^\\xc1\\x94uqv\\x8b\\xbe\\xdap\\xa3\\xcb\\x04:i\\x05\\x95o\\xd6\\xc9k\\x07\\xd0|\\xcf\\x8f\\x93v\\xf2\\xfe\\x1b\\xd0\\\\xca\\xaf)\\xce\\xb4\\x1f\\x10\\x0e \\xe3\\xa5\\x1e\"\\x81\\xfa\\xc71\t\\xf8>.\\xc2\\xbc\\x1bt\\xb1\\xde\\xdb\\xe0\\xd6-@\\xac\\xa7\\xe0\\xd2\\xee\\xcc\\xda\\x86\\xe3x\\xdba\\xf2s\\x84\\xda\\x85\\x10r\\x94\\xf3\\x14\\xde\t\\xcc\\xafg+\\xc0\\x10\\x14\\xcb<"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\t\\xf7\\xf3\\xad\\x89\\xc4(\\xa1@\\x11\\x0e\r@{\\x89\\xb6q\\xa4\\xb3\\xe9\\xb1<f\\xa8\\x19\\xaeq\\xe4\\xd3\\xcd\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\xa9w~\\xc5\\x11h\\xf9\\xf5v}\\xb9\\x8b7\\xe7\\x93\\xc9\\xa2\\x7f\\xa4^q\\xbf\\x0b\\x04\\x97\\xaa\\x1a\\xc3\\x86\\xb0\\xcbo?\\xab\\xbdf\\xe7\\xb3\\x8d\\xfcb\\xf9\\x89\\xe2 \\xaa\\x9f|k\\xfa\\x9a\\xf9tssbf\\xf0\\xa2\\x15*\\xbd\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d\\xbd>\\x1c\\xd3\\xa6\\x94=\\xa9\\xa04\\x1a\\xf8r\\xa7m\\xe2\\x08p\n\\xe7\\x04{\\xba\\xc7\\x14\ts\\x85\\x01r\\xd2fd\\xc1\\xf5\\xcc\\x98\\xd4jv\\xde\\x938oc/:"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8e]\\xa2\\x179'\\x99<\\xcd>\\xb5t\\x0cs\\xfe'z\\xa6i\\xbd\\xcc@8\\xac^>\\x94f\\xd9v[\\xa0q\\xf0\\xe6z\\x15t\\xa2i\\xbd\\xee\\xa4g\\x93\\xfan\\xfe%\\xa0\\x14\\x97\\x03\\x9f\\x9e\\xb7\\xef\\x1e\\xa2i\"t\\xf6o\\xb8]9\\x9d\\x07v\\xd4\\x91\\xa3\\x15\\xaa\\x16+\\xcc\\xb3\t\\xf1\\xaa\\x85\\xb7\\xa6!\r\\xd9\\x05)j\\xdd\\x12\\xbd\\xe4*\\x8a\\x99~\\x1fe\\x0f\\xf4+a\\xc2x \\xd7\\x81o\\\\xcd\\x9d1\\x88x\\xe6\\xf8\\xf9\\xdeh\\xa8ls\\xdd\\x9c\\x8c\\x89\\x17+y\\x97\\x89\\xb2\\x91\\xbc\\xcc-\\x9bx\\xb2\\xc1\\x08\\xae\\xa7 \\xc2\\xa2\ry\\xf9\\x8a\\x1c\\x94\\xb2g\\x90\\xed]\\x17\\x19c\\xa0#\\xc8\\xfc8\\xb7\\xf1\\xf7\\x84\\xcb\\xa7\\xb5\\xde\\xb8b<\\xf9\"\\xf3\\xab@x_@\\x1f\\x0b\\x00\\xa5\\x07\\x885\\x11@\\xf6\\x18\\xc8\\xef\\x19`\\x1f\\xf4\\xd0\\xaa\\xbe\\x8cd8\\x07\\x055\\x9f\\\\xd3r\\xa0\\xc9h\\xc8\\x90\\xe4\\xd2\\x15\\xd9{\\x1c\\xc9h\\xd3\\xc3\\xff\\xcdl\\xe2\\xd1\\xdb\\x9302\\xfae\\x14\\xb0`\\x89\\xd2\\xca(\\"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xb5\\xcf\\xf9\\xae=\\xb9\\x11\\xe1\\xdb\\xe88\\x0e\\x9f|g\\x11\\xe7\\xed\\xb2`&\\xd6zs\\xd7\\x9al\\xa5c\\x07\\xe0\\xd8\\x9b\\xe97\\x15\\x0fn\\xf0\\x8f\\x11m\\x9c\\xcc\\x14\\xf8\\xfei\\x9ea\\xad\\xeah43\\x13\\xe2*\\xf3\\x08\\xf6)\\xcb\\xa0\\xc1g[\\xc9\ty\\xbb\\x8b\\x85\\xaf3\\xf2w\\x14s\\xea\\x84\\x83u\\x07hnj\\x82$7\\xa1\\xd1\\xady\\x18\\xf2\\xf6\\x0b\nv\\x12\\x80\\xaf\\xd2x\\xa3t\\xea\\xb9\\xc2llwy\\xeel\\xe7\\xc4\"\\x06\\xb2\\xde\\x14\\xae\\xb3\\xee6\\xc2\\xc1^\\x03\\xc8`\\x0c\\x1e\\x95\\xa4b\\xb1\\xc6\\xb2\\x80\\x1br3\\xb0\\xd9\\xf6s\\x82f\\xa5g\\xea+\\xbe[,\\xf0s\\xb2w\\xb9\n\\xb8\\x90\\xa9g\\xc6\\x1b\\x95\\x0c\\xbe\\xb0\\xb9\\xfcj\\x87<\\xad\\x0eei\\x8dt\\xba(fc\\xe7l+r9e:\\xc3\\xc7\\xd6\\xd2\\xa4\\xa78!\\x15\\x96\\xc6\\xc4\\xef\\xee\\xaf\\xa0v\\xb0\"`\\xff\\xc4\\xdeg~\\x8b\\xebt#cz\\xed+i\\xb6hn\\x0b\\xe9\\x13\\xc5\\xd5u\\xcaq\\xbd\\x8d%\\xfd\\x8edx\\x14\\x8b\\xbb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\t\\xf7\\xfb\\xbd\\xe68\\xf7\\xddp&f,\\xc2]\\xc5\\x94vz\\xabq\\xff\\xc4?o\\x1a\\xf6\\x83svo8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea=\\x10g\\xcb\\xae\\xf2y\\xc7;\\xf8\\x0b\\xc2a\\xdca\\xe1\\x8d\\xe0\\x82\\xda\\xcc+\\xf5\\x80\\xb9\\xc0&\\xcb\\xff\\x07\\xff\\x9em\\x12\\xae\\x8f\\x8c\\xe4.\\xa2^v\\xa6)\r5\\x9e\\x95n<\\xc0$\\x17\\xa7y\\xeba\\xa2\\x13\\xcc\\xe9\\x0c\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4 \\xb5\\x97\\xa9\\xb8\\x88\\xba\\x04\\xd2xw\\x8d\\xcen\\xa7\\xde\\x1bd\\x82\\x0bh\\xfe\\xba\\xf0\\xed\\xb0\\xcdld\\xb0\\xda\\xf4;\\x91\\xa4f\\xba\\x9f\\x137\\xbe\\xfa\\xc3\\xb0\\x03\\x1d\\x96"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1eh\\xa6\\x87\\xb7\\xb9)\\xe9\\xe8\\xd8kh\\xdc\\x88\\xd9\\x89\\xd96\\x04#\\xe7o\\xe2\\x13d\\x12\\xff\\x98\t\\xdf\\xd8(\\xa2\\x8bd\\xb0\\xa4a\\x07g\\xa1\\xf0\"a\\x92%\\x9f\\xa4r$\\x95\\xd8\\xac\\x8b\\xb9\\x93h\\xb8\\xb51$|\\xab\\xd0\\xb2j\\x00\\x9fee-\\xa2\\xea(x\\xfc:\\xea\\x18\\x8cgg\\xe6\\xe5rn\\xc9\\xdcyh\\xe0z\\x1f\\x9a%\\xba]>n_$\\xbf\\xdb\\xffp'\\xa1\\x8d\\xcc\\xf6'k\\xfd\\xf0\\xbc\\x99#\\xc9#\\xf4\\xabs=\\x18\\xc6\\x98\\x13\\xb7\\x00\\x7f\\xadl\\xa0\\x1e\\xe9s\\x17gm\\x1ef\nqk\\xc1\\xf9\\x85:4w?\\x0e+\\xe3{>\\x97\\xf4(\\x8f\\xa8\\x16\\x87\\x14\\x15\\x00\\x7fk\\x86\\xdb\\x08\\xc7\\x9a\\xfa\\x1bjc)\\xab\\xec~p\\xc8w[\\x18\\xdc\rly\\xc7\\x0c\\x95\\xe6\\x13\\xd9es\\xd6qg@\\xd3\\xe7\\x15\\xc7\\xc2qfs\\x83\\xbe\\xf8{\\xd2z\\xfd\\xde\\xf1\\xb2j6\\x1f^<f=\\xead\\xfdt\\xdd\\xba\\xd6\\xd7\\xa3\\x06\\xb0u\\xa6m-_\\x85`\\xdd\\xbfo\\xf1\\x99v"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\t\\xf7\\xfe^s#\\x9c\\x12f\\xdc\\x1b\\x8fa&x%hv%\\xf9\\xf7y\\x05t\\xdc\\\\xfc\\xb8\\xb0\\xd4\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb\\xde\\x12\\xe6\\xb8\\x14x\\x1e\\xfb\\xe4\\xcd*o4\\x1bm\\x03?s\\xc7\\xf7\\xee\\x7f\\xf9\\xb0\\x9a\\xf0\\x871*\\xd6}\\x0eg\\xa3\\xf74\\xa0\\xa9\\x8e\\xb9\\x95+\\xc8\\xe10a0^\\x90k\\xb3s\\xe2wl\\xf2*\\xae[\\xe0\\xdc\\xa1\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xb9\\x16 \\xe5q\\xcdf9\\xce+\\x9f\\xe1\\x90+-\\x00j\\xbfp\\xe3#\\xba\\xc5\\xef\\xd5\\xcb\\xf2\\xfee\\x13\\x94}\\xe1\\xe7\\xd7\\xe4\\xbf\\xba\\x13\\xb7\\xdf_\\xbe\\x8d\\xb4h\\xe7"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa2\\xb3w?\\xcc\\xd6\\xd7\\xa0\\x9c\\xdb(\\xfd\\x17a\t\\x13a\\xfe\\xc6}[\\x90\\xff\ncx\\xc7\\xcf\\xce\\xb3+zgb\\xb4\\x92\\xc3\\xdb\\x97\\xd0so\\x01.w^\\xaa-\"\\x929\\xd1\\xd5\\x06\\x9b\\xfcf\\xcb\\x1b\\xcf\\x92;\\x1b\\x1e\\x00\\x1a\\x8c1,\\xa3.\\xd6pvg*\\x9a\\x96\\x05\\xa6}\\xf77\\x93\\xd61\\xed\\x0el\\x817e\\xdatw' \\xec\\x9c;s\\xbferi;\\x98[\\xdb\\xfd\\x98b@n\\xf7\\x9f\\xce\\xc9a\\xd9n\\xe8\\xaf\\x08o\\xc5x\\xd4\\x7f\\xcf!z\\xd7f\\xe7\\xd0\\x90nof\\xce\\xd8f\\xaco\\xa8\\xc1r\\x149\\x8a\\x98c\\xd0\\xe3\\xdf\\xd3'qs}p;\\xa4>*\\xd0\\xa5\\x17c\\x9b\\x98\\xb4\n\\x06\\x93\\x83\\xe6\\xca\\xce\\x00\\x19\\xf75s\\xe6r\\x08dh]\\x1bl\\xb9\\xa7f\\xd8\\xa9\\x022#i\\x07n9\\x84_\\xa4lgh-\\x18\\&\\xb65g\\xab\\xf4r.\\x96\\xe3\\xb4b\\xd9\\xb0\\xa9\\xdd<\\xb3ip\\xec\\xdf\\xf60 x\\x85\\x9b\\xf1\\xe2\\x1f}d\\x8d\\xc0\\xe0\\xbb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xb6\\x15\\x9d\\xa6]yd@!bq\\x0b\\x94\\xa6\t\\x97\\xb3\\xc8\\x8a%\\xe8\\xd1\\x13\\x13\\x1b\\x1b.^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x87j\\x91r\\x877k\\xfc$\\xe2\\x996\\xf9\\x18tj\\x99($q:\\xe6\\xf5y\\x86\\x82\\xbcn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf3\\xec\\xf0=n\\x81\\xda^\\xc7\\x92\\x1a\\x0c\\xa5wh\\x04\\x9f\\xba2\\x11\\x93\\x81\\xe7\\xd7\\x85\\x957g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_*\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1fjo=\\x11\\xec\"b\\xe3\\x13ldy\\x9a\\xa1\\xbfo\\xf8\\x18l\\x9f\\x89\\x0fa;[v\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8d\\x9c.\\x0f\\xdd\\x8a\\xde\\xf9\\xf8\\x13\\x10\\xccx\\xa6\\xef\\x89\\xd1d\\x9c\\xee\\xd7m$\\xc9\\xcd\\xe6\\xb1m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x19;\\xedyz\\xd6\\xdc9\\xa7+\\\\x93j\\xab0gv0t\n\\xa0/|`\\xbb\\xe0\\xcb\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xca\\x08\\xa3\\xd3'b\\x03n+\\x06_\\x9c$\\xa3r\\xbdh\\xae\\x81\\x82\\x06^\\xfdv\\x03\\xbe\\xc5\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xab\\xa5\\x1f\\x9c\\x19\\xb7\\xbe@\\x83\\xd0\\x02\\x07\\xfd\\xd6\\x92qrv\\x01\\xcc\\x8b\\xcf\\xd9@\\x1c\\x9eda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa5c\\x12\\x16g\\xfcy\\x84\\x1c^\\xbf\\xb1p\\xdbz?s\\x8b\\x10\\x7f\\xc1\\xc71\\xbb\\x1c9xh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa7\\xe4\\xc2}\\xaek|0\\x9a\\x8e\\xec%?m\\x9f\\xae\\x1c8\\xa9\\xcb\\xa1\\x03e\\x0c2\\xac\\x18b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1cm\\x92\\xf2\\xb4\\x02\\xcb5\\xc6\\xe6>\\x12p$}\\x8f\\x0f\\xd2\\xd0\\x90\\xc6\\x0e\\xc8\\xc0\\x84\\xe4\\xb4\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xd7\\x91\\x13\\xf2\\xc6\\x8e\\xa1\"@sp\\xea\\xd8f\\xbf6\\xb1n1\\xf9l.\\x97\\xad\\xc9\\xb9\\xf7&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00d\\x02\\x84\\xae(\\xe6\\xb8j\\x0c\\x91:\\xe2\\x82\\x9e\\x8e9q5\\xc7\\x95\\x85e\\x03 \\4{\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x9e\\xa5\\xd0\\xd8ay\\xc6\\xbe\\xde~a\\x1d\\xcf\\xb8\\xe8\\x81\\xac\\xe0\\x06,6\\x00\\xcaa\\x8a\\x9a\\x04\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1bs\\x93\\xe3\\x14?\\xc1\\x93\\xd50\\x00\\x08\\xb6\\x02\\x0f\\xa3ix\txv\\xac\\xd2id8\\xbf}\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x84\\xef\\x1ddg=\\x8f\\x0c\\x91u-\\xbe\\xea\\x85\\x0f,\\xd4\\xc2\\x8e\\x85\\x1a\\xaf\\x02\\xb1\\xdf\\x9c{\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00)\\x9av\\xcdv=\\x8d#\\xe0'7\\x86x\\xb5]6\\xd5\\xb2&}\\x94\\x1a}\\xbfy<\\x85\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf1\t\\x9e\\xe7\\xc1\\xbc\\x91<\\x12m7\\x8f@?=#8\\x84\\xb5\\xf9\\x9e\\xdd*f\\xe4\\xeb\\xa1\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00wxe\\x03\\xaa\\x08emv>n\\xe3=d\\x0e\\xd8*\\x1a\\x17\\xc1\\xc9xwx\\x18\\xbf\\xf1o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00_w\\x97\\xd9\\xc3\\x13\\xcd\\x08z\\x19\\x9b\\xf1\\x9e\\xfb\\x82\\x9ed\\xda\\xf6w\\xf2\\xeab\\xcdy\\xe6m\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x89\\x16\\x0e,+\\xe6\\x86:\\xa349\\x95\\xde\\x9c\\x93\\x9f\\x04\\x99\\xc2\\x84\\xd8u\\x11sy\\xf53\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa8\\x9f\\xe8\\xec\\x15w\\x96e\\x10#:w\\xa6ne\\xf0!\\x8a\\xda{|\\x95\\x1b\\xfc\\xb5\\xab\\xb5\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x1cdr\\xebe\\xcb%a;s7+:\\xc5}\\xbc462\\x10\\x1a\\xd5\\xa8\\xeb\\x8bo\\x94\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00`\\x86c}6\\xf5\\xde\\x11\\xa4g\\x17oua\\xcd\\x92\\x7f)q=6\\x07?\\xcdc\\x00\\x88?\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa1u\\xeb\\xad\\xab}\\xfb=\".\\x90@\\x91\r\\x00-\\x07\\x8d\\x04 8\\xd9\\xce\\xe6m\\xa0j\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8f\\x95n\\xab\\xa0\\x05\\x01\\x0e+r\\xfb\\x16\\xa8\\xfb\\xf7\\xa6\\x06\\xca*\\xb8\\x8c\\xaagr\\x00\\xbey\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00d3,_\\xcd7\\xb0\\xf4\\xa1\\x1d3\\xbdir\\xe9\\xf1\\xcf\\xef!\\xc7\\x89\\xc2\\x9d.i\\x803h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00l\\xd4\\x0e'\\x08~\\xeb\\x9c\\xeb\\x18\\xe4z\\xe3\\x0e\\xe20%(\\x1fn4\\x05\\xae8\\xf9\\xfa\\x84\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xc8\\x8c\\x18\\xaf\\x00\\x96\\xa2\\x8d\\xb4lpj^sq\\x96\\x9b\\x0e\\xc3h{2\\xb4\\x81\\xd5\\xdeo\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xf2.#s\\xdf\\xd6\\x07\\xe7b\\x9a\\xba\\x00\\xcb\\xe4\\xf8\\x1cz\\xca\\xec\\xb3\\x0b\\xc8\\x04\\xfcg\\xc5i\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00hsy\\xc4\\xca\\xe0\\xd1\\xfc\\x0ej\\x80\\xa1\\x9b:f\\x0cf\\x19_d\\x90j\\xd6\\x17xyv\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xca\\xc7\\x0f\\x9c\\xbeg\\xde3\\xf8\\x88\\xbe\\xcf\\x93\\xd0\\x7fn\\x16!d\\xe2\\x9d\\x04\\x0b \\xd1\\xc8\\xeb\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00s\\xa2\\xeex$\\x05\\x04\\x88\\xd1s\\x00o\\xc0\\xc54\\x15@\\xb2db\\xc6,\\x1b\\xd9oc\\xdd\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x00\\x95p\\x0f}p\\x12w\\x01t\\x08\\xeb\\xf3x\\xe5\\xbf\\x14\\xdc\\xe5\\xde\\x0f\\xd4o\\xab2 \\xb6\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xa9h\\xc9\\xdd\\xde\\xb8\\xae8h\\xf8_\\xfdl\\x92~\\x05.\\xabi\\x08#\\xeb\\xe0\"\\x93\\x0e\\xed\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x12~\\x06k\\x91\\x17\\x9e\\xbb\\xbf\\xb5\\xc6a\\x85\\xf2\\xa1\\x85h\\xc6lmf\\xb0\\x8e\\xd1*\\xb8\\xee>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00(-\\x8d\\xb4\\x8a\\xc0e\\x899v\\xd2\\x00\\x11k\\xe8yq\\xbe\\x89\\xd54\\xb3\\x11.\\x0bhl\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x8a\\x85\\xdb\\xd0zg\\xfa\\xae9\\xcb\\xc0\\xf8b'\\xc9\\xbc\\x94\\x03\\x8b$\\xf1\\xf2g\\x18_^m\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00>\\xe9\\xd9\\xce\\xccb\\xefc^\\x18\\x15\\xee\\xdda\\x1e\\xde\\xc9!\\xaa\\xb85\\x9f\\xe7\\xfe\\x18\\x9b\\x84\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00u\n\\xc9\\x1dg<\\xc5\\x92nv\\xfe\\x90xj\\x18\\xf3\\xce\\x00cuj\\xc9\\xad$(\\xe9r\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\xc8\\x99\\x98\\xc8\\xf4\\x00\\x19\\x16<h\\x8f(q\\xdc\\x9d\\x8b\\xb4\\xc4}\\xf1hc\\xef@\\x9a\\x1a\r\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x94\\x8a\\\\xc6z*/\\\\xb4b2\\xde\\xed\\x85\\xec\\xf8x\\x13\\x0b\\xec\\x95c\\xe1\\xc3;jx\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x00.b\\xc1\\xa89l\\x97l\\xa5\\xd5<\\xa5h!\\x14y\\xafjw\\x9c\\xbannh\\x1ai\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00a\\x8c&\\xf05\\x92\r\\x9f\\xc8\\x88r\\x1f\\xb9,a|!\\x04\"\\xc2\t\\x03&\\xb5\\xa2\\x81\\xc9\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x00\\x7fz]\\x9c\\x84+v6\\xb6-\\xe5\\xdf\\xb1\\xdej\\x8f\\x11ow\\xee\\xb5<b\\x1f\\xfb/\\xf0\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2<\\xf3]\\xe0s-o\\x0e\\x1b\\x93\\xf6c\\\\xf9z\\x0c\\xacr\\xf2\\xc6$\\x88\\xa6\\x82lx4\\x1b\\x8a!t\\x86\\xc0\\x8f\\x07\\xe5\\xed\\xe3\\x15\\xde\\xa5u\\x05\\xe4\\xdek\\x0f\\x01r\\xfe\\xb5n\\xec\\xd6\\xd8d\\x027\\xcf\\xd7\\xec,9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\x1blx\\xcc\\xb2\\x91\\x00v~\\x19\\xeb\\xe5\\xb5\\xd6\\xb1\\x95\\x98\\x02\\xd6\\xcf\\xa9\\x15<\\x1a\\x0e\\x86?!{y\\xdc\\xf0\\xbb\\xfd#m\\x08\\x990ja\\x8c@o\\xa7\\xcag"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb@\\xae\\xd53\\xb0\\xe2a\\xd4g\\xc7\\x8a\\xa3\t\\xf4i\\xf9\\xfa\\xa5\\xe1\\xe5\\x17\\xa2l\\xc8\\xc7\\x1a\\x1a\\xee\\xd4\\xe4q\\xa3\\xd4k\\xdfis\\x07\\xe3\\x8b\\xf5m\\x9a\\xacb -\\xf5\\xa7\\x91\\x0f\\xce\\xd0pn\\xa6\\x90\\xe6\\x1b\\xd4g\\xa7s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\x87\\xe19bj\\xaa\\x97\\x15\\x99.u\\x90\\xac\\xb9^\\xd4\\x17\\x8d\\xcc,\\x99z_\\xe5\\xbbp\\xc5\\x96+(\\xe2\\xe5e\\xb4\\xecv\\|\\x8agy\"\\xa2\\x8eh\\x1e "
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\x7fn\\xd2\\xcc\\x98,\\x0eb9\\x03+_\\xb3v\\x16f84w\\xa2`\\x13\\xd4\\xba\\x0c~\\xed\n\\x8a\\x9f\\\\xd0\\xf7%t\\xe4x\\x80\\xf8yu\\xcb\\x7f\\x8e\\xd6\\x8f\\x08\\xdb{`[o\\xf0\\xa1\\xbf\\xb7\\xc2\\xbco\\xdc\\xfb\\xb5\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x18o\\xfa\\xa3y\\xf3-\\xfd\\x9a\\x18\\xd3v\\x05\\x91\\xcbf\\x17yg\\xcagv\\xc3\\xfdo~\\xf8fz\\xcfa\\x8f\\xa3\\x85\\xfcn\\x04|\\x01w\\x0c\\x10\\x1ft\\x1fuo"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\xeb\\x17~\\xfa\\x91y\\x80\\xdf\\x94\\xfdt\\xf6j\\x9f\\x03\\xbbcw\\xf2\\xc5z\\x95wf\\xb3\\x1a\\x8a\\xd0rdn\\xffm\\xd7m\\xeb\\xf8\\xd00h\\xa5\\x0e\\x0eq\\xed?\\xdf'\\xaa]\\xf4\\xad3u\\xe8\\xc6\\xa2g\\x18\\xd3\\xb2\\x97\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x92\\xd0\\xa9r\\x99\\x7fq\\xed\\xf5\\x18*k%\\xfe\\xfdn|\\x976\\xc2\\xc6\\xbf\\x7f\\xcb\\x84(\\xc0\\x0b,c\\xd5r\\x85n~(\\x92\\xb9\\xc1m\\x00\\xef\\xec57\\xd7>"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa#\\xcf\\xb6\\xd2h/\\x03\\xacs\\xd1rd?\\xa8,\\x03**z\\xb4\\x01\\xb2q\\x89z2\\xbc\\x1f\\xb7\\xf8hc\\xd7\\xb5\\x0c,\\x84\\xfc\\xff;\\xb6\\xc9\\xfa\\xa1z\\xa8g\"1\\xf1n7\\x0b\\x04\\xdd\\x10}\\xe6v\\x16\\x14\\xef\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87t\\x92\\xe9\\x13j\\x83\\x92=\\x04vm\\xd2p\\xe0.|\\xff\\xaf\\xa2\\xd1\\xe4[\\xb2\\x15\\xb2\\x10\raw\\xae\\x02\\x02\\xe5o\\xe0\\xbc\\xcf\\xc6#e\\x8d\\xf7,/\\xf4\\x1fx"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1*\\xee%\\xa12\\x84\\xe1\\xdduo\\x90\\xd3%\\xd6\\x97\\\\xc0\\\\xadh\\xd7h\\xc8h\n\\x80{\\xd0\\xff\\x1bw6\\xe2\\xa6\\x1b\\xa9\\xf1\\xab\\x81\\xe4\\x17\\xc5\\xe4w\\xafi\\xffc\\x05\\xcf\\x16\\xf8\\xa3;\\x0b]\\x16\\xa4j9\\x8a\\xee-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xaa\\xec\\xa75o\\xaa+\\xd4q\\x98\\xf0o\\xf4\\xf77\\xae\\x1c6\\xa1ka\\xb6\\xce\\xb26\\!\\x83 v\\xd4\\xec\\xb2\\x8fyxo\\xdf\\x10\\x8d\\xc1\"a\\x81\\xa3\\xbe\\xc0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xba\\xe3b\\x96t*\\x0b\\xd9f\\x7fa\\xd8\\xbfbu\\x08\\xf2\\x84\\xf3\\xdc#hq\\x06\\xa1\\xe3~1\\x96\\x8f'f'@\\xc5\\x03\\x1c;\\xf8]q%u\\xd7|?\\xce\\xdf\\x03\\xf3\\xb7\\x89\\xd9\\xba\\x88x/\\xd2\\xd7\\xa2\\xafbn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000cfi5\\xb2e:\\xda\\xe0<\\xd8\\x0c\\xacz0\\xa4\\xf8l\\xde\\xc7\\xa6\\xbf\\xf1$hgym7\t\\xe5`\\xb5wu+m\\xcb8\\xed~\\x9d\\xa6'j\\xef\\x83\\x9b"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z?\\x13\\x12$\\xfb\\x0b\\xcb\\xa1\\xa7\\xdc\\xef\\xa4\\xf0\\x9c\\xdaa\\x87w\\x01t=\\xf5m<\\x97\\x94\\x89dl\\xbe\\xeb\\x04\\xe8f\\xdfo}\\xed\\xfd\r\\xcf\\xadb\\x0f$|\\xa2\\x17d8\\xdb\\x94\\xd3\\xc2\\x01\\x82r\\xda5\\xfb\\xa6\\xee\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 !\\xfa\\xdbh/$\\x9e\\xb9n\"a\\x19\\xbf\\x8f\\xa9d_\\xe4trv\\xf6k\\xce!\\xb2\\xcd%d\" o\\xb2imct!\\xca\\xd1\\xfck)\\xd2\\xb8\\xf2\\xb2"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\xb9nb\\xb0\\x94\\xba\\xb6r\\xeea\\x1d\\xa6i\\xe3?y\\x98\\xa8\\xe9\\xdax}\\xd1%\r\\x9f\\x06b9@<k\\xb1\\xe1o3e\\xa8\\xd6|m\\xef\\xdf\\xbdne\\xb4we[\\xf3\\x15 \\xff\\xcd\\xd3*\\xb77\\x8c\\x88\\xae\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xffe\\xf3\\xa4\\x998\\xe0\\xb8g\\x84\\xb5\\xc1o\\x92\\xd6\\xcem(\\xee\\x10\\xcfi\\xb5^\\xbb\\xd6x\\xb7\\x1cg'\\x1d\\x16\\x85$\\xdb\\x98\\x935k`\\x80\\xf1\\x9c\\xea\\x15\\xe0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x16e\\x8d4\\xab\\xfa\\xb2\\x1c\\x98\\x17\\xe2\\x0e\\x10\\x87\\x14\\x81\\xcb\\xbf\\x10g\\xfd#,>\\xcf\\xb5\\xb69ky\\xe8w\\x06s\\xc7\\xc5\\xef\\xddy\\xc4\\xf60i\\xaau\\x92s\n\"\\xd2\\xaet\\xb7)]\\x02g*\\xe4$\\x0f\\xc2\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa2\\xd7\\xfb\\xc2g\\x83\\xea\\xb1\\xd2\\xf0\"c,zj\\x90\\x80e\\x15\\xe1\\x97\\xb5`6\\xab\\xabs+ \\x0f\\xdf\\x90d \\xf1\n(\\xa3a\\x82y\\x96o\\xd7\\xa0\\xb5n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\xbe\\xc5~l\\xbdo=\\xd9\\xedrp\\x90\\xac\\xd7?\\xb8\\xea%\\x1d\\x06[a66}\\xb6\\xda\\xca\\xdc\\x8c\\xb1\t^\\x0e\\xeb\\xf9\\x05\\xac\\xa6q#\\xc2\\x08\\xbd\\xa4\\x89\\x7f\\xcb\\xad\\x80z\\xf0o\\xac=?\rvnl\"\\xfb<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?a\\xb5\\xe4\\x1b\\x0f,\\x8a\\x9f\\x99\\xf9\\x04h\\xec\\x8f&\\x87'\\xd7\\xfe\\xb8\\xe6\\xb5\\x1c!ccj+\\xe8\\xb6\\xc3j\\x01\\xc4r(\\xdf0\\x0c#?-\\xfd\\xf3\\{{"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\x12\\x9b?n\\x8fw*\n\\x9d\\xa7\\x14e_^\\x9dj\\x93\\xb9\\xder=\\xf7\\x10\\x94\\x819\\xe3t\\xdd\\x97$\\xf6\\x97\\x85m\\xd9r)\\xa9\\xaa\\g\\xf1\\x06\\xa1\\x81\\xbab\\x07?\\xd8\\xe8\\x95\\xaee\\x1f\\x12z\\xd0q_u\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\x98xl\\xd9\\xf6\\xfbf\\x14\\xb0c\\x848t\\xd5\\xbd\\xbf\\xa5\\x9e\\x13\\x8b\\x97\\xc2\\x9f\\x8d\\xea\\x0f,z\\x1a\\x98\\xb9\\xff[\\x13\\xde7f\\xcbz\\xefi\\xccbi1\\xa7\\xf1"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\x15\\xc2\\x04\\xb5\\x11\\xf5u\\x8e\\xab+5\\x9c\\xac]\\xef\\xc8\\xdf\\xba\\xcc\\xaed\\xf8\\xfe\\xfc\\x8d\\xba\\x07\\xf8\\xff\\x02\\xe8n\\xb1\\xa7\\x1e3\\xd0$^\\xda\\xc3;\\x832\\x1d\\xef\\xea\\x17m/\\x88\\x7f\\x9agj\\xc2\\q\\x00\\x13\\x98\\xe9\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o*\\xcdqhf\\x1d'4=\\xde\\xb5\\xba\\xf3\\xf1]\\x91\\xc1\\x81\\x98\\xe4hi3\\xeb\\xfe\\x99\\xb016g)\\xec\\xc3\\xc0b!-}<l\\x03\\x18/\\xb7z\\xc44"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c28\\xa2\\x98n\\x8aui\\x98\\x96[\\xa6p\\xff\t\\xdf\\x05]d\\x87\\xff3?\\x8b\\x97\\x13\\x83\\xd8\\xc7\\xa5\\xbd\\\\xd6\\xc5\\x00\\xb3z\\x0b\\xf7e\\x95\\x94\\xb2\"\\x93\\xab\\xee-\"\\xc6\\x8c@\\x8c\\x9bpa8\\xa3|q\\x1d\\xa2<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16>_3\\xf18c\\x8e\\x8e\\xe2\\x9fck\\xb0\\xa3s@\\xc8\\xdail\n~p\\xfcbj\\x06ia\\xd3\\xcf>\\xaf' \\xd9\\xd9\\x91\\xbf\\x9a\\x8d\\xc1h\\xa0)=\\xd0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k#\\xaa\\x8c~\\x05\\xecy$\\xf3\\xb2\\xd2\\xff\\xf6g\\xf5?\\xbb\\xc7\\x16\\xe0\\x1a\\x95\\xac\\xb4\\x98\\xcb\\xf9\\xdc4\\x8b\\x0e9z\\xa2\\xdb\\x0ci\\xbf\\xcd\\xa1\\xd2k\\xefp\\xccjt\\xb8\\x88\\xa5kuo\\xe5\\xa3\\x02!\\x96u\\xeb\\x8d\\xe8z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000d\\xd5\\xe63\\x95\\xbbl\\xb1\rt\\xc9\\xb8]^\\x00\\xa8\\xa5\\xf0\\x01'\\x04k\\xc5y\\xaae\\x02\\x11\\xdb\\x9d\\x87\\xb7a\\x0c\\xe6\\x0b\\x88!\\xf9\\xc0\\x99i\\x8a\\xb2\\x80d\\xf8\\xf0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\t\\x04*#\\xcab\\xfay\\x18\\x95\\xe9m'\\xe4&\\x8d\\x02\\xf5\\xdd\\xd6\\x1a\\x03k\\x89\\xf6v\\x9abu\\xa3\\xc2\\xaa/\\x84\\xd0\\xc2\\xb5y\\xc0\\x94\\x93<z-m\\x93\\xb2\\x1c\\xca\\x8d\\x93fo\\x7f\\xf0\\xb7o\\x06u6o\\xe5\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\xf9<<\\xa9=\\xc7r`\\xc6\\xc3<\\xf7\\xfe\\xd2h\\x9c|\\x0biy\\xbak\\xb2\r#\\xb7\\xb8\\x16\\x85\\x8cw\\xb9\\x16\\x11i_\\xf0[\\x06\\x85&\\x1a\\xff\\xffce\\xef"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5}\\x0f\\xca\\xcfg\\xe0w\\xb8\\xcdp\\x1f\\xcd1\\xfb\\xd5\\xce\\xeb\\xd1\\xdb\\x17\\xb7\\xe8a\\xb4\\x90s\\x94\\xcddvr(\\x18\\xe6\rlf5r\\x00\\x9d\\xbf\\xf6\\xe1zo\\xee\\xb8\\xe3'\\xff\\h\\xf0\\x8e\\x14\\xa5z\\xb77\\x89\\xb3\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x0b%\\xe9xz\\xed\\xc0\\x979\\x7f)\\x8f\\xe8g\\x83\\x01\\xb4\\xc2\\xf7\\x8b\\xe0\\x87\\xdb\\xc8o\\x87c\\xc5\\x13\\x8dy\\x844\\xb6\\xc0\\x0e\\x88\\xb7\\xea\\xbcw-\\xf1\\xb0\\x95\\xd3\\xda"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6]\\x01\\x9c\\xab\\xf7/\\xfb\\x18m\\x85l\\xe3\\xf33\\x9b\\xa7|%l\\x13!\\xd1l\\x88\\x08\\x99m\\xa71\\x94\\x86\\xb4r\\x94\\xb3l\\x1c\\x97\\x1c\\xb76\\xf8\\xd1bf\\x10%\\xb2\\xcb\\x917n\\x9ch\\x8b\\xbc\\xc2u\\xb8lx\\xb0\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\xe1r\\xa1\\xd6\\x85c\\xf6\\xe84\\\\xe8:\\x14l\\wd=ez\\xc5\\x0e\\xe9\\x06\\x07y\\xbe\\xa5\\xbc\\x0f\\xcf\\xde\\x99\\x03\\x11\\xe1\\x1f\"\\xb7\\x12\\xfe\\xaf\\xbdx-\\x906"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\x8b\\xd7\\xbb\\x9b(\\xbe\\xcb\\x0eryf\\xff\\xfe\\x14<\\x8a@\\xc2c\\x10$!\\xcc\\xc39\\x89@.\\xadd\\xb9j\\xf5\\xfaqgzo\\x85\\x1b\\xea\\xa37q1\\xb5\\x14@m\\xcc\\xa1\\x96\\x86\\xf6\\xd2\\xfd\\xa1\\x18|\\uo,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000gt {\\x10ci\\xa8l\\xd2\\xde\\x07\\x1a\\xf8j3\\x10\\x07&\\x15\\x1f\\xcd\\xaeo\\x8a67v\\xc2\\xa4\\xd8\r\\xd4\\x94+r\\xa0d\\xc3\\xaa\\xafk\\xc2m\\xa8\\x1a\\x9d\\xc4"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xbd\\xae{\\x7f\t\\x87mq:\\xce\\x97\\x03w*\\xbb\\xac!p!\\xab\\x9c\\xf7q\\x0ew\\x0c\\x9dg-h_\\\\xe3e$\\xbb\\xc6\\xb29+oz\\x85\\xa4g\\x1c\\xee\\x9d\\\\x84k\\x14\\xcev\\x87w\\xa7\\x0e\\xc1\\x85\\xde\\xb6\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xc4f\\x9fp\\xa5\\xd0\\xc0>\\xae\\x0ek\\xef\\xa9\\x12n\\xcaoq\\xca\\x1d\\xbbr\\x18\\xd1\\xdbe6\\x9b\\xa9\\xeavy\\xabn*j\\x9d7\\x89au\\xd1\\xd9\\xad\\xde\\xbf'"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1z\\xef5\\x82q\\xc2\\x01\\x83\\xc5\\xb8zn@\\xd2<\\xa3q\\xc0\\x1d \\x13\\xf4\\\\x15\\xdck\\x03?\\xdcj\\xea\\xf4t\\x07@@ \\xa7\\xde\\xeb4\\x86\\xd3\\xdd\\xf9\\x85\"\\xb4\\xa8\\xb9\\xce\\x00~m\\x08\\x13\\xf1\\xbe7;bfl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\xaaz\\xad\\x8b\\xbc\\xb2\\x86\\xaf\\xab>\\x82s^`0\\xf9\\xea\\x99d0\\x9d\\x81)\\xbcq(\\xb3\\xb7|\\xab\\xc4\\x10\\x05\\xab\\x80m\\x82\\xf6\\xbbb\\xd7\\x1a\\x8ew\\xe6\\xc2\\xe5"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xa4\\xe3\\xf1\\xf2\\xae\\xaf\\x90\\x03\\xe9\\x16\\xdb\\xbe)\\x9e9\\xdc\\xcf\\x92[\\x90\\x8d\\x97j\\x12\\x16,@\\x00\\x1b\\xe1\\x8f \\x05\\xfb\\x10\\x182\\x95l\\xe4\\x0c'\\xf8!\\xf22190!\\xa4\\xaefu\\x8fk|\\xe6sn\\x1d\\x98\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\xaf\\x97\\xd9\\xd2'|\\xbd(\\x7f\\xb233 j\\xcc-\\xf3\r\\x81muivm\\x1f\\x03i\\x81\\xe3\\x0e\\xd5\\xff\\xab\\x87\\xbet\\x85\\xd4\\x82\\xfc)r\\x16%/\r\\xf1"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xc3\\x1b\\x9f\\x848\\x0b\"=^\\x0fd<\\xd2\\xa3\\xc7`t\\x9e\\xe1\\xc3[\\xb6\\xbe\\xaf\\xf9\\xd2\\xdc\\xf6\\xe9\\xed=_z\\xb8\\xc1\\x93h7g\\xac\\xb3\\xa5\\xa5\\xf8\\x15\\x81\\x10\\xd0\\x90\\xa2\\xe0\\x10\\xf1\\x90z\\xfcx;s\\x87\\xfe`c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\xbe\\xb1d\\xe4\\xd4\\xa0\n\\x06\\xccw\\xa7\\x10\\xe1\\xd5\\x0f\\x7f:\\x8d\\x14\\x12\\xe5p\\x10\\xfe\\xc5y\\x94\\xd4g\\xdegw\\xc1\\xd6&\\x14x\\xe3\\xa4\\xd1a\\xd6\\x97\\x06h\\xf0\\x15"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\nv\\xce]\\xfeba0q^\\xbd\\xdbk`x\\x14sfya\\xb6w\\xc7\\x10\\xb1o=k\\xb1g\\xa1\\xa6\\x19f\\x94\\xa6\\x9b\\x9e\\xfc\\xe7x\\x80g4{u\\xb8\\xc5-\\x89&\\xc4\\xd13\\x82\\xc6m\\xc8\\xecj\\x97\\xb5\\xf1q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8`o/\\x14)\\x124\\xd0jz\\xec\\xa6\\xb5j\\xc8vu\\xc0\\x11<\\x1c\\xb0y\\x93g\\xb6t\\x17\\xb6\\xa1\\xb4\\x136\\xfd2\\x1ckg\\xb3\\x81s\\x93b\\xac\\xafvz"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xbc\\x10\\x9d\\xcf\\x99ek\\xa0j\\xbc\t\\x12?|o\\xefd\\x06\\xe6\\x1e\\xf3u\\xecw\\xbf6\\x9ek\\xce\\xb9,\\xdd\\x03t\\x81]\\x9f\\xbc\n\\x17\\xac\\xbe^\\xa1\\x9b0'\\xa0\\xcehl\\x0c\\x91\\xf3v\\x07\\x9c\\x03\\xfff!tr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb/n8\\xbe\\x07\\xa7xq\\x14\\x80\\x04\\xa2j\\xbf\\xf3db\\xd6q\\x11\\xc2e\\x0e\\xde\\x88\\xee\\xbe\\xc5s\\xabva\\x83\\xee\\xec\\x18\\xb7y\\x8d\\xe5\\x98\\x80\\xd2=\\x00x\r"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13\\x85#\\xf1\\x93\\x1c\\xbd\\x82\\xdc\\xb6\\x99\\x97\\x99\\xe4\\xc8{:\\xe7\\x89\\xb1\\xe5\\xcc\\x8b4\\x8fg\\x9e\\xa2\\x96\\xa0\\x88l&\rr\\xdc\\x1c\\x89\\xb1\\xac\\xd4\\x80k\\xd8\\xda\\xbc\\x18=!?v\\x03.\\x1f\\xef\\xfc\\x85\\x17#\\xa4fk\\x17\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m^^=6\\xf9m\\x15\\xe4\\xd6\\xfb\\x00$\\x8f\\x98\\x16i\\xa0\\x952\\x0cp\\xd9\\x18\\xee\\x068\\xd5\\xaa\\xbagnh\\xd6\\xa3\\x975`\\xd27b>\\xe6\\xf5\\xee\\xd3\\x88d"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w!\\xebo\\x0c\\xc5\\xb1\\x1d'\\x8en\\xb1\\x81\\xec\\x8b8a\\xc9\\xdfl\\x1c\\xc7\\x94u\\xa5\\x93\\xee\\xfe?\\xbbad \\xcd\\xea\\xe2z\\x9c;h\\xb62\\xf8\\xd7\\xc1\\x7f\\x0c\\xf7\\xcb\\xe1\\xe1e\\xfai\\xe5\\xc6m~\\xac\\xb2g\\xaa\\x8e\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x96\\^\\xe2h\\xc3\\x81\\xe1q\\xb7\\xfc\\xbcw\\x1b\\xd1\\xda\\xa4\\x19j\\xdbw`f\\xa2\\xe75\\xa2\\x1e\\xff\\xc1\\xfb\\xdc\\xca\\x1b\\xb3\\xdc\\x16\\xad\\x15\\xc4\\x04\\xf0\\x1a\\xe0o s\\x94"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xae\\x06\\xbd\\x89\\xee\\x83do\\xfa|\\xd2s\\xc6\\x87#\\xac\\x9e\\xb3\\x06\\xc7\\x7fs\n=\\x10\\x11\\xff\\x90\\x80\\xbf\\x9e8\\xb8{5\\x8c\\xc4\\xc7\\xdcl\\x9d\\xca\\xb9\\xd1\\x1a\\xea\\xd0:\\xa7t\\xe1\\xb1\\x87\\xb4)\\xba\\xcb\\\\x13<\\x98dm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xc5\\x10\\xe61\\xd6\\xde\\x8e\\x19\\xc5\\xe7\\x891__h\\x9b\\xdcf\\x01q\\xd0g\\xb4\\xab\\x9a\\xe1\\x83\\xe8\\xb0\\xbfs\\xd5\\xcb\\xe8q\\xa7v\rr\\xfc/\\xab\\x92i\\xe2_\\xdf"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xc3\\x06\\x0e\\xf4\\xd5\\x98\\xafd\\xb9\\xdb\\x97\\xb8\\xd3y\\xb7\\xfc\\x8a\\x0e\\x01\\xe1\\xc6\\xf5y/\\x82\\xc1\\xb7?\\xc5\\xe7\\x93_\\xd4n\\x084\\x8e\\x1cm\\x9bs\\xf7\\xa5^\\xff\\xee\\x17\\xb5lic\\xcb\\xb9\\x98\\xd4m\\xc6\\xa3\\xb3\\xa9\\x88\\xdd}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xd8\\x86^\t\\xf2\\xb1\\xe0<*\\xea0\\xe2\\x9c\\xd8\\xae,$r\\x0e\\xc7\\x96\\xcd\\xcc\\x05t\\xeb\\xd5\\x9e\\xd5\\x05\\x80\\xacq\\xda\\xe0j\\xec\\xb7\\x02&_\\xd9ev\\x14\\x93i"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\x8a#\\xdd\\x11\\xc7\\xbf\\xa56\\x9e\\xd0j:\\xfc~82\\xd3\\x93\\x1d\\xc7\\x0b\\xb4d\\x08\\x0b/l\\xe1\\xd1\\xfb\\xbccq4\\x05\\xca1?;'\\xe6~}k\\xeb\\xd4wq\\xc7d\\xcd\\x1c\\xa8\\xd7\\xf5\\xe7\\xc7\\xb6\\x81\\xbc\\xe9q^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1\\x9c\\xff\\xb8?\\xc3\\x94\\x03\\xef\"c\\xc7e\\xc31\\x92^\\xf83>\\x9a\\xc6f\\xa0\\xa8\\xccp{\\xa9\\xaf\\x02\\xe2u\\xa0\\x13v\\xc1\\\\xacm\\xee\\x930\\xc38\\xb5\\x82\\xa5"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7br\\xee\\xf2\\xab=$\\x8c\\xbc\\x06\\xcb$\\xa4\\xab{\\x12\\x95\\x97\\x0c\\x9f}s\\x899k\\xf6\t\\x12\\x88\\xc4\\x81\\xf5o\\xbf\\xdcu\\xafw\t\\x1d\\z\\xcd$:\\x06\\xe0_\\xa5}\\xd2\\x1b\\x8e\\x04\\x0b\\x9a\\xe8\\xb7\\xdc\\xbf\\xcf\\xb6\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\xe3\n\\xb2f*\\x8f>\\xc2\\xf6\\xf4\\x96eq\\xb9\\x9b\\x84\\xb0\\xb2\\xfa\\xff\\xe0<\\xbd\\x1d\\xcf\\xe4\\x994\\xd1l\\xe2\\xdf\\xde\\x8c\\x1b\\xea\\x0e\r\\xfc]c\\x12\\x82c\\xd6\\xb4\\x80"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\x9b\\xca}}\\x18n\\xaagq\\x14x\\x9b6p~<\\xc8y\\x84\\x81\\x9b#e\\xdd\\xa7\\x83k\\xcc\\xd0t\\x94>}\\xeeg\\xb8g\\x13\\x05!k\\x90k\\x06p\\xfe\\xf3u5w\\x9bn\\xf3s<s\\xeb\\xecs\\x1b\\x8c\\x18\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x853\\xb9\\xf1\\xa0\\xfd\n\\x13\\x1c\\xc6\\x82\\xa7\\xaf\\xfde\\xf5\\xd6]:\\x1fj\\x81\\xf3&\\xeb^\\x0e^j\\xe8\\xe9\\xb8\\xd0\\xd1p\\x90\\xd8\\xd4\\x1f\\xf7h=\\xb7_\\xfe\\xd0g."
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce{<z\\x19\\xa8h\\xfb\\x06h\\xe0y\\x9a\\x90=\\xd8\\xb9\\x98/\\x0e\\x1b\\x90\\xf2'q\\x90\\x8a\\xaa\\x1e\\xfb\\x8d\\x0c@\\xb7\\xabw9\\x91y\\x06\\xc1\\xd1\\xd3\\x1e\\xf0i&xdhv\\xb2\\xe3\\xbd\\xa4*k\\xf1\\xe60\\xb6g4\\x86\\x98\\xcea\\xb4\\xe4\\x06\\xa5\\xed\\x82\\x06\\xb5\\xca[\\x92\\xdf\\x93\\xf6\\xc7\\xc9\\x8d\\xa9\\xe6y\\x8d[\\xc3d\\xe5\\x9c\\xcf\\x81\\xe5\\x0b\\\\xb9\\xe8\\x91g\\x13\\x13y\\xe96\\x96\t;;=\"\\xfaoiy\\x12]\\xc2@\\x16\\x18\\xdez\\xdcf\\xad\\x90\\x1fm\\xd9\\xd7lyo~j\\xb4c\\xb4\\x85)\\xcb~)\\x06\\xe6\\x19;\\x88\\xe3\\xf0\\xe6\\xb4j\\x16 \\x95xmj\\xc4\\xcd\\x0b\\xc5\\xaaed\\x1e\\x96\\xecbs\\x98\\x19\\xec\\x0e\\x80\\xfa+\\x8d_g\\x94_\\xd5\\xa151\\xbe\\xf5\\xe8.\\xaa\\x81\\x1b\\xd97\\xb8\\xbe\\x86\\xbf\\xa4b\\xf2\\xd81i\\xc7\\xc9#\\xbc\\xe48qmnj:\\xd3y\\xca\\x02\\xd4\\xdan\\xe5fe\\xdf\\xf2\\x98\\xfc\\xfd\\xfd1\\xd1\\x12w\\xd7i\\x00\\x90+p+\\x8b\\xf5e\\xcd"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\xa2\\xb7\\xe5\\xe0vq\\xda\\xb3\\xd1\\xb2\\x80\\xc7&\\xfasq6\\x85\\xc44~\\xb4&\\x0b\\x85\\x91h\\xbf\\xfd\\xe8v\\xd8\\xe7\\x80\\xb0\\x9e<\\x95\\xd4\\xb81p\\x93y\\xd8k\\xf6g\\xa3\\xf5dk\\xcdx{\\x802\\x8fp\\x17\\xf6\\x01er@\\xbb\\xdf\\xaa_\\xae\\xb5p2g\\x02\\xdf\\xf7\\xfc\\xa1>\\x99\\xfe\\xfb\\x06\\xa68\\x96\\xd9\\xaf\\xa3\\xfdv\\xed\\x16\\x00\\xb1)r\\xc9`;\\xf9\\xa4\\xc6\\xb4\t\\xae\\x8f\\x9a\\xe9 \\x1f\\xd1\\xbfz.x!\\xe9s\\x10|i\\xc7\\x89\\x9d#\\xf2\\xc7\\xf4\r\\x1b\\xc2\\xcb\\xbb:\\x9f\\x18\\xea\\x8f\\xb66+\\xa1\\xf1\\xb1\\x86\r\\xfcv\\xa6\\x96\\x8b\\xed\\xb6\\x96\\x11z\\x15\\xf9\\x18\\x18\\xa82<p};|\\xbc+\\x98\\xc1#\\xfc^e*\\xacd\t\\xffd\\x85\"\\xe7\\x9e]mu0j>\\x98\\xcf\\\\xcez4\\\\xad\\xdafo\\xdfy\\x88\\xe5\\xe4\\x16\\xa7`\\xe6\\x06g{\\xd7:)\\x7f\\xf9\\x9b\\x84b\\xfe\\xd2i\\x81#\\xfc`'\\x92\\x85\\xfe\\xf3n\\x8a\\xcd\\xc77\\x9c\\xd6w18\\x17k\\xc4|"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\x0e\\xaf\\xf9\\x92}\\x9b\\x12-\\x81yjk:\\x97o\\x12\\xe2q2\\xf7\\xe7ni\\x7f\\x1f\\xa5\\xfe\\x99\\x97^3\\xf2x\\x08o8\\xe3\\xf2*\\xe6~\\xfd\\x14\\x155\\x89n\\x86d\\xd0\\x06\\xa3\\x9e\\x11qn\\x0e\\xd7\\xde5\\x0e\\xda\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6p\\xb8tj\\x8caez\\x81\\x8erf|\\x12\\xd7\\x98;i\\xbf6>\\xe8x{\\x18\\x80\\xf0l\\x8c\\xc7\\xe8\\xcb[\\x02\\x17\\xc6\\xc6/\\xff7eq\\x88\\xb3\\x16q\\xd3"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\x1ek\\xc3\\x99!\\x9f$w\\xdd\\x02\\x1a*\\x18\\xe4\\xcb\\xde\\xff\\xf7<\\xfa3!\\x07\\x87&\\xff\\x7fp\\x92#\\xae\\xcbs\\x952\\x9dmwzc*jy)\\xac\\xc9\\xa0\\xc0]\\xdb(\\xa1\\xea\\xbb\\x9d\\xf7\\xedw\\x9bn\\xfe\\xcc\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\x00\\xd4j\\xf7\\xfd\\xbe\\xd7\\xdd\\xa6\\x06\\xd7\\x0b^u\\xcc\\x7f\\xf4\\xe46\\xcfj\\x83\\xd3\\xb4\\xcb\\x1ak\\x90$a\\\\xbf\\x07\\xde5-\\xa8>\\xcd\\xc7/\\xbc\\xd5\\xee\\xc0g\\x1c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\x827\\xa0\\x9e\ty?\\xa3\\x96\\xb2\\x94\\xedo\\x1a\\xb66\\x16\\xeb\\x88#z\\xdeo\\xff\\x85\\xad\\xbe\\xd7\\x08o\\x17c=\\x7f\\x1f\\xa0s\\x8a\\x1c\n\\xa3\\xfd\\x80}\\cj\\x13\\x92-\\xc2n\\xd0\\xa7\\x9c\\x8f\\x8d\\xea\\x8b\\x8a\\x01\\x1d\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\x88\\xc8\\xfa[{b\\xaa\\x87 \\xcd\\x80p\\xc4[_\\x16\\xc3/\\xd8\\x9e)\\xd2\\xea=\\x10\\xac\\x11\\xb9\\xc3\\x83\\xc8\\xcb?\\xf8o\\xf1\\xf8d\\xdd\\x18\\xc6\\x08\\xe7\\xa6\\xfa\\xb0\\x1c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd4\\xdd\\xeb\\xf59\\x19u\\xa2\\xde\\x84\\x9d\\xd7/\\xe0\\xaa\\x15\\xc0\\xa0\\xfe\n>h|n\\xe3\\x04\\xb9\\xcfg\\x08\\xadz7}-4\\xa2e\\xbay\\x8c\\xae\\x0c\\xdc\\xd2\\x88\\xa6#\\xb6t\\x1b3v4\\xe7\\xbcf`|\\xa1\\xbe\\xf5$\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xf1\\x92\\xce\\xbc\\xd3\\xb3\\xf9\\x02\\xe1e\\x89\\x14\\x88\\x991&\\xafv\\x98\\x86*\\x13\\xc3\\xe9\\xc3\\x82s\\xb1\\xcavj\\x94\\xa5q$]\\x89m\\xcbf\\xd5\\xb1g$\\xbf#\\xec"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\xa8%40\\xb9\\x92\\x11\\xd6\\xd07\\xe7@\\xefs%$^\\xa6i\\xa9\\xa6\\xf9\\xdc\\x08\\xa3\\x0b\\xdc\\x81\\x9c\\x98\\xd7\\x86fw\\x9c\\xbc\\xfd\\x08\\x00\\xe5\\xa7`\\xf5\\xbe\\xc5)\\x00_\\xb4\\xe3\\xe8\\x18\\xeb\\x18zp\\xa9<\\xf4\\xccf\\x03!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\x85\\xb4\tr\\xd5c\\x982a\\x18q\\xe5\\x07\\x9f\\x08\\xd8ck\\xed\\x94q\\xc6m\\xca\\x8d\\xc6\\x92\\x89\\xb6\\x15\\xa7d\\xdbox\\xc9k\\xbd\\x8e\\xbd\\xb5\\x92ag\\x81np"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\x16\\x85x\\xea\\x14\\xfc\\&/\\xde\\xdf\\x04~m\\xf5\"*\\xc6\\x0b\\xdc\\xbe\\x91e\\xbd\\xd1\\x92\\xc5\\xf3\\x95\\x1c\\xce\\x8f*\\xfc\\xa1}3\\xc1q\\xb19%\\xdb)z\\x85/\\x88\\xd30\\xe2\\x10\\xedau`j\\x0b=#\\xc2\\xd6\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j@\\x1a!(\t\\xc9\\x8cy\\xfa\\x1a7\\xf6\\x14\\x12\\xdd\\xb1p|\\xa8c \\xfe\\xfe\\xdb\\xbd\\x83m\\xd4\\x11\\xb1\\x17c7(\\xd5\\xf5\"si\\xc5wa\\xec\\xeb\\xb5\\xdf\\x0e"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde$&\\x16_\\xe0\\xc5\\xeb\\xc6\\xdf\\x048\\xbd\\xc75\\x08g\\xb22\\x90io\\xa7\\xb2\t\\x80\\x17t\\xda\\xedk\\xa4m\\xcff\\xcamau\\xbd\\xa0i\\x87\\x08\\xa4-`\\x83\\x0co,s\\x06\\xe2\\x86i\\xf8bz\\xcbpm\\xa5\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\x10qh\\x15\\xec]j{\\xd5\\xdb`)n\r)\\x11\\xf7#\\xbf\\x1e8myp\\xfa\\xc7\\xdc\\xf7n8\\x1c\\x92\\xb2\\x91+?];f\\x8b\\x84\\xdam\\xa4\\xd1\\x8f\\xdd"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\xf8*\\xb5=>\\xc3\\xd7l\\x19d\\xd7s8\\x82\\xd9\\xb1\\x99\\x85\\xa0m]\\xf1\\xcbg\\xe4\\x15dw\\x88\\xa5\\xff\r\\x88\\xe0e\\xbcj]\\xd7\\xde\\xdf\\xcc\\x16\\x16\"7b\\x1e\\x07~)yep\\x14\\xa5v\\xe0o\\xfd.g\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03w\\xd1\\xbc\\xe7$\\x88\\xd6\\xa0\\x8e#\\x07\\xab\\x1e\\x88\\xb1\\xf4\\xf3\\xa6\\xeak\\xe0\\xf1z\\xaew^\\x16q\\xe3\\xa5\\x99\\xb9jieu\\xb9\\x0b\\x01\\x15\\x83\\xa2q+\\x07w\\x93"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\x85\\xaa]hs\\xeffz\\xb5\\xbe\\xd1\\xa57ql$,\\xc7qi\\x92x\\xa4\t\\x86jwv\\xfae\\x0br\\xc8\\x8e(n\\xc9p\\x0f\\xee\\x95\\x98\\xb6p\\x85\\xecp\\xc2\\xec>\\xe8\\x11\\xf0\\xa5^\\x1ep\\xe2y77!\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaex\\x0f\\xc2\\xb8]\\xd1y\\xfb\\xb7\\xd2\\xc1*b\\x9c\\xa4\\x0fk<j/`5\\x9c\\x16\\xa8\\xef^p\\xe8\\xc1\\xe6k\\x04\\xe21\\x11\\xc69\\xdc\\xbe\nk\\xd0\\x1aoh\\xa4"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a?\\x18\\x979\\x8fjin:(2\\xfc>+\\xbb\\x0b\\x14\\x12\\x8d\\xb3+\\xb9j!\\x13l\\xcc\\xe7\\x14\\x13.@\\xa4\\xe0\\x88\\xbf}\\xa3\\x9d\\xa28\\x94\\xe1g\\xb0~3l0g\\xfe`\\x16hf+h(\\xc0\\xea\\x96\\x810\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%i\\xab\\x8f\\xd4\\x8et\\x97\\xb0l\\xc2\\xc1\\x1a\\xf1$\\xe60\\xda\\x86\\xc0\\xefx\\xe4\\xfd\\xce.\\x8bl6\\xdfg\\xd7~|d\\x98\\x02\\xe7>9y\\xd8x\\xf8\\xf4\\x05\\x8ej"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\xc7\\xa6\\xdc/\\x0c\\xa7\\xae8\\xc0\\xc5\\x82\\x0e\\x81\\xba\\x91\\xdf\\x9a\\x92\\x1a\\xe0b\\xda\\x8d1\\x15\\xb8ja1\\x1a$q\\x8a\\xa0\\xd0\\xff;>@\"\\x88\\xfdzf\\xd4\\x12\\x15\\x14|\\xff\\xd84\\xa9\\xcd\\x0c\\xbd\\x95\\x0f\\xdc\\x0chn\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000kr/\\xa6:i\\x9c\\x18\\xb4kc4\\xee\\xf2\\xccyj\\xef\\x18b\\x8c]&\\xe6\\xf5\\x9c=s\\x9c\\xed\\x1c\\x01\\xe0\\x9d\\xc6\\xb1\\xeaz=`h\\xef\\x95\\xc5\\x07\\x87\\xf0\\x1c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042l\\x81\\xb9\\xd0\\xd5-\\xca\\xaa\\xa7\\x84\\xc4\\xaa\\x84\\x88\\xd5\\x12l[\\x8e\\xa1`\\x1a\\x84\\x9f\\xd0\\x8b\\xd8\\xa83\\xdf3\\x07ilsku1b-\\x18\\x0c\\xe9d\\xa7o\\xaa\\xc6\\x9bs\t|u=f\\xee]&\\xafo\\xf7\\x17\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1cy\\xf9\\x0c\\xf1\nu\\xe5*\\xe3\\x84y\t\r\\xe6\\x10>-z\\xdcg\\xf7\\xc6\\xd6>tzx9\\x0b\\x1a0\\xb57\\xc5(j7;\\x1a\\x966\\xf1\\xfc\\xa4\\xc1\\xc6\\xee"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\xc8xu\\x8f\\xb8y\\xb5\\xfe\\x84b\\xb5\\xb3\\xae\\xfa\\xa4;g<\\xb2q\\xd7\\xc9\\xfb\\x8b\\xc9\\x9c\\xcbe\\xd9\\x1bhu\\xe7fgp\\x1f6\\xf7\\x04\\\\xd4\"a\\xe8h\\xb0wo\\xee\\xc62\\x9bo\\x04q\\x82\\x078\\x98\\x935\\x13b b,ib\\xd4_;jk\\xe0\\xd1\\xa0\\xad\\xd1\\x0f+\\x11\\x10\\x1e\\xb7\\x1b\\x92\\xbd\\xca\\xa8\\x0b^}\\x13\\xeb`\\xc3h\\xda\\xa1\\xc8\\xabpkw\\x04\\x1e\\x9d\\x8b\\x9d4zl\\xac\\x84\\xc4\\xa4\\x80(a6h2\\x9c`\\x9c-\\x91\\x85\\xc8%\\x0c~^8\\xed\\x9c\\xbco\\xee\\xac\\x16\\x93^i\\xce\\xf37\\x9e|\\xb8\\xa4\t\\xd9\\xee\\x1f\\xb7\\x04\\x98\\x16\\x95\\xf3g\\xfc\\x89\n?\\xd3*\\xb3\\x11(\\xd0\\x99\\xd9\\xec\\xd8\\xa2vp\\x7fl\\x9d \\xb9\\x16!\\x18\\xac\\xe3\\xcdw\\x89>|\\x83\\xe9\\xff\\x96\\xe5v\\x0c\\xd2o\\xdd\\xa36\\x8f\\xd7\\x05\\x80\\xe4of\\x0b\\xac\\xf0\\xa1\\x8bo\\xb9\\x7f(d\\xd2a\\xc6tp\\x83d\\\\xb0\\x832x6\\xae\t\\x90\\x98i\\x0e\\x17\\xbf\\x93\\xc9\\xd2\\x95o"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\x88\\xa2\\xf9\\x9b.m\rcjk\\x12g\\xf5\\xe47\\x92c;\\x01i\\x06\\x02\\xd2uh\\xb7\\x9d*\\x9cz\\x99\\xa2/@xj\\xb1\\x8b\\x9b\\xea#\\x06\\x91=\\xdd\\xa2\\x167\\x9a\\xef\\xbb\\xed\\x0c\\x91v\\xfe\\xbd\\xcb\\xb2\\x8d\\xfc\\x84\\xcd?j>\\xd3\\x95\\xe2t\\x13\\x00\\xecz_$d\\x105p\\xb5\\xcf&q\\xbf\\xbd\\x1c\\xebl#t\\xf90\\xa3\\xad<<\\xd6\\xc7\\x91\n\\xd64\\xa9k& \\xb6\\x128~\\xf2\\x91\\x81\\xa3\\xbe\\xe7\\x1e+\\xc9\n\\xf9+\\x07c,d\\x0b\\x16p\\xfexi\\x95-\\xfes\\x8cd\\x07'\\x18\\x1a\\x82n\\xb3\\x17\\xec\n_\\xa9\\xee\\xf9e\\xb9\\xc2\\xcdo,\\x08!\\x07\\x07q\\x85\\xe2\\xb4\\x00u\\xae\\xd3yw\\x94\\x14!|h\\x9b\\x03\r\\x06\\x1a\\x193\\xa2\n\\xbf\\xe1\\xab\\xe9\\xb8\\x02vk@\\xe1&\\xd6f\\x82w`\\x8c\\xdf.i\\xed%\\xd6d\\xb8\\x11&)\\x12\\xaf\\xe4\\xa0\\x85\\xa46\\x9c\\xe0w\\x18\"\\x9d\\xf9\\xd8\\x93\"\\x01\\xbf\\xf8_\\x8d_\\x98\\x10h\\xee\\xf1\\x86nl\\x05\\xd2\\x01s"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xa7\\xd7>}\\xcaq\\xc2o \\xdf\\x1acx\\xbd\\xd2y\\x8b\\xb5\\x00\\x03`\\xf5\\x97\\xc3\\x14\\xb6\\xee\\xd4\\xea\\xa2\\xc5'<#\\xf5\\xaf\\x00\\xea\\x80\\xdf/1\\x0c\\x12yf\\xae\\x1bp\\xf1\\xfb\\x81\\x05\\xbf\\x00f\\xed\\xaa}\\xc9w}\"/\\xd5z\\x02\\x05\\xe1\\x00\\xb5\\x8c\\xbc\\xc4v\\xae\\xb5\\xf8\\x98rz\\xcf\\xaf<\\xc1\\xe9|xcy~\\xf8+\\x91\\xd7\\xde\\xfa\\x00\\xcf\\xc4\\x02\\xd4@i\\x07n7\\x03\\x05\\xb3t\\xd12m\\xabj\\x88p7\\xa0\\x18&\\x91\\x10\\x95\\x94\\xf3,\\xbd-}!\\x8c\\xdc\\x9c4i\\xbfh\\xc7\\x0b\\xa9\\xad\\xf4$\\x95\\xf0\\xcf\\xf3s\\xf80\\xa0\"s\\x1a\\xa4\\xfe\\x86\\xf5j>\\xd8\\xa1\\xd5\\x96j\\x998j&\\xa8\\x16\\xd8i\\xa1\\x0b\\xcb\\xd7 \\xe9&\\x87\\xe5eb\\xbc\\xe0\\xa9\\x1ce[\\xa8\\x95\\xda\\x9a\\x0b\\x95c4\\x9e\\x83p~\\x0b*\\xe6xq[\\x00\"d\\xc6\\x16an\\xa5\\xd6\\x12\\xa4y\\xfa#n\\xac\\xf5l\\x9c\\x1c\\x91\\x08\\xe9\\x8d`\\x1f\\xdf\\xff)\\xc3\"\\xb0qp\\xbanwkg\\x88"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?r7\\xa3!\\xbd\\xcce\\xf9'&ku\\x08\\xf0t\\x94\\xb9\\x9a\\xd6\\x88\\xd8\\xfb\\xe9)\\x91\\x96\\xa43\\x13\t\\xdd\\xcf|b\\xd9\\x9e\\xbco\\x83\\xb9t\\x10\\x97\\xad\\xff\\xf1\\x92&\\x11\\xc9\\x0c\\x02\\xb8\\xf1a)%\\xadn\\x93\\x94\\x83\\xee_\\x8d\\x8b\\xbd\r~2rx\\xe9bf\\xda\\xca~\\x15d'\\xe0\\xa0\\xb7t\\xc8\\xfe(d\\xc9\\xc3\\x15\\x81o\\xa1\\x9f\\xb4\\x99%\\x02\\x08o!1xvu[:\\x99u\\xa0\\xd9\\xf2l\\xf45n\\xef\\xb0+p|\\xb3w\\xe4\\xf1\\xb5\\xaa^\\xabzt@\\xff\\xdc\\x9c\\x8fn\\xb8\\x0b0\\xbf\\xf2\\x14\\xc9a\\x9f\\xc9>\\xf1\\x8apk\\x02\\xfb\\xed!k\\xb6\\xe7\\xf1\\xac|(\\xff\\xcc:u\\x17\\xbe\\xcck\\x0f\\xf8\\x8b\\xbc\r\\x0c\\xce\\x03%1\\xae\\xbd\\xc5}[b\\xb0\\x1c&jg\\xc3\\x14\\x18\\xbe\\x15\\xc5\\x93\\xaf\\xf1\\xcb\\x0e\\xd5\\x9b\t\\x1c\\xc8\\xf4\\xcev\\xab\\xa9\\xd6\\xfc6un\\xa9]4\"9j\\xe3\\xdflg\\xc9\\x01\\xda*\\xcc\\x8a\\x96\\xba\\xd1\\xa1\\x7fs\\xa0\\x13@\\xe7ym\\xec\\x95"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\x8e\\x83\\xd1\\xd2\\xdd\"rd\\xda\\xaa\\xed\\x05\\x08nbh\\xfc\\xa5\\x81\t6\\xd5)\\xda\\xfc ef\\x1b}\\xca\\xf8\\xab\\x1b\\xd6\\x89\\xf6y\\xe2p_\\xfc\\x13q\\x88\\xce\\x99\\xd4\\xec\\xa2\\xec\\x00\\xf1@\\x8c\\xbe\\xdd\\xcd\\x96\\x03\\xda\\xf1\"\\xe0`\\x88\\xb3?\\xa1\\xdf\\xa0w\\xc8\\xf0n*j6\\xaelnv\\x05\\xe6\\x8e\\x82\\xce[\\xaft\\x14\\x83\\x87h\\xcd\"\\xcfv\\xaa\\xf8t\\xc3\\xd2\\xe0\\xd0\\x9da\\xf6\\x11\\xbb\\xd3\\xc8\\xcd\\xb4jh:or\\x87\\xcd\\xbf\\xaan\\x7f\\xfd\\xe3\\xda\\xee\\x0f\\xe0=\\xa2bip9w\\xa7\n\\xd6\\xaf)\\xbe\\xb0p\\x8c\\xf7\\xc2\\xcatz\\xc7`l\\xf4:\\xbc\\x88)\\xc6v\\xd5\\xc6\\\\xa1\\xbcd;0\\x04\\xa2@\\xe9\\xe9\\xdc\\xb0\\x15\\xe3\\x8f\\x8a\\x01r\\xf4h\\xe6\\xa9\\xca?\\xa5o\\xd7\\xd2|\\x1f\\x17\\x97\\xd3\\xa5\\xa6\\xd2\\x97\\x00\\xcc\\x85v\\xaf\\x8c\\xb6\\x96{\\xc7>\\x90\\xe3]\\x97\\xb8m1\\x07\\xec\\xbb\\x05\\x83\\x01t\\xd5\\xd7_\\xe1\\x1a\\xea\\xaat1\\xd6=\\xa4\\x01\\x92t\\xaf\\x9e$m\\xaf\\x92w/"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xffb\"+\\x16\\xa8mm5r\\xf81&`n\\x9d\\xa8\\x83\\xef\"r6j\\xe5\\x80\\x9e\\x9e=c\\xfe\\xd6\\x9e\\xac\\xeb\\xc1^4t\\xa7\\xd1\"<4\\xe8\\xca\\xb9|\\xaf\\x85\\xb7-\\xc8 \\xa2\\xd8\\xdc\\x9e\\x15\\xeb\\xe8\\xf6\\xae\\xb6{\\xcd\\x1e\\xd7w\\xcc\\xf5t\\xcb\\xc3\\xc3@\\x16\\xc8-\\x8ax\\x1a\\xb2\\xd9\\x0e\\x9b\\xc7\\xc7\\xba\\x97\\xa9\\xda\\xe9\\x07\\xe5\\xd6\\xa8\\xaf\\xe2\\x12\\x94r\\xf8\\xae0\\x8fas\\xf5x\\xf2\n$\\xca7/\\xc8#f\\xfa\\x12\\x1d\\xa6tl/q\\x0b\\x93q\\xbc5<2g\\x9ae\\x0b+\\x11\\x1flh\\x7fv\\x82\\xecs\\xd8\\xd1i\\xe9\\xb5;\\xde/l\\x14\\xe8\\x01\\x9e\\x1c\\xfc\\xed?\\xe6\\xab\\xd0z\\xbe(d\\xd5\\x1bvel\\xeeoq4(56\\xac-\\xa0@\\x86\\xc1^\\x8ag\\xb6\\xb8g-\\xfa\\xe8\\xbat\\xbb\\xb8\\x1e\\x8c\\xc5\\xb9\\x17tx\\x07\\xe4\\xc9\\\\x11\\x10\\x83\\xb6\\xc5]\\xa4p\\xc4\\xb7\\x9e\\xeav-\\x1c!\\xe0\\x8f\\x13r\\xad~~\\xb6]n\\xb1\\x0f\\xa3\\xd1\\xb7\\xb1\\xa6w\\xfbj\\x0c\\x0c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\x04*\\xbd\\xb3\\x13\\x8a\\x1b\\xb4\\x18nw\\xb8\\x9b\\xf83\\xbf\\xa1\\xdct\\xf2q\\xec8\\x99nyx\\x0b\\x90\\xaf\\x11\\x15\\xf9ewo\\x82\\xa7\\x85\tbcp\\xb1)\\xa0i\\x03\\xec\\xc0i\\xc3\\xdde\\x15\\x84of\\xcatb\\x98dwa\\x97\\xffj7\\xda\\xb5\\x02vt\\xbb\\xf5\\xd9{\\x03\\xab@\\xea\\x8f\\x0c\\xe8\\x1ak.\\xaf\\xbb\\xcb\\xea\\xf7\\x82 \\xbe\\xc1\\xa1\\xbc\\x8c\\xf0l\\x84zb3\\x1d\\x8a\\x8c\\xe7\\xb8\\x86\\xdd\\xb4&\\x7f\\x8c\\x9eqv\\xd1\\xe2\\x82\\xed(/dv\\xc8a\\xa4\\x1d}\\xfd\\x97\\xa0\"?x\\xb7\\xf5\\xa7\\xf7u \\xb0\\x9c\\x90<\\xea=}j-\\xee\\xe3\\xfe\\xdb\\xae\\xbce\\xd49\\xfe\\xd0$\\x0f\\xd8\\x16\\xce\\xdd\\x1d\\x7f\\x7f\\xa8\\x98\\x0c\\xfc'6\\xb0j\\xa1b\n2\\xff\\xea\\xed\\x82%\\xa1k\\xdc\\xfa\\x1c\\xa8\\x9f\\xf3\\xa1-\\xed\\xd1\\xfe\\x91:u\\xe5\\xa7\\xc5\t`\\xf3\\xaaw{\\x81\\xf3\\xab;!<\\xf9t\\x03i\\xb9\\xcb\\x07fu\\`\\xd5\\xa7\\xa0\\xda\\xdb4l\\x93d7\\x052\\x17\\xcdc\\x9f\\x10"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\x14\\x125\\xa5\\xe3&\\xf28*\\xb7\\x8b\\xec\\x03\\xfa\\x81\\x98h\\xc5\\xc6\\x00j?c\\x8b|'\\x05\\xd0\\xcfl\\x02\\xc9\\x85\\xf7\\x9e5\\xec\\x06\\@\\xa6x\\xc9r\\xfa\\xd0\\x89\\xa8\\xd1\\x07\\x01p#\\xb1\\x13\\xa2\\x83\\xc7\\xd0\\x80\\xd2\\x0b\\xdb\\x134[\\xe7b\\x99f\\x99\\x0ci\\xa16\\xaf;i\\xa0c\\xb2g\\xf8\\x1c\\x8d\\x9c\\x0e\\xfd\\x13u\\xf5\\xe1\\xa9\\x9b\\xbb?\\xfc\\x0cs^]\\xf0\\x01\\x1c\\x97\\x88/\\x7f\\xf4n\\xa3\\x8f\\xdc\\xa0\\x95\\xb5\\xd3\rf\\x95\\xa4\\xe9\\xb5\\x98\\xdb\\xebn\\xef\\xd2\\xf9o\\xbc\\xf7\\x9f\\x07o\\xc1\\x916td|\\xc2sc\n\\x98\\xc6k%x\\xd8\"\\x8ar\\x00\\x03\t\\x00br\\xd4pv\\x8d\\xf6\\xe4\\xf6\\xdc\\x9b\\xe5\\xdcxy\\xe0\\x13\\xeb\\x85i0\\xcf\\xf0h1\\xe4d\\x10\\xaa\\x85sji2\\xd8v\\x7f\\xc8\\xdek\\xac\\x01\\x1d\\x83\\x8e\\xa7\\x94\\x83\\x9f\\xd4\\x03\\x8d\\xe9\\xfd\\xaf\\xfc\\xd3\\xee\\xe1\\xa2\\x84\\x8bk,z\\xda\\xdb\\x92<\\x8b\\xe64\\xddv\\xc3~\\xaf\\xf7\\xd9m2^i\\xda\\xbc\\xc3\\xb6\\xf6\\x10\\x16>"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2p\\x9be\\x97\\xacg\"\\x1b^\\xb8\\x99p\\xc6\\xc8\\xce\\x0e\\xa6v\\x93\\xfb\\xd9b\\xd53\\x10\\xcd\\xeb\r\\x17m\\x12%\\x19\\xf1\\xf4\\xa0\\xb3\\xa6\\x91h\\x9c\\xc2\\xe0\\xce\\xd85d\\x07\\xca\\x9e*\\x04@./\\xdd>\\xb1}umh\\xa5\\xfe\\xbco\\x17-a;h\\xcc\\x1e\\x97\\xa12\\xa7m\\x98!\\xff\\x94\\xcb\\x94@\\x06h\\x8d\\x08z\\x07\\x1aq\\x1e\\x1b\\xcfw\\xb6<\\xa2=\\xe1x\\x05x\\xf4\\xf5g\\x145\\x1d\t\\xf9w{4\\xa6\\x91\\x0e\\x11r\\xa3\\x0e\\x01\\x8d\\x12#\\x134{\\xe1\\x15l\\x12\\xa2q\\x00\\xd5\\xee\\xbacje\\x07\\xfdb\\xb0\\xed\\x92\\x1c\\xd5 x\\xb0 $\t\\x8e\\xc1h\\xb1o\\x9c\n\\x8dptcxq\\xb8\\x97\\xc2\\x0b\\x88\\x7f\\xc70r\\x01\\x0f\\xe5\\xfbd\\xe9\\x07{\\xb1c\\x18\\xe7\\xd24\\x15\\x80e\\xb2}\\x04\\x96\\x05f\\xa2\\xa4\\xf1\\x1d\\x16\\xdc>\\xa7y\\xb3\\xce\\x00\\xca0\\xb2\\xd8\\xe3!\\xf1[\\xce9\\x8e`\\xd5\\xda#\\xd9\\x06\\x7f\\xf6q\\x9c\\xef\\x1a\\x01\\xecz\\x7f\"?q=m\\xa6\\xae\\xf5o"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1<\\x86\\xaf\\xaf\\x80\\xfd\\xff\\xc0\\x84\\x1e:sb\\xf7\\xf246\\xdda\\x8cx\\x92\\xaa\\xb0$\\xd5\\xd4\\x9bza\\xc3i,\\xc66`8\\xc9m\\xa9i \\xaf\\x94{1b\\xb0u\\x04\\x81\t\\xfc\\x16\\x0c\\xbc\\xe7z\\xb3\\xf7\\x17\\x06v\\x16\\xc8\\x17n\\x8cm\\xe6l~\\x8bz\\x95'=\\x02\\x1a\\xa7\\xa7|\\x16\\xb7k\\x01i\\xbc\\xc2,?\\xb3\\xf0\\xd4\\xbd\\xb3\\xbfz\\xfe\\xc9\\xfc\\xef\\xb5l/\\x1d\\x1c\\xd0q\\x12\\x91\\xf4o\\x19\\xaa`\\xc0\\x06o\t\\x9c\\xa4\\x94\\x9d\\xe7\\x85\\xbdd\\xceur\\x80,.\\xb5r\\xeb!k\\xfc\\xce\\xe1\\xe8\\xfb\\x92\\x06sx\\xaa\\xf1t\\xfb\\xde8i\\xc2l\\x99\\xde\\xcf\\xa4\\x82\\xb2p\\xa2[2;\\\\x00\\xb7\\xe7\\x8f\\xb7f\\xa2}\\x13\\xa7\\xa4e\\xda\\xf3r\\xe6\\x8d\\xb1\\xb7v\\xea\\xa7ua\\x0f`\\xf7\\xdap\\x97\\x86q\\x11h\\xc4-\\xcf\\xab\\xf1\\xfe\\xfb\\x12\\xbb \\x04=^0u)\\xdd\\xf8\\xc2\\xa8cs^\\x8f\\x00\\x8cd\\x87!|]\\xb3+0\\x0f\\xa2\\x05\\xe3\\xe6\\xa7m\\x8b\\xb9;\\xf7\\xbd\\x9c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdbc\\x14\\xdey,\\xf8t\\x08\\xb4\\xd6\\x80\\x9b\\x84\\xa8\\x8d\\xda\\xbea\\xc9\\x9a\\x88`\\x84\\xae\\xd4\\xe8\\xca\\xab\\xb0\\xef(\\xb0\\xfb\\x10]>\\xf5v\\xff\\x9bf1[w\\xf7\\xe5\\xeb>\\xb8vlnk\\xd2{1 +\\xf3\\x9b\\x89?\\x83j\"\\xc7g\\xc5u!z9\\x9de\\x16\\xc9y2\\xc32+\\xef\\x92\\xb4\\xfa\\x0e\\x1a4\\xa7\\x90\\xc2[\\xef\\xeaf\\x04w\\x19\\xd2\\x9e\\xe9ni\\xa5p\\xf5\\x8d,\\x0c\\xa6\\x08\\xc9pl\ng6&k'\\x1ck\\x12\\xa8\\xaag?\\xfa\\xfbh\\xa7\\xe0h\\x14db\\xe0\\xf1\\x16\\x97au\\xb2\\xe1r\\xb6\\x0bp\\x93\\x0fy#\\x96\\xdc\\x97\\xb6 \\xb5\\x1d'l\\xff\\x98f(\\x19\\x05\\xd6g\nu\\xb9\\xe9u\\x97\\xe9\\x07\\x1d\\xd4\\x7f\\x8bi\\xb3s\\xf2e\\xd8c\\xaf<\\xa5\\x1b\\xe0\\x84{i\\xee\\xb9\\x88\\xef&p\\xb0.\\xbc\\xf4%g\\x9f\\x05y\\xa2u87\\x9fq,+\\x11\\x80\\x0c\\x8d\r'\\xaaju&\\x9e\\x98l\\x03\\x7f\\xf3\\x1bv-e+\\xaa\\xe6,\\xe3\\x180\\x15\\xecu["
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010*\\x90b\\x8a\\xf0\\xd6!\\x9f\\x05\\xb3m\\xbf\\xe1j\\xf2\\xf7\\xda\\xb9\\xdf\\xf4\\xf139>\\x9a\\x8f\\xa0\\xd3\\xdc\\xac\\xd9\\xcf\\xe2\\x9a\\xfd\\xa0\\xffi\\xee#\\x1b!\\x8f\\x0f\\xc4\\x94\\xaf\\x7f\\xd0\\xa8(\\xd1\\x12\\x14\\xa5pc\\xf5,*r\\xa2\\xa5\\xe4\\xd5\\xc8|pr\\x17(\\xe9\\xdf\\x90\\xa7a^\\xd7\\xd6\\x98\\x9ew\\xa8;6\\x11\\xfcx\\xe1v~\\x05.\\x1b\\xbc\\xa7n\\x1f\\xc7\\x07w\\xb0\\x15(\\xf6\\xdc\\xc6z5\\x92\\xd3\\xb5-\\xbf\\x12}\\xf1\\x0c\\x8f\\x1c\\\n\\x80\\xf4w\n\\xb60\\xae\\xb4b\\xca\\xa3\\x84\\xa4@\\x96\\x13j\\xd7\\xb3\\xbb\\xf5\\xba\\x8cvn\\xb3q\\xf1\\x17\\xec\\xe7se\\xdd\\x9b\\xfd(\\xb1\\x98\\xf6\\xe5br\\x96\\xd3\\xcf\\xfc>\\xefj\\xc3\\x8az\\x87\\x8f\\xc7@\\x84\\x93\\xcd\\x9b/c9n\\xdc\\xdb\\xb83\\xf2)\"&\\x95\\xdc\\xbbb>\\xb9g\\x04y\\x86\\x0c\\x00\\x05\\x1b:\\x95\\x07w\\x84\\x83l!\\xd2\\x10\\x07\\xfb\\x92\\x923\\x93\\xb0\\xd0&-\\xac\\x82\ni\\xb2\\xc2\\xb3\\x83\\xe4\\x92\\xf3_\\xb3<\\xfc\\x84:8\\xb8\\x94\\x8c\\x9d"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xe6\\x84o\\xf4\\x80\\x1d\\x9c\\xe8\\xbe\\xce\\xcb\\x8b4if\\xd6\\x10\\xab\\x96\\x17#@\\x9c\\xcf\\xc6\\x86\\xe0d\tt\\x04\\xe4\\x06\\x9ah\\xff\\xf1\\xab\\x83\\xd2\\xe3y'\\xc1<\\xbc\\x98\\x9eq\\x14\\xd7w\\x87n\\x12)\\xc2(\\xae\\x05\\x96w\\xc3\\xaa\\xc2\\xacp\\x0e!w0^\\xaf\\x97\\x04\\xc2\\xbev\\x94u\\xa2k\\x1a\\xd6/i|\\xd5\\xa1\\xcd\\xfc\\xbe\n\\x86m\\xa0\\xbe=\\xe4\\xea\\xb9\\xc0\\xb6\\xc3h\\x89\\xa2r`\\xcao\\x07x\\xc9\\xad\\x9c\\xa1|\\x17[\\xea\\xfd?\\xa3\\xcf*\\xd7\\xc1[\\xbc\\xc9\\xe1\\xae\\xe6\\x95:,\\xd7'\\xd4pbxc\\xcdn:g\\x95\\x83\\x8a\\xa1\\xe1e:ugs#\\xa2\\x12\\xc1,\\xd8v\\x1c\\x08i\\xd2\\x98f\\x94o\\x0f\\xd0#\\xb7\\xaa!\\x9b\\xbb\\xee&0\\x9doe\\xe8\\xfds\\x82\\xd9<\\xe8k\\x07\n\\xdbsq\r\\xc1\\x07\\xb3\\xf3c\\x88\\xc7\\xbf\\x13)\\xc6\\xb9\\xfdz\\x81\\xb8\\x18\\x87d\\x99 s\\x8ef\\xa7v\\xc2\\x8d\\xd5\\xfe4e\ng\\xd9\\x82\\x8e6\\xd7\\xbe\\x9a\\x97g\\xccl\\xdd\\x17\\xf40"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6s\\xc1\\x98\\x1f\\x14\\xa8n\\xde\\xea\\x1d\\xc29\\x00\\x01u\\x88\\x83\\x1e\\x94\\xc2\\xd6 \r\\xcb'u\\xcbx\\x8bv\\x04~\\x0b\\x00\\x9ex\\xf0\\x8a\\xf7\\xdbt\\x8f\\xcd\\xbd\\xa9\t\\xec<<;\\xb0:`\\xeb\\x96\\xad\\xa1\\x9e\\xc7\\x99\\xf0\\x80\\x99'&7\\x83x$\\xfa/\\xcd&4s\\x18\\x91\\x8d\\x9b\\xbe\\x8d\\x16\\xbb\\xd3\\xae\\x0725\\xb9\\x00@\\xf4}[\\xee0\\xf3y\\xa2\\xe5\\xf9\\xa9\\xdbh}\\xef\\x00\\xd2\\xfe\\x19\\x85\\x9emo\\x01\\x98\\x8e4?\\x02<\\x03\\x9c6\\xc0\\x0c\\x15\\xfc\\xe7\\x8b\\xcbw\\x08\\x9b<\\xaa\\xab\\x96\n\\xbb\\xea\\xd0b\\xe1\\x10k%p\\xaag\\x91]\\x9cr\\x12}\\x02;\\xb7m7m8ir\\xdf\\xb8\\xe6\\x8c/\\xc3\\xf4\\x03q@01#\\x95\\x91\\xb7\\x0e9q%\\x19\"\\xe8\\xa5t\\xe2\\x0f\\xe3\\xf8\\x05\\x9e#\\xf3\\x82\\xc7r\\xbdgjt+*$f\\xaf\\x86a\\x17\\xb96\\xf1\\xb2\\x82{}\\xf8\"\\xe8\\xcd\\xf3\\xf9h\\x82\\x1f\\xd9pq`\\xa7w\\x81\\xe9\\xb80\\x1a\\x8c\\xe7mh==\n?r\\xf4"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:q\\xc85\\x17\\x8a\\xe9\\x0f2\\x84n\\x02\\x05\\x08\\xbd\\x96\\x91\\x89:'`akrxq\\xba-*\\x805\\x0f\\x91\\x0b\\xdb=]\\xa4\\xc6\\x1b\\xcc\\x06\\x9b\\x08hs\\xee\\x03\\xd3\\xc5\\x8b\\x00\\x1f[\\xf3/\\xb01\\xe9k\\xf1\\x07t\\xf1r\\x10&\\dj\\xf4{\\xfb\\xb4p1\\xdc{\\xf2v4\\xf1p\\xf7\\xe7ny\\xf8\\xb8nw}\\x03v3\\xbc\\xd0\\xc8\\xa1\\x9f~\\xe6\\xcb\\xaegaz^\\xf3\t\\x16\\xe5q\\xa7\\x9eb\\xd2\\x07\\x91\"\\\\xbck\\xab\\xe6i\\xfe\\xcc\\xf3\\xda\\xbar\\xf6\\xac\\xe1\\xda\\x05a\\xd4\\xfd\\x98>\\xe8n\\xe9lt\\x85\\xe2\\xa6>\\x1c\\xb7\\xaa\\xads,\\xf8\\xb4\\x06'r\\xdbw\\xf8\\x05\\x89<y>f\\xf9h\\x18\\xbb\\xa4>9\\xf3\\\\xb8iz\\xe3\\xe3\\xcd\\xcc\\x0b\\x93\\x01x*\\xaashs]\\x89\\x05\\xf98\\x8d\\x92v\\x98\\x14)\\xbe\\x7f\\xef\\xe5\\xf2m\rly\\xf9.1hv\\u\n:\\x0ey4{\\xde\\x06k\\xf0t7\\x7f\\x06\\xf2+\\xc3\\xb1nv\\xc5\\x16\\xe8m\\xca\\x9db\\x91"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\x15k\r\\x06(\\xd2\\xed\\xb0\\x8e\\x02\\x9fff\\x82~w\\x89\\x9a\\x03?\n%\\x87j\\xefgxp\\x19\\xe8\\xe9\\xbb\\xba\\xd7\\xf1p\\xde\\xce\\xbf\\x07s\\xee\\x81\\xc2\\x959\\x08\\x9a\\xdb\\xc9\\xdc\t\\xddj{\\xf8\\xa8\\xd0i\\xa9\\xeb\\xa8\\xafi;\\xb1+t!.f\\xbb\\x189r\\xb23i.\\x9b\\x83\\x98\\xbb\\xc9\\x1c\\x97v\\xe2\\x99\\x88l\\xb9\\x05l\\x1f\\x13\\x0f\\xf75\\xd9\\x05>.f\\xf7\\x94\\x88@\\xd6%\\x90\\x07\\xff}\\xeb(c\\xf1s%brm!.d2\\xe4s`\\xf8b\\xe7\\xbe\\x07\\xb0\\x9f\\x1c\\x19j\n\\xdf\\x08n\\xcal\\x90\\x9f\\xcf\\x02f\\xffj\\xd5c\\x7f~\\x0b\\xb5\\xdd\\x9f\\xaf\\xf4\\x86\\xf2\\x10m\\xc66\\xefj\\xff\\xfdk\\xe5u\\xa81\\x03'rrqt\\xd2\\xa6\rc\\xde5-\\xbd\\x03\\xff\\x92\\xbb\\x05\\xd4-\\x12\\x05$v\\xfc\\xf6we\\x9fm%\\xa9y\\xee(s$\\x12\\x0e\\xc6\\x04\\x9a:\\xc7\\x1c\\xda7u\\xe6\\xa0\\xf9\\xf5kz\\xad<\\xdd~4\\xb2\\xb3\\x96\\xb3\\xedgc\\xb5\\x88lc\\xfe"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\xd7\\xca\\x89\\x16z\\xa4}\\xca\\x10\\xa7\\xc2\\xd9\\x15\\x88\\xe9\r\\x16\\xd3\\x87\\x9d\\x0f\\xe6o\\xc1\\x8cv\\xda\\xd7p\\xe9ab\\xe3\\xd7\\x8a\\x97@#\\x1f\\xf7^\\xb3\\x8d\\x8e\\xf2\\xfelh\\xf4\\x95\\x9a\\x84\\xa6\\xf6\\xa9p\\xb5\\xb2\\x192?\\x94\\xfb\\x82*r\\xd1\\xae\\xaa \\xa6\\xf4\\xb0\\x8b\\xc2\\xae\\x07|\\x8b\\xd6\\x06\\xa7\\xce\\xfaq\\x8f\\xf3\\x1b\\xbb\\xc7\\xbf\\x8f\\x1b@5\\xd6\\xb9\\xc6\\xfa\\x86\\xb3\\x03\\x89\\xc7\\x9f\\xe4\\xcf@:\\x81v\\x932]\\x1e\\xf8\\xdfl\\x13\\xedi\\x1fu\\x966\\xfb\\x85(\\x18\\x84\\xabn\\x85\\x91:\\xd0\\x1e\\xf5\\x89\\x9c\\x7f\\xe2\\x03l\\xf5r\\xae\\x18<,\\xce[\\xda\\xe6\\xbb\\x9b\\x19\\x9e\\x0c\\x1f[\\xe7\\x94y 7\tlhoy\\xf8x]2%\\xebj\\x9b\\x98\\x818q\\xed\\xbb&14bx\\x1f}e\\x8cf\\x7ff\\xcc\\x9b@b\\xea7-+\\x1b\\xd0\\xf1\ta\\xae\\x82\\xe7\\x7f\\xa6d\\xba\\x80\\xa6{),\\x1c\\xdd2\\x12\\xda\\xca \\x1c\\xa7\\x96e\\xc0h\\xf5\\xad\\xfes\\xf0*\\x84u\\x1b\\xfc \\xc4\\f\\xce"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f#jol\\xbf\\x16\\xa78\\x059\n\\xee\\x08\\xcd|\\xf3\\xc0\\xb2\\xb5\\x8d\\x9e\\xce\\xaa\\xf1t>\\xdfl\\xa8h\r*eg\\x919\\x00\\x06\\x90\\xd6ws\\x17\\<\\xda_\\xf9\\xec[\\xd9\\x94mz\\xd0\\xb7o\\x94o\\xb9\\x814t\\x8f\\xe7\\xf3\\x19\\x1b\\xfew\\xa6/\\x1ci\\xfd+\\xbb\\x9b\\xe6\\xd6/c\\x00\\xe5&\\xc3k\\xfc\\xe8\\xaes\\x17\\xe1\\xf6h'\\xa4\\xf3|\\x11\\x8an1\\xef\\xd3\\xd1\tl\\xa5\\xe8\\x10\\x9a\\x8e#\\xf3fp\\x1d\\x8c\\x15}\\xe2l\\x1ar6/\\xf04h=r\\xc9\\x11\\xb7\\xf3\"\\xf1\\x89\\xaf3h\\x8au-\\x1c\\x99\\x10\\xb5p\\xd4\\x1dq=\\xcd\\xf7-\\xd8\\xcc6s\\xad@4\\x98'+x@o\\xbb\\xc8ved]\\xb3\\xafew\\xfc;k\\x80l\\x1b\\xba\\x8a\\xadg\\x83\\xc8\\xfd\\xc8]\\x90\\x182\\x07d\\x82bc\\x1a\\xf7w=\\xe2\\xb9\\xe6\\xa4\tc\\xe4\\x07\\xc9\\xbb\\x93\\xd9\\xde\\xc9ue\\x0b\\xd1y\\x08\\x00\\xf1\\x89d\\x86\\x19\tb\\xd9\\x82\\xe8\\x1f\\xde\\x17[\\xdcs\\x8b\\xd3o\\xf4\\x8a\\"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\x9b,e\\xed\\xc3\\x0c\\xa0\\x8e\\xff\\xfb\\xa5w\\x86\\xc5\n\"\\xcb\\x1bf\\xe3\\xff\\xfd^\\x82\\xc1\\x92\\xd6\\xee\\xf9\\xe0ueb\\x0f\\x90o#\\x90e.\\x8c3-\\xc1\\x89 r\\xf9\\x95r\\xa0]q\\x03\\x16\\x8c\\x9d3\\x82df*\\x9d\\xcc\\xa6\\x1f\\xb8\\x0f\\xfcg\\x93\\xfd\\xba\\x8f\\xf8n\\x1e\\xf5\\xa5\\xcdcy\\xbc>\\xf8\\xda5\\x13\\x16\\x00\\x1eo\\xed0\\xc7\\x89\\xf2x\\xf5\\xa0j_\\x86\\xb9\\x06\\x19\\xfb\\xcdcl\\xfd\\xdd\\xad\\xc8\\xa5\\xd9\\x1f\\xae\\xe3c\\x90\\xc0\\xa6\\xd9i\\xcb\\xee/\\x14\\xbcc\\x91\\xf7\\x90\\xec-1n\\xde\\xd1q\\xae\r\\\\xb0n\\xab\\xc0\\xd5l\\x1e\\xb1\\xc8\\xe6f\\xa3'q\\x00\\xbfp\\xb5\\x92\\x9e\\xdb.?\\xff\\x1b\\xcd\\x93\\x9c9=\\x13\\xa4/\\x9c%\\x8ad\"=\\xc4m\\x8f[\\xf9\\x02i:m\t\\xff\\xb2\\xf3\\xe5\\xdf{rq\\x9c\\x93\\xad\\x02\\x9e\\xd3z\\xdd\\xf7[6\\x01\\xa1t\\xbd>\t\\x0e\\xb7~\\xe1\\xc5\\xf8\\xd1*\\xa1h\\x9b\\xad\\x1e\\x84\\xb2\\x97^eu\\x03\\xe6\\xf4\\x9e\\xf4\\x85\\x85\\xdfh\\xe3\\x8ea\\xfd"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x13=\\x1da\\xba\\xca\\xfd\\x88*\\xc9\\xd6\\x0f\\x91\\xe5\\xe4\\x17t\\xb9\\xd0\\xcf\\xa5\\x835\\xc0\\x98\\xf0\\xb6\\xdf\\xc4!\\xfbi\\xc3_db\\xd0\\xa6\\xba\\x10\\xf7\\x05b\\x9e\\x1e\\xf4\\xcb1\\xee\r\\x1f3\\x02\\x8ey\\xf0\\xbd\\xe9<\\x17z<x\\xdd\\x9d\\xaf\\x81\\xdb\\x9fn\\x07\\xef\\x06^\\xc3:\\xd7\\xe4b\\xe0j\\xe1c\\xc7z\\xd3\\x15\\x8b\\x97\\xe1\\xdcw\\x01\\xdb\\x00\\xba\\x98\\xfam1xgu\\x08\\x11\\xef^ $\\xba:\\x01\\xbag\\x04v\\xc1l\\x8f\\x05?\\xe5>\\xb6\\x06\\xf1|\\xa8\\xa9\\\\xb6\\xa2v\\x8cf#\\xb8\\xf5y\\x84\\x1e\\xa3v\\xff fd\\x0e\\xf6i\\xff\\xd1\\xb8&%\\x01\\xa4@|'\\x88m\\xedk\\x9c;|\\x1a\\x82w\\xef\\x07\\xffw\\xc7\\x19\\xe3\\x18\\xa1\\xed\\xd5\\xc8\\xf5o\\xd4|j\\x8d1\\x1dj\\xc0\\xc2m\\x1bk\\x00\\x10\\xb6\\xd3\\xf8\\x89\tt\\xde\\xa7\\xe4\\x9e\\x99jx\\x94b\\xb3\\xc8\\xd1u\\xff\\xb3\\xad\\xdc\\x18|\\x1b\\xd3\\x0e\\xa0}\\x05\\x97\\x0e\\xe5\\x9c\\xf6\\xeb\\x10\\xbfz:\\xe2\\xfd\\x9e\\xde\\x03\\xee\\x80\\xb5\\xdd6\\x87"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010dy\\x11\\xff)16\\xf6\\x81s\\xce\\x9ex\\xb2\\xcbo\\xa5\\x92\\x90:\\xa7\\xb4\\xa3\\xf5\\xee\\x816i\\x06\\xdd\\x1e8\\x80p\\xaa\\x07\\xac\\x81*!~\\x0bx\\xcc\\x93\\x05\\x99*\\x0bhci\\xfa\\x8f\"\\xf3\\xc7\\xe9b\\xad7\\x9a \\xc2\\xaa\\x8d\\xe7yo\\x14}\\xc9ggw1\\xc1\\x13\\xa3\\x8d;\\x8e\\x8afk\\xec*\\xd3\\x10\\xd1\\x8a&\\xbc+%l4an\\x827i\\x88\\xdbq\\xf4\\xc3\\xe1\\x81\\x91\\x14e;\\x95\\xb52\\x94m\\xea\\xaef5x\\x14\\x8c\\x85\\x98$\\xc3\"%\\x96\\xce\\x16\\xfb\\xe1he\\xe7\\x9e\\x0e\t\\x9c\\xc8\\xd9>}\\xe1\\xef\\xf3\\xd9@\\x0f\\xbf\\x90\\xd3\\xb1\\x16)\\xe7\\xd2r\\xbc\"\\xf5\\xe1o\\xd4\\xfd\\xf5r\\xd2\\xcb+\\xce\\xc5\\x9f\\xe0\\x0e\\xb2\\xb7\\xf4\\xa0g.d\\x88\\x82\\x9c7\\xb2\\xa1\\xf0\\xcf\\x80 \\xf3)\\xec\\xac\\x9f\\x9d\\xf3\\x96\\x96a\\xad\\xc04\\x876\\xa0\\xddg\\x08\\xe8\\x1fu\\x0e\\x87o\\x98nnz1\\xfe\\x9f)\\xb8\\xe7\\x97\\xcb\\\\xf3n\\xc1\\xccm\\xecss\\xac\\x02\\x89\\xb4\\xe9qv\\x19\\xf3"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd'\\x18\\x9a\t\\x92\\x90&\\xc6\\xa0\\xc8\\xe0\\xe8\\xa6\\xa1e\\xae\\xa1\\xdft\\xbd,\\xc7-#f3\\xac\\xfa\\xe3\\x12\\xe4\\x08\\xb1\\xeb\\x17\\xcc\\xe4.\\xe8i\\x15x\\xb0\\x80\\x9b\\xba$\\xb5\\xde)\\x0b\\xc5>\\x85\\xec\\xf3o#>n\\x95y<9\\xac\\xebe\\x8bt\\xd4\\xf0\t<s\\xfb\\xbe\\x10z\\xb6p\\x077l\\x9b\\x8a+\\xf3\\x06\\x92\\xb2\\xfai\\x11#3\\xb9[\\xb5\\xf0\\xaa\\xd9\\x01|\\xea\\x08\\xd6\\xa9\\xa5\\x9b\\xa7\\x99\\xf8>\\xab\\x9d\\x05z\\xac)\tu\\xe1\\xd3\\x1c\\xa1\\x8c\\x9b;\\xf8\\xb8\\x0f\\x0c\\x80k/c#\\xa6\\x8aq\\xf3\\xba\\xdfd\\xf8\\xeb\\xaa?\\x17\\x07\\xdd\\xd7qmt\\x95\\x99\\xea\\x80xp\\xa7i\\xc2\\xa6\\x14kdw\\xd0mis\\xfcg}\\x83\\x08'\\xe6\\x16\\x88u%\\x00\\xeb5u\\x1e\\xf9\\xe4jhwk\\x05\\xffp\\x9e'\\xffj\\\\xb5\\xa2\\xa8\\x17\\xee\\xff\\xd5\\xdf\\x89\\xf5m\nl\\x7f5\\xe7\\xc3\\x85\\xfa`.^\\x7fe\\x13\\xa4x\\x8f\\x17a\\xe99\\xbeo5\\x9c\\xd9\\xfcvi\\xcb=kp\\x8c\\xf2o"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\x95\\x8ard\\x084x\\xef\\x7f\\xe5\\xf1\\xf0\\x0f\\x03\nc\\xa9\\xf5')-\\x84\\xcc\\xfa\\x0b\\xa28y\\xec%\\xc2\\x82y\\x14\\x12\\x05\\xb8\\xb3t\\xbae\\xf7\\x14\\xc2w\\x17\\xd1r\\x945\\x05\\xee\\x85\\x95v\\xe3\\xa4l=o\\x9a\\xba\\xfe\\xda0\\xb8\\xb2\\xf0\\xfc)\\x9c\\xbaj\\x9ae\\xcf\\xac\\xdfnr\\x0f\\xbd\\xd6h\\x93\\xeb\\xe76\\xe3\\xfd\\xaauv\\x8aa\\x1f\\x85\\xcd6\\xd7\\xd2^q\\xa8,\\x8cl\\x80y\\xbae\\x9f\\xbc\\xc4\\xef\\xa0*.\\x95\\xf9\\xb4\\xcb\\x99\\xaa\\xcc\\xfd\\xe7\\x84\\\\xb3\\xb44>o\\xe0i\\xba\\x88\\x19`\\xc2\\xfbbc0\\xe8\\xab3\\xcd\\x06#a\\x0c\\xa8\\xce\\x80v\\x1c,\\x02m\\x19\\xd2d\\x9bn\\xd9v\\xba\\x8f\\xff^\\xac\\xeel\\xe6\\x00\\xc8\\xf0\\x93e\\xfe\\x03\\xf2/!v\\x8dgmzl\\xbem\\xc2ua\\x92]\\xf1v\\xddp\\x0e\\xe64\\xc7o?0s\\x0ca\\x08\\xd8x\\x08\\x81\\xa7\\x8ao\\x1bu\\xefn\\x1bg\\x18\\x8ad\\xa0{\\x9f)\\x11h\\x8d!\\x0c\\xf4\\x88\\x9d\\x01f\\xa6^f\\xc5gg"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x88\\x94\\xaf\\x9d8\\xcb\\xba\\x0b\\x04,\\xd5>\\xac'\\x91-y\\x9d\\xe7^ad\\x05\\x91p#\\x8a\\xb7\\x8a\\xca\\xb3\\xcf\\xe1\\x8a\\x8a\\x1f\\xf7&{\\xe4v\\x01u\\x93}\\x85\\xfb\\xee\\x8d(n\\xea~w\\x1fp\\x17h:'x\\xd8\\x8c\\xee2auc\\xef\\xe8\\xb5\\xa1,\\x05w<:j\\x9b\\xb8\\xbe\\xa6iu\\xc0$cn\\xa8\\xe2\\xe7,:u\\xdfyy\\xca\t\\x973'en?\\x89\\xd2\\xa9\\xc5\\xc6cs\\xbf\\xda\\x94\\xf1\\xa5\n{w)/\\x16\\x85vp\\xb5r\\xb7\\xfb\\xdc\\x1b>w\\xb9\\xcd\\xe1,\\xce\\xb4\\xe3?\\x93\\x80u\\xad\\xfb\\x85\\xfax\\x00\\xe5\\x1a\\xe7y\\x05\\x1a\\x8d\\x89'*\\x07\\x92d\\xeay\\xd5 ]\\xcd\\xd1\\xab\\xe4\\x8f]k\\xb4\"\\x95\\xaf\\xe6\\xc4\\x16\\xcc\\xd8f\\x08\\xe3&\r+zn\\x08s>\\xa8i\\xeci{r\\x85\\xb8\\x81[b&\\xdc\\xd7\\xfa\\xd9wv\\xc7\\xb6yt\\xb8\\xcb,\\x8cl<\\x0et\\xad\\xd4\\x8e\\xb4v\\xb6\\x1a\\xe98\\x9eu\\x90\\xb8rw\\xdey\\xe1\\xb6'\\xedmh3"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3/\\xfch\\xe9ak\\xb0\\xcef\\xe5\\xd0\\xdf\\xdf6\\x96\\xcb\\xe5\\xeb\r\\xd4\\x1bf\\x96\\x1c\\xdbgr\\xbd\\xc4\\xea\\x07t\\x8b\\xe9\\xf4\\xa5\\xda\\x11\\xc8\\xfbj\\xdba\\x1a\\xdc\\x912u\\x84}\\x90w\\x9f\\xbd\\xdc7g@\\x00\\xfe\\xe1\\x051\\xdb\\xcf5\\xe9\\xec\\xea\tni\\xf6d\\xc8\\x12)bz\\xd9\\xd8\\x9c\\xb7}k\\xef^\\x8a\\xb8!\\xf3?{\\xc6\\xbam\\xd8\\xe0\\xf7\\x1c\\x80\\xa9\\x0c\\xd1d`\\x85\\xd7\n\\x7fg\\xc2\\x96\t\\xf3\\xb9\\x14i\\x90j\\x00b\\x1b\\x91\\xf0\\x88\\xc7gz\\xa6#}x\\xf7\\xdf\\x08\\xb07 \\xb0\\x8a\\xd1;\\x9e\"\\xe2\\x99\\xe7\\xb2\\xb5e.\\xbc\\x8a~\\x16'\\x18]\\x9an\\xe9;h\\xdd\\xb4\\xcem\"-\\xa0-j\\x9f\\xca\\x1e<i\\xa5bd7\\xf0=\\xc8\\x92\\x06\\xe8\\x92l\\xcdwp\\xde\\xa6\\x1c\\xd9\\x8a\\x83\\xa6*\\xfb\\xbadv&urf\\x8e\\xf2\\x15\\x96\\xb7\\x14\\xaf\\x15\\x96\\xc7\\xd59ox\\xd4\\xfa\\xf8/`5\\xd7\\xdfa\\xa4^\\xa2\\x9c\\x9f\\x08\\x86\\x15gx8^i\\xc9*d\\xc34"
            },
            {
                "http_request": "winword.exe_WSASend_\\xc4\\x00\\x88\\x00\\x88\\x00\\xaf\\x12\\xb0\\x96\\xc1h\\xd9\\x83\\x06\t\\x8e {s\\xf9\\xc3\\x1a\\xd8e\\\\x0cm\\xb7\\x91\\x93\\xab\\x050\\xaep\\xa2\\xe1\\xbeg\\xdd\\x81~}\\xa9\\x1c\\xdb\\xd2w\\xc8\\x8b\\x8b\\xa4\\xc3|\\x89r\\xe61\\xadg\\xa2\\xd8n\\xd7b\\xc9\\xea\\x15j9\\xf9\\x1f4y<\\xfd\\x8b\\x94\\xccr\\xb9ee\\x90dm\\x9f\\x10qq<^\\xf2\\xcf\\xe7\\xf0\\x9a\\xabq%\\xce\\xa4.\\xebe\\x97\\xc8\\x86\\x8f\\x86\\xbc\\x03\\x95 x\\xdb\\x9f\\xf2\\xdd^s3\\x9a^f\\xbd\\x1b\\xd4g4b\\xecd|\\xd6\\xec\ttx.#h_\\x83r\\xb2\\xf10\\x9d\\xa0\\xa0\\xc7\\x93\\x98\\x12r5s\\x1d\"o\\x05ao\\x80\\xb8\\xf3\\xc9\\xe5g((|~\\xca\\x95\\x97\\xaa0\\xc3u\\x85\\xbd\\xdc\\x96n#l\\xd6\\x89\\xaf\\x86\\x1ff\\xf3\\xd1\\xfc/\\xb2v}a\\xaf\n\\xd8\\x85\\xdf\\xc8l83\\xf3\\xef\\xa5\\xf40;\\xe9bx\\xf1=\\xb2\\xe5\\x91\\x03<vn\\x14nf\\xe3p\\xc1\\xc1\\xdd\\xf1\\x93\\xf3\\x94l\\x02b\\xb2\\xcb\\xb5\\xb0x\\x86ab\\xde+\\x1f"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x8e7g8\\x18\\xec\\x93\\xcc\\xa3\\x84\\x8ep7\\x93\\x0e\\xb3\\x8f\\x05\\xd7\\xc1\\x16,\\xbac\\x88\\xe1\\xd2\\xf3\\xc838\\xecv\\x937\\xce\\xfa\\x08\\xd5\\x14\\x9cz\\x1c\\xd5\\x1f\\x10\\xb7\\xcd\\x90f-\\xfb\\xad\\x8d\\xa6\n\\xdcv\\x98\\xc6\\xd5b\\x15\\xe4\\x08\\xc8\\xf3\\x8f\\xb3\\x85\\x80\\xdf\\x8e\\xae\\xe8v\t21\tl\\xb1x\n\\xb8\\xe4>d\\xd7\\x9b\\x88\\xd1\\x86\\xd8\\xf1\\xf3tcr<\\x97\\xdap\t:ojth\\xed\\x95cq\\xef\\xc9*\\xad\\x80[\\xd7}\\x18\\xc7\\x03;x'\\xd3\\x9b>\\xf1\\x80a\\x15\\xe8\\x81\\xe6j\\xba\\xa517\\xe1\\x93\\xe2\\x87\\x16\\x8c\\xb3-th\\x14\\xa2\\xec\\xec\\xac\\x17\\xac\\x8d\\x9e\\x01\\xdf2m\\xaf\\x07\\xd1\\x98y'\\xf9i\\xde\\x06\\x01m7\\xf2v\\x00\\x90\\xe55\\x82v\\xb7]\\xc7m\\x1a\\xa4\\xaa\\\\xf6\\xbf\\xc6\\xc9\\x1d}\\xda\ny\\xec\\xcb\"\\xa7)\\xc0\\x10\\x9af\\x1a\\xdal\\xbc\\xc1\\xcf_hnm\\xd1\\x80e\\xf2\\x06\\x00\\xfa\\xf1\\xdc\\x1a\n]*2\\x8f\\x96]\\xa7\\xf2&z\\xef\\xf1\\xe6\\xa1{\\x99\\xe8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6g\\xa7}\\xc1\\xe3p\\xe1\\xfe<\\xe43%xd\\x1a\\xc3\\x8a\\xa61<m\\x9c\\x1a,p\\xdf\\xb1ch&pt\\xeb\\x98z\\x1d\\x8fb\\xb1\\xca\\xf5\\xf6\\xe6\\x19q^\\x99\\x8e\\xe6\\xdbatv\\x9a9\\x8e\\x94\\xe64/%\\xd4z\\xf6\\x04\\xd4\\x1498\\xffu\\xf3\\xf9\\xa1_\\xa9\\x1e\\xa4\\xcb6\\xd1el\\x10=\\x95\\xdaq\\xff\\x9e\\xd4\\x88x-ok\\xe7-\\x94by\\xf8\\x96\\xff\\xdf\\xb9\\xd3ip\\x9eczks\\xfb3\\x88\\xbdv\\xf4\\xad\\x87y\\x80\\xa2\\xac\\xb7\\x0e+\"z\\xfdx\\xe2n\\xa5\\xe3\\xde\\xdc$\\xd3f\\xad\\xea\\xd36>.\\x18\\xa5\\x9e\nd\\x83'\\x9a\\xcf\\xa1>\\xb8\\xd90\\x96\\xec@\\xec\\xa4\\x9ah\\x91\\xe4\\xe69\\x84\\xa3\\x18\\x15c\\xbfk\\xa7\\x96}\\xae+\\xe4\\x9az\\x16\\x98\\x18\\x1d\\x82\\xbc\\x82\\xba\\x8ew\\xd0#\\xc1p\\xfb<g\\xa0\\xb0\\x1c\\x14\\xd7\\xf0\\xf0\\x94\\xe8\\xb6\\xd1ot\\xe6\\xed\\xa9\\x12|\\x9d\\xadm\\x97\\xd7\\xcf\\x87\\xc0@c\\xaf\\xc3\\xe9\\xf6a##\\x8bx6\\xd5f\r>f\\xaf\\x05"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r'\\xf3\\x93\\x88&\\xf9\\xc7[;et\\x02\\x9b\\xc1\\xc3\\x1a\\x82\\x02\\xd4\\xddcs(\\x89'*\\x04\\xb3\\xc28. \\x04\\x97\\xfc\\xea\\xd8z@\\xc6+\\xfe\\xbb\\xd0n\\xd4uc]\\xd6<\\xeb\\xc2\\xc5od\\xcb\\xc3\\x7f\\x93\t\\xc4\\x16\\x03\\xe1\\x9e\\xd1\\xbf\\xd3\\x13.\\xa1\\x84\\xdc\\x0f\\xb6\\x92\\x91\\xdd\\xc3\\x1e\\xc27\\xf6\\x8d\\x8c\\x92e\\xf3\\xdb\\xddd\\xc6+fh\\x9b\\x86\\x9e\\x98(\\xdc\\xf0\\xc4\\x06!\\xd7v\\x9b\\x9e\r\\xd1\\x89{\\x18{\\x1cq*rc\\xc2h\\xe3\\x05\\xd5!)3k\\x15\\x16\\xdf\\xda\\x80u\\x843\\xff\\x91xq\\x02\\x1a\\xc1m\\x1a\\xd8+\\x90\\x9d\\xdc{\\xce\\x84xij\\x0byp\\xe2\\xf4\"\\xec/\\x037=\\xf5\\xf7\\xc3\\xa6s\\x10\\xaf2\\xee\\xe0\\xb7\\xccx\\xc2u\\xae\\xef\\xb3\\xdc\\x15\\x0c\\xc6\\x02j\\xaek\\x8cr\\xa9\\xa5s%i\\x85\\xe8\\xef5\\x14\\x19\\x89aw\\x9ca\\x02\\x03\\x90\\xbc\\xa7\\x1fd5\\xdfv\\xc2\\xa4\\x0b\\xab\\xc0~\\xd9\\xae\\x90\\x81\\x03\\xb7\\xc1\\xf4#\\x03\\x9d_\\xfb\\x8f`\\x9cii\\xd6\\x11\\x95"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xbe\\xac\\xe0\\xa2\\x94\\x85\\xfd\\x03\\xed\\xe0\\x7f\\x87\\xe9\\xfb\\xd0\\xf4)\\x0b\\x16z\\xea\\xf0\\xf4\\x8c\\x0e\\xe8l\\x18\\x82\n \\xd8v\\x85\\xbe+\\xd5=\t\\x1ce\\xbcr\\xdeb\\x86\\xea\\x0b\\x86\\x05jz\\xb1c\\xect\\x8c\n|\\x0b\\xd1\r\\x93u\\xb5\\x11\\xcbl\\xd1\\x8d\\x8a\\x90@v\\x11<\\x0b\\x0b%\\xa6\\xfc\\xec\\xede&\\xa6\\u\\xc0vm0\\xda\\xf7[g\\x02\\xd9\\x84\\x9fz\\x85\\xa8\\xac\\xde\\x90-z\\xcblg\\xa8\\x8b\\xdf\\x7f\\x94\\xd4\\x98x*\\xfe\\xbc\\x94]\\x08i#\\xc4\\xf2\\x06\\xf2\\x11\\xd4\\xe6r\\x8d\\x95\\x81\\xc7\\xd9\\x97+\\x92x)t\\xe4{d\\xb8\\xbf\\xcd\\x9f\\xcc\\xc0-\\xc8ek\\xd5\\xac[3\\xf0\\x8d\\x7f\\xb9\\xbdw\\xd0\\xf6\\xb91f\\xde\\xa3#s\\xe0%\\xf2\\x94\\x8d\\x1a\\xf8[\\xc1i\\x98\\x1f\\xbd\\xc5-w\\xc21w\\xef}s\\xea\t;\\xc5\\xa5s\\xc4(\\xcc\\x89dk\\xc8f\\xb0\\xc2\\xe3\\x00;0^\t\\x01\\xb8b\\xd3\\xde\\xb6\\xe5\\xb9\\x1fn\\x1d\\xca\\xe7w\\x8a\\xfb\\xe5-\\xb4\\xaf\\xdcnef\\x83g\\\\xa8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\t\\xee\\xb8\\xf1\\xe5[s\\xda\\xe9\\xff\\xe5\\x96\\x06\\xe8\\x00\\xd8ni\\xe8@&\\xc3s\\x0f\\x81\\xbd\\xa5\\x9e\\x15\\x91\\xaf\\xebg\\x98\\xbe{\\x07\\xa3\n\\x99\\xd7o\\xbe\\xa4\\xae\\xc0\\x11zjj\\x92\\xed\\xb6\\x9a&\\x8a\\xaa\\x92\\x150\\x85\\x85z\\xae\\x93b\\xbd\\x87\\xc44'\\x9d\\xe1\\xach\\xae\\x06\t\\x10\\x9d\\xb0\\xb5\\x06\\xff\\xd9\\xdd\\x8d\\x1f\\xc3\\x12\\xed\\xf7j14\\x9ap\\x1d\\xba\\xfd\\x15\\x05\\xc3\\x0b\\xf4jyt\\x8f\\xf2\\xf8./\\xbe]\\x9f2v\\xf5\\x9a\\xce\\x13\\xd8\\xdd\\xae\\xc7\\xcb\\xfe\\xee\\xcb\\xf8\\x08\\x9f\\xe5\\x89\\xdf/i\\xdd*\\x17\\xa6e\\xa2e\\xf5f~e\\xdej$vq\\xac\t\\x8f\\xcca\\x12\\x94\\xae\\xe7\\xd8\\x89\\xf8\\x0bkw\\x08\\x1f2\\xe9m\\xf0\\xe7\\x8c^\\xb8)\\xfd%6`\\xe1\\xb6\t\\xf5\\x0f=\\xc8\\xacoz\\x85\\xfa\\x84\\x92/\\x11\\xa3o\\xe3\\x1e\\xe8\\xf2\\xbbaz\\xeac\\xf7\\xd8^o\\xd0\\x08qa\\x93\\x8b\\x80@\\x9a\\xedt\\x13\\x19\\x14a)\\xc3\\xb7r\\xd4\\x1a\\x8d8\\x18>\\xc1\\xb43\\xe2q\\x14z\\x97u\\xbd"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xf4\\x94q%~\\xb3y\\xc0o\\x05\\xf87\\x91p\\x0c\\xee\\xa7\\xc8\\xcf\\xac%%\\x1f\\xc8xx8\\x1d\\x90a5*\\xc6\\xb1\\x8e\\x9fjjn\\xcb\\xc7\\x9a\\xfak\\xc0\\x1ad\\xd5\\xae\\xf9\\xb1\"\\xdaa\\xc2\\xffo[.\\x8bwn\\xc3\\x00c\\x18-\\xaf^\\xb6\\xcb\\xfc%\\xaa#\\xb0\\xa6\\xee\\xc1\\x94-\\xab\\x8c\\x87\\xa8\\x88\\xe3\\xb08\\xb1b\\xae\\x8a@et\\x85dz1w\\x02\\x82\\xcc\\x81%\\xeb\\xed\\xd8n\\xc7\\xedb\\xca\\xf4$\\xb4\\x9f\\x05\\xa07\\x9f\\xdcm:\\x9f\\xea\\x7fp\\xd5\\xd8\\xca<spc?\\x1d\\x16\\xeb\\xe2\\xac\\xa2e\\xb8\\x8ah~\\x9e\\xbfm\\xfd\\xa8\\x0c\\xb2\\xec\\x97x\\x19\\x08nq\\x81\\x92`gomc=\\xc8\\xae\\xd4:l\\xd7r`\\xd7+\\xe7z3\\xb9tr\\xe5\\x18\\x13z\\xf6/5:\\xe9\\x9b\\xdd\\x0fc\\x0f!\\xc5\\xc8p!\\xd2\\x93\\x94`dl\\xe0\\xe1\\x8a\\xf7\\xba\\x912k\\xb1\\xc1\\xfa\\x87\\xbf\\x81\\xaa\\xba\\xd3_\\x9a\\xd5\\xd5\\x88y\"\\x9bm\\x7fao\\x94y8\\xd5\\xe7\\x97hg\\xca\\xae"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xf5!\\x91o\\xab\\l\rp\\x02p\\x06\\xe4v\\x94g/8\\xec\\xc4\\xc5\\xd5\\xee=b`h&\\xb8\\xdax\\xc4yc\\xd5\\x11\\x7f\\x9a\\x0bp~\\x12t\\xa0\\xe5\\x83 \\xd2\\x0c]f79\\xd0\\xd80\\x06<\\x14]\\x85\\xd9c\\x97\\xbbb\\x1e\\x01\\xbe\\x85\\x00\\xd3\\xb9\\x12`t%\\xe5\\xad\\xe9\\x85e\\xd0cj\\x07\\x06\\xfc,jh^\\xbd\\xa4\\x13\\xd4\\x1e\\xea\\x8b\\x80\\x10-\\x0c.\\xa8bq\\xe6[\\x19\\xee\\xb1\\xa2\\xc8\\x8e\\x1b\\xbb\t,\\xd1s\\x84,\\xe9\\xf6f\\xed\\xf7\\xe2\\x90\\xcc\\xe3\\xf2y\\x7f\\x1a0m\\x81v\\xda\\xd8:m\\x89\\x1a\\x05lh(\\xc20;\\x1c\\xc7-r!\\xf4+\\xc3\\xfa\\xd4}\\xe7\\xa5\\xa5w\\x10\\xa3\\xab\\xcb\\x96\r}\\xac$b\\x88\\xf9\\xbd\\xb5\\xf4np\\xd1ph\t-\\x86\\xda\\xb6\\xaf\\xb3\\x00\\xab\\x96sm\\xa3\\xa6\\x9a[$\\x92\\xfek\\xd0}\\x84v/\\x10\\x08t\\x0b\\xfc\\xf1\\xa9\\xcc\\x137}\\x80y\\y\\x98\\x19\\xc3i\\xa0:\\xd3\\x95\\x1c\\xf6\\xb0\\xde\\xbb\\xb6\\x0ca\\xb0-\\xba\\x05\\x80\\xf8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\xd2\\xd8\\xf6\\xd0f\\x1e.z\\xa0\\x02\\xff\\x9f\\x89\\xb4\\xd9\\x1f\\x94\\xdcs1]\\xf8/\\x14\\xcb\\xf9)\\xe4\\xbef]w\\x0c\\x13\\xb8\\xe8\\x0e~t\\xf9%h\\xd8\\xa0\\x80\\xc8'_\\xfa\\x92\\xee\\x94]\\x83\\xebl\\xa0\\xf2*(;\\xac\\xf8qi\\xba\\xe7\\xf0>\\xb5\\x19\\xd6\\xad0\\xea\\xf7r3\\x03\\xcc\\x90i\\xdd\\x10d\\xdd\\xb0\\x7f\\xbb\\x0b\\xad'o[\\xbe!\\xeb\\xd3\\xb7\\xbf\\xdc~\\x82#!\\x9e{\\xb8eg\\xfd\\xdd\\xaa\\x8cw\\xbczy;r\\xac\\xd0\\xb6\\x12\\xd9\\xf6h\\x9f\\x81\\xec\\x9d}\\x8c;\\xec\\xf87\r,\\xb5\\xbe\\xd6t\\x9c\\xad\\x0c_t\\xe2\\xab\\xeb\\xa3\\xb5\\xec\\xac>.\\xec\\x93\\x8bj\\xc98\\xdb;\\x8a\\x05\\xa7\\xa0\\xfc\\x86=]pv\\xd9ak\\xd8q\\x85\\x95s\\xb9\\x8eb\\xe7\\xb3o\\xc5\\x1c\\xa7e\\x9efy\\xc2\\xd9\\xf2u\\xf0\\x94\\xf9okr\\x02!n;f\\xb0\\xa2\\x04\\xed\\x8e$t\\x0b\\x16\\x9d\\xa9:t\\x0f\\xe9n\\x025\\xa8\\xd3\\xb8\\x1a\\x9e\\xff7\\xa1\\xb8+k\\xd2p\\xd7m\\xfdl[\\x01\\xad\\x9e"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>@\\x10w\\xe0\n\\x88-b\\xa4\\xa4g\\x92\\x13\\x80j\\x14q\\xf5<5\\xb2<\\x18\\xa0\\x1a6fm\\x19\\xd3\\xde1\\xa7\\xcb\\xb2\\xe6\\x0f\\x07\\x92\\xd7\\x06\\xe9\\xf5_\\x9f)qv\\xec\ti\\x91\\x05c\\x8f\\xcdf\\xf2\\xfbzo\\xd8\\xa1\n\\x87\\xc52\\xb2t\\x9a\\xfa\\x96\\xe2s\\xbeqa\\x03c\\x82\\xd6\\x1a/\\xd3\\xcd\\xa3\\x1c;\\xb8p\\xfb(,#\\xb6\\x9e\\x06{~\\xf9\\x17\\x07a\\xe9\\x1ct\\x1c,@\\xc1\\xf5\\xa5\rq\\x0e\\xb6k\\x93h\\xde3\\x1c\n\\x0e\\xa2\\xac\\x1d\\xe3\\xb0\\x0b\\x10`]\\xb9\\xa74\\x91\\xb4n!\\x85d\\xbc\\xa0a\\xd6>\\xc9\\x9enu{\\x98'\\xa3\\x0fj_;q\\x91`/z\\xdc\\xde\\xba\\x1c]b`\\xe5\\x8b1\\xf9\\xd8\\xa6\\xa9\\xf72\\xf9\\x03\\x9c\\xa2\\xcc\\xde\\xdazc\\xf7(\\xf7~\\xbf\\x8d\\x94\\xab\\x80\\xfc\\x0c;\\x8b.\\xd3\\x80/\\x06x\\xdf\\xb1\\xdd7\\x98\\xfb\\x0c\\x90{\\x02\\xe4\\xebf\\xbe\\\\xde\\xc5vf\\xea\\x00.\\x97\\xf7\\x9ad\\x90\\x8fz\\x04*\\x86`;\\x9a'p%\\xf4\\x991\\xc6"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103y\\x0b|\\xeb}\\xbe\\xd7\\xa9|\\x11t6\\x08\\x81\\xc5\\xcf\\xce\\x0c\\xae\\x1b\\xa4\\x8ez\\xa9\\x84<\\xf3ap!\\xfdp\\xf5\\xed\\xbe\\x8c\n\\x83\\x93k\\xc3w\\xe0\\xc4\\xe2&\\xf0\\x1fh9\\xe0\\x89\\xb1{\\xa9\\x06]'`\\xfbb\\xff\\xb00\\x98b\\xf2@\\xac\\xad\\x05o\\xc3\\xf7t\\x82\\xb4m\\x17i\\x9e\\x99\\x0bz.\\xa8x\\x19\\xc5\\xb4\\x97\\x832s\\x07in\\xdbj\\xb7w\\xbf@\\x8e:\\x96\\xc1i~s\\x8c\\xb3i\"\\xb9\\x13-\\xa9\\xca\\xff\\x04\\x18\\x05\\x06q\\x15*\\xc8d\\xe4t~\\xfe\\xa4\\xed&h\\xc61\\xa8\\x8c\\xa0w$\\xfb<\\xcbj\\x13\\xa6\\x9b'\\xe5z\\x81\\xf3r\\x05%\"-z{\\xd3'\\xf27[5\\xd6\\xc5c\\xcb\\xc2\\xcf\\x7ft\\xb1\\x9f.\\x84\\xe7\\x9c\\x86\"\\x071\\xde\\x88\\xa7\\xee\\x8a\\xa3f\\xe9\\x8e\\xf7\\xc3\\xa9\\x10\\x02\\xad\\x16\\xcd\\xc4\\xb0\\xcb\\xee\\xf6\\x10\\x186\\xd7`\\x7f\\x1f{\\x9f\\xd6\\xce\\xb1e\\x9a\n\\xd9\\xc2\\x80\\xd3\\xed\\x10q\\xf1f\\xbd\\x1a\\x9c\\xa2\\xb8p\\xceb=\\x9b\\xb3\\xbf:y\\xdd\\xb2\\xa0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xac\\x84\\xd9nb\\xf7\\x11w\\xc3\\x900\\xdc\\x8e\\xccu5uvm\\x08\\xc7\\x17\\x02\\xa58\\xaf \\xcbdp\\xf7\\xfb\\xb2\\x8dxa\\xd17>\\x83\\xf6`5^`\\x8b8w\\xea\\xd8\\x16\\x89\\x85\\xc0`\\x92\\xf8\\xb65f\\xbc\\xe8l\\x99\\x0b\\xc4\t>\\xeaer\\x02\\x8f\\x85\r\\xf0\\x18mr}\\xa0\\xf2\\a2\\xd2e\\xb5r\\x84\\xedy\\xe3in8\\xc6\\xe0\\xf4s\\xddcm\t\\xb2\\xe2\\x8b\"\\i\\xbcv>\\xdco\\x17\\xa7\\xcb>\\x9c\\xce\\xb4\\x1ds\\xef\\x8b\\x97xr\\xc7z\\x88\\xc0\\xec\\x80\\x18nmx\\xfc\\x83\\x9f\\x83\\x88b\\xa5c\\xa7v\\x10\\xf2\\x87\\xbd\\xcd-\\x12\\xc0u\\x92\\x92\\x84\\x87l\\xf7\\xe0\\x92\\xab\\xff1e\\xb9j[\\x02l}\\x87\\xd4\\xb5`q\\xeaec\\x85d\\x9e\\xb8p\\x82\\xe1\\x07\\x1d\\xd90\\xe3\\xbc\\x00\\xa9\\xd0,el\r\\xca\\xb1\\x99\\xd1(\\xc8*s\\x18\\xf3|\\xc2`w4/\\xa3s'lbom\\x0cqa\\xfe\\xd9eq\\xd6\\x80a\\x9a7f\\xd7>p\\x1e\\xadr{(\\x8b\\xde"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2\\x9d\\xb3\\xa8\\x08\\xeb-}\\xc20\\xb3\\xc9y\\x98\\x9aw\\x9cy\\xe8\\x7fs\\x8c\\x0c\\xe0.\\x9d\\xcb\\xecs\\xa8\\\\xaa\\x89\\x1d%\\xcc\\x03t;\\xc9\\xdb\\xd9,_\\xe8\\xe2-rw\\x98\\xb0\\xc9\\xaea%\\x01\\x01\\x86\\xb4\\xb4\\xd4\\x8e\\xfb\t\\xfb,~zb\\xe2y\\xbf\\xf60\\\\x97\\xec}&\\x84\\xf2<\\xd9\\xce\\xb8c\\x8e\\x1a\\xca\\xa5\\xa7&\\xe0\\xf1\\xce\\xd7\\x9cqo\\xb5\\xde\\xa0\\x9b\\xba^\\xad\\x9b\\xa9wq\\xf3\\x1e?\\xd0&\\x95\\xccu\\xa2$\\xf2\\xcb\\x98w\\xd6\t\\x98\\x92\\xa2*\\x93\\xcf\\xaf\\xbcz`\\x80\\x8fu\\x98\\xf2\\x82\\xf9\\x10\\xfa>\\x96\\xe4!\\xd7w\\xf0\\xde\\x88\\xec\\x99v\\x99t\\xc0:\\xd4\\xa4\\xac`\\xc3\\x84t\\xd8\\x18f5\\x8e\t\\xda\\x89\\xce&>\\xb9\\x84nb\\xfc\\xe2\\xc3\\xb4\\xcb\\xbd<k\\xfd;i\\x96a\\x90u\\x88\\xb2\\x9d\\x1a\\xc7\\xda\\x07r\\x96\\x0e\\xf8\\x9d\\xdep&#\\xe4@f\\xda\\xec\\x16\\x8a\\xdb\\xab\\xd1\t\\xb0\\xcb\\xb3\\xa0\\xaac=\\x1a\\x0e sia\\x83_z\\x16\\xba\\x89\\xed\\xde\\xeb\\x02t)\\xf5"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\\xff\\x9ef\\x006\\x1c\\x99\\x0b\\xaaj\\x8bl\\xc6\\xe9.\\x0et'y\\xb3\\xdb\\x98re\\xc3\\x13\\xab\\x15w\\x9a\\x17\\xac\\x90c\\x06)\\xeb\\xef&\\xe2f\\x0e\\xd9\\x82\\x0eb\\x19\\xe1)\\x07\\xf2b\\x14\\x10jq7\\x1e\\x11\\xf3\\x14\\xbe@\\xd5*\\x06\\xed\\xe6\\xa3nw\\x06\\xd1\\xafl\\x15\\x7fmf\\x05\\x1e\\xe5\\x15\\x0f\\x13\\xd8\\x07\\xe7\\xbd\\x86\\x9e\"\\xdb\\x96\\x9d\\x81\\xd2{ \\xe6\\xc7\\xce\\xe9_\\xf6\\xd0\\xc7\r\\x1b7\\xc1\\xf0\\x05\n\\x01*{\\xd1\\xf1&}r@\\x8blr\\xba1^\\xa2n\\xf2\\xc8k]\\xce`\\xb7\\xd1\n]l\\xaa\\xd6\\xe1\\xa2\\x1c\n\\xe0\\x10\\xb9\\x0fiw\\xe88\\xe8\\x13\\xa72\\x88\\x15\\xa5\\x9e\\xb7\\xce\\x0f,\\xb9\\xb9\\xd5&\\x15\\xf1\\x87\\x9b\\xc5f9b\\x86s-\\x1f\\x84\\x98p\n \\x08~uz\\xe7\t\\x86i&\\xe8|\\x9a\\x1b\\x97\\x8d\\xac\\xd7\\x92\\xe1>9fj\\xb7fp\\x8c\\x04\\xf3f\\xd5\\x857\\xa5/\\x86\\x1d\\xae\\xb9'\\xec\\xaa%\\xc5\\x8fmpqf\\x05l\\xdb\\xc3oo\\x89\\xf7wif2"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#r\\xbf\\x80v\\xfe\\x91b$5\\xa2w\\xea\\x9e\\xca\\x0b\\x12\\xf4\\x00a\\x9b]\\x84u\\xb4bq\\xb1+\\x80\\xc6.\\x0c\\xe1<\\xaf\\xa0\\xc8\\xa5\\x845)\\xdf\\x81\\xf3\\xdejly&?\\xcc\\xf6\\xc3\\xb6e\\x99\\x0f#\\x9cc\\x82mo\\xf3y\\xf8ml\\x03\\xcb\\x01\\xca\\x0c\\x13cn\\xa4n\\xfa\\xcfo~+\\xa7\\x8d\\xdb\\xd7\\xd2\\xe5\\xad\\xd0\\xd7\\xd0\\xbc*s,=q1\\xca\\x11\\x91u\\x91\\xcb\\xf5\rr\\xc7d\\x01\\xab\\xd7\\xd5t\\xcf\"2\\xe0\\x82\\xdd.\\xe6\\x90)\\xafk\\xf0\\xba\\x16`\\xda\\x0c\\xf4\\xf4\\x1br\\xa1\\xe3oj\\xbce\\x18t6\\xd2w\\xb9\\xaa\\xa3]\\xabk\\xfb\\xe3\\x165.~\\x99\\x99\\xeewjf\\x92\\x8d\\xd2+a\\xa1\\x8d&\\xae\\x91\\xf1`\\xb7m\\xd0+\\x01i\\x02\\xaa\\xab\\x94\\xf7&\\x0fv\\xacwm\\x82\r\\xcc\\x04\\xff\\xf4zi\\xd7\\x90\\x9ctc\\xfcj\\\\xf7\\x98\\x81\\xdc\\xc9\\x06\\xe3\\xf0\\xb8sv\\xbe%\\xba\\x1e\\x85\\xf4\\xe1\\xcf&\"]\\xa7\\xe1q\\xc0p\\x8a\\xd9\\x8f\\x84\\xady\\xcb\\x82\\xbbd\\xd7"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010uz\\x07\\x11i\\xa2\\xc7\np\n\\x1a\\x07\\xfc\\xfa\\x96$8\\xc8\\x03d\\xa7\\xc8\\xe6\\xa7\\xfb!5t\\xef\\xab\\x8a\\xc0\\xdbb\\x16;\\xb0h\\x81s\\x029\\x12\\x0b\\xc0\\x14m/\\x7f\\xd4\\x07=\\xb5\\x99\\xd6\\x80+\\xb11\\x01(\\xe0\\xa7\\x07\\xb7m&\\x12\\xf6\\xf6u\\xf1\\x07\\xb9\\xbe(\\xd3\\x10\\x00\\xeeou\\x14b\\xc7\\xd2\\xdf\\x9bu\\xae\\xc9\\xd1\\xdb\\x015*\\xbe\\xa0$ym\\xcc\\xaf\\x90,\\x95\\xb2*\\x02\\xb3\\xfb\\xe9\\x81\\xe8;\\xdf\\xb6\\xa1\\xeb\\xec\\x13lj\\xd7\\xa8\\x7fbp\\xa3\\x08o[{x\\x85\\xf2\n\\x85=\\xd7:\\x05\r=\\xb9\\xb0\\x02\\xa3\\x94\\xdf\\xc7c\\xecw;\\x04\\x0c\\xfbl\\xb4\\xcd~bf$\\xedxe\\xf2k\\xcb<\\xb2\\x7fg+?\\x0fv\\xb2uz\ra\\xbe!\\xb0h\\x06\\xcf\\xf6\\xdd\\x7f\\xed\\xd7\\x92@\\xf1:\\x82\\xfb\\xe3\\xb9<\\x83\\x1b\\x18sig\\xf3^x\\xde\\xd3\\xa8\\xfe|z\\xcf\\x05\\xfb\\xb8l\\xd4,\\xc9\\x1f\\xe1s\\xc2{\\xbe;\\xd9\\xd9\\x8f\\x9an\\xf7\\xaf\\x0bh\\xef\\x95\\xdcef\\xbc\\xd4\\xd3"
            },
            {
                "http_request": "winword.exe_WSASend_\\xc4\\x00\\x88\\x00\\x80x\\xbb\\x12\\xa1|\\xf1\\x15\\xe8h\\x9c)\\xb6c\\xa2\\x01\\xc1,]t\\x0ct\\x9a\\x13?y\\x98\\xb9\\xad=2/c \\x96\\xba*\\xc2mi\\xef\\xf1el\\xf12\\xee\\x82\\xb9\\xfc\\x8d\\x8b\\xc9c`sy|\\xf2\\x14\\x99ny\\xbf8\\x92\\xbc\\xec[\\x01h9\\xa0\\xb3\\xf6?\\xc1\\x95\\x8f1\\xb1\\xab\\xc9t\\xba\\x95\\xa8\\x1b\\xa15nv}\\xcd\\xab\\xb3\\x1a\\x06\\xcd\\x17\\x83\\xdc\\xae\\x9c\\xf4\\xe3\\xc2\\xe9a\\xb1h\\xb1\\x1a\\x93e\\xf0\\xcc\\xc6\\xa5nx2\\xc3\\xa7\\xa2\\xe4ps\\xcc\\xcc\\xd6t\\x9e\\xe0b\\x11\\x88\\xe3\\xba\\x8b\\\\x95\\xe6\\x1b~\\xb6\\x05r\\x94\\xc5\\x1eo>h\\xd5\\xfa\\x13\rx\\x82\\xd2\\x0e\\x819\\x1f\\xdc)\\x11\\xef\\x97\\xc8\\x8f\\xa8\\xe0\\xd0\\xe9\\xa5\\x00\\x16iz\\xbanb\\xcb\\xa0\\xae\\xefga.\\x02\\xba=\\x81\\xc7\\xf4\nj\\x99 k\\x905\\x8a\\xce\\xfc\\x94b\\x0f*aei\\xebn\\x83q{g\\x8f\\xc6\\x89\\xa0\\\\x14g)\\xd4\\xaf\\x7f\"\\xac\\xfa\\x1a\\x87\\x04m9 =\\x08\\xe7t\\xc0\\x00\\x9b\\xf2\\x0f\\xf0\\x10n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01o\\x96 \\xbd\\xf5\\x01\\xca%\\xcd\\xa2u\\xe1\\xb0o\\x1d\\x00{\\x8b\\x0c\\x8d\\xd5%\\x12\\x9f\\x1d\\xe2\\xdbr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x0c\\xb8\\xc1?\\xef\\xd6k\\x11\\xce\\xfd*\\xa2\\xc3$\\x8d+\\xec\\\\xd0\\xac+\\xb2x\\x0e-kb\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x1ell\\xac\\x1d\\x8c\\x82>\\x0e\\x9b\\xb8@\\xb6\\xf4%\\x9ex\\xd9\\xad\\x1d\\xf5\\x87\\x92\\xdcj@\\x08\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01$s\\xfc\\x0c\\xb6;&\\x95g6\\xd2d\\x97,\ta\\xb5\\xc5\\xf2k\\xcf\\x1a\\x17y\\xce\\xde\\x96[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01:\\x98\\xe8_\\xe3}\\xb1k*}\\x83sq\\xaf\\xe6t(\\x93$\\xc2\\xe4\\xd7y\\x0f\\xa4\\x04\\x04\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\x86\\xa8\\xe8\\xa10\\x08lus.\\xf2s\\x18\\xaf\\xe3\\x8f\\xf1\\xe4$\\x02\\x12\\xda\\xa3\\x07n\r\\x86\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\xd9\\xe9q\\xb1r*\\xc2 \\x90\\x1d$\"rn\\xcb\\x17\\x86\\x83\\xc2\\x97\\xc6\\x85\\x8d\"g\\xf0m+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01mia\\x9d\\x8b|\\xe1p\\x9c|\\x8f\\xc2\\x9cz1\\xe7\\xe1y\\xa4\\x89v|i(\\xc4\\xcdj\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01\\xf85\"m\\v\\x1a\\xcb\\xe6u\\xffr\\x1b\t\\xae\\xa0\\x0c\\xd6l\\xb8al\\x89j\\xaa}\\xcbk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf8\\x01uf\\xee\\x93\\x9e\\x8b\\x18\\xf0\\x17w\\xb3\\xc5dp\\xf5\\xa5\\xcb\\xb0^\\xc9g\\xd0\\x9a\\x81\\xa7i\\x92\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x1alwn\\xd5g\\xeen\\xc6\\x91z\\xbc\\x90m\\x88\\x03r\\x18c 0\\x86\\xf4\\x05\\xd1\\xce\\bv\\xfe\\xd4tl\\xd0p\\xd0f\\xea\\x98\\xa7\\xc8\\xe3!\\xc3\\x98\\xa7r\\xcf\\x1c\\xea\\xb1c\\x84\\x02;\\xfc\\xa9\\x0beu\\xa0\\xc3@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\"\\xcc$\\x98\\x87\\x8b\\xdedy\\xfa\\xd6ht\\x104\\xff\\xd1\\xbd((\\xd3\\x11\\x9fg\\xa4\\x99\\xe8\\x10\\xf4\\x040\\xd3\\x84\\xb8\\x88\\x92\\xb8\\xd1\\xbb\\xf8rh\\xfc\\xbd\\xdd\\x910"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xe6\\xb5\\x9ca\\xda}x\\x91\\xfc\\xec\\xc0xknrj\\xb05\\xa65\\xd0\\xb8\\x84_g\\xa7s\\xee\\x8c:\\xa7l\\xc1\\x8e\\xb6c+\\xc9\\xcaq\\x85\\x835\\xa6<\\x9ep\\xb9(w\\xd4\\x8d\\xf3\\xaa\\x7f\\x90\\x15-\\x02\\xee\\xf0j\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xac\\xc8\\x90\\xa7k\\x04h,\\x039\\x9d\\xc3\\xa9\\xd9skz_\\xa9\\xdd\\xd5,\\x84_\\xb2\\xeb\\xcd\\x9f\\xa0u\\xea\\xefx \\xebhr.\\xa4\\xd1\\x94\r\\x81\\xde\\xc6z\\x84"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\xa3\\x8c\\xbc\\x0e6s\\xcf\\xe41\\xb0\\x1f\\xba\\xeeb\\xa82lt\\xc9p\\x94\\x9c\\x13\\x80t?\\xf8n\\x10\\x1f\\xdfeo\\x84\\xd2\\xb4)\\x17\\xb3\\x81\\x05\\x86za.\\xd3\"iv\\xb1\\x13\\xcc\\xa5su\\xf9'w7\\xf9j\\xfaq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccy\\xd6\\x91\\x8d\\xd9\\x17ui\\xd23\\xca\\xe7{ \\\\xfb\\x98\\xe2\\xfd~?.\\xc6\\xfb\\x0cq\\xac^i\\xb3}\\xf5\\xb1~v\\xf5\\xa5'\\x8d\\x9a\\x84\\xa6%\\x84\\x11\\xef@"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xd2'#\\xe6\\xb3p\\xf42\\xa4i\\xe7\\x87\\xde\\xe0\\xd7\\x86\\x98qed\\xd4\\xb9i\\xc3,\\xfbl\\xeb\\xff\\xb8\\xb7@\\x08k\\x15\\xafp\\x81\\x11]\\xfc\\x1bv\\xb1\\xf7\\x06\\xf8u\\xf3\\x9d\\xc49\\xb4\\xc7\\x9b@x\\xa5g\\xc9\"t\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98\\xecw\\x0ep\\xec}\\xd06\\xccx\\x83i\\x93\\x89\\xf7\\x02\\xf8\\xe8\\x10\\x8e\\xbb\\xdac\\x17\\xe6\\x91\\xf3\\xd7\\xbe\\xca\\xfe\\x972.\\x81\\x91\\xf4\\xbe\\x1a\\xe1\\x1a\\x12\\x05\\xff\t\\xe8\\xeb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xbdj\\x1f\\x9e\\x9d>\\x13\\xcc\\xed\\x17y8/l>x{o\\xd6um\\x87\\x0c\\xdfq\\x8b\\x10\\x16\\x993<b%\\xf9&\\xe5\\x8d\\xe5\\xdc\\xfd^\\xb0;\\xe4w\\xb0\\x9cv\\xc8\\xcf\\xed\\xb5.\r\\x11\\xc3xg^\\xfe\\xd7\\x14y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y x\\xe6\\xee\\xf1\\xa1k\\xf5\\xb3\\xcd\\xc4\\xb7i\\xb7\\xb1\tn\\x1f\\xd2%\\xa6\\xd6\\xbf\\xf4\\xf1'\\x97u\\xac\\x8d4%\\x01!\\x8f\r\\xe1\\x8a\\xdc\\x15\\xd0\\x199\\xe88\\xf6w"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qq\\xc6\\xedy\\x9b\\xa1\\x94`\\xe1{b\\xe9\\x88\\x86\\xabe\\x11\\xa1\\x1bz\\x86\\x04q\\xad^\\x87et\\xa2$p\\x08p\\x94\\x139\\x0ex\\xde\\x1ejo\\x1ak\\xd6\\x08\\xe3\t\\xabj%{8\\xa0\\xd5\\x96\\x05\\xbbw\\x83\\xa6\\xfe\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xa3i\\x8b\\xb1\\xf8\\x01'\\xf9\\\\xa1z\\x12\\x86\\xec\\xdadq\\xb2l|\\xa8\\xfa=-\\xed)\\xd8\\xec\\xb5=\\x8d\\xd9g\\xf2g|\\xde\\x9ds\\xd4\\x02\\xc7.\\x95bd\\x02"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xec\\x1cf%\\xb2\\xba\\x95\\xa5\\xa0_\\xceng1\\x17\\x8bw\\x90\\x975\\x18>@s\\x14\n\\xea\\xd1\\x85>\\x82\\x10,\\x84\\xa7\\xbbd\\xc5\\xc4v\\xc4\\x99\\xcb\\xaf\\xedf\\x15\\xc6\\xf61\\xb8\\xc6\\\\xc4\\xf4&\\xb9\\xc4\\xf7q\\xf1\\xa1\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\x8e\\xc1\\x92\\xd00o\\xc9\\x9d\\xabz\\xce\\x93qz{\\x08\\xdf\\xe4\\x1bx\\x99\\xb5e\\xc7\\x15\\xb0\\x86j\\x0ct\\x08\\xc3nn\\xc6\\x80\\xad\\xc3\\x9b\\x8a\\xf9g\\x01y66\\xcb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8ev\\xb9b\\xe4\\xc5:+;s\\x1f\\xac\\x91\tr\\x85\\xe7\\xe1\\x9e\\x00\\x92\\xb9l_\\xa46\\xfc3\\x82jns\\x93\\x0ee\\x1e\\x11\\xc5y\\xe9`l\\x88\\xe4\\xa3npq\\xb4\\xa4\\x19\\xf6\\x83zc\\x141\\xed\\x8dpo\\xba\\xc2\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xae\\xc1\\xd5ud\\xd7\\x95?\\x8e\\xdf\\xba+rb\\xa2\\xc4\\xb1;`cht\\x17\\xef\\x97 <\\xae\\x110af\\x80\\xc5hn0\\xa8\\xfc(\\x1fn9\\x0e\\xc3jx"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90ni+3t\\xa9m\\x01\\x90\\x15ft\\xc4\\xb5:\\x13\\xb0\\xbd\\x85\\xdfrgm9\\xf4\\x9e\\xd1+;\\xde\\x02f\\x88\\xa9\\xa7:\\x94@\\xbf\\xecn\\xe8\\xbfs\\x18\\xb3\\x1e*\\x0e>\\x12\\xf6'e\\xe7\\x118av;\\x08\\\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\xf6\\xa2d\\x16@o;\\x97^rl\\xcc\\xeea\\x89\\x85\\xedg*\\xaf\\xa0\\x86*~^\\xda\\xab\\q\\xc4]\\x8blya\\xd2\\xdb\\xf7\\xffg\\xacyy\\x0f\\x97$\\x13"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04sv\\xef/a\\x1c\\xf7z\\x17\\x07,\\xfb0\\x85n}+crn\\xdf\\xdf\\m\\x82\\x9al9\\xff\\xd6\\xf1\\xba\\x8f\\x8az<p5\\x831\\x80\\xee\\xd1\\xee:\\x85q\\x10eu@\\x94\\xd6 \\x90h#\\xd4\\xb3\\xa4\\x8ff\\xc3\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\x16\\xb36,e\\x8az\\xbeb\\xe6=o\\xb5\\x1c\\xba\"\\x18jy\\x0b|\\xf8g\\xf2\\xef|\\x07\\x0bl\\xa6o(\\xa2\\x1fze\\x15\\x95l\\xc8\\xda\\xf5\\x88\\x969(v"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\t\\xf8\\x02,$\\x915\\x89\\xf1\\x85\\xec\\xf0\\\\x1a\\x1f\\xef\\xcfi\\x1d\\x0b\\x1d\\x1d.(\\x0e\\x1d\\x1ax1\\xa7\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?\\xd9b\\x7f\\xc7\\x9c\\xc5\\xcaz:\\x95)d\\x01t\\xb1oo6!\\xc7#\\xf4\\xc11\\xbaqe\\xa2\\xe5;d\\\\xe3\\xc4y\\xa0'\\xd4\\xc57\\xcf\\x80\\xd9\\xef\\xdf\\xfe\\x00\\xdf\\xac\\x01\\xd0jm\\xcf\\xc8\\xcem\\xa9wxiv\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xb2\\xb3\\xed%0b*\\xcf\\x9ar\\xb3?f\\xd0ay\\xa6qm\\x1e\\xea\\xfb\\x95$\\x8b\\xa0}\"$\\xa3\\x9d\\x0e\\xcc\\x11l\\x17\\xe8\\xdf\\xded\\x84ta`\\x81\\x90l"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:z|\\xd9\\x81\\xb5\\xa5a\\xb8\\x87\\x1b\\xd1^\\xac9\\x139\\x0f\\x9a\\x0b\\x84\\x93\\xcbq0\\xa6n\r\\xe9\\xa6o\\xc7\\xb4\\x1f\\x959\\xd0\\xf7\\xb0\\x02q\\x10\\x01\\xdf\\x11\\x10ip\\xd88\\xf5\t8\\x99\\xc6y\\x0f{\\x1d\\x92\"\\xeb /\\xc1k\\xa8\\xf1a\\xa2\\xa9\\xe5\\x84b\\xfe\\xcb\\x95h'\\x933\\xcd\\x13\\xc5\\x9cb\\xde\\x92q1\\xfa\\xabdn\\x9e\\xd8\\xf4\\xc5?i\\xda\\x0f\\x08m2\\xa8&\\xf36_m\\xd9\\x8bo\\x8d~\\xa0z&\\x84'\\x8c\\x13\\xf9\\xfd\"\\xba\\xfao(\\x82k*~r\\xc3i\\x8b\\x91\\xe7\\xdb\\x05@s\\x13\\xeco\\xd1\\xaf8\\xd2.l\\xdc\\xe4\\xa8r\\xb7hz\\x1eb\\xd8`\\x17ei #\\xe0\\xa2\\xe6<\\x1cm\\xd8\\xf4\\xa3\\xdb\\xd3\\xa3\\xdc\\xa1\\xf0\\xba\\xd8\\x0f\\x9f<\\x99_\tg]\\xad\\xb93\\xa48\\xe6:\\x13\\x94l\\xddj\\x8a\\x97\\x7f\\xbf\\xe4'i\\xb5l\\x92\"d\\xf6.t\\xce\\xec\\xdcx\\xf8\\xb1\\x9ewe[\\x8c\\xd9\\x1e\\x0e\\x804\\x1a\\x99\\xb0\\x1e\\xed\\xac\\x9cpc\\x19\\xc8\\xba\\xbc\\xc2"
            },
            {
                "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaaj\\xd6\\x00\\x8e\\xdd\\xa1\\xfan\\xab\\xdf\\x14\\xd3\\xcd\\x97o\\xc28\\x89\\x02o\\x9e\\xe1\\xbd\\x1c:\\xa2\\x95c\\xcc7ygz\\xad\\x819\\xb43\\x0f\\xe8xy\\x06\n\\xbd\\x8c\\x19m\\xb23\\x96=\\xc5\\xc0\\xac\\xad\\xc8=\\x8e\\xcfuo\\xbf`\t\\xc2/\\x95b!\\xe7\\xcb\r\\x87d\\xe1\\xb8\\xf6\\x08\\xc3{\\xd0\\xa6\\xf6y}>\\xb9\\x03\\xb0\\x8b\\xce\\xe9\\x85\n\\x1f\\x13h\\xc2\\xdf\\xe8(@d<\\xcd\\x1f\\xfcy.h\\xb7\\x0e\"\\x83\\xb29\\xa9=\\xc0!\\xb6;0\\x06\\x8ba9\\xe9\\xac\\x93\\x91\\xe8\\xb0v\\x82\\xb1\\xdc\\x88\\xe9\\x88\\xf1\\xc4\\xad\\xcd\\x07r\\xac\\xa0\\xb5\\x98\\xae\\xbd\\x93\\xa0ez\\xd3\\x82m\\xed\\xcc_\\x90\\xd8\\xe01\\xee\\xe5\\xd9\"\\x8a\\x83\\x9d\\x9as\\xe6`\\xe5\\xee7\\xf8\\xf8u\\xa4y\\x92ms\\xc6\\x95ak\\xa9\\xed\\x9c\\xec\\x13\\xc1\\x0c\\x06g/y\\xd3\\xfe\\xaf{\\xd2\\xc9\\xb3n\\x18\\x8a\\xd8\\xb5\\xbbm\\xb7\\x1c\\x9ab\\x01\\xbc\\x9b\\xf9\\x9f\"\\xae,\\xbe\\xaa\\x15ui\\xacz\\x13\\xfdk\\\\x86-\\x1a\\x05s@a\\xc5p"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\x81\\xa7\\xe4~z]8\\x04\\xf8\\xca\\xf5\\x0e\t\\x1ab\\xfa-^\\x94a\\x06\\x98\\xa7\\x80\\x19\\xe3#\\xb6ax\\x00\\x18\\xde\\x8c\\xe5i\\xc9\\x93\\xe4\\xa2kq\\xcf\\x872\\x8f\\xf5\\x14<\\x96*a\\x8d3\\xc6\\xa2\t\\x89\\x8c\\xb5\\xc6b\\xc9\"\\xb5b\\xd6\\xfb9h\\xdf\\x00\\xe2\\xa2l\\x85frq$\\x1b\\xf0<4m`m\\x11\\xa6\\xaf\\xb3\\xff\\x1b\\x8f\\x80v\\x1b2aj\\x1d\\xc2\\x86\\xc1\\x9b8\\xef\\x948\\x17\\x17\\xbc\\x8d\\xc56\\xfb\\xf7\\xd5\\xbd\\x93\\xee\\x9d\\x7fu\\x98\\xe9~b\\xf7c\\x07\\xcc\\x83\\xec\\xee%\\x0e\\xbbp-e\\xc8\\x02\\xf4\\xda\\x1a#\\x05e\\x8a\\xfds\\xacr\\xba\\xdd\\x07\\x9e\\x14@&q\\x7f\t/\\x97\\xac\\x85p\\xdf\\xf1\\x16*\\xf0\\xf9b\\xa1p\\x8fd\\xfbl\\x88\\x83\\x86\\xd9\\x86|k\\xe1`\\xdf1r\\x9c%\\xe4m\\x97\\xa3\\xb7\\xfc\\x1dk\\xe0q%\\x87p%`\\x9a\\xf66\\xcfssr\\xcbs\\x8e5\t\\xe3\\x8at\\xc7\\xca\\x08\\x8b\\xdei\\xc0\\x86p\\xa4\\x08\\xf4\\xa4\\x19\\xe9\\xaa'1qo\\x89\\x8c\\xd1\\xb8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\x90q\\x9f(4\\x90i\\x9c\\xe0\\x1f\\xca6\\xd7\\x1f\\xf0\\xe6\\x88\\xd6\\xa0\\xda\\xd8&\\x86\\xe9\\xe4}\\xfa\\xb2$\\x06\\xd3c\\xf8\\xdc\\x02\\xf1\\x18nz\\x07jma\\x1b\\x7f\\xfaxs\\xc1n\\xdbky\\xf1>\\xe8oy@c\\xdfn,\\xe6\\xc3\\xb6\\xdc\\xd4\\xdb-\\xddh}$g \\xadk\\x01)\\xdf\\xccg@.\\x00h\\xebk\\xf3th\\xf5\\xe0\\xdc\\xd2(\\xc0x\\xd0\\x80\\x021\\x99\\x1d\\x84w\\xf6(\\x193\\x12a\\x15\\xf1\\x95v\\xcer\\xde\\xb2*\\xd2vni)\\xb8<\\xd1\\xf9\\xa6\\xdc\\x854\\xea\\xcb\\xb1h)\\xee\\xe7\\x81\\xc0zr\\xbd\\xcb\\xb2\\xdd_\\xa52\\xadk\\xda\\x1ae\\x1aq\\xf3\\xe5n7\\xbb\\xd99m\\x08\\x95`\\xe2\\x08\n\\xe0\\x06\\x82adn\\x0c77\\x8a\\x16\\x087\\xa0\\xd3\\xf4\r\\x9c\\xba\\xa3\\x8bx<\\xe2dp\\x91iet'\\x12\\x8bw\\x8b=r\\x99\\xdb;e\\xe6\\x19<7\\xec\\xf3\\xb6\\xb4\\xeb\\xb2@\\xce\\xa7\\xbe%\\x02\\xb6e\\x9a7\\xd6\\x80\\xb6\\x7f\\x14s\\xcf`\\xb2/pf\\x1d`\r"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xf9\\xce\\x93@]uq\\xcf@\\xfct\r\\xecn\\xcf}(!\\xd897=\n\\xfe\\xf5^\\x9ai1a-\\xc8\\x89v\\x13\\x18\\xe0ea\\x9c\\xdc\\xbf\\x84&f\\xfcu\\xe6\\xa7\\x9b\\xbf\\x9c]\\x9d\\xc9\\xa5\\x8c/-\\xd7\\x99\\xce=\\xd4\\xda\\xeb\\xd8\\x8a\\xc1mbw\\xf0u\\x8a\\xfb(3\\x1d\\xdb\\x02\\xd1\\xe6\\xb2~\t\\x82\\x9bl\\x001l\\x1b\\xdf\\xd1l\\xae\\xb6\\xd7_\\xfa\\xc4\\\\xe1\\xd0\\xd4m\\xc9\\xe6\\xf6\\xa7>\\x05j\\x9b\\x08\\xa4c\\xaf\\xb2y\\x1aeq(\\xd5\n\\xd0\\x05\\x1fu\\xf0\\x9d\\xb1\\xe2[\\x1b\\xd8\\xac\\x8d\\x85\\xb5\\x8f4\\\\xe6l\\xe2=v\\x1c~\\xf5!b\\x1b\\x8f\\xab\\x12\\x1fh\\xc5:\\xfay\\xe6c\\xaf\\xae\\xca\\x0f\\x87*l\\xab\\x13\\xd6\\xbd\\xf4vi\\xa9\\x9b\\x97\\x9e\\x8d\\xe5\\xeb\\xcb\\x94m l\\xfb\\xdc\\xe2\\x14\\xe1\\xe4\\x83\\x86\\x9c\\x99\\xcd\\x0e@\\x8a\\xd6\\x04|\\xed\\xcb\\x13\\xf1ez?`\\xd9\\x92\\x071v\\xf2\\x9b\\x1a\\x84+\\x14\\x8a\\x04\\x8b\\x15\\xed\\x82\\xc4y\\x82\\xe80\\x80\\x91{\\x9a\\xc5\\x8f\\xe5\\x05\\xc9w"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\x8c\\x92\\xd0k\\x10\\xfe\t\\xdf\\xaby\\xf0\\x0b\\xa9\\x19!\\xf4%\\xd9\\x1d\\xb6w\\xb0\"\\x02\\x9a\\x92\\xfa\\xa3\\x8f\\xe4\\x8b\\x11w\\xaa\\xda\\xac\\xf3c[\\x97\\x18\r\\x19)\\xa6[c\\x0c\\xbe6cps\\xc6\\x0c\\xd7\"\\xea\\xa2\\x14@;\\xf7\\x00\\xd1\\xde\\x82(3q\\xfc\\xaf\\xd6_`h\\xc27\\xff&>\\x83\\x83<\\x91\\x1au \\xc6\\x0b\\xd0i\\x17\\xf9\\xb7v\\xd8h\\xd14\\xd0\\xf4\\x968\\x1c<\\xe8j\\xc9\\xcf\\xf8$\\x81\\xc0\\x84/e\\x83\\x98:\\xe9\\xa3\\xf1\\x0e7\\x9b\\x1a\\x8e7\\x8c\\xa2\\xe6\\xd4\\xb3\\xac.\\xf1\\x0fq\\x82\\xe2\\xde\\x1a\\xe5\\xcazn\\x1f\\x10\\x97\\xb5$c\\x93%\\x8b\\xd3\\xbc\\xa9\\xf6\\xd0\\xbf\\xcc\\xff\\xc3\\xc5\\xd7=\\xa1oz\\xb3\\xc1q\\xaa<in\\xec\\xfa\\x93.o\\xe4\nj\\xce\\x01d7\\xaco\\xe9\\xeeh\\xba\\xdf]\\xdc\\x94\\x07\t\\xe6^i`\\xc3h\\xde\\xd4b\\xc8\\x02\nh\\xd2\\xc3\\x0faet\\x83@\\xe6\\x9e\\xb1\\x9c\\xcf\\xbd\\xf0\\x8de0\\xcd\\xed\\xd1\\xf9;\\xc2\\xfaw\\x1a\\x0cc1tu_\\xc1\\xfe"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe97l\t&}\\x03\\xa8u)\\x95\\x16\\x06h\\xbd\\x81\\x9eq\\xd0\\x11\\xd3q\\xe0o\\x1fv\\xe6\\xa2\\x15\\x02f\\xce\\xfcfy\\xf8^l\\x8f4\\xd1e\\xefc7\\x0c\\xe1\\x99\\x98$\\x0e\\x94g\\x9a'\\x97\\x1c\\xfa\\xbe\\x18\\xcb\\x8b\\xc43\\xd6\\xf1~\\x7f\\xe0x\\xf2\\x89\\xb7z\\xd0~\\x98a\\x9bs\\xd00-t\\xcd\\xdb\\xce\\xd9\\xa1\\x0c\\x9am\\xd8\\xbf\\x9c\\x97\\x92y\\xe9\\x1acg\\x05\\x0cr\\xc0\\xae-\\xf2\\xe2\\xd4./\\xbe\\xe0]\\x92jw\\x07gme\\xeb/e\\x1c\\xd96\\x95\\xb3\\xc9\\x18\\x87\\xe7\\xbe\\xa4\\xc3\\x8en\\xca\\xfdk\\xdf\\xfc\\xee/vm\\xca\\x0bg\\xb8\\x94\\xe0\\xbb\\x82n\\xe8\\xb3@\\xc0\\x1c\\xef\\x8e\n&\\x01yn\\xd0_\\x0c\\xc5e\\xea\\x8f\\x97f^v\\xd2\\x18\\xff\\xf9\\xeb\\xd5p\\x0c\\x13\\xbe\\x9e9\\xc6\\x98;\\xfe\\xb6k\\x1c,\\x18q\\x96p\\xcc\\xb9\\x05\\xaa\\xbcoj\\x9at\\x0cf\\x8f\\x03\\x17\\x14v\\xed\\x94\\x04\\xc5f\\xcfo\\xd0\\x07v\\xbd![q\\xf1q\\x99\\x1b\\xb6\\xac\\xeaw>\\x83s^\\xfb\\xbf\\xd3y"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\.^\\xce\\x8e\\xa3\\xa0\\xbb\\xf5\\x84\\xcal`s\\xc5a\\x16\\x16\\x12\"\\xc2\\x02/g\\x02'\\x9d\\x14\\xc79\\xb8}p\\xc12w\\x87\\xd8\\xf5\\x7f\\xbc\\x82\\xe2,}\\xed\\x90\\xfe`\\xb0i\\xbd\\xce\\x98\\x9c\\xa1y@l\\xaf)[\\x9b,\\xa9}\\x86fq\n\\x0f\\x9e&q%>\\xa0+\\xc6\\xb0\\xf1\\xdah\\x16\\x0ef\\xb1\\x18>(k\\xb4\\x04h\\xae\\xdb\\xa1c\\xeb\\xe5p j\\xaa,2\\xcf\\xbam\\xb5b\\xa5n\\xb9\\x90\\xb0\\xa5\\x01\\x92]\\xe7\\xcb\\xe79z[\\x84ax\\x92v\\x9b\\xc8z\\xa7\\x0b\\x16t\\x05^\\x8b?\\x13b\\x84ts\\xfb)\\x87\\x96\n\\xedu\\xe1\\xf2\\xd9\\xb6\\xb0\\x80\\x94\\xd3\\xfd[\"\\xa9\\xa1d\n\\xe0\\x04\\xd5^\\xba\\x84en4:j\\xf03\\xc5\\xed\\xe6iq \\x90\\xf2\\x03 (>~\\x13\\xae\\x84cuj\\x9e\\xa4\\xf5@\\x1a\\x02\\x1e\\x16\\x06\\xf9>\\x1cy\\xbd--\\x11]u\\x80#\\xbe\\xe1\\xce\\x9f\\xdb\\x99\\x9d\\x8a0\\xc80\\x9f\\x89\\xd4tyw\\xf3\\x16\\xd1<\\x0eh\\xc2\\xdb*fy"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x90\\xe2&\\x06+l$\\xdb\\x87-\"qg\\x93\\x83\\xb1\\x13ca\\x1a\\xda\\xfbv\\x0b\\x0f\\xe7%\\xcdx\\xe1w\\x1d)\\xef\\xd8\\xf8\\x02u\\xe1\\x8c\\x7f\\xc7b\\x12\\xa8\\x83\\x94\n\\x08:\\x8a\\x86\\xd4zu\\x05\\xefxq\\xef\\xea\\xd2^\\xa1\\xa1#\\xb6\\xdb\\xa0\\xa4\\xb7h\\x02\\x0f{\\xe0\"\\xc4\\xfd\\x95h>t\\xc3\\x0c\\xf4\\\\x96\\xf5\\x8ce\\x07*\\xbb\\xf0b`hb\\xa8m\\xe2\\x1b\\x03f@\\xa6o\\x84\\xf4<\\xca4\\x8a\\xc7^ik\\\\x98\\x88+\\xfe\\x16\\xd4\\x08\\xf6\\xb9\\x065>\\x92~b\\x1c\\xa6\\x96\\xe8\\xa0\\xbe\\xf5}\\x84\\xa3\\xb1\\xd9\\xbe\\xb1\\x88\\xf1\\x1fs;\\xa8u\\xb7\t\\x81g\\x19\\xd6\\x022\\xc1x\\xafd\\xf5\\x81\\xad\\xa2\\xc3:\\xc0\\x1f\\xd6\\xf8\\x0b\\x93\\x11h\\xb0l\\xce>\\x87\\xe2`\\x1e\\x97y\\xde\\xee\\x13)ft\\x03\\xf2\\xfb2\\x95\\xcc:\\xf0\\xdco\\xbd:\\xe4f=\\x82spc\\x82\\x16o+{\\xfd\\xcf\\xc9\\xd0\\xe5c\\xb2\\x0e\\x87,x\\xba\\xe7\\xae&\\xe8\\x18\\x02d\\xe7v\\xdd/w\\x99i\\x16\\xf7k"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8q\\xc1\\xd0\\x86\\xfb\"\\xa3\\x80!2\\xdd;rf\\x89xr$\\x88\\xa9\\xa9\\x81\\x0c{>\\xc8\\xdb\\x89\\x0e\\xe5\\x05\\xcf\\xa4\\xf2e\\x06\\xb8\\x86\\xf59.\\x19\\xc1\\x94\\x9c\"\\xb5\\xc4\\x85uo};\\x0c\\xf5\\x158\\xae\\xb7\\x8f\\xb3\\x1d\\x13\\x17%v\\x89\\xf6\\xf5\\xb3\\xa5\\xd3vi\t~\\xea:t\\xf5\\xc3qgz\\x98\\xaa\\x1e8\\xa3b!_\ts\\xeew\\x0c6<\\xcd\\x05 \\xd6\\f=\\xac\\xb7\\xf5w\r\\x0b\\xb1\\x01e\\x91\\xd6\\xf8%\\xac\\xaf\\xdc\\xbf\\x86\\x03\\x94\\x93\\x9b-\\x96\\x9c\\x03\\xa1b\\x7f\\xdb\\x9a\\x9f\\x9f\\xe7z\\x0c\\xa7&\\x80\\x9cl\\x97n\\xa77)\\xfb\\x19\\x00u;{\\xcdx\\xa5g\\xfa\\xc8b7\\x17\\xb3\\x1d\\xd1\\x10\\x1c28\\xc1d|e\\xfb\\x19\\xde\\x12\\xe7\\xe2\\xfda\\x9cq\\x92\\xef/\\xeb|c\\xa2p\\xa0\\xbdc+\\xf8\\xde\\xcc\\xa3\\xdf11\\xc0\\xd1\\xa2;u<\\xf0\\x13\\xb5\\xa0h\\xca\\x04\\x03[x\\xfe\\x80\\xbe\\xcf\\xd9 \nb\\xf7g\\xdb\\xa8\\x93\\x07\\x95b\\xae)\\x9d\\x115\\x9fm\\xa3}h\\x93"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd-\\xc5\\x96\\xa9\\x7fb\\x0c\\xff\\xca\\xf1\\xab\\xfayc\\x92\\xde^~\\x1c\\x18\\x01\\xe9\t\\x17\\x81\\xf4\\xa1\\xfd\\x94\\xb3\\x974\\xe2#\\x16dt\\f\\xbb\\xd9\"\\x974\\xe5/\\xe1\\x11r\\xa3\\x91\\x124/\\x08\\x00\\xf0\\xfb\\xf0\\x9e\\xa7\\xb0\\xc8\\xc1\\xd0+\\xed:)\\xfa1\\xb4\\xa6\\xa9\\xbb\\xfc<\\xbf:\\xf4\\x0b#\\xdco\\xd7w\\xfc)o'p<\\x1cf\\xe3\\x18\\x12\r\\xbf\\xb6 \\x95\\x943m1\\xdck\\x1b1\\xba-\\xcf\\x16\\xe8\\xffy$\\x85\\x8a\\xd5\\x04\\xc6p\\x15\\xf7\\xe4\\xeaw,\\xf2\\xd6\\x9df\\x8c\\xf7tx\\x11iix\\xbf\\xcez\\x9a\\x1f\\xf9/^\\x13c\\xe2o\\xba't^\\xde#~\\xe3\\x96!\\xe796\\x88\\xf2x\\xa7\\xf1\\xec\\xd8 \\x8b=,\\xf5\\xcc\\xb1?\\xa1\\xff\\xf8\\x85\\xb3w|arov\\xfflp\\xd4\\x9b\\x0b|\\x18\\xbd\\x9c\\x00\\xe1#yi\\xe4\\xa6\\xa0\\x80\\x83\\x96\\xd0+\\xdb\\x05 ~d\\xcc\\xd5\\xab\\x17\\x83pm\r\\x97\\x058\\x04)p\\x87\\xc6\\xe8\\xe9\\x1e\\x81\\x92\\xbai\\x80\\xa9\\x84\\xee\\x90~"
            },
            {
                "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 16 feb 2019 02:02:49 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x0e)j\\xf8\\xc7e\\x9e\\xf5\\xfe8\\xe8.\\xbb\\x82d\\x0eru\\x99\\xdb\\xb0:\\xb24c\\xde\\x1b\\x0c\\xbf\\xc2k\\xce\\xc6\\xac\\xb9%o\\xa3j\\x93&\\xb6y\\x01\\xa9\\x8f\\xd3p\\xbb\\xccbr\\x1c\\xc9\\xdblu\\xd7\\x89\\xf4\\xa0\\x1f\\xe712\\x83\\x1c\\xb6[\\xdcy\\xeeb\\xa4?\\xa3\\xa3\\xa8\\xae\\x80\\x1b\\x7f\\xf9\\xfa\\x9c\\x9c\\xf0\\xda\\xe8\\xc6\\xae\\xb3/yk\\xae3\\xb4[\\xb9\\x0c\\x1cx\\xaa\\x81\\xd5\\xe9\\x88)\\xd4\\xe9\\xbf\\xe0\\xb7\\xda?i^\\xc2\\xbd4\\xcdf\\xecl>\\xc8:\\x8f\\x17\\x86\\x1f\\xea\\xa6|>\\xc5o\\x16l.\\x98#\r\\x0f\\x97\\x8d\\xc9\\x91\"j\t\\xa1\\xb5\\xc8a\\xedvm`\tv\\xabo\\xa3\\x1d\n\\xbap\\x14\\x1eb\\x0c\\x0f\\xac\\xe2(\\x12e\\x15\\xefh\\x0fb\\x1e2\\xa0\\x05p\rdd-?\\x8e\\x95\\xfe\\xf9*\\xf7@\n\\x01\\x05\\x84\\x8e\\x08/\\x97\\xf0\\xd0ww\\x8e\\xc6\\xadf\\xbb\\xf2\\x07f\\xccl\\xd8\\x91!h\\x9b\\xc1\\xd0d\\x9d\\xb6i\\x12\\xd9t\\xbd\\xfc^\\xde\\xf3o\\xe0\\xe6"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`}lb\\xdd\\x1bt\\x04\\xeb\\xea\\x9eab\\xf1ih\\x1d\\xf5\\x8d\\x9a\\xc1c\\x18\\x80\\xe1\\xccm#\\xd6\\xad\\xe6\\xa0\\xfd]\\xe9a\\xf9\\x8ft\\xf0\\xb7\\x14z\\xcf*~\\x8a\\x00\\xd4&\n\\xcen\\xdf\\xf6\\xb8e\\x9a\\xcf:\\x9dl\\x11j\\x0bej\\xe1=\\x16\n\\x88\\x01\\x02\\x8d\\xc4\\xe6\\xed\\xadev\\x94\\x83c\\x1d\\xfa\\x06m\\xe0\\xcc\\x8d\\xc8\\xc8<\\xd0\\xadxi\\x00'y\\x8a\\xc6\\x82e\\xae\\x91\\x87z\\xa5\\xb9\\xd2\\x9du\\x98\\xa4\\x1a*(\\xd4y\\xcc,\\xb4\\xf41{\\x1d+\\x0e\\x88\\x9ap2\\xbd\\x08\\x80\\xb9\\x93^{\n\n\\xa8~\\x12\\xcf,-\\x89*\\xf5\\xa6\ty\\xdek\\x03\nw\\xf8\\xdd!z\\x8c\\xf6h\\x9a\\x04e\\xc3\\x92\\xbbm\\xf6*\\xee_\\x87\\xf9gv\\xa1\\x939\\xd0e\\x08e\\xabr\\xe73@!{\\xb3\\x13g\\xcf\\xc4\\x84\n\\x84\\xcf\\xc7vs\\x8c\\x8d\\xfbg\\x95\\xe0g\\xe9\\xcdy\\x1c.\\xdc\\x8e\\x85\\xf7\\x03l1j\\x99s\\xdb\\x14q\\xa9\\xab y\\xf1w}\\x8cm\\x08g\\xc5si1\\x9a\\x10[x"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xbb\\xebk\\xfdxy\\xcce\\xc3\\xbb\\x93\\xab\\x8f\\xc2\\xdbm\\xbf\\x8djq.%\\\\xabb)`\\xf4[fq&\\xf6\\x1f\\x84\\x0brl\\xeb\\x9f7.\\x955\\x8e\\xedm\\xe51as\\xa6mm{\\xee\\x19x\\x95\\xb0\\xaa\\xfd|\\xbb8\\xb5#w/\\xf7\\\\x03o\\xed)\\x9d(\\xad\\x12\\xe9\\xfb\\x97\\xd8\\xe1\\xc31\\xf8\\xe1}\\xdc\\xc9g\\x14\\xb6nn\\x8e\\xc2:\\x06\\\\xadh\\xc0\\x93g`\rq\\xd1o\\xee\\xfa\\xf2ym\\xd5\\xa2u\\xf4c\\x13\\x0f:\\x11\\x06/\\xed\\xcep\\xeb\\xe3\\xd9\\xa9#;\\xeeo9\\x85\\xe3{\\xc9\\x90\\x12\\xb4\\xed\\x01or>\\x92\\xd0\\xf7\\xec\\x11\\xa0\\xd0\\xd3\\x1fo]\\xe2\\xd0\\x0bi\\xf1q\\xfb\\x9f\\x0b~p\\xf0\\xa8fa\\x0b,\\xca\\x7f\\xc2a\\xbfii\\xdab\\x98\\xfc\\xf1yj\\xda\\xe4u\\xff}\\xe7\\xcb\\x10a\\xc7\\xdf\\x91\\x92j\\xb8\\xffw\\xa9r\\xb3\\xb43\\x9c\\xd6\\x80.\\x8a\\x9a\\x10>2\\xb2\\xa8\\x95id\\xe0z+\\xe5w\\x84\\x85}\\x90h\\xa7\\x85\\xbc\\x12\\xaau\\xa3]\\xe5zq\\x91"
            },
            {
                "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 03 may 2019 05:00:32 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
            },
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
            }
        ]
    },
    {
        "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "FireEye": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "ALYac": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Cyren": "CVE-2017-11882.E.gen!Camelot"
            },
            {
                "Symantec": "Exp.CVE-2017-11882!g3"
            },
            {
                "ESET-NOD32": "Win32/Exploit.CVE-2017-11882.BQ"
            },
            {
                "Avast": "Win32:ShellCode [Expl]"
            },
            {
                "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
            },
            {
                "BitDefender": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
            },
            {
                "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
            },
            {
                "DrWeb": "Exploit.ShellCode.69"
            },
            {
                "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
            },
            {
                "Sophos": "Troj/RtfExp-EQ"
            },
            {
                "Ikarus": "Exploit.CVE-2017-11882"
            },
            {
                "Avira": "EXP/CVE-2017-11882.Gen"
            },
            {
                "Microsoft": "Exploit:O97M/CVE-2017-11882.L"
            },
            {
                "Arcabit": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
            },
            {
                "GData": "Exploit.CVE-2017-11882.Gen (2x)"
            },
            {
                "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
            },
            {
                "McAfee": "Exploit-CVE2017-11882.yx"
            },
            {
                "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
            },
            {
                "Zoner": "Probably W97NativeOnly"
            },
            {
                "MAX": "malware (ai score=94)"
            },
            {
                "Fortinet": "MSOffice/CVE_2017_11882.BB!exploit"
            },
            {
                "AVG": "Win32:ShellCode [Expl]"
            },
            {
                "Qihoo-360": "virus.exp.21711882.d"
            }
        ]
    }
]

[*] Started Service: [
    "osppsvc"
]

[*] Executed Commands: []

[*] Mutexes: [
    "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
    "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
    "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_920b8022cf38fb202b76f11fe9844e73.doc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_920b8022cf38fb202b76f11fe9844e73.doc",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{3AAFB77E-89AE-4E15-8BFB-9EA61136E7FA}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{066AE2AC-E5B5-430A-9E2D-37A439D50B48}.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_920b8022cf38fb202b76f11fe9844e73.asd",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA05348923C55AD00.TMP",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab525F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab52EC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab52ED.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5446.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56CA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5832.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5843.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5844.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5856.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5854.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5855.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab58C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5886.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A10.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5897.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A21.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5AAE.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E39.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab607D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60EB.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab60FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab61A9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6227.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6238.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60EC.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6258.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6259.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6306.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6317.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab675E.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab682A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6982.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A9D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BD6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D72.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C76.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D75.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D88.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D8B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D77.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D73.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\architecture.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D9C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D8A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D89.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E29.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\RadialPictureList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D52.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FA4.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\CircleProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\PictureFrame.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7072.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar70B2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7023.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7511.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Equations.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\Frame.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7510.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7512.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\Basis.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\BracketList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\Dividend.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\HexagonRadial.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab774A.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar75FE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\ConvergingText.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Element design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\Metropolitan.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\ThemePictureAlternatingAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\pictureorgchart.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\ThemePictureAccent.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Headlines.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Badge.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\rings.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\Wood_Type.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\TabList.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab82B2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\chevronaccent.glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab86CC.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\Circuit.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\TabbedArc.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\Droplet.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CAF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\Damask.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\content.inf",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\Mesh.thmx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AEA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Insight design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Content.inf",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab21B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar21B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_920b8022cf38fb202b76f11fe9844e73.asd",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104[[fn=Feathered]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937[[fn=Vapor Trail]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104[[fn=Feathered]].xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab60EB.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929[[fn=Slate]].eftx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar60EC.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430[[fn=Banded]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937[[fn=Vapor Trail]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927[[fn=Main Event]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929[[fn=Slate]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104[[fn=Feathered]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430[[fn=Banded]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917[[fn=Berlin]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937[[fn=Vapor Trail]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430[[fn=Banded]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105[[fn=Crop]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927[[fn=Main Event]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929[[fn=Slate]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927[[fn=Main Event]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105[[fn=Crop]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917[[fn=Berlin]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105[[fn=Crop]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917[[fn=Berlin]].xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D88.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C65.tmp\\iso690nmerical.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D89.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D72.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D73.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D77.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E29.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6C76.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D8B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D52.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D75.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D8A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6D9C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C66.tmp\\mlaseventheditionofficeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5886.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7072.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar70B2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D76.tmp\\gb.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EA8.tmp\\CircleProcess.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7131.tmp\\Equations.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7511.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5854.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C16.tmp\\architecture.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab52ED.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab60FD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7512.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5856.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6D74.tmp\\chicago.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FA4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab52EC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7023.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7510.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar75FE.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EB9.tmp\\PictureFrame.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6227.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\HexagonRadial.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD763E.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab61A9.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5843.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72AC.tmp\\Frame.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7120.tmp\\iso690.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD71FD.tmp\\gosttitle.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BD6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5844.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750F.tmp\\Basis.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab682A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD792F.tmp\\Metropolitan.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6982.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD729B.tmp\\Dividend.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD73D6.tmp\\BracketList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab675E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A10.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD720E.tmp\\gostname.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AE9.tmp\\ThemePictureAlternatingAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5832.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E4A.tmp\\RadialPictureList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6306.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7930.tmp\\Element design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A21.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD771A.tmp\\ConvergingText.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6317.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E39.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C34.tmp\\pictureorgchart.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6259.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E78.tmp\\rings.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5897.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C23.tmp\\APASixthEditionOfficeOnline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7EB7.tmp\\ieee2006officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab58C7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80BD.tmp\\TabList.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A1C.tmp\\ThemePictureAccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD807E.tmp\\Wood_Type.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E0A.tmp\\Badge.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6238.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6258.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab774A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8583.tmp\\chevronaccent.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab525F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC8.tmp\\sist02.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab56CA.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8488.tmp\\harvardanglia2008officeonline.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5855.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7B09.tmp\\Headlines.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A9D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD873A.tmp\\turabian.xsl",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab5446.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B2.tmp\\TabbedArc.glox",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab607D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD88B3.tmp\\Circuit.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab82B2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8AC8.tmp\\Droplet.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab86CC.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{066AE2AC-E5B5-430A-9E2D-37A439D50B48}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_920b8022cf38fb202b76f11fe9844e73.doc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8C9E.tmp\\Damask.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AF7.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8E65.tmp\\Mesh.thmx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CAF.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BA6.tmp\\Insight design set.dotx",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AEA.tmp"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ma,",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\295334",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\388B53",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ma,",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ #*",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\388B53",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\295334\\295334",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "blogmason.mixh.jp",
        "answers": [
            {
                "data": "150.95.52.111",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "150.95.52.111",
        "domain": "blogmason.mixh.jp"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca.com",
        "version": "1.1",
        "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
        "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 3,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 2,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 5,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 2,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 03 May 2019 05:00:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {}

[*] Resolved APIs: [
    "mso.dll.#1443",
    "mso.dll.#9214",
    "mso.dll.#199",
    "mso.dll.#1073",
    "mso.dll.#4255",
    "mso.dll.#3459",
    "mso.dll.#1262",
    "mso.dll.#5709",
    "mso.dll.#7353",
    "mso.dll.#5228",
    "mso.dll.#2155",
    "mso.dll.#1725",
    "user32.dll.RegisterWindowMessageW",
    "mso.dll.#4314",
    "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
    "secur32.dll.FreeContextBuffer",
    "ncrypt.dll.SslOpenProvider",
    "ncrypt.dll.GetSChannelInterface",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.SslIncrementProviderReferenceCount",
    "ncrypt.dll.SslImportKey",
    "bcryptprimitives.dll.GetCipherInterface",
    "ncrypt.dll.SslLookupCipherSuiteInfo",
    "mso.dll.#6484",
    "user32.dll.LoadStringW",
    "mso.dll.#8499",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "ncrypt.dll.BCryptFinishHash",
    "ncrypt.dll.BCryptDestroyHash",
    "crypt32.dll.CertGetCertificateChain",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertSidToStringSidW",
    "sechost.dll.ConvertStringSidToSidW",
    "mso.dll.#9871",
    "mso.dll.#4743",
    "mso.dll.#5452",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "mso.dll.#2088",
    "sechost.dll.OpenSCManagerW",
    "mso.dll.#5274",
    "mso.dll.#3195",
    "sechost.dll.OpenServiceW",
    "sechost.dll.CloseServiceHandle",
    "sechost.dll.QueryServiceConfigW",
    "mso.dll.#8165",
    "mso.dll.#9175",
    "mso.dll.#5315",
    "mso.dll.#8140",
    "user32.dll.IsWindowEnabled",
    "ole32.dll.CoGetCallState",
    "ole32.dll.CoGetActivationState",
    "advapi32.dll.RegisterWaitChainCOMCallback",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptVerifySignatureA",
    "cryptsp.dll.CryptDestroyKey",
    "cryptsp.dll.CryptDestroyHash",
    "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
    "ncrypt.dll.BCryptImportKeyPair",
    "ncrypt.dll.BCryptVerifySignature",
    "ncrypt.dll.BCryptDestroyKey",
    "crypt32.dll.CertVerifyCertificateChainPolicy",
    "crypt32.dll.CertFreeCertificateChain",
    "crypt32.dll.CertDuplicateCertificateContext",
    "ncrypt.dll.SslEncryptPacket",
    "ncrypt.dll.SslDecryptPacket",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "webservices.dll.WsCreateError",
    "ntdll.dll.EtwEventWrite",
    "ntdll.dll.EtwEventRegister",
    "ntdll.dll.EtwEventUnregister",
    "webservices.dll.WsCreateHeap",
    "webservices.dll.WsCreateReader",
    "webservices.dll.WsSetInput",
    "webservices.dll.WsFillReader",
    "webservices.dll.WsReadToStartElement",
    "webservices.dll.WsReadStartElement",
    "webservices.dll.WsReadType",
    "winhttp.dll.WinHttpCloseHandle",
    "crypt32.dll.CertFreeCertificateContext",
    "rpcrt4.dll.RpcBindingFree",
    "webservices.dll.WsFreeReader",
    "webservices.dll.WsFreeError",
    "webservices.dll.WsFreeHeap",
    "webservices.dll.WsCreateServiceProxyFromTemplate",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpSetStatusCallback",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpSetCredentials",
    "winhttp.dll.WinHttpQueryAuthSchemes",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpGetProxyForUrl",
    "winhttp.dll.WinHttpQueryOption",
    "webservices.dll.WsOpenServiceProxy",
    "webservices.dll.WsCall",
    "webservices.dll.WsAddCustomHeader",
    "shlwapi.dll.StrStrA",
    "shlwapi.dll.UrlUnescapeA",
    "cryptnet.dll.CertDllVerifyRevocation",
    "profapi.dll.#104",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall2",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "shlwapi.dll.StrStrIW",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "cabinet.dll.#22",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "cryptsp.dll.CryptSetHashParam",
    "sechost.dll.QueryServiceConfigA",
    "sechost.dll.QueryServiceStatus",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "sechost.dll.LookupAccountSidLocalW",
    "rpcrt4.dll.RpcStringFreeA",
    "webservices.dll.WsResetHeap",
    "webservices.dll.WsCloseServiceProxy",
    "ws2_32.dll.#3",
    "ncrypt.dll.SslDecrementProviderReferenceCount",
    "ncrypt.dll.SslFreeObject",
    "webservices.dll.WsFreeServiceProxy",
    "user32.dll.RegisterPowerSettingNotification",
    "powrprof.dll.PowerSettingRegisterNotification",
    "user32.dll.GetWindowThreadProcessId",
    "user32.dll.GetWindowTextW",
    "mso.dll.#25",
    "mso.dll.#1056",
    "mso.dll.#8136",
    "mso.dll.#8931",
    "shell32.dll.SHGetFileInfoW",
    "mso.dll.#5362",
    "mso.dll.#6044",
    "mso.dll.#6516",
    "mso.dll.#6221",
    "mso.dll.#5780",
    "mso.dll.#4870",
    "mso.dll.#6046",
    "mso.dll.#1241",
    "mso.dll.#2821",
    "mso.dll.#2340",
    "mso.dll.#7287",
    "mso.dll.#5290",
    "mso.dll.#1508",
    "user32.dll.IsZoomed",
    "user32.dll.GetWindowPlacement",
    "user32.dll.GetWindowRect",
    "mso.dll.#821",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayDevicesA",
    "mso.dll.#2378",
    "user32.dll.SetWindowPos",
    "user32.dll.AdjustWindowRect",
    "mso.dll.#5912",
    "mso.dll.#9719",
    "mso.dll.#8824",
    "mso.dll.#6117",
    "mso.dll.#3307",
    "user32.dll.SendMessageW",
    "user32.dll.DestroyIcon",
    "mso.dll.#3813",
    "mso.dll.#1815",
    "user32.dll.PtInRect",
    "mso.dll.#1613",
    "user32.dll.SetWindowTextW",
    "user32.dll.GetClassLongW",
    "mso.dll.#8572",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.GetViewportOrgEx",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.ExtTextOutA",
    "mso.dll.#1573",
    "mso.dll.#8612",
    "user32.dll.SetScrollRange",
    "mso.dll.#2509",
    "user32.dll.BeginDeferWindowPos",
    "user32.dll.DeferWindowPos",
    "user32.dll.EndDeferWindowPos",
    "user32.dll.OffsetRect",
    "user32.dll.EnumChildWindows",
    "user32.dll.GetScrollInfo",
    "user32.dll.MapWindowPoints",
    "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
    "gdi32.dll.DeleteDC",
    "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
    "mso.dll.#6126",
    "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
    "gdi32.dll.GetFontRealizationInfo",
    "gdi32.dll.GetFontFileInfo",
    "gdi32.dll.GetFontFileData",
    "mso.dll.#7261",
    "mso.dll.#9540",
    "usp10.dll.ScriptGetFontScriptTags",
    "usp10.dll.ScriptGetFontLanguageTags",
    "usp10.dll.ScriptGetFontFeatureTags",
    "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
    "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
    "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
    "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
    "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
    "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
    "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
    "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
    "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
    "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
    "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
    "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
    "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
    "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
    "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
    "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
    "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
    "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
    "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
    "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
    "user32.dll.SetRectEmpty",
    "user32.dll.InflateRect",
    "mso.dll.#1100",
    "mso.dll.#7047",
    "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
    "user32.dll.GetCursor",
    "user32.dll.GetClientRect",
    "user32.dll.SetScrollInfo",
    "user32.dll.SetScrollPos",
    "mso.dll.#3747",
    "mso.dll.#8218",
    "mso.dll.#5394",
    "mso.dll.#331",
    "mso.dll.#6829",
    "mso.dll.#539",
    "mso.dll.#4959",
    "mso.dll.#6463",
    "mso.dll.#4987",
    "user32.dll.GetWindow",
    "mso.dll.#7195",
    "mso.dll.#7573",
    "mso.dll.#445",
    "user32.dll.GetCaretBlinkTime",
    "user32.dll.CreateCaret",
    "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
    "user32.dll.IntersectRect",
    "user32.dll.DestroyCaret",
    "user32.dll.GetCaretPos",
    "user32.dll.SetCaretPos",
    "mso.dll.#5932",
    "mso.dll.#2071",
    "mso.dll.#1024",
    "mso.dll.#6245",
    "mso.dll.#9041",
    "mso.dll.#1767",
    "mso.dll.#9369",
    "mso.dll.#4617",
    "user32.dll.FillRect",
    "mso.dll.#343",
    "mso.dll.#9636",
    "mso.dll.#2022",
    "mso.dll.#4750",
    "mso.dll.#4577",
    "mso.dll.#850",
    "mso.dll.#1776",
    "mso.dll.#9026",
    "mso.dll.#4497",
    "mso.dll.#4647",
    "mso.dll.#8926",
    "mso.dll.#7212",
    "mso.dll.#5407",
    "mso.dll.#5152",
    "mso.dll.#3327",
    "mso.dll.#6333",
    "mso.dll.#420",
    "shell32.dll.SHAddToRecentDocs",
    "mso.dll.#1335",
    "mso.dll.#2041",
    "mso.dll.#7834",
    "mso.dll.#239",
    "mso.dll.#6357",
    "mso.dll.#7026",
    "mso.dll.#1671",
    "oleaut32.dll.#7",
    "mso.dll.#8263",
    "mso.dll.#9307",
    "mso.dll.#1441",
    "mso.dll.#9223",
    "mso.dll.#6453",
    "ole32.dll.PropVariantClear",
    "oleaut32.dll.#9",
    "mso.dll.#8044",
    "mso.dll.#3698",
    "mso.dll.#8565",
    "mso.dll.#8373",
    "mso.dll.#9741",
    "mso.dll.#478",
    "mso.dll.#479",
    "mso.dll.#340",
    "bcrypt.dll.BCryptOpenAlgorithmProvider",
    "bcrypt.dll.BCryptGetProperty",
    "bcrypt.dll.BCryptCreateHash",
    "bcrypt.dll.BCryptHashData",
    "bcrypt.dll.BCryptFinishHash",
    "bcrypt.dll.BCryptDestroyHash",
    "bcrypt.dll.BCryptCloseAlgorithmProvider",
    "mso.dll.#8633",
    "mso.dll.#5213",
    "mso.dll.#6163",
    "mso.dll.#552",
    "mso.dll.#5630",
    "mso.dll.#2513",
    "mso.dll.#1607",
    "mso.dll.#791",
    "mso.dll.#1848",
    "mso.dll.#8735",
    "mso.dll.#9374",
    "mso.dll.#5286",
    "mso.dll.#6368",
    "mso.dll.#4262",
    "mso.dll.#1010",
    "mso.dll.#7979",
    "mso.dll.#8549",
    "mso.dll.#8970",
    "mso.dll.#9198",
    "mso.dll.#4795",
    "mso.dll.#1865",
    "mso.dll.#9688",
    "mso.dll.#320",
    "advapi32.dll.RegDeleteKeyA",
    "user32.dll.DestroyCursor",
    "mso.dll.#7173",
    "user32.dll.IsHungAppWindow",
    "mso.dll.#8511",
    "mso.dll.#3299",
    "mso.dll.#7001",
    "mso.dll.#3913",
    "user32.dll.PeekMessageA",
    "mso.dll.#1380",
    "mso.dll.#9500",
    "user32.dll.TranslateMessage",
    "user32.dll.IsWindowUnicode",
    "user32.dll.DispatchMessageW",
    "user32.dll.DispatchMessageA",
    "user32.dll.UpdateWindow",
    "mso.dll.#999",
    "mso.dll.#287",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "mso.dll.#1575",
    "mso.dll.#5034",
    "mso.dll.#1517",
    "mso.dll.#718",
    "mso.dll.#4708",
    "mso.dll.#8046",
    "mso.dll.#4175",
    "mso.dll.#8672",
    "mso.dll.#1990",
    "mso.dll.#3051",
    "mso.dll.#1819",
    "mso.dll.#1419",
    "oleaut32.dll.#147",
    "kernel32.dll.WerRegisterMemoryBlock",
    "dwrite.dll.DWriteCreateFactory",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.BitBlt",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.StretchDIBits",
    "riched20.dll.REExtendedRegisterClass",
    "user32.dll.GetWindowLongW",
    "user32.dll.GetSysColor",
    "user32.dll.SetWindowLongW",
    "user32.dll.RegisterWindowMessageA",
    "user32.dll.RegisterClipboardFormatW",
    "user32.dll.GetDoubleClickTime",
    "user32.dll.SetCaretBlinkTime",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetKeyboardLayoutList",
    "mso.dll._MsoGetFidUspDll@0",
    "mso.dll._MsoLoadLocalizedLibraryEx@12",
    "usp10.dll.ScriptGetProperties",
    "usp10.dll.ScriptItemize",
    "user32.dll.LoadCursorW",
    "user32.dll.IsWindowVisible",
    "user32.dll.GetKeyboardLayout",
    "user32.dll.PostMessageW",
    "user32.dll.DefWindowProcW",
    "uxtheme.dll.IsThemeActive",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.OpenThemeData",
    "user32.dll.GetDC",
    "user32.dll.ReleaseDC",
    "user32.dll.IsIconic",
    "user32.dll.GetParent",
    "usp10.dll.ScriptGetCMap",
    "user32.dll.InvalidateRect",
    "user32.dll.HideCaret",
    "user32.dll.ShowCaret",
    "user32.dll.NotifyWinEvent",
    "user32.dll.GetWindowTextLengthW",
    "user32.dll.EnableWindow",
    "msctf.dll.SetInputScope",
    "advapi32.dll.RegQueryValueW",
    "user32.dll.GetWindowRgn",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SaveDC",
    "gdi32.dll.SetPixel",
    "gdi32.dll.GetPixel",
    "gdi32.dll.RestoreDC",
    "apphelp.dll.ApphelpCheckShellObject",
    "imm32.dll.ImmAssociateContext",
    "mso.dll.#806",
    "mso.dll.#4908",
    "user32.dll.SetRect",
    "mso.dll.#8439",
    "mso.dll.#2736",
    "gdi32.dll.GetTextAlign",
    "gdi32.dll.ExtTextOutW",
    "mso.dll.#8122",
    "mso.dll.#2114",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "mso.dll.#6558",
    "gdi32.dll.GetFontData",
    "usp10.dll.ScriptItemizeOpenType",
    "usp10.dll.ScriptShapeOpenType",
    "usp10.dll.ScriptPlaceOpenType",
    "mso.dll.#8395",
    "mso.dll.#379",
    "mso.dll.#6338",
    "mso.dll.#7964",
    "mso.dll.#1437",
    "mso.dll.#1427",
    "mso.dll.#6137",
    "winmm.dll.timeGetTime",
    "mso.dll.#5940",
    "usp10.dll.ScriptPlace",
    "usp10.dll.ScriptShape",
    "usp10.dll.ScriptJustify",
    "usp10.dll.ScriptTextOut",
    "usp10.dll.ScriptCPtoX",
    "usp10.dll.ScriptXtoCP",
    "usp10.dll.ScriptFreeCache",
    "usp10.dll.ScriptCacheGetHeight",
    "usp10.dll.ScriptLayout",
    "usp10.dll.ScriptBreak",
    "usp10.dll.ScriptIsComplex",
    "usp10.dll.ScriptGetLogicalWidths",
    "usp10.dll.ScriptApplyLogicalWidth",
    "usp10.dll.ScriptGetGlyphABCWidth",
    "usp10.dll.ScriptGetFontProperties",
    "usp10.dll.ScriptApplyDigitSubstitution",
    "usp10.dll.ScriptRecordDigitSubstitution",
    "usp10.dll.ScriptGetFontAlternateGlyphs",
    "mso.dll.#7578",
    "mso.dll.#8483",
    "mso.dll.#2613",
    "gdi32.dll.GdiIsMetaPrintDC",
    "mso.dll.#7848",
    "user32.dll.GetForegroundWindow",
    "user32.dll.GetFocus",
    "user32.dll.GetClassNameA",
    "user32.dll.IsWindowRedirectedForPrint",
    "gdi32.dll.CreateRectRgnIndirect",
    "user32.dll.GetUpdateRgn",
    "gdi32.dll.GetRgnBox",
    "user32.dll.ValidateRect",
    "user32.dll.GetUpdateRect",
    "user32.dll.BeginPaint",
    "user32.dll.EndPaint",
    "mso.dll.#3624",
    "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
    "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
    "mso.dll.#6247",
    "gdi32.dll.TranslateCharsetInfo",
    "mso.dll.#3300",
    "mso.dll.#7465",
    "gdi32.dll.SetWindowOrgEx",
    "mso.dll.#732",
    "mso.dll.#5804",
    "mso.dll.#9465",
    "ole32.dll.CoCreateInstance",
    "mso.dll.#434",
    "user32.dll.GetMessageExtraInfo",
    "user32.dll.TrackMouseEvent",
    "user32.dll.GetInputState",
    "mso.dll.#8461",
    "user32.dll.GetClipboardOwner",
    "mso.dll.#1422",
    "user32.dll.SendNotifyMessageW",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "mso.dll.#8202",
    "advapi32.dll.NotifyServiceStatusChangeW",
    "mso.dll.#5360",
    "mso.dll.#8574",
    "msi.dll.#39",
    "mso.dll.#8318",
    "mso.dll.#1283",
    "mso.dll.#8705",
    "mso.dll.#9685",
    "mso.dll.#3579",
    "mso.dll.#8747",
    "mso.dll.#2880",
    "mso.dll.#7615",
    "mso.dll.#4219",
    "mso.dll.#3244",
    "mso.dll.#408",
    "mso.dll.#2714",
    "mso.dll.#8622",
    "mso.dll.#3380",
    "mso.dll.#2566",
    "mso.dll.#1429",
    "mso.dll.#6502",
    "mso.dll.#2968",
    "mso.dll.#709",
    "mso.dll.#5913",
    "mso.dll.#8051",
    "mso.dll.#6505",
    "mso.dll.#3901",
    "user32.dll.GetWindowDC",
    "gdi32.dll.SetLayout",
    "gdi32.dll.RectVisible",
    "gdi32.dll.GetClipRgn",
    "gdi32.dll.ExcludeClipRect",
    "gdi32.dll.SelectClipRgn",
    "advapi32.dll.RegDeleteTreeW",
    "user32.dll.WindowFromPoint",
    "user32.dll.IsClipboardFormatAvailable",
    "xmllite.dll.CreateXmlReader",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetCapture",
    "user32.dll.GetMessagePos",
    "user32.dll.ScreenToClient",
    "user32.dll.SetFocus",
    "user32.dll.GetDesktopWindow",
    "user32.dll.FindWindowExW",
    "uiautomationcore.dll.UiaClientsAreListening",
    "mso.dll.#8662",
    "advapi32.dll.ConvertSidToStringSidW",
    "msi.dll.DllGetVersion",
    "msi.dll.#111",
    "user32.dll.GetActiveWindow",
    "user32.dll.GetAncestor",
    "mso.dll.#7009",
    "mso.dll.#6429",
    "mso.dll.#5667",
    "mso.dll.#86",
    "mso.dll.#4746",
    "mso.dll.#2052",
    "mso.dll.#7778",
    "mso.dll.#5127",
    "mso.dll.#7590",
    "mso.dll.#2687",
    "user32.dll.GetQueueStatus",
    "mso.dll.#8060",
    "mso.dll.#5925",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenKey",
    "cryptsp.dll.CryptGenKey",
    "advapi32.dll.CryptImportKey",
    "cryptsp.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "cryptsp.dll.CryptExportKey",
    "advapi32.dll.CryptDestroyKey",
    "mso.dll.#3638",
    "mso.dll.#3258",
    "mso.dll.#7974",
    "mso.dll.#2609",
    "mso.dll.#3500",
    "mso.dll.#3347",
    "mso.dll.#1905",
    "mso.dll.#2812",
    "mso.dll.#4416",
    "mso.dll.#4008",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptSetHashParam",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "cryptsp.dll.CryptGetHashParam",
    "advapi32.dll.CryptDestroyHash",
    "mso.dll.#7366",
    "mso.dll.#7546",
    "mso.dll.#1406",
    "mso.dll.#4926",
    "user32.dll.GetScrollPos",
    "mso.dll.#629",
    "mso.dll.#676",
    "mso.dll.#8644",
    "mso.dll.#3141",
    "mso.dll.#8472",
    "mso.dll.#2281",
    "mso.dll.#2628",
    "mso.dll.#3425",
    "mso.dll.#5291",
    "mso.dll.#1718",
    "mso.dll.#4777",
    "mso.dll.#424",
    "user32.dll.IsWindow",
    "mso.dll.#3544",
    "mso.dll.#900",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "ieawsdc.dll.HrExtractTemplateToPath",
    "msi.dll.#90",
    "mso.dll.#8837",
    "mso.dll.#1455",
    "user32.dll.LoadImageW",
    "user32.dll.CreateWindowExW",
    "comctl32.dll.HIMAGELIST_QueryInterface",
    "comctl32.dll.DrawShadowText",
    "comctl32.dll.DrawSizeBox",
    "comctl32.dll.DrawScrollBar",
    "comctl32.dll.SizeBoxHwnd",
    "comctl32.dll.ScrollBar_MouseMove",
    "comctl32.dll.ScrollBar_Menu",
    "comctl32.dll.HandleScrollCmd",
    "comctl32.dll.DetachScrollBars",
    "comctl32.dll.AttachScrollBars",
    "comctl32.dll.CCSetScrollInfo",
    "comctl32.dll.CCGetScrollInfo",
    "comctl32.dll.CCEnableScrollBar",
    "comctl32.dll.QuerySystemGestureStatus",
    "uxtheme.dll.#49",
    "uxtheme.dll.CloseThemeData",
    "user32.dll.EnableScrollBar",
    "user32.dll.ShowScrollBar",
    "user32.dll.ShowWindow",
    "user32.dll.SetParent",
    "user32.dll.KillTimer",
    "user32.dll.ClientToScreen",
    "user32.dll.MoveWindow",
    "user32.dll.DestroyWindow",
    "gdi32.dll.GetViewportExtEx",
    "gdi32.dll.GetWindowExtEx",
    "gdi32.dll.GetTextCharset",
    "gdi32.dll.GetMapMode",
    "gdi32.dll.GetLayout",
    "oleaut32.dll.SysAllocString",
    "oleaut32.dll.SysStringLen",
    "oleaut32.dll.SysAllocStringLen",
    "oleaut32.dll.SysFreeString",
    "uxtheme.dll.GetThemePartSize",
    "user32.dll.GetMessageW",
    "gdi32.dll.IntersectClipRect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkMode",
    "gdi32.dll.SetTextAlign",
    "gdi32.dll.ExtSelectClipRgn",
    "gdi32.dll.GetTextColor",
    "uxtheme.dll.DrawThemeBackground",
    "user32.dll.WaitMessage",
    "wininet.dll.InternetGetConnectedState",
    "rasapi32.dll.RasConnectionNotificationW",
    "sechost.dll.NotifyServiceStatusChangeA",
    "cryptsp.dll.CryptAcquireContextW",
    "osppcext.dll.SLActivateProduct",
    "osppcext.dll.SLGetTokenActivationGrants",
    "osppcext.dll.SLGetTokenActivationCertificates",
    "osppcext.dll.SLGenerateTokenActivationChallenge",
    "osppcext.dll.SLSignTokenActivationChallenge",
    "osppcext.dll.SLDepositTokenActivationResponse",
    "osppcext.dll.SLFreeTokenActivationGrants",
    "osppcext.dll.SLFreeTokenActivationCertificates",
    "gdi32.dll.GdiFlush",
    "crypt32.dll.CryptQueryObject",
    "wintrust.dll.CryptSIPPutSignedDataMsg",
    "wintrust.dll.CryptSIPGetSignedDataMsg",
    "cryptsp.dll.CryptGetDefaultProviderW",
    "crypt32.dll.CertEnumCertificatesInStore",
    "crypt32.dll.CryptVerifyCertificateSignatureEx",
    "cryptsp.dll.CryptReleaseContext",
    "wintrust.dll.WinVerifyTrust",
    "wintrust.dll.WintrustCertificateTrust",
    "wintrust.dll.SoftpubAuthenticode",
    "wintrust.dll.SoftpubInitialize",
    "wintrust.dll.SoftpubLoadMessage",
    "wintrust.dll.SoftpubLoadSignature",
    "wintrust.dll.SoftpubCheckCert",
    "wintrust.dll.SoftpubCleanup",
    "wintrust.dll.CryptSIPVerifyIndirectData",
    "advapi32.dll.RegDeleteValueW",
    "mso.dll.#7531",
    "mso.dll.#8606",
    "user32.dll.SetCursor",
    "mso.dll.#5787",
    "user32.dll.ShowCursor",
    "user32.dll.IsChild",
    "mso.dll.#5070",
    "mso.dll.#6899",
    "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
    "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
    "advapi32.dll.SaferiSearchMatchingHashRules",
    "wintrust.dll.WTHelperProvDataFromStateData",
    "wintrust.dll.WTHelperGetProvSignerFromChain",
    "crypt32.dll.CertCloseStore",
    "user32.dll.GetClassNameW",
    "mso.dll.#4702",
    "advapi32.dll.CryptReleaseContext",
    "cabinet.dll.#23",
    "mso.dll.#1885",
    "mso.dll.#832",
    "mso.dll.#3702",
    "mso.dll.#3484",
    "mso.dll.#1966",
    "mso.dll.#6960",
    "mso.dll.#7892",
    "mso.dll.#1414",
    "user32.dll.SetForegroundWindow",
    "mso.dll.#7651",
    "mso.dll.#5071",
    "mso.dll.#2802",
    "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "mso.dll.#4111",
    "mso.dll.#2386",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.ReportEventW",
    "advapi32.dll.DeregisterEventSource",
    "mso.dll.#816",
    "mso.dll.#511",
    "mso.dll.#2620",
    "shell32.dll.SHGetKnownFolderPath",
    "mso.dll.#9748",
    "mso.dll.#3496",
    "mso.dll.#2901",
    "mso.dll.#7830",
    "mso.dll.#5396",
    "mso.dll.#6895",
    "mso.dll.#7931",
    "mso.dll.#3837",
    "mso.dll.#8398",
    "mso.dll.#2477",
    "msproof7.dll.DllGetClassObject",
    "msproof7.dll.DllCanUnloadNow",
    "mso.dll.#4172",
    "mso.dll.#1439",
    "mso.dll.#8986",
    "mso.dll.#7945",
    "mso.dll.#9566",
    "mso.dll.#111",
    "mso.dll.#4191",
    "mso.dll.#3802",
    "mso.dll.#6982",
    "mso.dll.#8800",
    "mso.dll.#3572",
    "mso.dll.#167",
    "mso.dll.#988",
    "mso.dll.#5177",
    "mso.dll.#3334",
    "mso.dll.#7320",
    "mso.dll.#9639",
    "mso.dll.#9436",
    "mso.dll.#5541",
    "advapi32.dll.GetFileSecurityW",
    "advapi32.dll.SetFileSecurityW",
    "advapi32.dll.GetSecurityInfo",
    "advapi32.dll.SetSecurityInfo",
    "advapi32.dll.GetSecurityDescriptorControl",
    "mso.dll.#2955",
    "mso.dll.#1914",
    "mso.dll.#5737",
    "mso.dll.#590",
    "mso.dll.#1401",
    "mso.dll.#5919",
    "mso.dll.#4597",
    "mso.dll.#7189",
    "mso.dll.#2738",
    "mso.dll.#8691",
    "mso.dll.#6079",
    "mso.dll.#7167",
    "mso.dll.#7163",
    "mso.dll.#333",
    "mso.dll.#1785",
    "mso.dll.#8693",
    "user32.dll.RemovePropW",
    "mso.dll.#5973",
    "mso.dll.#2014",
    "mso.dll.#9668",
    "mso.dll.#2294",
    "advapi32.dll.RegDeleteKeyW",
    "mso.dll.#235",
    "mso.dll.#3758",
    "mso.dll.#9398",
    "mso.dll.#1442",
    "mso.dll.#4388",
    "msgr3en.dll.CheckVersion",
    "mso.dll.#8022",
    "msgr3en.dll.#29",
    "msgr3en.dll.#30",
    "msgr3en.dll.#31",
    "msgr3en.dll.#32",
    "msgr3en.dll.#33",
    "msgr3en.dll.#34",
    "msgr3en.dll.#35",
    "msgr3en.dll.#45",
    "msgr3en.dll.#46",
    "msgr3en.dll.#47",
    "msgr3en.dll.#48",
    "msgr3en.dll.#51",
    "msgr3en.dll.#50",
    "msgr3en.dll.#49",
    "msgr3en.dll.#43",
    "msgr3en.dll.#41",
    "msgr3en.dll.#42",
    "msgr3en.dll.#44",
    "msgr3en.dll.#39",
    "msgr3en.dll.#40",
    "msgr3en.dll.#36",
    "msgr3en.dll.#38",
    "msgr3en.dll.#37",
    "msgr3en.dll.#56",
    "msgr3en.dll.#52",
    "msgr3en.dll.#53",
    "msgr3en.dll.#57",
    "msgr3en.dll.#58",
    "msgr3en.dll.#59",
    "mso.dll.#6889",
    "mso.dll.#3633",
    "gdi32.dll.GetTextExtentPointA",
    "user32.dll.MessageBeep",
    "user32.dll.LoadStringA",
    "user32.dll.DialogBoxIndirectParamW",
    "comctl32.dll.RegisterClassNameW",
    "uxtheme.dll.EnableThemeDialogTexture",
    "uxtheme.dll.GetThemeBool",
    "mso.dll.#2561",
    "mso.dll.#1266",
    "gdi32.dll.GetStockObject",
    "user32.dll.GetDlgItem",
    "mso.dll.#6501",
    "riched20.dll.REMSOHInst",
    "mso.dll.#6900",
    "user32.dll.CallNextHookEx",
    "mso.dll.#8118",
    "gdi32.dll.GetGlyphIndicesW",
    "uxtheme.dll.BufferedPaintInit",
    "uxtheme.dll.BufferedPaintRenderAnimation",
    "uxtheme.dll.GetThemeTransitionDuration",
    "uxtheme.dll.BeginBufferedAnimation",
    "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
    "uxtheme.dll.DrawThemeParentBackground",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "uxtheme.dll.DrawThemeText",
    "uxtheme.dll.EndBufferedAnimation",
    "user32.dll.GetDlgCtrlID",
    "mso.dll.#844",
    "user32.dll.IsDlgButtonChecked",
    "user32.dll.EndDialog",
    "uxtheme.dll.BufferedPaintStopAllAnimations",
    "uxtheme.dll.BufferedPaintUnInit",
    "user32.dll.UnhookWindowsHookEx",
    "user32.dll.SetActiveWindow",
    "mso.dll.#3144",
    "mso.dll.#1213",
    "mso.dll.#4220",
    "mso.dll.#3214",
    "mso.dll.#6521",
    "mso.dll.#6489",
    "mso.dll.#613",
    "mso.dll.#1541",
    "gdi32.dll.CombineRgn",
    "user32.dll.CopyRect",
    "gdi32.dll.SetStretchBltMode",
    "user32.dll.UpdateLayeredWindow",
    "mso.dll.#6344",
    "mso.dll.#9099",
    "mso.dll.#8320",
    "mso.dll.#7770",
    "mso.dll.#6216",
    "user32.dll.EnumThreadWindows",
    "user32.dll.EnumWindows",
    "mso.dll.#1923",
    "mso.dll.#3784",
    "mso.dll.#4317",
    "user32.dll.GetLastInputInfo",
    "ws2_32.dll.#116",
    "gdi32.dll.GetBitmapBits",
    "user32.dll.VkKeyScanW",
    "ws2_32.dll.WSAGetOverlappedResult",
    "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
    "gdi32.dll.D3DKMTCloseAdapter",
    "gdi32.dll.D3DKMTQueryAdapterInfo",
    "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
    "setupapi.dll.SetupDiGetClassDevsW",
    "setupapi.dll.SetupDiEnumDeviceInterfaces",
    "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
    "setupapi.dll.SetupDiDestroyDeviceInfoList",
    "setupapi.dll.SetupDiGetDevicePropertyW",
    "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
    "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
    "d3d10warp.dll.D3DKMTGetDisplayModeList",
    "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
    "d3d10warp.dll.D3DKMTSetDisplayMode",
    "d3d10warp.dll.D3DKMTCloseAdapter",
    "d3d10warp.dll.D3DKMTSetGammaRamp",
    "d3d10warp.dll.D3DKMTGetDeviceState",
    "d3d10warp.dll.D3DKMTQueryAdapterInfo",
    "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
    "gdi32.dll.D3DKMTCreateDCFromMemory",
    "gdi32.dll.D3DKMTDestroyDCFromMemory",
    "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
    "gdi32.dll.D3DKMTCheckMonitorPowerState",
    "gdi32.dll.D3DKMTCheckSharedResourceAccess",
    "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
    "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
    "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
    "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
    "d3d10warp.dll.D3DKMTDestroyContext",
    "d3d10warp.dll.D3DKMTCreateContext",
    "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
    "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
    "d3d10warp.dll.D3DKMTPresent",
    "d3d10warp.dll.D3DKMTDestroyDevice",
    "d3d10warp.dll.D3DKMTCreateDevice",
    "d3d10warp.dll.D3DKMTQueryAllocationResidency",
    "d3d10warp.dll.D3DKMTSetAllocationPriority",
    "d3d10warp.dll.D3DKMTDestroyAllocation",
    "d3d10warp.dll.D3DKMTOpenResource",
    "d3d10warp.dll.D3DKMTQueryResourceInfo",
    "d3d10warp.dll.D3DKMTCreateAllocation",
    "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
    "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
    "d3d10warp.dll.D3DKMTEscape",
    "d3d10warp.dll.D3DKMTUnlock",
    "d3d10warp.dll.D3DKMTLock",
    "d3d10warp.dll.D3DKMTRender",
    "d3d10warp.dll.OpenAdapter10_2"
]

[*] Static Analysis: {}