API tools faq
paste
paladin316

Docs_013bfd13141ca2ac25473b23d979e551_doc_2019-08-06_01_30.txt

paladin316
Aug 6th, 2019
2,253
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 262.31 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Thus"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_013bfd13141ca2ac25473b23d979e551.doc"
  7. * File Size: 123904
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Title: UBD Lesson Plan Template Stage 1 Desired Results, Author: Habersham County Schools, Template: Normal, Last Saved By: Habersham County Schools, Revision Number: 1, Name of Creating Application: Microsoft Word 11.3, Total Editing Time: 10:00, Create Time/Date: Wed Dec 3 23:32:00 2008, Last Saved Time/Date: Wed Dec 3 23:56:00 2008, Number of Pages: 9, Number of Words: 2542, Number of Characters: 14493, Security: 0"
  9. * SHA256: "7d7ffe5cd5c10728cb8f83336ac9c81775e5812f3486917b056660dc8cb79b96"
  10. * MD5: "013bfd13141ca2ac25473b23d979e551"
  11. * SHA1: "09ed22674434872115a34776a916ed7800711834"
  12. * SHA512: "4456d35a5a9eb845ecaacb5f9791f2c9e8fff5cd46d4f28fa3dc6495806e571540d54787235626746d494417aec61bc6327df0026cc42685b9d2ddc23389e8b1"
  13. * CRC32: "0FBE082D"
  14. * SSDEEP: "3072:wl4y4pfF7CrHBugQAfSzuHF1bRpM2pFppmqcj8urYhG:ov1bRpM2pFppmqc7rYhG"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  25. "Details":
  26.  
  27. "IP": "52.109.20.1:443"
  28.  
  29.  
  30. "IP": "92.123.51.45:443"
  31.  
  32.  
  33. "IP": "184.28.188.193:80"
  34.  
  35.  
  36. "IP": "23.60.72.96:443"
  37.  
  38.  
  39. "IP": "40.91.122.234:443"
  40.  
  41.  
  42. "IP": "72.21.91.29:80"
  43.  
  44.  
  45. "IP": "104.18.25.243:80"
  46.  
  47.  
  48.  
  49.  
  50. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  51. "Details":
  52.  
  53. "ioc": "ist.glox"
  54.  
  55.  
  56. "ioc": "ontent.inf"
  57.  
  58.  
  59. "ioc": "rocess.glox"
  60.  
  61.  
  62. "ioc": "iso690nmerical.xsl"
  63.  
  64.  
  65. "ioc": "rid.glox"
  66.  
  67.  
  68. "ioc": "..3b"
  69.  
  70.  
  71. "ioc": "architecture.glox"
  72.  
  73.  
  74. "ioc": "ccent.glox"
  75.  
  76.  
  77. "ioc": "ext.glox"
  78.  
  79.  
  80. "ioc": "pictureorgchart.glox"
  81.  
  82.  
  83. "ioc": "gb.xsl"
  84.  
  85.  
  86. "ioc": "nline.xsl"
  87.  
  88.  
  89. "ioc": "harvardanglia2008officeonline.xsl"
  90.  
  91.  
  92. "ioc": "ieee2006officeonline.xsl"
  93.  
  94.  
  95. "ioc": "e.gu"
  96.  
  97.  
  98. "ioc": "rame.glox"
  99.  
  100.  
  101. "ioc": "adial.glox"
  102.  
  103.  
  104. "ioc": "set.dotx"
  105.  
  106.  
  107. "ioc": "rop.thmx"
  108.  
  109.  
  110. "ioc": "chicago.xsl"
  111.  
  112.  
  113. "ioc": "rc.glox"
  114.  
  115.  
  116. "ioc": "rings.glox"
  117.  
  118.  
  119. "ioc": "turabian.xsl"
  120.  
  121.  
  122. "ioc": "chevronaccent.glox"
  123.  
  124.  
  125. "ioc": "anded.thmx"
  126.  
  127.  
  128. "ioc": "content.inf"
  129.  
  130.  
  131. "ioc": "iso690.xsl"
  132.  
  133.  
  134. "ioc": "quations.dotx"
  135.  
  136.  
  137. "ioc": "gostname.xsl"
  138.  
  139.  
  140. "ioc": "etropolitan.thmx"
  141.  
  142.  
  143. "ioc": "gosttitle.xsl"
  144.  
  145.  
  146. "ioc": "iew.thmx"
  147.  
  148.  
  149. "ioc": "rame.thmx"
  150.  
  151.  
  152. "ioc": "sist02.xsl"
  153.  
  154.  
  155. "ioc": "adge.thmx"
  156.  
  157.  
  158. "ioc": "eadlines.thmx"
  159.  
  160.  
  161. "ioc": "asis.thmx"
  162.  
  163.  
  164. "ioc": "mlaseventheditionofficeonline.xsl"
  165.  
  166.  
  167. "ioc": "ype.thmx"
  168.  
  169.  
  170. "ioc": "uotable.thmx"
  171.  
  172.  
  173. "ioc": "erlin.thmx"
  174.  
  175.  
  176. "ioc": "arallax.thmx"
  177.  
  178.  
  179. "ioc": "ividend.thmx"
  180.  
  181.  
  182. "ioc": "ircuit.thmx"
  183.  
  184.  
  185. "ioc": "g.n9"
  186.  
  187.  
  188. "ioc": "avon.thmx"
  189.  
  190.  
  191. "ioc": "roplet.thmx"
  192.  
  193.  
  194. "ioc": "eathered.thmx"
  195.  
  196.  
  197. "ioc": "late.thmx"
  198.  
  199.  
  200. "ioc": "esh.thmx"
  201.  
  202.  
  203. "ioc": "vent.thmx"
  204.  
  205.  
  206. "ioc": "rail.thmx"
  207.  
  208.  
  209. "ioc": "amask.thmx"
  210.  
  211.  
  212.  
  213.  
  214. "Description": "Performs some HTTP requests",
  215. "Details":
  216.  
  217. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  218.  
  219.  
  220. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  221.  
  222.  
  223.  
  224.  
  225. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  226. "Details":
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xee\\xe9\\x18\\xfd\\xe1\\xa2o\\xdb\\xe3\\x13\\xe7\\xeas\\x89\\x16\\xc6v\\x9ea\\x04\\xe9\\x1d&\\x96\ni_\\xcew\\x89\\xa5+\\x94z\\xd42\\x1b\\x10\\x17\\xc2\\xbe\\x82\\xa9s7\\x16e\\xa1\\xbc\\xb2\\xea\\xdf\\xb0\\xff!\\xd6\t&*)\\x99c\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf22\\x97\\x16\\xdc\\xb0\\xd5\\x13\\x08 t\\x8a\\x1f\\xf59$\\xc6@&z\\xa1\\xa1\\x7f\\x86\\xd9x\\xb9\\x88!\\xe9\\x04ic\\xf2\\xafm\\x00a%\\x13o_\\x04\\xc4\\xad\\x19\\x10^"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x05\\x87\\xfc\\xec\\xb8\\x95\\xde\\x1cd\\xe8-\\xc5b\\x1f\\xf3\\xfb\\x80\\xde0\\xa7\\xc6\\xbf\\xe2%bo\\xd7\\xe2\\x83g\\x0f\\x17\"\\x8cc\\x98\\x19\\x02\\x83\\xa9\\xef\\xb6\\xe3?e\\x06&\\xff\\x89a\\xef\\xab\\x10\\x0e\\x8c\\x1ac\\xb5b\\xc6\\xff\\x8d\\xea\\xbd \\xe6\\xab\\x95\\xbc,\\xa5\\x07\\x1e\\xf9d\\xd3#3\\xfdlm\\xac\\xe9w\\xc5\\x04>\\xc4\\xd1g\\x7f\\xc9y\\xd1l\\xf6tt\\x87\\\\xbfi2\\x93v)\\x1e\\x03f\\xfea\\xa29\\xb7y\\x9ax\\x1b?\\xaet\\xe1,\\x99\\x98\\xe0\\xd8#3\\xd1y$\\xadq\\x93\\xb6 b\\xb4w\\x9e\\x01\\x1a8\\xf7\\xa2p\\xca\\xbe\\x93g\\x9dj\\xdfvj\\x1d\\x0b\\x18\\xb8\\x920\\x12\\x9f\\x97p\\xb6`\\xc6\\xfd\\x9c\\x9e\\xe6\\xb3\\xa02\\xc8\\xbe\\x85\\x96p\\xa4\\xea\\xa0\\xfb\\xbd\\xe2^\\xe8\\x14\\x07lf\\x9el\\x13\\x16\\xcec\\x1f%c\\x04\\xa9^\\xab\\x89\\x8e\\x8f\\xf0\\xe0t\\xc3\\x03\\x98\\xb3\\xe5\\xe0\\xe1v\\x8d\\x0e\\xfde\\x9db\\x04.\\xc6\\xd1\\xc2\\xa0\\xfa\\x1d#h\\xaa\\xb5\\x97\\xaa6*\\xb8\\xb7\\xb1\\x0f\\xe4"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xcd\\xd4\\xe4\\xf9\\x14\\x1cii\\x91n`b\\xa3\\xa3c\\xb1\\x1e \\xdfo3\\xb4\\xd8f\\xd1\\xc8\\xa3\\xe4\\x0b\\x8f,tq4d\\xa5\\x97\\xd8\\xad9\\xe2\\xf2\\xc2r\\x03\\xe1w\\xf4\\x839\\xa5/*\\xc0gw\\xd4\\x12\\xa5\\xfc\\x92\\xb7\\x10\\x13\\xedr\\xde\\xf8\\xdf?w<\\x14\\xfc\\xc6\\xc9\\x19\\xcdr/u\\x91t\\x19\\xa9\\x04c\\xbb\\x1d\\x9f\\xa2$\\x93\\x15\\xd2\\x00\\xca\\xa6\\xd0\\xe6\\x97#'y\\xae\\xa1\\xde\\xbb\\xed\\xf3;\nl;f\\x08\\xc4,6.\\xb5:2e\\x8c\\x89\\xbe\\xcao\\x93\\xda%g\\xbds\\x89\\xb9_\\x00\\xf6s\\x92\\x9f\\x84\\xe7z_\\xbc=\\xa5\\xf8\\x1c\\x04\\xf9\\x1c\\xfa\\xb3\\xf8\\xc5\\xa7rg8\\xdb\\x93\\x9d$\\xe9\\xf6po7\\xd6.(\\x01\\x07\\xdd%r\\xe2'-z6\\xf0\\xect\\x89\\x9ah\\xb7\\xc8hh\\xd7\\x07^\\xd3\\xa7\\xe6\\xdb\\x03\\xe0\\x806\\xe4\\x88ru\\xb6\\xe76\\xf8\\xa9\\xa0\\xa7\\xd9\\x10m>\\xd3\\x16\\xb7\\xe3\\xd8j1|qh+u\\x93\\x7f(\\xb1\\xc8\\x9d=f4t\\xf6\rs$\\xc7"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01h\\xcfk\\x19\\x15\\xf0x.\\xdb\\x08\\xb2$+\\xdc3a\\xb4\\x1cp\\xad\\x13\\x89/\\xdd_5\\xd5\\x94\\xe1\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2,v\\xd4\\xces\\x97\\xb6\\x81y\\x03*\\x02\\xfb\\xe0\\xfe\\x7f\\xack\\xe0\\xc8\\x8a\\x80\\x17za\\xc9\\xb6\\x13`w*\\xd4:\\xa9\\xd1\\s\\xd8\\x81\n\\xb6.\\x93\\x14\\xb8\\x93g\\x87\\x9a\\xb8\\x8b\\xdf9\\xf3\\xc9'\\xac\\x98\\x1e\\xed\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6<f\\x06\\x8c\\xa1_\\xf0\\xac\\xd5\\x1a\\xff1h\\xd3'3\\x831\\x8c\\x06\\xbft\\x0e\\xb8\\xdcr\\xe1\\x9c\\x00\\xb5;\\x17d6\\xe0\\xbad\\x95\\xcc\\xea\\xbc\\xfa=b\\xbb\\x16"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfaf|\\xdb\\xc2\\xc78\\xd4\\xf6\\xfco\n\\x9d\\x9f&\\x83\\x9c\\xbe\\xdd\\x1b\\xe1\\xbf\\xb9\\x93\\xda\\xad\\xda\\x86\\x90l \\xf3:\\xd3s\\xad\\xf8\\xe2\\x01=\\xa8\\xca\\xd8r\\xf1g\\x99\\xba>\\xb81\\xc9\\x1ct\\xd2\\xa9\\xefp\\x836\\x11\\x027\\x82s\\xca*\\xfe\\xb6\\x92j\\x1b\\xec2\\xa9\\x05\\xd3-\\x99\\x13\\x00u \\x14\\x88e\\x15\\x18\\xf7e\\xbef!`?8\\xf3\\xffm\\xedz\\xab0\\xc7'\\xaa\\xc1\\xc1p\\xde=\\x1a\\x17x\\x0c\\x94\\x90r\\xca\\xb4\\xba/\\xf9v/m\\xa1\\x89\\xf1 v\\xcd\\xd2j\\xb1\\x15y\\xf6\\xed\\xfa\\x08\\xa9\\xdcujf\\xf1\\xe7\\xa5\\xe49q\\xaa\\xac\\xc2\\x1b\\xf3ic\\x8a\\xb0\\xf7|\\xbe!\\x1c\\x1d)\\x12\\x86\\xfd\\xa7\\xb0\\x00$\\x8d\\xb4p\\x96\\x86\\x11c-\\xf0\\x08^3\\x13\\xec\\x0fp*\\x8at\\xec\\xe4g\\xf4\\xc0e\\xcch\\xcec>\"\\x99\\xe1\\xaf\\x94\\xb7\\xd2h\\xac\\x88\\xb9\\xa8\t\\xd9\\xee\\xca>\r\\xad?:vl\\xf8\\x08vu\\x0b\\xa4a%\\xda\\x0f\\x91q\\xcf\\x9ef\\x97\\x85\\xb4"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01h\\xcfq\\x9d>`\\xc9<\\x8c\\xe4\r\\x1a\\xf38\\xf2\\x972a\\xd8e\\x92>\\xd1g\\xbd%\\xf8v\\xf7\\x9fw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb\\xf4\\x9a\\xad6\\x8f\\xb8m\\xb6\\x15\\x0f\\xe5\\x0cbh\\xb5\\xfe\\xbe*a\\xcf\\xd0\\x98\\x00\tp\\xc9lu\\xcdz\\xbbt\\xb0\\x127\\x0c'\\xa0\\xf2%\\x89)\\xc5u\\xb3x\\x94p\\x1f\\xfb\\x0e\\x0f;\\x1c\\xad\\xbe\tos\\xc6\\x88hk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\x8e?8\\xf7\\x94gx\\x03\\xed\\xce\\x08\\x94\\x96\\x1c\\x14\\xcfn\\x80\\xd5\\xb4\\xf5\\xab\\xe3sg\\x1c\\xd5let\\xbd(\\x00\\xab\\xa6<\\x83\\x01\\x1e\\x15e=\\xb8\\xf7\\xe1\\x91"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`0w\\x00\\xf4v\n\\xe7\\xa6d\\xdd\\xadl\\x80wk\\x95\\xf7\\x047\\x0c\\x1ewr\\xa7mj\\xed\\x94\\x12\\xfb5\\x9f9j\\xeb\\x92\\xd3f\\x13\\xc3\\x14\\x82\\xe9t\\xb2\\x80~\\x14o\\x96\\xfar\\xf9\\xe0*\\xbc\\x1e\\x85\\xdc\\x01p\\xa9\\xb0\\xe1\nq\\xdc\\xa0\\x05\\x97\\x84i\\xf7\\xf4up\\xf3\\xb58o\\x05\\xd6\\xd1\\x19\\xcav\\x89&g\\b\\xa0\\xe7\\x8a%\\x84zd2\\x99\\x82\\x88m\\xe9j0i\\x1f\\xcb%\\xd23\\x83\\x82\\xaak3\\xb7\\xed\\xd3\\x84z\\xec\\xeaf\\xa2\\xd1\\x8d/\\x0c\\xf6\\x9a\\x03\\xef\\x080wfs\\xf4\\x91w\\xeb\\xe3\\x95ig\\x93~d\\xd3\\xca\\xbff\\xe1_\\x01^b\\xd7\\x1cg\r\\x9b\\x19\\xbf\\xe8-\\xc3\\x1e\\x8d\\xd7j\\x1a#u\\xcc\\xabb\\xaf\\x80\\x8f\\xc1\\xdd&\\xb6\\xbc\\x14\\xc9mh\\xa1\\xed\\xf0h\\xf6\\xea;by:c\\x98\\x02\\xdd\\x8d*~c\\xca~d\\xae\\xe3\\xa7\\x83\\xfb\\xa83\\x03y\\xaf\\xad2\\x9f\\xbd5b?\\xc8\\xbb<\\xb4\\xe9\\xd8h\\xb2\\xaa\\x16\\xf0\\x81\\xd0v\\xe1\\x0f\\xb8\\xcb<"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xce\\x80=\\x95\\x03\\x90c\n\\xd4l\\x1e\\x0fh\\xa7i\\x0c\\x91\\xab%\\xfd\\xff\\xab\\x82w\\xe8\\xc7\\x06\\xf6\\xa9\\xbc\\x80u6\\xe7\\x8d\\x1f\\xc3t\\xdb\\xd0`\\xbb8\\xe4\\xc7\\x8b\\x9b\\xe5\\x02i\\xad8a\\xf5ks\\x08\\x83h\\xe9t\\x17\\xcb\\xf7\\x157\\xaa\\xe0\\xb4&\\xe7l\\xd4\\x83\\x15r/4\\x97\\xc8\\x1b\\xad7\\xae\\x9b\\x0c\\x0er\\xe5\\xf3f\\xda\\x05\\xa9\\xef\\x0f\\x00g\\xbf\\xba\\xd6\\xc7('\\x8cf\\xfa$\\x7f\\xb3\\xd5\\x1f\\xdb\\x83\\xce\\xee,)\\xf9\\xa9\\xfca\\x89\\xado0\\xb3\\x0c%\\xea\\xe8q\\x0b\\xaa\\xac\\xdf51\\x87^4u\\x19:l;\\xb6\\xe5^\\xfd\\xb7mt\\x03\\xd4\\xe3\"\\x98\\x06\\x8f_\\xe9z\\xfb\\xdc\\xbb\\xe6s\\xe6\\x0c\\xa3\\xa3\\xb3\\x97\\x8dn\\xf1py\\xb3\\x06#\\xd1:\\x00\\xb7\\xd8\\xb4$\\x80_n1\\xdc\\xaa7\\xf0\\xb1\\'o\\x14^yhs\\xec\"\\x9atj\\x99\\x87\\xe2\\xaa\\xf2c|_\\xc6\\xbe)re:\\x80\\xb9\\xe0\\x93\\xd1\\x89\\x03\\x97\\x17\\x1a\\x08\t\\xafd&\\x04\rl\\xde@z"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01h\\xcft\\x989\\xcb\\xa4\\xef\\x87\\xcecw\\xcf\\xbb\\xc3\\xcc\\xe5\\xd75\\x9f\\xb5\\xe3\\x8c,7\\xee\\xb1\\xcc\\xb5\\x9a\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\xd7\\xaboy<\\xdf\\xe68\\x8bj\\x13\\x0e\\x00!\\xb5\\xea\\x7fl\\x065\\xd2\\x9b1\\xc9\\x04a\\xaf8\\x04\\xd3sd\\xe4\\x9ebvo\\xd8\\xae\\\\xbfy\\xa1\\xc1\\xc84v\\x18\\x0f\\xe5\\xa12\\x9c\\xb7\\xdd\\xfa\\x11\\x9fr\\xb5\\xd8v\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4\\xb6\\x9f\\xcag \\x0b\\x06$\\xaa\\x1d\\xf8\\x84\\xb3\\x8b\\x02\\xe9\\x94\\xabsl\\x0e\\x1c>\t\\x9a\\xa1\\xa7n.\\xca\\x12>\\x1b\\xd8\\x06g\\xff\\xb7\\xe6\\xe3-\\xe1\\xb6\\xc5u\\x86"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x15v\\x96q\\xe3\\xc6?ffe\n\\xd4t<\\x1cx~\\x15%\\x850\\x92\\xb8\\xd1\\xddjb\\x8d$\\xf4\\x1db\\xe1\\xb8\\x1d*i\\xa5\\x8cb\\x12\\xfe\\xdd\\xe6\\x03\\xed\\xb3\\xd56\\xcc\\xb9\\x89 \\x99+4e\\x7f\\xa4\\xc4\\x15\\x9f\\x8b\\x96i\\x97\\xa0\\\\xb6\n\\xbc\t\\xfa6\\x12\\xd1\\xe5\\xc8\\x0b\\xb8_\\\\x91o\\xb3\\xff\\xcfj@w\\x9b\\x9b\\x18\\x9f#-f/x?dge\\x16\\xb1\\x9dj\\xdd^\\xb3qj\\x91\\x03v\\x82\\xdby\\xd2\\x1a\\xa7\\xaa\\xb6\\x011\\xaa\\x89\\x16\\x8e\\x05\\xc4\\xc0f^\\xcf\\x1b y\\x829\\xe5\\xdf\\x80a\\xbauz\\xa8(\\xb7\\xd0\\xf3\\xf1\\xc1>*\\x9a\\xe3\\xec\\xfe\\xd2v\\x13u\\xd72\\x8afk<\\xaf\\xe1\\xb6\\xf7\\xc8\\xfb\\x14\\x92\\x15\\x950\\xa5\\xa5\\x91e\\xbe\\x9d%\\xc5\\x0f\\xec\\xb8\\x92\\xc8w\\x01\\xf5\\x83\\x89\\x10\\xcb\\xb5\\xc4\\xca\\xd2\\xc9\\xe40\\x9d\\xe6\\xbay\\xd0@\\xa3\\xca \\x9dwy9-\\xab\\xe7\"\\xd3\\xa5\\x9d\\xfd\\x8ee\\x89g'\\xe6\\xd2\\xab\\x81\\x9a\\x8d\\xb2\\xdf\\xd3&\\xba\\x1cz\r\\xefc"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfuu%\\xf1bb\\x03h\\x18\\x12\\xeb\\xf9\\x08\\xd8\r'\\xa2\\x1a\\xbf\\x02x\\xadue?\\xd4\\x8c\\xafn\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x9b\\xf8pt\\x12*w\\xda\\x9c\\xc1\\x06\\x8d\\xcb\\x7f\\xf47\\xec\\xc2\\x94\\x16\\xc0\\x99\\x97\\xe6\\xf5\\x8fv\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu^w\\xcdq\\xe3\\xd1\\x98\\xa2w4\\x95\\xc1\\xcb\\x00\\x92\\xcbj\\x14l\\xd7\\xa9\\xe2s.\\x05\\xfc\\x04j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xe9\\xc5s\\xbc\\xb7\\xb1\\xb4\\xf6\\xbds$59\\xb5\\x9aqb\\xf5g9\\xe3\\xa8f\\x9f\\x02\\xfb\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu!v\\xa9\\xea\\xc0\\x1c;*\\xc6\\x90\\xa9jz\\x98\\xcf\\xf9\\x8c\\x05\\x87\\\\x92\r\\xde\\x0fs\\xf6\\xc3\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfub7\\xc9m\\xb3\\x08/f|\\xb4\\xc5;+i'\\xa5\\x14v\\x8a\\xf1\\xd8\\xa1/\\xe6brji\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x06`\\xf3n\\xe0pu9\\xcd\\xcbf\\xf6~1\\x05z#>\\xc8oz\\x10\\xee,)\\xb9\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xed \\x89\\xf4\\x96\\xc4*\\x89jz\\xaf\\x00|\\x0c\\xa3\\x0f\\x80oa\\xf0)\\\\xd7\\xaf\\xe0~\\xaa=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xf1m\\x1c\\x1d\\xd1\\x85u\\xa4\\x05\\x90\\xbd\\xa4\\x08\\x95ms&\\xfd\\xef\\x8f\\xe4v\\xa7\\xc5z\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x04\\x18\\x10\\xbc\\xad\\x0e|8\\x90\\xc3\\xefnt\\xb5t\\x99o\\x02l\\xd9x\\x13-\\xbb\\x12\t\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfup a\\x83\\x18\r\\xbe7\\xcb`_\\xb8\\xf4\\xd5\\x82r8\\xbb\\xc3k\\xdap\\xd8\\xdcx\\x8fu\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x032\\xb3a\\xff0w\"\\x93\\xf7\\xdaas>z\\x8b\\xef\\x8e\\xbd\t\\xdf\\x8a\\xf5\\x87\\x16\\xe1\\xfb\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfuv\\x1d\\xec\\x00\\x01\\x1a\\xaf\\xc7m\\xc7\\xd1\\xe5\\xe00\\x11\\x8a'o\\xb0d\\xee\\x1c5\\xe9\\xf5e\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\xc2\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfun\\xc4\\x8a\\x98\\xb8\\xfb&\\x97y\\x0b\\x83a\\x80\\xda\\x12|\\xca\to\\xce\\x88\\xae\\x98\\x068+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfuug\\xbe%5\\x01\\xea\\x07\\xd5\\xb2\\xe9\\xd6j\\xd9\\xe0\\x8e\\xb5\\x00;w\\xadh4%u\\xe2\\xfbx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xa3\\xf6\\xddf\\x08\\xbfx\\xce7(&o\\xc7\\x1c\\xcc\\xd8h\\xb76#d_\\x99\\xb8\\xb8n\\xb2\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfum;\\xd5r\\xd0m\\x12\\x0e2\\xd1\\xaa/\\xc0u/\\xcb\\xf6\\xfaw\\x80\\xe2\\xd24t~\\x8b6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xad\\xbb~j3\\x97\\xbe\\xca;&\\xf5b\\x0748\\xe3\\xcaa\\xa7\\xa5:\\x98\\x8779d\\x1fh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu9\\xa1\\xbf\\xb0$\\x0b\\x921\\xbb(\\xa8o\\xd0\\xc7\\xe1)w>\\x85\\x02\\x95\\xd5\\xeen\\xeba\\xc4d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu,\\xb9\\xaed\\xf5.:\\x12\\xd8\\xe5q\\xdby\\xfac\\x91\\xfd\\xae(\\xbf\\xc6\\xac\\x0bk\\xc9\\xe2fe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x7fh;j\\xb2\\xbc\\x9b\\xb8\\xc4\\x06lh\r\\xd3\\xec\\xc3\\xa0\\xf60\\xa9)\\xbc\\x87\\x046\\x88u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\xae\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xeb\\x9b!\\x0c~\\x801\\xc9\\xec\\xd2\\xce\\x90\\x9f:\\x10\\xa6?(-,\\x00\\x13\\xdb\\x80gi\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xafs\\x00a\\xcd\\\\x8b\\xf4\\xc0'\\x97-\\x01l\\xc0\\x0f\\xc9\\x06ta\\xa4\\xa8\\x96\\xce#n\\xe6\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu+\\x9d\\xd3c;\\x9ad\\x02\\xcam88\\xc9\\xa3\\xfe\\xdb\\xb6p\\xf09\\xdf`\\xb66\\xb0\\x04o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu?\\xf8\\xea\\x9d\\xde\\xb0\\x9c\\xd3e\\xd6'\\xca\\xe6\\xb7\\xc1\\x8a%\\xe4m\\xd6\\xb8n\\xce\\x86\\xbc\\xec\\x1d\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfuo\\xd4_k\nj\\xb1\\xf4\\xe2=p\\x93\\xb7\\xb3\\xe8\\x7f\\x0b\\x87\\x1c\\x9069\\x1f\\xc6l\\xde\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xb1\\x01\\xa2\\x88\\xd5&)y\\xbaf\\x95\\x06\\xc7/\\xf8\\xb8p1h\\xab\\xe8\\xb3\\x86y\\xd5\\xdc\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\xc2\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x8d\\xbe^\"\\xea\\x1d\\xfd\\xb3;\\xcb\\x8c\\x93ty\\xfb!\\x9a\\xd5\\xec\\xdc\\xb2w\\x94#h\\x9c\\xa6k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x99a\\xe8\\x7f\\x12\\xb9\\xf0<\\xde\\xb2$\\x98\\xd1l\\x1b\\xdfw\\xd5\\xd5a=\\xad\\xd13ed)\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfuh-\\x13\\xb5\\x7f\\xc3%\\xd7\\xd4\\x90\\xc9@n'\\x80\\x08\\x08\\xf0\\xad\\x01\\x81\\x02\\xb0\\xc9\\x1f\tc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x00\"\\x8f\\x12yv\\x0b\\xea\\x02\\xbc\\xc4\\x13\\xba\\x15\n\\xf1\\xe4\t\\xd7\\x10er\\xe5\\x92\"h\\xf3\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xf9\\xbek\\xbd\\xf7\\x13\\x0fp\\xe9\\xf8\\xf6\\x0f\\x9a\\x10c\\xf5f\\xf3np\\xf5\\x9b\\x7fd\\xf1\\xd7\\x1cs\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfum\\x94\\x89\\xaa\\xf3y8v\\x14\\x81\\x94\\xadd\\xc6\\xc0\\x94\\x0f\\xd8\\xce\\xa3\\x05\\xdd\\xb0\\x0c\\x17\\xfc\\xcc\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xc6\\x1e\\xd2@n\\xe7\\x12\\x90\\xcd\\x04e\\xf6\\xe4x\\xdd\\xbb\\x82v\\xccl\\x128\\x183g\\x18\\xf7u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xd4\\xebw\\xb3ya\\xc0\\xed\\xf9y\\xf1\\xea\\xbd\\xe6`\\x9e\\xac7\\x97k\\x14\\x9f\\xaf\\xf4\t\\x07schc%\\xdf\\xd6l\\x98\\xecknc\\xf2\\x02;\\xc7\\xe1\\xf0\\xc8u\\xb0\\xcfh~\\xb9\\xec\\x1f8\\x85\\xa5h\\x80\\xd2\\xee\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xf1\\xdac\\x19\\xeb\\x00\\x13d\\xaeyv\\x03\\x93\\xb7\nir\\xc4\\xa3\\x80\\xec\\xa7co\\x01\\x92\\x1e\\x9d\\xd1\\x87\\x07\\x03n\\x8e\\x85\\xbc\\xe1\\xb3,\\xb9\\xa4\\xfb7\\xe6\\xa0"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8\\x94y\\xc1\\xf7\\xfa\\xeeq\\x84\\xb2\\x02\\xa5\\xffn\\xbd\\xdb\\xd0,\\xe9\\x1f\\xae\\xbc\\x89\\x93\\xc7 7\\x1f\\xe7\\xa7g5a\\x03y|\\xf1\\xb9&\\x18 \\xf8\\xe0\\x8b\\xe7\\x02o>\\xba6c\\x8f\\xd4c\\x8d\\xf6qp_\n#\\x9c\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\x13\\xb5\\x95\\x10o.^\\xb5\\xcb\\xa1qa\\x1eyn\\xc9ri\\xb2\\xc0i\\xb8x\\xa8\\x88<j\\x93\\xa5g\\x17*\\xbbyh\\x94\\xbaz\\xcb\\xe0\\xab\\xc3\\x1f3zxf"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>e\\xb1\\x10\\xf6~\\xfb=\\xf0\\xa0\\xa6\\xc6\\xf3$2d\\x07x\\x9d\\x8bw\\xed\\x80\\xa6\\x08\\xba\\x04~\\x94\\x16\\x9a\\xd9\\xe1\\xf0\\xdeu\\xf8\\xb3\\xb0\\xe0u\\xabovj\\xbe89\\x89\\xf0\\x07\\x8dw\\xd7\\xb7;,_\\x7fwa\\xf5n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|\\xd5sw\\x8a\"v\\xb5e\\xb6\\xb2e\\xe4\"\\xfd\\xb2\\xa0\\x8e\\x0b\\xe4\\xa21\\x82\\xc9\\xc3\\x95-\\x9b\\xb9/\\xd9\n\\xbbs;\\x0e\\xb1\\xcc`nd\\x8asm\\xc9\\xdc'"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\x08\\xb9\\x03\\xcc\\xaa\\x08\\x8f\\xca\\xfb\\xd9\\xcd\t\\xf7\\x1bm@\\xea*\\xc2ir6\\xaf\\x9c\\xa0\\xea\\xaa\\xbdj\\x11\\xc7l8w\\x99~\\x1c\\xdc^c'\\xaft\\x1a$\\x84\n\\xc7\\x02\\xd8\\xdep\\xb9o\\xc0\\xc6*\\xbf\\xd2fs\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g~\\xafbx\\xca\\xab\\xdb\\xb6\\xc9\\x05.\\xc3\\x1e\\xd9\\xddag|7\\x02g\\x05\\xe6_\\x18\\xb5\\xd2$ \\x1b\\x9a\\x0e\\xf8\\x96\\xa7\\x12tj\\xee\\x1d\\x98m<m\\xd35"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x0452jp\\xcc*\\x18\\xc0+\\x05\\x94\\xe9\\xcd\\xe3\\x9byo\\x87&\\x18,\\xfc\\x0f\r\\xd1z\\xef\\xe8\\xc9\\xfb.$\\x1b?b\\xf5\\x93\\xd3\\xcf'\\xceo\\xd9\\xf4\\x88\\xae\\xa7\\xe6\\xcd^\\x11\\xc9f5xh\\xc5\\xdc\\xc2\\xfb\\xab\rj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\x05\\xf3\\xb3\\x00\\xdd\\xcf\\xfe\\x0b*qn\\x07\\x96\\x12 6\\x96\\x06<,\\x7f\\x12\\xd8\\xadx\\xd6tu\\xa8\\x0f(n\tj\r$\\x8dg\\x9f&w\\x9d\\xc1/d\\xc7"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xc3l\\xf7`\\x9e\\xc2f\\xc1\\xd3`\\x10\\xdcf+\\x8f\\xa2s\\x9f\\xe4l\\xb4\\x92\\xed\\x08\\xf8\\x0c\\xa2\\x07\\x0f%\\xf0\\xa8\\xdb\\xf28;\\x11\\x12\\xf2pr\\xa5jmp\\xf4n\\xd5^\\x18\\xec\\xd1 \\x0b\\x04\\x14\\xc6\\x8bs\\xa3\\xbar\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\xe3\\xc3rx\\xfd^\\xdfu\\xb2\\x89\\xac\\xbbl\\xf2\\xa3\\x1a\\xad\\xfd\\xce\\xe2\\x94\\xf3\\xa1\\x05\\xads\\xff\\x18\\xe0\\xc6\t\\x01b5&\\x9b\\xf0\\xb8^\\xc6\\9\\x06\\xb6\\x19\\x1c\\xe2"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\x0c\\x1a\\xdd\\xeb\\x84\\xba\\xbb\\xc7\\x8c\\xe23\\xa47\n\\xf9\\xa7\\xa7\\xec\\xb4\\xdc@\\xf5\\x97\\xc8l\\xd3|\\xfe+\\xdf\\x15+\\xdf\\xfb\\x94\\xab\\x87\\x87\\xee \\xce<\\x85\"\\x83i\\x10\\xa9\\xf7\\x87\\xc3'\\x8e\\xac0c>\\xea\\xd8\\xaa\\x0bh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009\\xa5q\\x0b\\x8d\\x00\\xa4(\\x03g\\x0b\\xb4hfsc\\x8av\\xe2\\xad->f\\x9e\\x95\\xd9s34\\x081\\xc4d\\xf7\\xc2\\xaf\\xf8\\xcdy\\x17$gd\\xcd\\xe3n"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdfk\\x00\t\\x92ap0-\\x8d`m\\xbfu\\x1c%m\\xf46 \\xd0s\\x83\\x12rdz,o\\xc1\\xc1/w\\x10\\x8c\\xe5t\\xeeo3\\xe9v\\x1c\\x13\\xba\n\\x7f\\x9b@\\x06\\x89>\\xff\\xae\\xe1\\x9c\\x1b\\xcbo\\xff5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\n\\xffg\\x1a,\\x01\\x95\\xa7c\\x0c\\xe7e\\x11\\xb4\\x9ar:\\x05\\xd5\\xcf\\xf8c\\xd8*\\xd9\\x8e\\xa9\\xa1qx\\xfbk?\\xe4\\xd5\\xd4\\x8c\\x1a\\xeb\\x06\\x00\\x0f\\xba!w\\"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\xeb\\x8d\\xd1\\xd7x\\xfb\\xb0w`&1\\xb4\\xc8t\\xf6h\\xd9\\xcb\\xde\\xac\\xdd\\xb6\\x12z\\xe0\\xd6u\\xb6\\xa9\\xe5\\xfdy\\xca\\xdc:\\xe6\\xb3z\\\\xf5\\xa8\\x0c\\x01\\x8a\\x9a\\xf3\\xd9;=~\\xb9\\x95\\xf0\\xe0;l\\xe7\\xa7\\xe7\\xc8\\xce\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2w\\x93\\\\xe0\\x1e\\x97\\x1b\\xff\\xa4vk\\xb5\\xa9u\\x95h\\x13qar\\xa8\\x12pk'\\x02\\xd9\\xbb\\xe1\\xe2\\xae\\xede\\x82\\x8c\\xb2\\xe5u\\x18s\\x10\\xb0\\x86\\xdd\\xa4e\\xa9"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94\\x1eowlwx\\xbb\\x84\\xa2\\xf8\\xac\\xe3\\x05\\xc2j\\xec\\xca\\xc4u\\xa7.\\xe1-\\xf2\\x80\"\\x9f\\x1c\\xbd\\xa1\\xa3*$?\\x9c\\xcex2\\x8d+\\x89\\xa6\\x8e\\xaa\\x01ec\\x0c3\\x83/\\x8e@$5o`5rl\\xa59\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d\\xa3\\x1a\\xdcf\\x80e\\xeb\\x9f0\\x9f\\xca\\x9a\\xc8\\x1f\\xb8l\\xd2\\xe04\\x9b\\x80|\\x05\\x02ci_hk\\x084\\xaeb\\xabm\\x7f\\xd5\\xbd\\xbb,\\xb0\\xf6\\x06p\\xdb\\x89l"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8>\\x02\\xa5\\xe1\\xb6\\x1c~\\x1f\\x1d\\xb2\\x87l\\xccu\\xbft\\xedh\\x82\r\\xc4\\xfb\\xc77.8sb\\xe3\\x9d\\xe28n\\xef\\xec\\xafy\\xf0it\\x0e\\xf0\\xe9\\xcf9\\xba\\x12i\\xdbl\\x9e\\xa1\\x9d\\xb1vh\r\\x96\\xf9\\xa3\\x1f\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\xdf\\x00i.\\x10\\xa9h\\xad\"i\\x98\\x98\"w\\xce\\xdb\\x06\\xb3)\\xdc\\xe9\\xa0\\xfe\\xe2=\\x86\\x9e\\xb4v\\xd9-\\x19\\xeb2\\x87\\xc7v\\x92\\xc5\\x1c2\\x14=\"\\xd1\\xcc"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b?\\xaa\\xcb\\x15\\xa9\\xb2\\x7f\\xe1\\xb3\\xdf<?\\xc4w,c\\xa5\\xf9\\x1f\\xbb3\\xc7\\xfct\\x03t5\\x10\\x9c\\x89\\xfc4\\xd1\\x1d\\xb4\\x048\\xffx\\xb1\\x0f\\xcfc\\x05v\\xf69\\xb9\\xd4\\xb6\\xb3\\xc7\\x90\\x96\\xc1\\xfd$6<~\\x1b\\xa4\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\n\\xfff\\xfbg\\x89\\xde\\xff\\xc2k\\xa0\\xb7\riv\\xad\\xc2\\x84,\\x95\\xff8p5\\xf4\\x06!\\xa0\\x04\\xed\\xf9\\xf2\\x803\t\n\\xfc(j\\xcb\\x15\\xedz\\xf6\\xdc\\xe2"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.6\\xa1\\xcc\\xec1e\\x0c\\xea\\xf3\\xe7\\xfby\\x139'w\\xef\\x8b\\xfb\\xf5\\xfa2r\\x932\\xeb\\xe8&8lv\\xb4y\\x98\\x087\\xed\\xdd\\x1d\\xc8\\xca\\xaf\\xe8s\\x82\\xec\\xd1\\xb4z\\x82b\\xdf\\xb5\\xd0\\x0f\\xfa\\x91\\x97'\\xdf\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\x00\\x16\\x9b\\x02\\x94\\xee\\xa5\\xb7\\xe0=7\\xa3\\xe1\\x9f249\\x9bu\\xc9\\xf3o\\xd7\\xfe%\\&\\xd54o\\x17\\xa0\\xf8\\xdc@\\xe6\\x1b7e\\xbb\\xdc\\xec3\\xefo"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043\\xac\\x1a\\x8e\\xd9\\xbd\\x9a\\x81orx\\xd8\\xaah.\\xcb\\x16\\xf5/o\\x14\\x1d\\xaf \\xdf\\xfb\\x8b\\x98\\xff^\\xc5x\\x03\\x0f\\xd1 \\x82-\\xfe\\x18\\x02s\\xa8n\\xea\\xd1\\xc0\\xf1z\\xe0h\\x91\\x97\\xf3\\x95i\\xe2ao\\xb2\\xb8\\x8a\\xd3\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5p\\x96\\xe7\\xcb\\xa4\\x95i`\\xb4\\xda\\x8a\\x8a\\xc6r\\xac~\\xd4\\xb6v\\x1e\\xcb\\xbe\\x9e\\x83\\xaf\\xc0\\xbe\\x89\\xe1#\\x93\\xf4\\x83\\x94\\x03\\x01\\xde\\xd7\\xa9\\xec~uzd+\\xe3h"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\x0e\\xa9\\xb4\\xc1\\xb1r\\xfds!c\\xd56\\xfeb\\xd4\\xe3p\\xe0dkp\\x01\\xd5\\xc3\\x1f\\xbb\\x18^\\xc8fe\\xb81y\\xffr\\xcae\\xc9\\x1fo\\xd7x\\xdd(\\xfa\\x88\\xb0\\xfep(b\r\\xbde(bq\\xf5h\\x13j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xaf\\x80\\xa8\\x0f\\x19\\x7f\\xc2q\\xce!\\xe8\\xc5\\x8aafs\\x9b.\\x91l\\xf5;n\\x94\\x9c\\x0e9\\xc2@i|s\\xb3\\xf9\\xb4\\x99r\\xe9\\xaf\\xe9\\xbe\\xade0v\\xdd4"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb7\\xfa<c\\x89w\\xec\\xd6r^\\x90\\xec\\xee\\xfcu\\x08\\x1f\\xbb\\xba\\x1d\\xf5\\xafk\\xaaf3\\x83\\xddw \\x87p\\xe5\\xbb+\\xf5\\x1a\\x1b\\x801\\xf0f\\x93\\xe1\\xfcs\\xa2\\x0c\\x12\\x02\\x91\\xc8\\x1b\\xe6\\xf8v\\x10\\xfcc\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf-\\xd0\\x93\\xd8\\xec_\\xce\\x8d'\\xd5z\\xa7t\\xb2&\\xc4\\xe8\\x99ns<\\xc85\\xb7n\\xf3\\x08\\x86o#6\\xaea\\x89t\\x85$0\\x02k\\x10uuz*"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\x0ebk\\x13\\x117\\xc4?j\\x88s\\x08\\xdeh\\xa0\\x80'\\x03\\xa4%\\xf7w\\x86\\x7fo\\x8b\\xef|\\xef<l\\xf0\\xda\\x07\\xa9\\x0b\\\\x05\\xb1\\xa60\\x94\\xba\\x19\\\\xb3\\xc8\\xc0\\x90&\\xd8a9\\x8f\\xed\\x18\\xfen<\\xce\\xca=\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf\\xe2`\\xbe:^)\\xff.o\\xee\\x89\\xe9\\xc0@bo\\x978\\xa4\\xfc\\x05\\xe8taaj\\x8a\\x04\\xa1p\\xf0\\xa1\\x98h.m\\xdb\\xe5\\xfc%\\x84\\x9b8\\xcfd "
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c~\\x08\\xdb\\x7f\\xe8\\xdeo\\x98\\xe9\\x19\\x1a\\xdb\\x81\\x15\\x9d\\xbf.\\xf5\\xe1q\\x9adm\\xc9\\x05u\\xfd\\xc7+\\xa2\\xe5o\\x99+\\x8dh\\x94\\xce_\\xd10g$/\\xb4\\)\\xbb\\x87\\x88\\xf0\\xd2\\xafy\\xd4\\xe6\\x80\\x9b9\\xa6\\xd5\\xa4\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\x86\\x84\\xde\\x1ef'w&\\x00\\xeb\\xdb\\x19\\xa7\\x7fbj\\x14\\x9f~\\xe5e\\x1f\\xa8\\xa2\tgw?v\\xe3\\x8b\\x0f\\x00\\xfc\"`%r'?b\\x7fg'3!"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9aw\\xfb\\xd9<\\x83\\x08^\\xcd\\x85\\x9c\\x00qi\\x03\\xbe\\x89f\\x94\\x9ea\\xe8w\\xc2\\xf78p\\xe3 \\xff\\xac\t\\xc8;\\xf5q\\xd6\\xdf\\x8c\\xa4i\\x82x\\xf1\\x82\\xb5\\xa8k\\x077#^\\xcf\\xa7\\xbfd<\\xa7\\xc3t\\xb5m\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y5c\\x9f\\x85mo1\\x07d\\x1a\\x84^\\xfefc\\xfd\\xf5\\x8dvq\t\\x9f\\xa79\\xb8q\\xa0\\xf1:\\x08\\xf1jf`\\xa7>\\xb4wucr\\xd1\\xaa\\xb0\\xf9\\xc5\\xea"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xc0\\xcd\\xa58\\xbc\\xb0\\x8d\\xc2\\xdbv/(#\\x82\\xcfu\\x01\\xc7x\\x1a\\xdc.*\\xf6\\x90\\xe0\\xd4\\xf9\\x85/r\\x81\\x1b\\x98\\x80\\xac\\x01\\x9c\\xca\\xe8\\x01\\xed\\xb3\\x96\\x12\\x9a\\x83\\x8f\\x8b\\xa2n\\xb6\\x8d;\\xaf\\x18\\xe3\\xa1~\\xc0\\x83\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6\\xb9w\\xe2\\x84\\x0f`\\xde\\xdc\\x90\\x0e\\x84\\xd8(\\xe0\\xae5w\\xed\\xb3\\x1d\\xdc\\xe9\\xa2\\xb2\\xa5z\\x92\\xc2\\x8d\\x89\\xea\\xe2\\x1f\no\\xaa`!\\xd5\\x85\\x8d*g3\\xa9"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x93\\x9d\\xfc\\x15\\xe6\\xa7\n\\xb1f\\x0b\\x8b\\xb5z\\xf8\\x12\\xa2\\xb1\\x07>%\\xc8f\\x85\\xc2\\xbe\\xe2\\xbc\\xff\\xaa`\\x07a\\xb4\\xce\\xbe\\xb3i\\xf3pz\\xd16\\xb6\\x1d\\xac\"r_t\\xd4\\x8f\\xf68z\\xe0\\xc5\\xe1\\xdds\\xb0:/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\x1a\\xfc\\x92\\x90g\\x17\\x00\\x82vz7\\x14\\xbc_\\xf7\\x99\\x99\\x12\\x872\\xdc\\x8a\\x9e\\xfe+j\\x94z\\xc7\\x95\\x123\\xb6i\\xf0\\xc6\\x98\\xebff\\x8fs\\x7f1u"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\x19\\x89\\x02\\x9a\\xf9\\x831)2\\xfca%\\x96,>\\xd0\\x98\\x9b\\xea\\x8d3:\\xac\\x1d\\xd0\\x0f\\xc5\\xbc\\xadz\\x9b1\\xd4?03\\xb8\\xa3\\x9f&\\xd7\\xb1l\\x98\\x0b\\xc7\\xa2-\\xd4\\x1e\\xe5c\\xce\\xf7\\xd8\\x1c\\x1a>\\xbc\\x89\\xd7\\xc6\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xb6\\xd5\\x1e\\xa8/\\x89\\x11\\x81\\x7f\\xdd\\x17b=w\\x1cmq\\xdd\\x9bt\\x19b\\x11p\\xd4?t\\x15\\x0e7\\xb5\\xb2d\\xa4\\xd2\\xca\\xe1\\x9e\\xb7\\xd4\\xdb\\xd4\n\\xb4\\xbc\\xa4"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x96o\\x0f\\x87\\x11\\xa0m\\xf3zo\\xafw\\xdc\\xafo(\\xf7\\xe5\\x11\\x03z\\xfa\\x9ac\\x17\\x85\\x82\\x0c\\x1a&.\\xa6\\x88\\x8b\\x89g=\\xd9\\xb0\\x19\\x84y,\\xea%\\xcc\\xd6\\x8bg,a\\xa7\\x8b2&\\xd7\\xbbo\\xa9\\xbe\\x89c\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\x8a|#\\xb3\\x11\\xf0_\\xcag\\xd8\t\\x93.\\xd7\\xe4\\xe2\\x1c\\x1c\\xc4`\\xef 1\\xf7\\x88\\xb6\\x9a\\xa3sx\\xc6q\\x989\\x15p\\x9c\\x8f \\xdch@gq\\xac\\x17"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\xd3li\"\\xc3\\x15h\\xba\\xe8\\x19\\xc9~p\\xc0\"ur\\x02\\xe2\r\\x02\\xd8\\xf2\\xf4\\xbf\\xaf\\xe4y\\x0e\\x14\\xb9\\xedc\\xb9\\x07\\xa1\\xfdd<\\x86\\xe6,amr>2\\xee\\x02% \\xd4\\xa5\\x18\\x1a\\xf6\\xb5\\x10\\xa4b\\xbcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2p\\xfc\\xf8\\xd95\\xf6\\xdd\\x82\\x0f\\xf0\\xb5|\\xc5\\x12\\xd5\\xfd3\\x0c\\xf0\\xe8\\x84\\xd2u\\x1dd\";lw\\x0e\\xb2\\x83\t\\x8er\\xa9w$\\xa8\\x9e,\\xf0\\x82l\\xfe\\x95\\xeb"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x8dy(\\xcd\\x82\\xa0=\\xc8\\\\xe4\\x9d$\\xda\\x92\\xd5m\\\\x00\\xd1\\xb04\\x9b3\\x85c\nu\\x13\\xd1\\xe3 \\x06\\xcak\\xab\\xf5\\x8a`\\x01x\\xd28\\x03\\xff\\xd3\\x9av&@\\xc0\\xf6)\\x03\\xfd\\x15|\\x05@\\x87b\\x9a\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@fo\\x87\\xf8b~!\\x02\\xb7\\x84\r\\xc8it:\\xa5\\xf62\\xb2\\xe0f\\x91\\xf8-\\xe8\\xf2\\xaec\\x9ak\\x95^z\\xa4\\xec\\x1b?\\xe2\\xf5/\\x88\\xc6\\xbe\\xd1i\\xd7\\x98"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\x98\\xd9x\\xf5\\x12\\x0c\\x108*\\xebk\\xe6\\x11\\xf9\\x89\\xb5\\xe7/z\\xc79\\xce'\\xab\\x15p#n\\xea\\x05v\\x92uun\\x98v\\xed\\x14+\\x04\\xca&\\x9a\\x1b\\x16\\xcd\\x81\\xd6\\xaa+\\xb5nw.h\\x81\\xdd\\xb1\\x08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\xbe\\x1f\\xd3g\\xd5\\x84\\xaf\\xd8\\xca\\x9e\\x91w\\xb1\\xdche\\xc6\\x8b\\xa5\\xae\\x0b9\\x05\\xb5\\x92):\\x96\\xe6\\xc3\\x1boen\\xd1\\x1d\\xc0\\xd2\\xc1x6\\xcb\\x12sf\\x92"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b-\\xa0\\x0f\\xeey)\\x8bi\\xb0\\x94\\xee\\x88s\\xcds\\xbbk\\x7f\\xa6.\\xde\\xe8\\x7f\\x8a.\\xdf.\\xb0\\xb2\\xefr\\xd6\\xac\\x18h\\xbdui\\xd4\\xb6j&\\xb4%\\xd8\\xf8\\x8c\\x19c?1\\x0c\\x1d\\xf8\\xec\\x9c\\\\x9f\\xc4\\x81\\xa5\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\xda\\x86\\xed^\\xb0\\xd9\\x0e\\x96z\\xe1;u&@l/\\xebt\\xa3\\xe3\\xb3\\x1d\\xd3^\\x01u\nd\\x8761\\x84\\x95\\x0f\\xbd\\xbde\\x14\\x92\\x9dv\\xe3\\xee&\\x8d"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\x11\\x8b@qt\\x0e6\\xf9\\xdfs#_\\x83\\x19\\xb8\\x81n\\x18\\x9c\\xcd\\xe5\\xb5p\\xd9\\x0b7_c4\\x89mvqa\\x9ewd6yu\\\\xb2\\xcf\ryh\\xc5\\x02\\xfev|\\xcau\\xd4\\xf3\\x845\\x9c\\x85\\xef\\xcd\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xacy\\x18\\xaa\\x95\\xc7f\\x1d\\x06g\\xf8\\xcb\\x86\\x13\\xac5\\xb2\\x0c \\x96|?\\x80\\xe7\\x01\\xe4`\\xf0j%\\x89b\\xee\\xdc\\xcdx\\xf2c>gf\\xd9\t\\x8b"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x01fonz2^\\x9a\\xf54f\\xfd6\\x0c\\xbe\\xbf\\xf5\\x93\\xa3\\x1f\r\\xd16b\\x12\\xb0\\xa8\\xef\\xc2k\\xfd\\xfe\\x15z\\xa1\\xbd\\xe33|\\xab\\x1e\t\\x80=\\xd0\\x18\\xc3u\\xb3\\x04l\\xad\\xca\\x14\\x03a\\xc1\\x03\\xe6x\\xd4\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5\\x92v\\xe5\\x19\\xb4\\x16_\\xb2q\\xbc\\xd45\\xbb\\xaa^\\xf0j\\x9e\\x18\\xa3\\x1f\\xe2\\xb2\\xebm\\x7f\\x0e\\xf6m\\xc4?\\x98l\\x0b\\xde\\x96\\x8d\\xf6q\\xc35\\xa5\\xf3\\x1f\\xcc\\x8c"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84\\xc8\\xda\\xad\\xae\\x00\\xae\\xda\\x99\\x11^.\\x82\\x8f(\\xf5\\xbb\\xd7\\xc2w\\xdd\\x9a=\\xbd\\xf3\\xf7p\\xc35\\xc0\\xab\\x0fm\\x88\\x05\\xc5-<\\x9b+\\xa8\\x19!i\\xf4.x\\xf5\\x87vx=\\x94\\x05\\xb4tz\\xa0jmg\\xfc\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\xa1\\x89;\\xa7\\xc4\\xff\\xa8\\x9c\\xbb\\x96y\\xf0~\\x8a,\\xa5;\\xac\\xb6\\x92\\x8a\\xb3%\\x89y,\\x14\\xae\\xb9o\\xbf\\x81d\\xc1>\\x81\\xeb/\\xb0\\xb3\\xa2q\\x18\\xb2\\x8b\\x98u"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?f/\\xbe\\xf6o\\xfd\\x0c\\xdd\\xd6\\xd6 \\xaf\\xe8\\x90\\x12\"x\\xdc\\x99f\\x82\\x94\\xe4\\xe1ssb\\xdf9\\xf8\\xd8\\xd4\\x84\\xd8\\xc0\\xb4\\xa7\\xa2\\xd9\\x96\\xab\\xa9\\xbd \\x9axfl\\x89m\\x86\\xe2o\\xcb\\xac\\x9b\\x15\\xee/a\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xab\\xc7f\\xad1\\xea\\xc6,\\x84\\x0f\\x94i\\xdc\\xaf7m7\\xf7a\\xa9\\x99\\xc3\\xebu\\x17=\\x82\\xb1e\\xa7\\x7fz\\xb3\\x92\\xf1\\xb0\\x9e\\x08\\x84_o\\xff\t?\\xe0k4"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\t\\xb7\\x92\\xdc\\x9ea\\xc6\\x8f\\xef\\xb6\\xdf\\xc0\\x83\\xd1\\x1e\\x04\\xe9\\xc3\\xc2h\\xc4\\x18\\xcd\\xb5(\\xf7~\\x961\\xbc\\xeb\\x14c\\x1c<\t\\xf2\\x16`*9\\xf0s\\x8eb\\xc4t\\x96\\x18\\x19\\xa9l&6\\x8a\\xfccf\\x99\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000&\\x90\\x1d_\\xf4\\xd8\\xce0\\xc8\\xcc:\\xcc\\xf8e\\xf7\\x7f\\x82\\x19n+\\xde\\x99i\\xb9\\xb8\\xdbchi\\x9ag\\x12\\xac_\\x0e\\xfc\\xe6\\x93\\xb4\\x84a\\x8e\\x17\\x99\\xc8\\xb0\\xb6"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xc6l\\x0b\\xcc\\x1c\\x86'\\xa4\\xd1\\x9c\\xff\\xf7\\xe4\\xa1\\xbd\\x11\\xa2uub\\xf4\\xa5\\xa1\\xec\\xc8\\xb2h\\xb8&t\\x8bt=9\\x13i\\xb9\\xfap\\x1ef\\\\xd1\\x04\\xdaq\\x9c\\xcd/\\xb6t\\xfe\\x03m\\xd2\\x8f|\\xfck4\\xb1\\x08\\x17\\xd5p\\x8b\\xcd\\x8c\\xa58%w\\x99\\xdf5\\xa8\\xe1b\\xef\\x8ec\\x8f\\xb3\\xe5\\x8e\\xcf\\x8a\\x8b\\xd8\\xe3d\\x99q\\x02i\\x0e\\x8fe\\xf0;\\xcf\\x02\\x19|\\x90o\\xda=k^\\xab#\\x19x\\x90\\xb5\\x0f\\xe6\\x89\\xaf8\\xb1\\xdf\\x92&\\xb3\\xdad\\xf3\\xff\\xca\\xe2\\xae\\x17\\xca\\x86\\xddj\\x91\\xe3h\\xbb\\xf6\\xf4w\\xab\\xc45\\x15x\\xec\\xf4\\xe5\\x10'\\xe14'|>~\\xcbt\\xab!l\\x8d\\xc5\\xd3\\xf6:\\xf5*g\n\\xf1g\\x00w\\xb8\\x8f38;g\\xcc-\\xb4\\xa5\\xad\\x94\\xe0\\x99\\xd1\\xf8q\\x82\\xc9\\xddo1\\xe1\\xa9\\xfbq\\xe6\\xd0\\x99\\xc8\\xc9\\xb1\\xa3\\x06\\xa8\\x82'a\\xa3\\x0ct\\xc7\\xe6\\xce\\x9a\\xde\\x86\\xcd\\x8c\"\\xbe^\\x10\\x90\\xf1\\x05(\\xa9\\x92\\xad\\x956\\xaf_\\xe9\\xd2"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\x03\\x93\\xb1\\x0c\\x9a\\xbepor\\xc8\\xd8\\xbe\\xcbb\\x0c\\xd2=hp\\x8crw\\x97\\x12\\x87\\x97\\xc4u\\x89'\\xd0m\\xfcoq\\xa4m\\xfd\\xef\\xf6c\\xeb~\\xf3s$_e\\x1a\\xcb\\x0c\t\\\\xafp\r\\xc9\r\\x9e\\xbd\\xd0u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c/\\xcdv.kk+^\\xd06\\x1a\\xbbj\\x97m\\x95\\x18\\xeb\\x1b\\x0b\\xd0^\\xbc\\xd6;\\x1fm\\x08\\xb1\\x08\\xcd\\x14y\\xc2@=f\\x19\\x87\\xc1\\xb1\\x9c\\x85\\xbef\\xcb\\x87"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc3\\x00e\\x1dv\\x0c\\xc7\\xbcf|\\x88+\\x95m\\x9c\\x08fl\\xef\\xf6\\xaf\\xc0x%\\xdd^\\xc0\\x07>\\x99\\x87\\xd2\\xce\\x93\\xe0\\x9e\\x11\\x1c\\xber\\xadc\\x98=x\\xceg\\xac\\xf3\\xad\\x83/\\x87\\x9f\\xc2\\x9a\\xb7\\xb6\\xf8\\xc6s\\x07\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x83\\xda\\xa1\\xa3\\xca6\\xc4\\xdaj\\xfchw\\x19\ri\\x9a\\x9d\\xb1\nzw mfp?\\xd8\n\r\\x88\\xc8$.\\xf2\\xcc\\xd1\\xb6>\\xfd%i\\x0e\\xed\\xe1\\xda\\xfd\\xc2"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde\\x82\\x86*\\x8ak\\xce\\xb8!ef\\x1e!\\x8ddln\\x93\\x82\\xb6/\\xdf\\x0f\\xe6\\x19\\x9e\\xa6\\x9c9\\xbb\\x14\\x8bt\\xa8\\x95\\xd1g\\xe2\\x94\\xabt\t\\x85\\xf70\\x8b7\\x10\t\\xbe\\x05\\xe7_\\xd31\\xf4\\xdb\\xb1\\x8eo\\x8e\\xe1\\x92c\\xd6>\\xe6\\x10h\\x0bw\\x98\\xcb\\xec\\xb8\\xb1s\\xd9\\xd0(%\\xfc\\xf0\\x92t\\xee\\x97\\xf1\\x8c\\xce\\xd7\\x16v\\xed\\x0cj\\xfed\\x7f8fs8\\x8e@\\x0c\\xf5\\xbe\\x8d=\\xf0\\xf1la\\xc5e\\xf5\\x9av\\xa7\\xdc\\xfb\\xed\\\\xba\\xa7\\x95q\\xe1\\x10'\\xf4\\x069t>z\\xea\\x97b\\x07\\xe8>\n\\xc1\tu\\xc8\\xbad\\xc5\\x92<\\xb8\\x1e\\xe6\\xd1\\xf3\\x1d\\xa4\\x17\\xf1\\xde\n\\xe4\\xads\\x9cr\\xf4\\xe9z\\xe4xkv \\x87\\xe4iv\\`9zo\\x8e\\x1a\\x82f\\xfa$=\\x7f\\xa9t\\x86\\x0cg/ u\r\\xf1\\xbch\\xda\\xec\\x0c$\\x0fea\\xb2\\x8by\\x17\\xe6\\xe4<\\xe6\\x0ff\\x14\\xbb\\xe6\\xea\\x8c\\x16\\xd7\\xf9kfame\\xca\\xda\\xe1\\xacj\\xf6\\xbe\\xe9\\x19"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\x9f\\xfc\\x94\\xb2\\x85\\xa7\\x1f\\xf6\\x1c\\xb5\\xc0\\x1b\\xcf\\x7f\\xb4\\xb2\\xdd\\xd3\\x01\\xc5\\xf7\\xaa\\x90:\\xe6\\xe7\\x0b3\\xbe\\xf8@\\xeb\\xf7%l\\x9co\\xc9\\xf3\\x9c\\xc1h\\xa8jw\\xdd\\xaf#\\x17l\\xb8=k\\xcdi~\\x02x\\x0e\\xfc\\x06\\xa2\\x08\\xe2\\x85\\x0c\\x81!j\\x01t\\xba\\xdd#u|\\xce\"\\x85\\x89\\x80\\x94\\xea\\xcf\\xf6\\xa4~\\xa3n$\\xbe\\xeai\\x1eh\\x93\\xc3\\x1fy\\xf7\\xd5\\x02\\x1a_\\x08\\xc4\\x10\\x8e\\x99\\xf1jhd\\xce\\xb3~\\xb4\\xf9\\x04\\x123\\x08\\xc9\\xe8\\x17\\xaf_h\\xb0\\x00jw\\xe1,\\x864\\xf6\\xfc\\xf8\\xca->\\x0e\\xcd\\xf6\\xcal,\\xa7\\xaa\\xf8\\xbe|\\x81dn\\xac\\x93rr\\xab\\xc0zn\\x98q?\\xc3\n\\xb6\\x18\\xea\\xc5 ;ib\\x15\\xc6\\x9db\\x99j\\x1fm\\x8b\\xf2ay\\xc7\\x99\\x0c\\x1c\\x87l<!\\xe2\\xd0\\xbe\\xa9\\x90m\\x07v\\xb4tbz\\x1d\\xd7\\xb2\\x1e6\\xde:\\xc4\\xe9\\x9d\\xa6,\\xea\\x94\\x9f\\x1b\\xcb\\xa00\\x0bry<u\\xee\\xfa\\xbd\\xab\\xd6\\xa2q\\x12\\xbf.\\x16\\xd2"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\xce\\x13eu\\xc9i\\xd2x\\x82\\xe9k\\xe20\\xc4\\x1e\\x97v\\x19\\x0es\\x06\\x1f\\x8e\\x96\\xf6\\x03ih\\xe2_\\xda\\xbb\\x8b0h\\x91tr\\xe95\\xda\\xf9\\xd5\\x00q7s\\x8d\\x89\\x8f\\x1emi\\xf1|\\xaf\\x8e.\\x1698\\xa2\\xb3\\xa0/a\\xab\\xb3\\x07\\xcdef\\xd8\\xcd\\xcb'\\xd9@\\xf7\\x1e\\xad\\x03\\xfd\\x93)l\\x89\\x05`\\x00\\xfa\\xbasebg\\x87\\xa9\\xda\\xda\\xd0\\x0f\\x8f\\xadwp\\x9ck\\xa0\\xd1\\xeeev<f\n\\xa5\\x18\\x90\\x9e\\x8e\\x89s\\xe85\\x922u\\x177\\x95djlg\\xb8\\xa0\r\\x07\\xcc\\xfd \\xe8'\\x7fo\\xd0h\\x02t\\xf8\\xe3o\\xf5\\xaf\\x17&\\xd3g\\xd3\\xaf5a\\xad\\xce\\x1a\\xa1\\x87'8\\x88\\x1b\\x0f\\x8b\\x81\\x03\\xbdw\\x8c\\xadg\\xcc\\x1c\\x04\\xc3m\\x93\\xe9\\xdb:a\\xa0\\xb9\\xb0\\xaa\\xd3\"\\xd6(`ho\\xe1\\xfc\\xdf\\x0c\\x87\\x84\\xf1\\xe4\\xae?\\xbfyd\\x06a\n\\xf4rc \\xb6=ky\\xa1h2\\x89%f\\x96\\x90\\x01\\xef\\x7f\\xe1k\\x0e%\\xd8s\\x9az\\x95=\\xfd"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04fv\\xa9\\x10m\\xceb\\xa1\\xca\\x07\\xd8\\xed\\xe4\\x0b;\\xf2\\xf1n\\xfd\\x97\\xed\\xc04z\\xca\\x84ga\\xa6\\xd2\\xc9\\x94\\xc9\nc$\\xa4f\\xa5\\x8a`\\x076'v\\x9a\\x80\\xbf\\x0c\\xd8\\xea\\xbe\\x80\rc%\\xf0\\x14&\\x96\\xac\\xff\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xc73$j\\xf2\\x08\\xa5\\xee\\x8d\\xe0\\x8f\\x08+\\x88>\\x85mg\\xab\\xf8 \\xa3-\\x98\\xe9\rkxvx\\xfa\\xe9\\xa1\\xdfb\\xb9m\\xd3\\xcb2\\xf5w\\xf0$r\\xab\\xe9"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x83\\xe4\\xdb \\x19\\xbd\\xe3\\x82\\xc0\\x08\\x91\\xc4)\\xc4\\x8f\\xee\\xfc\\x81\\x95\\xac\\x1f\\x81\\xc8\\x8f\\xbc\\xd6\\xc7\\x1bt\\x00\\xba\\xc9\\xb0\\xac.\\xe2\\x89\\x17\\xd4r):\\xa0\\x06d\\xfc\\x9c\\x7f\\xbf7\\xef\\x7f\\xcd~\\x84\\xd9\\xde\\xa7\\xacd\\xb8\\x05\\x0e\\xd8\\xcf1\\xd2\\x9a\\x96l?.\\xfb\\xc1b\\xbb\\x87\\xed\\xde\\xb5&\tc\\xe0*\\\\xce\\x17q\\xed\\x98\\x17\\x8d\\xb0\\xf1.0\\xea\\x90\\xf9\\x9d\\x83\\xf4\\x05\\x81\\x19\\xb1\\x9f\\xde\\x84\\x01\\x04\\x9e\\xb5*\\x99\\x0en\\xa7\\xdd\\x84\\xef\\xda\\xce\\xbd\\xd39\\x86j\\x82\\xe6\\x7f\\x07,\\xf0la\\xf8j\\xfd\\xe3\\xe0\\xd6!m=\\xe2\\xe4r=k-\\x00\\xbc\\xe1j^\\x1dnw\\xe2;h\\xc1\\xe2\\xecf\\xdbn\\xaa~+\\xc54\\x16a\\x92za\\x91c\\xc9\\xbb\\xdcm\\xc9>\\xf0\\x9cx\\xfc-`\\x01\\x9d\\x99-4\\xbc\\xbf\\x84x6n\\x037\\x88t\\xff)j\\xcf\\xf3\\xa5q\\xe4xcq\\xe7\\x8a\\xe0\\x96d\\xf8\\xfba\\x1e1ge\\xa3g7\\xc0u\\xbe\\xa3\\\\xc4\\x01\\x80?'\\xba\\xfd`"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\x1d\\xf3\\xbd\\xb14*\\xfa\\x819#b\\xed.\\xed*x\\xb4\\xbdb\\xf1\\xde\\xac\\xfd\\x19p$q\\x8f\\x02\\xf3\\x9d&\\xa5^\\xf7\\xd3j;\\x8bywf\\xb6\\x0b\\xcbt\\xb4\\xc0\\xdce\\x0c\\xbc\\xfd\\x1f\\x0c\\x11\\x1c=\\x9e\\xd8?u\\xb5\\x91\\xb9b\\xd3\\xd1\\xb3\\xb3n5\\x1ai\\x9e\\xd0\\xbb\\xbfw\\*\\x10\\x91(\\xa7\\xcb\\x00%\\xcf\\xa2\\xb7\\x9e7\\x93\\xa3\\xa3d\\x1cg\\xcd\\x007c\\x95\\xe0\\xb0'\\x8b\\xc5^\\xb9\\xe0\\x7f\\x06`\\xaf\\xc7\\x81g\\xabc-\\xfbuk\\x07\\7\\xb8y_\\x81\\xdf\\x10b^\\x12\\xe5\\xc5\\x08\\xbdp\r~-q\\x93\\x91\\xec<\\xbcb\\x16\\xd1\\xae\\x84\\x8f\\xbc^\\x84\\x8f?i1\\x00n\\xc3\\x10\\xc3z\\xd4\\xe2u\"\\xfb\\x85\\x89\\xc0\\xc9,s\\x04\\xf5\\xda2w^\\xeb\\x87\\x19\"lte\\xcd$\\xb8\\x13\\x9f_\\xe0\\xde\\xfa\\x08\\xaeco\\x063l\"r\\xe0\\x057m\\x05j\\x10f\\xa7ctn\\xdf\\x08ai\\x1b\\xd0\\x\\x8d\\xdf\\x1elf>\\xc0h1\\x1d\\xbb\\x\\xf9b2"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\r\\x9f\\xf1\\x15\\x181\\xbf#y\\x00\\xa0\\xe2\\xcb\\xd1\\x13\\xc1\\x92\\xc8e$\\xb8\\x8b\\xc6c\\xb9`\\x95i\\x93\\xf8\\xb3\\xf5\\xca;o\\xabu\\xaa\\x14\\xabv\\xde\\xee*8\\xfa/\\x85\\xd9n>\\xde\\xa4\\x84\\xac\\x10\\xff\\xbeh\\xb5\\x83x\\xae\t\\xd7\\x96\\xa8\\xd1\\xb3~\\x08\\xd9\\xb7\\xb2\\xd6@\\xe87\\x1an\\xdfl\\xb9\\xf2\\xfcm\\xbe\\xee\\xc01\\xb80t\\x98\\xfc\\xff\\x18tvc\\x8b\\x85(\\x14\\xcf\\xb4\\x04\\xec\\x8b\\xc8\\xb7\\xe7#rh\\xc0\\x90\\xb5\\xef\\x9f\\xb1\\xdb\\xf5t\\xa1>m\\xed7\\xca&aw\\xf7\\xdf\\xc2\\xd0\\xe3\\x8a\"\\x1f\\x03\\xe0#\\x90\\x9fg\\xd4q\\xe3\\xcd\\x07\\x16;\\x0f5i\\x12\\xaeev\\xd3\\x98\\x8d\\xe2\\xb8&\\x81\\x9b\\x9b\\x0cg\\x93t\\xc8\\x90x\\x8ck\\xdcq\\xff\\xfb\\x11\\xd9\\xa3\\xe2\\xa7\\xcaq\\xa4re\\xb9\\xc0\\x98\\xd2g\\xfdfh\\xfe\\x81k2\\xdc\\x00\\xad0\\xa03\\xcd\\xc8mk\\x85\\xc7\\xe0u\\xfe\\x89os4?\tq\\x13xq\\x0e\\xf1\\x03r\\x92\\x92\n\\xdc\\xd7\\xd8\\xc7&\\xderuj\\xc1\\xda"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x80\\x8c\\x83r\\\\xceh\\xd2\\xd8\\x8f\\xaf\\x1bf\\x10\\x06%b\\x1f\\xf3a\\xb0\\x94\\xce,\\xf0\\xf0\\xa9\\x7f\\xd3~m\\x08\\xa9\\x86\\xb0\\x0fm\\x82f\\xba\\x17\\xea\\x81\\x06o\\xe4\\xaa\\x95\\x9c\\x82r01\\xb9\\x04oo\\xe2\\x0f'/\\x10\\x93\\xcb\\x81c\\x8c\\xbc2v'\\xfeo\\xc5\\x98<z\\xdd\\x92\\x8bd\\x85\\x0c\\xaei\\xb4r\\x07o\\x9bc\\xbc\\xe0\\x15\\xfaltd7\\xb9\\xea@cp\\xaf\\x92\\x0e\\x86u\r\\xa4\\x90\\x9fw\\x06\\xf7!\\x9b\\xc2\\x94\\xbf\\xee\\xd9f'dq\\xd1\\x91\"\\xf3\\xdab;\\xf0\\xea\\xa3iaj\\x8d\\x12j!1|\\xafi\\xf8\\xd1\\xdb\\xdd\\xa4\\xd0\\xe4\\xa1f\\xd0vn\\xeeh\\xd61\\xb4\\xa3r\\xedkbf\\xb6\\x91\\x01\\xd1\\x1c\\x17\\x16\\xe9 \\xbb\\x0c\\xe3\\x1az/\\x10\\xb4\\x8e\\xf3m\\xd2\\x7f\\xbe\\xd7\\xf2\\xdf2\\x9a\\x9c\\x85k\\x8a\\xb3\\xe4|dv\\x8c\\xf4\\xc3v\\xb1c\\x8e\\xaf\\x1br_\\xea\\xa82\\xc0zj\\xf2\\xa0/\\xce\\xd0\\x10b\\xd5\\x15\\xf8\\x03\\xf8\\x92\\x1df\\xb5c\\xba\\xd9.`"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7\\xcc\\x8a\\xe6m\\xbc\\xc7%\\xcf#\\x00\t'\\xc9o\\xa1z:j\\xb1\\xf3~\\x01:\\xe0\\xd5\\x1f\\xbc\\xb9ro\\xe8\\x92\\x0ek\\xd5\\x858\\xf7\\ le\\xb1\\x84\\xf2is\\xca:n\\x0f\\x08(\\xcc\\xdbc\\xc8\\xf3a\\xee#r\\xd7ds\\x13z\\xe02\\xe1s2\\x89v\\xfb\\xe9\\xed!\\xe3\\xb4\\x81ll\\x93\\x9fl\\x86\\xcd\\x16v_\\xc5k\\xf5w\\xbdi)\\x88,z\\x1et\\xd4\\xbc\\xc3q1t\\x93\\xe7\\x98\\x99\\xbd\\xb4f)\\xe7)\\xcd\\xc1\\x07<\\x0f\\x88z@\\x0b\\xf7\\x97d\\xd7\\x0e`x\\x8a\\xb9=\\xbdj\\x84\\x82\\xcci8% =\\x19^\\x00m,\\x0fb<\\xb7\\x0e\\x16\\xa8pb\\x9c\\xae\"\\xd9\\xb2k\\x9a\\xb0\\xd0 \\xa1>\\xd2;\\x86\\x90\t\\xe5\\x91\\x82f\\x1b\\xa2j\\x8e\\xcap\\xffa\\x9a3\\xd2\\xd7\\xe4\\xa5f0\\xb3\r\\xb9\\xae\\x84\\xaf\\xc1\\x89\\x10\\x10\\x89s>\\x05-\\xba\\x17\\xf6\\x16\\x13\\xa8k(\\xa3\\xeej\\x9fm/\\xca,q\\xbd\\xdc\\xfah\\x0b\\x10\\xd5\\xc2sq\\xde"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xceg5\\xc6\\x99\\xb5\\xc69*\\xa7us\\xa1*\\xac\\xba\\xee\\x9494t\\xaf\\x92bac\\xa9\\xa0k\\xce\\x11u\\xef\\xaf\\x1f\\x80\\xbe\\xe5\\x8ee\\x03e\\x87\\x1ck\\xde\\xb9$\\xc7\\xa3'+\\xab@\\x0c\\xfc\\x98\\xf2\\xcc\\xe2\\xa5\\xa4\\x1a6\\xdb\\x867r0!\\xc7&r\\xcd\\xb8\\x8b#\\xb1\\x0cp;\\xc9pe\\xf1\\x11\\xa7\\x93\\x9f\\xc5\\x8bbz\\xa6\\xc0\\xec\\xb3y\\xb9j\\xde\\xf1\\xee\\xe1\\xac\\xc9\"\\x07\\xbe|q.\t\\x83\\xab\\xc9\\x14\\xc3\\xc8\\xb3\\xc7\\x850s\\xfb\\x97\\xeb\\xdf\\xa0\\xf763\\xec\\xaa\\x16\\xe4wq\\xa3%\\xd6j\\x8a\\x90\\x82+_\\x91@\\x9b\\xde\\xc2\\xb6tm\\xdc\\x89a\\x05\\x9er\\xd9\\xcfp3w\\x7f\\xedg\\xcd\\x0e\\xdd\\xbb\\x13\\xbfv\\xd8\\xff<\\xf7\\xd2\\x82_\\xbf\\xfa\\x01zj\\x84ga\\xaeq\\x87\\x06\\x0e\\x1et\\x831\\xd6uj@'il\\xa0a5v\\xb9\\xb8\\xc3mc\\x152\\x17\\xe8\\xeds\\x7f\\x7f\\x90\"c\\x03\\x88d\\x15q\\x85\\x84w\\xf9\\xa5\\xc5\\xa0\\xdd\\x8d\\x15`\\xd3\\x08\\xd3"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\xbcj\\x0b\\x9c\\xa2\\xdf\\x87\\x82\\xc4.\\xfc\\xf0t\\xb4\\xa6\\x81\\xee\\xca\\xee\\x05t\\x9f\\x81p8\\x8d\\xd4\\xc4\\xbf.\\xddt\\xbc\\xdce\\x9d\\xd5h*\\xf1t\"l\\xad\\xc8e6t\\xec`\\x1bng\\xe3jh\\x92\\xa5\\xb2x\\x96\\xba\\xec\\x86\\x8a\\xa9^\\xf0\t4\\xd4\\xf3+\\x1a\\x7f\\x1f\\xe2=x\\xaaq\\x07\\x0fu\\xd6\\x89i\\xfbv\\xd5`\\xcc>q\\xf6\\xbe\\x97\\xa0\\x7f\\x9e\\xd6k\\xf2bj\\x1b\\xf3\\xe79%\\xaf\\x13jz\\x12\\xab\\x87ue\\xcf\\xd3\\x8b\\xe7\\xdez;a\\xb2\\x88\\x8b\\xedc\\x0ez\\x95\\x8b\\x91\\xac>\\x8d\\xe8\\xf3\\xc5\\x1bn\\xa0\\x0c+\\xb9\\xdf\\xbf\\x1bz\\xfc\\x9f\\xcd\\xf8\\xa6\\xa9\\xfe\\x95\\x95\\x16\\x04\\xef\\x97\\xe9\\xd2\\xc1:\\xa2 \\xc9g\\xa7zi\\xf7_\\x90h \\xcfv9\\xe2@\\xf7\\x90\\xb7ix\\xffn\r.(\\xb7w\\xd5g\\xe4\\x1b\\x87\\xaby\\xf5\\x10\\xac\\xec#\\x8c\\xf6\\xf1z\\x8eo\\xc2sf\\x02\\xd4\\x19\\x95v\\xd4u\\x0f\\xba\\xaa\\x19\\xf6s,\\xdc&h\\x12r\\x9cj\\xd9\\xc8\\xe9\\xc8\\xd4"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\x85itz\\xe7o\\xfa@bf\\xee\\xd0^\\xa4up\\xb7\\x88\\xd8\\xbf\\x1d\\xfd#\\x9bm2\\x9f7g\t\\x96\\xebt\\x0c\\xf01u\\xcf~\\xcem\\xa05\\xc5q\\xb9\\xc1\\xf0\\xcdn2\\x92,\\x13s9\\xecr\\x9f\\x81k^\\x9e2\\xd4\\x00p\\xfb\\x1f\"\\x0cg\\x0b|\\xf6\nq\\xbdy\\xb8\\xf9c\\x16\\xe4\\x1f\\xae6py\\xd3_<ia\\xa1\\xe3>\\xa0\\xc8\\xd5v\\xac\\xfa\\x08\\xe3;\\xe1b\\xcfd\\\\xd9l\\x1b\\xd0\\xdf\\xe0\\\\xec\\x0e\\xbd;\\x05e%\\xb8\\x85jz!un\\x93\\x99\\x8d\\x0f~6\\xdd&z\\x81(;\\x89\\xe8\\xa1\\xfdt\t, ta\\x016/\\x8b\\xb2\\xba\\xe7\\xc0er8h\\xc0\\\\xc4\\x93\\xae\\xcf\\xb9\\x9dy\\x1ej\\xf7h\\x98\\x86\\xe0\nkr\\xc7x\\xc3*0\\x7f/\\x0cj\\x03v\\x10cv4q\\xdd\\x9d\\xbf\\xde\\xe5\\xcdqi\\x06\\xe6>v\\xc0\\xc6\\xd4\\x12;\\xb7\\xd4\\xaeq`\\xda@z\\x81\\xb7\\x98l\\xaf)oz\\xe7\\xb8\\xa7c5\\x1b\\xdcm\\x82\\xa6\\x85s"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\x8bh\\x8b:s\\xad\\xda<\\x1f\\x19/m\\x1b\\x96\\x9ep\\xce\\x1f^\\x9d-\"\\x1a\\x03<b\\xb3\\x9fa7k\\x07^\\xd1\\x18\\xfft\\x98\\xa4=m\\xa4_\\x94\\x02\\xef\\xcd\\x8f\\xf6\\x13\\x13\\xe3tvkfc |\\x86\\x92*\\xe4\\x07\\x07\\xeeey\\x1b\\x15\\xeegne\\xde\\xae\\xbd\\xda\\xe5\\xf5\\xe5\\xe9\\x96\\x8f\\xc7\\xef\\xd1\\xde\\xd0\\x7f7^\\xa6\\xc77\\xb4\\x1d\\xf8j4\\xfb\\xce/3\\xe0w\\xd7(\\xd28\\xf3q\\xe6\\x9c\\x8a3\\xdd\\xb1\\xfbg\\xa7\\xbam\\x8b\\xad\\x94_\\xaf\\xc1b\\x9f\\x86\\xdf\\xc0z\\x903\\xe1\\xbd\\x83\\xee+.%\\xd3|4\\xee\\x1cw\\xe9&q\\xa0\\xabba\\x85\\xd9u\\xc1n\\x90hn\\x0c<\\xbb\\x1d&\\x9c\\xa0w\\xc8+\ty\\xf4.\nsbn\\x9f%\\xc9\\xecjs1w\\x9e\\xbe\\x1e\\xe5\\xb8\\x04c\\x1em\\x9d\\xcc\\xf4\\x04\\xd3\\xddu\\x94\\xeb\\xc2d\\x96\\xce\\xa5\\x9ci\\xe3\\x96\\x9b\\xddi\\x9a\\x04\\xd4\\x18\\xb2\\x8cne\\xf2a\\xc6\\xe6\\x1a>\\x99\\xbe\\xef\\x00\t\\xbdu\\xfd7\\x99\\xb7z\\x1a("
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\xb0\\x9ds?\\x9f\\x8cs\\xfb\\x1d3\\x05\\xbf\\x1a\\xc4c\\x06yrx\\xa0ha\\xd5\\xc2\\xc4\\x05\\x08w+\\xf0c\\xdfz\\xc7\\xea\\x17\\xf4o\\xb8l\\x84%d\\\\xd4y\\xc3\\x05j\\x8b\\x85\\x11p8\\x84/g\\xa6o\\xe5ir\\x1b\\xa0\\xb4fl\\xf9i\\xe1\\xe2$d\\xac\\xcd\\x13\\x04\\xff\\xbb\\xb5\\xf7p\\x8d\\x91-/\\x95\\xf44\\x07\\xf5\n\\xd4\\xb7\\x8d&i\\xf2>\\xf6ep\\xa3\\xbd\\x9b#\\x13\"\\\\x83\\xa4\\x00*f\\xb7\\x82\\xef;\\x87\\xa3\\xc4\\x80\\xb1\\xe1%\\xf4\\x85b\\xe9\\xcf\\x92bw\\xdee\\xa7m\\x9b^&\\x16yigh\\xf4d\\xf8#\\\\x028y\\xd9\\xf2\\xa4lh\\x9d>\\xfe\\x9ce\\x94y$s\\xc6\\xc9ss\n\r=\\x02\\xc7\\x98\n\\x12m\\xb0\\xef\\xd7o\\x8d\\x8a\\xd7s.\\xd2\rt\\x1b\\x9b\\x18\\x7f\\x1em\\xa7\\x01\\x92_\\x13\\x008\\xc5z\\x98\\xe3\\x0b\\xeb\\xc5\\xe4b\n \\x04\\x9b\\x92n\\xb6\\x86\\x94\\x91\\x17\\xfa?\\xc2\\xb5j\\x0e\\x83\\x0c\\xf27;\\x84*tl\\x00,p\\x08\\xd8\\xad"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%(r\\xca\\xfcf|5\\x9dd\\xe2r\\xfa\\xf1\\x80\\xc0iw\\x88ks\\x81\\xb3\\xef\\xc5\\xb8s\t\\xdf\\xaab\\xbb\\x94\\x14\\xb5/\\xc3`\\xb6\\x9av\\xca>a\\xd6\\xfc\\xf2cq\\xb7\\xd4oz\\x057ls\\xb6\\x80\\xe1\\xf1\\xe6\\xcc\\x7fl\\x848\\xa3d\\x91\\xf8\\xd6z#x\\xd9\\xb2r\\x0e\\xac\\xf2\\xef,\\x04\\x0e\\xbc\\xee\\x18\\x89c\\xa7\\xd0?\\x06ap\\xc7:\\x93\\x05z\\x04\\xbd\\\\x88\\xa7!\\x9e8\\xae\\xea~fw0\\xf5\\xff\\xf0\\x89\\x10\\xeb\\xb7v\\x82\\x83\\xdd\\xbf\\x82\\x8awq\\x1e\\x0c\\x15\\xcc\\xc8\\x94\\xef\\xabwto k\\xff\\xa4\\x1a\\xfb\\xd3\\xad\\xf0az\\xba\\xb5\\xb5\\x82\\xb6\\xa2\\xba\\xe7\\xba\\x9b~\\xd5\\xb3\\x9c\\x19\\xd9\\xd4\\xc7\\xca\\xb6\\x9eb\\xf90\\xee\\xb0\\xc3\\xf8\\x17o\\xb8\\xd3w\\xbe(i\\x1fo\\xec\\x8c\\x17\\xd2=\\xc4\\xf3\\x92\\x1bb;\\x96j\\xde\\\\x94\\xaf\\x1f\\xd5eim\\xe6\\xdcd\t\\xc9\\x81\\x9f\\xad\\x15\\x81l0j\\xa9\\xc8<\\x97\\x0bh\\\"\\xad\\xd1\\xbb0pigo\\xe6'\\xe3\\xd1\\xecf\\xa5"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#^\\x05\\xa9\\xbf\\x02\\xe6\\xdaa*\\x8dh,g\\x1f\\x95)\\x13\\xeb#,\\x08s\\x06\\xe8l\\x97\\xbd\\xbe\\xe4\\x0b~\\x83>\\xe4\\xden\\xa7\\x99\\xbb\\x94\\x7f\\x90\\xdd\\x86\\x1e\\x92\\xea\\xf8\\x06jcse\\xc5\\xe0d7\\x08\n\\xd0\\x84\\x98\\x00\\xa6\\x10d\\x8d8^\\xe4\\x07%\\x17\\xc1\\xc4w\\xd8\\x89!\\xfa\\xb8\\xbf\\xcf\\x98g5\\xcbc\\x9dam>g\\xe3\\xb6\\xc4;\\xfaw\\xf1\\xb8\\xf7\\x88\\x94m9\\xa8\\x86e\\xfcc\\x00d\\xd5\\xb4:-\\xaf\\x9b\\xf1\\x0f\\xa6\\xf4\\x18_\\x16f\\xf2\\xd7\\x1c\\x9fe\\x03\\xb4\\x1a\\xb8\\x01m:@\\xb8\\xed=.b\\x0e\\xf0^\\x7f\\xf4\\x9d\\xa2\\xe6\\xfa\\x86\\xc5\\x07\\xf8\\x9d\r\\x04\\xe5\\xf7\\xed+\\xdb\\\\xfd\\xd4\\x94\\xc8\\x1be\\x1ax\\xbfit\\x84?\\x16\\xd4\\x0e\\x03\\xabr.\\xb0\\xa4\\xbd\\x85\\xfa\\x96\\x1c\\xdb\\x0c>\\x14|c&\\xb8\\x00\\xb2\\xc8\\xf0\\x9d\\xb8\\xea:\\xc6\\xf3@%\\x89\\xea\\x94\\xf2\\xff\\xfc\\xb4\\xb0x-\\x1d\\xf1d\\x99\\xa7qhp1e$\\xb2^x\\xafp\\x0e\\xcb\\xaf\\x84\\x1d\\xc3\\x93\\xcc"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e)\\xc3l%\\xc4\\x13`\\x90i\\x96iwgg\\x7f\\xeb\\xb5\\x1b\\xd5\"\\xedmm\\xf5\\x90\\x7f'\\xe9xp\\xc4\\xa7#\"mt\\xdev1|z\\xd5\\xab!vb?t8\\xde\\x13\\x8b\\xcae\\xef\\xe8v\\x84\\x110jm\\x02\\xff\\xdbfh\\xca\\xcd\\x0e\\xd1\\xcb\\x98pf\\xa0\\x87\\xf8\\xber\\x0f\n\\xb0\\x15\\xbc\\x96\\x01\\xdf\\x8ea\\x1f\\xc9\\xe77\\x89+\\xc9u\\x91n\\xf9t\\x17q\\xdb\\xd9\\xb7\\x18\\xc6\\xbb\\x08\\x0fa^\\xde13\\xdf3\\x9ay\\x07\\x183\\xf4^:\\x0b\\x8c\\x93\\xbf\\xcd-j\\x96 %1\\x03m\\xe3o\\xeb\\xf3\\xaa\\xfc*\\xc4n\\x82\n\\xc1\\x8dy03+\\xcdl\\xa4\\xfe\\x8bj*\\x06\\x01\\xb6r\\xf9j,r\\x12\\x1e\\xdf\\xd8\\xee\\x86\\xbb\\xaa\\x17p\\x1b!\r\\x16p)\\xd3\\xbc\\xadis\\xf1\\xb8\\x03\\x99\\x90\\xba\\x00\\xb7\\x03\\x99#q\\xc0\\x19\\xf7\\xa5\\xa2$\\xdf\\x94\\x15\\x9e\\xb0\\xc7&i8k\\xa8\\x0f\\x0f\\x82\\x13\\xa6%\\x1f(\\xf3d\\xb1\\x1a\\xc3`\\xf5*x\\x95x\\xe3\\xdf`"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x14\\xe1\\xee\\xc4\\xbb\\xf8?\\xdb\\xa6i\\x9a\\xe2\\xe0\\x85t?\\xb5q\\xc3\\x9a1\\x89\\x8bu0u\\xa99\\xf2\\xb5\\xc0\\xc0\\x91o$kg3\\xb1\\x95%\\x04\\xd7vrb|#\\x81\\x19\\x97\\x12\\xads(\\xe1\\x98\t\\xfe\\x11\\xfbi'\\x17kb\\x0c\\xa1h\\xb3d\\xa9\\xa0\\x82\\x89$\\x84\\xb9\\xed\\x94\\x8c|\\xe3\\x87\"\\x07\\x06\\xa4\\x890\\xeca1m\\x0f\\xbe\\xd13\\xf9\\xfd2\\xf4\\xbb\\x04\\xa4 \\x13j\\xa0\\xf4\\xb8t\\xbec\\x97v\\x12t^\\xc0\\xcd\\xb9yg\\xf1\\xfe\\x1f\\x99o\\xa2\\x1d\\x94\\x92\\xdf\\xab\\x97\\xafhx\\x9dz&\\xd1\\xd8\\x04x\\xa3\\x84\\xb1c\\xc6\\x17\\xbd2d\\xfc\\x9cwfr&\\xa5o\\xe3w\\xac\\xea\\x908\\xefm\\x0e\\x9f`\\xe8\\x03ml\\x0b=\\x1ewaix#\\xd2pa+y5\\xe3z\\x89\\xec\\xd2\\x9d\\xa3\\xf1\\x92%\\xe6\\x0e\\x932\\xa8ggv\\x01h8\\x0ct\\xa9\\xa3c\\x1b\\xc1\\xf4\\x8e\\x94\\x15\\x12\\x02v\\\\xa1d\\x01\\x8b^\\xfa'\\xe0u\\xb0\\xe4j\\x96\\x87\\xf2\\x12\\x8f\\x1e"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3l\\xe7\\x16\\x99\\x85-\\xb1y\\xda3\\x1f\\xb3|ott\\x9b3\\x9d\\xb7\\xdez\\xd7\\x1d\\x10\\xeb\\x83$>\\xf7\n\\x94u$\\xdd8=\\x82\\x1b\\xd7\\x11\\x8e\\xe6\\xc7\\x8bp/*d\\x9f\\xf68\\xe2\\x1e\\xdbq\\xa1|0\\x16\\xe8\\xf4f3\\xd2m1o\\x97\\x06\\xa0\\x0f\\xc3.\\xc6)\\x10\\xe5\\xcb\\x82\\xe720\\xa7\\x1f$\\x1a\\xaet\\xeek\\x1f\\x8c\\x02\\xad5\\x93\\x14\\xec\\xb2\\xd1\\xc2\\x05\\xd5\\xad\\x8c\\x0c\\xdf\\xb7\\x99\\xe3\\xeff\\xee\\xee\\xcb&8i\\xce\\xf7\\xc4\\xf0k\\x89#\\x0f\\xe4\\xfb\\xdd\\xfe\\xf2\\xf7\\xc2t4#\\xf8\\xe3w\\x9e\\xe6\\xfa\\xebl\\x1d\\xa9\\x87\\xb2\\xc3\\x83\\xe1\\x1a\\xcc\\xf4\\x19d\\xa7\\xaaa\\x10\\x1a\\x0fwm\\x1ay\\x16\rf\\x0cbq\\xfa'\\xbe\\x138\\x90\\xcf*\\xd4:^\\xf0xb\\xdd|(\\x04\\xdd/\\xcb\\x12\\xd5o\\xabpv\\x0c\\xe6\\x16\\xffy\\x82\\xfdo\\xb3q\\xa99^\\xfe\\x18g,b\\x9b\\xfd\\xbb\\x1e`\\xef\\x113\\x98\\x00\\xe3=\\x9a\\xcf%\\xfe\\x84\\xed\\x198,\\x11\\x0f^\\xff;\\x19?"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\xc1\\xc7\\xffiy!\\x154f\\xc2\\x04\\x0c\\xcb\\x98\\xb3e\\xc34+\\\\x06\\x84o\\x84\\xb0\\x0f\\x1f\\xdc\\x847\\xa6\\x81\\xd9\\x10\\x9d\\1\\x02\\xec xc\\xc6\\xd4\ta\\x83\\x0e5p\\xfd\\x85>e19=sp\\x93j\\xa1\\xc7\\x04+nx\\xfda+\\xbbh*\\xe34\\x16\\xa7\\xc5\\xe4a\\x90\\xd7\\xe8\\xeb\\xb4\\x90>\\x96;t\\xd3y\\xea3\\x9crq\\xdc\\x9d/\\x14dc\\x91ie\\xa1?\\xb0\\xbf\\x9f\\xd3\\xffy\\x8am\\xc3\\x03\\x1e.\\xe5m$\\x19\\xd2zo\\xdb\\x9a\\xe7k\\xcdr\\xb3y\\xd4\\xe8\\xa8\\xc2\\xc6\\xb4\\x18e1\\x1a\\xe2\\x1d\\xbc\\xa1\\x1d`\\xf9\\xe3f\\xbd\\xad\\x02u$iko\\x84\\xbe6l|\\xce\\x00\\xb8h\\xfc\\xbd6\\xe9vlh\\xb6\\xa6\\xdfis\\xce\\x8f\\x18\\x8b~o\\xbe\\xb9\\xc5\\x11\\xfa\\xbb%\\x06vuk\\x1c\\x98\\xbb\\xe6\\x81\\xe9\\xea\\x15g\\x05\\x18j\\x9d\\xe6\\xf2\\x8a\\x89\\x8b^\\x1ap\\x88\\x8f\\xb5\\x9d\\x08\\xbb\\xfa\\xff$\\x18\\xec\\xc2a\\x82\\x0bs\\x9d\\x13\\xc5\\xd4>\\xad"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x96<r\\x84\\xf9v\\x0c\\x98\\xed\\xd6x\\xf3\\xab\\xf8<\\x1e\\xb4\\x1d\\xbd\\xcd\\x15\\xdepn\\x02\\xc3mr?%\\xb7\\xa2\\xa6\\xb5.\\x85\\xe1\\x07\\xbcqs\\xc2b\\x17\\xc6\\xe0e\\x88a\\xd4\\xdfj\\xc2\\x86\\xe7\\x9d\\xe0tm\\xb6\\xa1z,\\xc4\\x10%\\xd6!\\xf7\\x1a\\xff\\x02;\\x0ev\\xc6vs\\x04\\xe0\\xff\\xd4\\xff^\\xf0\\xf8\\x0f\\xe9\\xcc\\x84%\\xd5\\x95\\xa5>\\xc6o\\xc3\\xcd\\x05#\\xd8h\\xb7\\xc3a\\xb8nd\\xf3\\xb6\\xfdzt\\xbax\\xb9\\xb2\\xc1\\xcb\\xab\\xe7\\xad\\x9f\\x0b\\xf0\\x92\\x07\\x0b\\x06\\x99h\\xbag\\xbdcl\\x00\\xf6a\\x01\\xce\\x8fy\\xeeo\\x00s\\xa7\\xf84\\xb5i\\xb8\\xf2\\xa8\\x07ty\\xff\\xed\\xc1 \\x07\\x8a~3\\xf6\\x9b\\x12\\x1f\\x1e\\xf3\\x08\\xc3ube\\xb4?\\x93@lv\\x9a\\xady\\xc1\\x8e\\xd0j\\xc7\\x08lx\\x0f?y\\xadn`u\\xd1\\x9dt\\xab>g\\xa8\\xe2\\xb0!h\\xfa\\xf7\\x9div\\xdd~\tk\\xa3uoh\\xb1\\xa5\\x11\\xc3\\x88\\x98~\\xfc\\xe8x\\xe3\\xe6\\\\x02\\xa2\\x81\\x89?qa"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8c\\xcb\\x17a\\x8a5f\\x08m\\x80c=\"ho\\xfd\\x89f( \\x11g%\\x84\\xa8a\\xe2\\xb5\\xb1\r\\x87-\\x107p\\xd0\\x942\\xb9\\xf9|\\x16q\\xc8ja\\xb1\\xca\\xd7\\xe5s\\x02|\nn\\x03l\\xd9\\xee\\x9f\\xe4\\x04\\xce\\x83\\x08\\x8e\\x16\\xd43\\x92$\\x86t\\xbd\\xb0\\x01\\xc9\\xd3 \\xbd\\xeb\\x1c\\xfa/\\xe5y\\x93\\x84\\xc78\\x85vm\\xa7#\\x95\\x0b\\x06,+\\xfb\\xf0\\xc6\\x95\\x86wth\\x1ctt\\xee\\xfc5\\xf5\\xf1-q\\xaf\\x03\\x1c\\xb9\\x07\t\\xe4\\xd5\\x8b$\\x13\\xe0\\x04\\xe0\\x8csc\\x8aq\\x89o\\x086\\xa0\\xfdld\\xb8\\xfc\\x17\\x83_\\xb8as\\x04r\\x81\\x1c\\xdc\\x19tz\\xe8\\x15\\xee\"'v\\xaae\\x03\\xb4\\xee\\x9eh\\x97\\xca\\xe3\\xef\\xd4<c\\x07\\x82\\x1e\\xf3fi\\xd6\\xe1\\x00,\\x87\\x1ec\\x92@6\\x97:)\\xd4\\x97nr\\xc8\\x8ad(\\x17\\x03\\x15\\xda\\x918e\\xaa\\xe1\\x1dvz\\xfb\\x93\\xcb7\\xf7x\\xff\\xbe\\xf4<h\\xc6^\\x06)\\xbc\\x81\\xcaxgx\\x0epx\\xb8x"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x115(z\\x1a\\xa7\\xf6\\x8e\\xc3rr\\xc7\\xa3\\x14q \\xa0d\\xde\\xa3\\xbf\\x99\\x89\\xbe(\\x94 s4\\xc04y\\x8a\\xd2\\xa2\\x08\\xd0\\xe7\\xfd\\xad\\xcf\\x89\\x11\\xf1w(\\xc7\\x06y4p\\x9d\\xb5\\x03\\x7f\\xf9\\x1d\\x19\\xef\\xb5\\xc4g\\xb3\\x07\\xdau\\xd4\\xbb'u+k\\xa08,\\xa1\\x04\\xef\\xc6\\xb8\\xe7\\xbc\\x93\\x02\\x121\\x9a\\xdd\\x95\\xdb%w\\x1d\\xc3\\x03\\x0c-k_\\x9e5\\x86\\xb0\\xe8\\xc0\\x98f\\xf6p\\x06\\xf1\\x7f:\\xa5\\xc1yb$\\x9e?\\xa3y\\xfawg\\xf2\\x88\\x17\\xf3>\\x82^\\x95\\xdb\\xb0\\xc5\\xcb\\x8dt\\x8a\\x13i\\x91:\\xb3\\xfa\\xb5\\xf7)5^|\\xa5t|\\xd6\\xee\\xb4\\x8a\\xb5$\\x03\\xf8\\xf1>\\x1d\\xd7\\xee\\xf4l\\xdb\\x92'\\xa7\\x06@\\xd9\\xf2\\x91\\x7f\\xba\\xa1p\r\\x8a\\xd8\\xe8o\\x8e\\xcfn\\xe8j\\x96\\x8f\\x8asw8\\xe6\\xca\\x84w\\xb3t\\x10$\"\\xce\\x1d(\\xec\\x12\\xbc\\xc2h\\xf9\\x0e\\x8b\\xb3\\x13\\xa1\\xf2\\xa9\\xd4\\x88\\xf7\\xc6\\xc2v\\xa5\\xf7b\\xae\\xce\\xaf\\x92\\xbb\\x1d"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xfbf\\x7f\\xaa\\xc1f\\x81\\xb5\\x0c\\xb2\\xc81\\x05y\\xd8\\x85\\x14k\\xe0\\xc8\\xd5\\xa2%\\x1d\\x82\\xda\\xba\\xb3oi\\xf2\\xba\\xb08\\xd0\\x1b\r\\x08\\xac\\xf3\\x0c\\xed\\x18\\x1e\\xe2\\xef\\x04c\\x93\\x18h\\x82`\\xb8\\x7f\\xe0\\xd9\\x8f\\x12\\xbbf\\x01\\x05\rr:\\xc4r\\x1d\\xd7\\x1ev\\x97\\x91\\x94d8/s\\x80\\xd0\\xd1\\x0c\\xd2c\\xfc\\x03:\\xa3\\x8b\\x88\\xc6\\xce@\\xdb\\xbby\\xe7c\\xb86a\\xeei|\\xc0\\xc1\\x07\\xe0d\\x97\\xcb\\xbd\\xb8\\x98f\\xc8z5uo\\x8c\\x16 -\\x038\\xf6^\\xa1\\\\xf7\\x99\\xd9\\x15pt\\xb1+8\\xeb`\\xcd$\\x04\\xcb\\xf1\\x9f%u\\xc1\\xa7\\x9e\\xad*\\xea\\x10\\xa4\\xd2\\xf2w?cx5\\xe3u,4\\xad%\\xb3\\xee\\xfc1ur\\x18k\\xf7\\x88\\xd1\\xe5y\\xb0_\\xe4<\\xfb\\xe55\\xe2\\xd1vy\\xe0\\xafg\\xa1\\x15\\xbb\\x1a\\xbb\\x90\\xebp\\x88\\xe5\\xcd\\x1asd\\xf0y\\x813b\\x06\\xd6f\\xd3\\x9a\\x0f\\xab\\x96&\\xe9\\x0b=\\xa7\\x07\\xf3s\\xd8_/\\x03.\\xd1\\xe2\\x8ce\\xd3\\xa9\\xe2\\xcb/\\xd8\""
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7h:\\x91\\x9c\\xcd\\xdd\\x92\\xe4\\x1f\\x1a\\x1a\\xfc3\tz\\xf6\\xaf\\xdft\\xa2\\x7f\\xb3f\\xb6\\x81\\x96vp\\xdc\\xfe\\xa2\\x8bw:\\x97kn\\xa0\\xbei\\x8a\\x8f\\xa6\\x7f\\xe4bl\\x8a\\xec(\\x98\\x87y\\xf2\\x9c\t<\\x94\\x1b\\xd7\\x0c\\x1a9\\x10\\xf33\\xc23\\x95\\x14=\\x19z\\x92\\xd5rd\\x87\\x92\\xb5m\\xa7\\x92\\xad<b2\\x0c\\xcc78v\\xf0s\\x81\\x1e\\x82\\x1av\\xb7\\xf4\\x13;\\xe0\\xb2\\xf3\\xf4\\xf9'q=\\x80\\x1ch\\x02\\x00\\xf1\\xa0a\\x17\\x1d\\xc7m=\"\\x1d'#\\xd2\\xfa\\x821,\\xf4\\xce>\\x8bx\\x94o\\xc7\\xd6\\x80\\x94u\\x04\\x9c\\x82\\xc4/\\xa2\\xc7\\xc8-\\xe29\\x95\\xd5\\xc0\\xc9\\xe8\\x81=\\xf8\\xac\\xc5\\xd5\\xf7\\x03\\x15\\xce\\xee\\xba\\xa9/a\\xd5\\xe5\\x8d\\xb6\\xa0\\xa4\\xd5p\\x9f\\x02\\xf9\\xfb\\xc0 q\\xac\\x1ft\\x16\\xe3\\x06\\xf7\\xfb\\xa4\\xf9j\\xfc\\xd0t,j\\x15\n8\rurj\\xf6y\\xd1\\x1b+@*j\\xc9q6\\x00\\xf2\\x8c\\xa9wk\\xfb\\x08\\x82\\xf4\\xde\\x10\\xa5\\x84\\x90\\xaa;\\x0e\\xdesf"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?\\xd2t\\xb2\\x03\\xc9\\x1e^\\xfb9y\\xd8\\xcda\\x7f\\x84\\xf1\\x8a\\x1a\\x83~\\xc0\\xe7-ew\"\\xe4\\xf3a9\\xe95\\xd4v\\x15\\xea\\xbfg+\\x10\\xa0\\x90\\xc7\\xb1\\x8b\\xe0\t\\xb1c\\xcc\\x1f|\\xda\\x85\tb\\xf9\\xbf\\xb7\\xd8\\xfekx\\xa78\\x10;-k\\xa0\\xb7 n\\x9dv\\xd2\\x05\\xbc\\x1c\\x8a\\xcd\\x13o\\\\x0f\\xa7m\\xfe3.5\\x16\\$\\xbb\\xfa\\xbda\\xa6\\x94\\x87gv\\x08\\xeb\\xa1\\x870\\xc2t\\xb7\\xb1\\x8abz(o<\\xf5r\\xba\\xf0\\xb5\\xcc\\x8b\\s+!\\xea\\x8f\\xbb5\\xee\\xd8\\xec\\x9bk\\x18\\x87\\xdd\\x11\\xdc1u\\xc8\\x814\\x1e_\\x96\\xa0\\xc7q\\xf7\\x19s\\xc3\\xda\\xe0\\x94\\x0f\\x89\\xd5(\\xd1\\xc9z\\x05\\x8b:\\xac\\xe1qx\\xcd\\x10|vy+\\xdf\\xb3(\\x93\\x0e\\x18\\xedus\\xfa&\\xfa\\xc6\\xfa\\x07\\xf5\\xf5\\x9c\\xd0\\xf9\"u\\xbf\\xc9\\x82f!\\xe2\\xce\\x15c2\\xcc-gq\\x80v:x\\xeecjb\\xa9\\xc8\\xc0\\xccv\\x07\\x95d\\xf6v\\xc8!29#:j\\xb4w"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu0 `m\n\\xddj\\xe5\\xb36s\\xe2\\xf8\\xaf\\x13\\x14\\x0b\\xde\\x16\\x0e\\xe8\\xf3s_\\xeb#\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x7f\\xfe\\xa5\"\\xa8>\\xae\\xbeft\\xa0\\xa0\\xf9\\xce\\x95\\xd1\\x9c_\\xc6\\xdc$\\xb54rx\\xbe\\x82*\\xb3:\\xd3\\xff\\x17fw\\x82o\\xd8\\xcc\\xd3\\xcc\\xb3!g\\x0b\\xb7\\x92\\xa9\\xfe\\xad\\xd4<l)k?\\x11$\\x8b\\x1au\\xa6\\xe9\\x16m#\\xc2\\xeb\\xac\\xa0\\xd2%\\xeb\\x7f\\xedk\\x02\\x1b\\xac~\\xb3\t\\xba\\xae\\x96\\xa3ph\\xb8\\xb6m\\xde\\xed+\\x9bo\\xe3\\x89\\xe7d+\\xc7#\\xa0\\xbbi)\\x977k-\\x10\\x94\\xb5f\\x8b2\\xa3\\x7f\\xc5\\x03|\\xd9k\\xfc\\xf3q\\xeep\\xfb\\xa3\\xe4\\xcb\\x9e\\x1an\\xb8z\\xfdkz\\x02\\xad\\xe9\\xea\\x8e\\x14lc\\xb1\\xd0:@\\xa5\\xa8zi\\x936\\x91'n\\xc9\\xbe!t\\xee~\\xf3\\xe5\\xc1\\xfea\\x8c7\\xa3v\\x97\\x91>\\xa0\\xa8\r\\xe1\\xe1e\\xb8\\xf6\\x02\\xcc0n\\xd5\\xc5\\xb1\\xe3\\xfb\\x91\\xban\\x08\\xeb1\\xd8g\\xd0.\\x81\\xf2q\\xd3\\x04!\\x08j\\xdd\\xd9\\x1by\\xb2\"\\x04\\xbc\\xd4e\\xa0\\x9f\\xba:\\x9e\\x15q\\xc8u\\xe2(-\\xa6\\xc6\\xf6\\xc7\\xc5\\xda\\x1bv\\x0f\\xf8\\x8c\\xd5\\x8f"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~\\x954\\xc7\\x0fd\\x98i\\xa2\\x19b\\xec\\xd65~?\\xdb\\x1ce?\\xec\\x06\\xee\\xf6:\\xdb\\xce\\xda\\xff\\x02+\\xb5\\x0c\\x13\\x81\\xd4\\xa5\\xb7;\\x0c\\xf0\\xf5\\xdd\\x92\\x8e\\x0c\\xd7:\\x19\\xab\\x96\\x11\\xac-\\x9a\\x93a\\xe4\\xe4\\xd8v\\xd9\\xd4t\\xc5\\xec\\x077\\x81\"\\xda\\x06y\r@\\xb73\\x1a\\x94\\x0b\\x93p^\rlkl\\x1e\\xda\\xe7\\xb0a\\xb1vqk\\x9b\\x86\\x96\r\\xef\\x93m\\x0b\\x9c\\3\\x9ek\\xcb\\xd2h&\\x89/\\xe2\\xa3q,\\xea\\x89\\xae\\xa4k1vg\\x93>\\xf7f\\xdeh`n|\\x94\\x10\\x01i\\xec\\xfd\\xde7>\\x8f\\x9f\\xa9\\x9b\\x8b`g\\xfb|y\\xc1\\xdbh\\xecb\\xfa\\x17\\x83\\x1e\\xc2\\x06q\\xa9t\\x99\\xa2\\x0b\\xa85\\xed\\xc4\\xf0\\x18r\\xdf\\xdf\\x0e\\xcf\\xb7y@8<\\xe5\\xa4\\x06?z\\xd2s\\xd8\\xc8\\xb3\\x0cgf\\b\\xf3\\xdd\\x000i\\xea\\x7f&\\xd3\\x91\\xa1\\xc7\\x80\\x9d#j\\xca\\x90wt\\x9c\\x17\\xfam\\xb5\\x96\\x0co\\xf1\\x92\\xcfzmm\\x10* \\xbd@\\xbf(\\x04\\xe2"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\xdez+ \\x84\\x83\\xc60\\x9a\\x8a\\xb2\\x0c\\xa8m\\x9c\\xdc$4\\xc7\\xed\\xd7(\\x95\\xe0\\xe6\\x17s-\\xab\\xc7\\x92\\xd0\\xfeo\\x9dx\\xc3\\x90q\\x00b\\x899\\x84#e\\x99\\x90\\xf7\\xff\\xd3\\x8d\\xd8\\x85\\xcc\\xc0\\x17\\xa4hhl|\\xba\\xbc\\xdck\\x85w\\x7f\tyxea\\xefg\\x04\\xd1=n\\xff\\x9d\\xfcc\\x8d\\xa0f_\\x96\\xff\\xb0\\x07\\xb0\\x90;6\\xe8\\xe3\\xcf\\x83jo\\xd8\\x84u\\xf9n\\xbf\\xd0d\\x98\\xd0p\\xff\\xf2r\\xf9\\x18,|\\xe6\\x9b\\xb1\\xe1\\xbd\\x0fo\\xee\\xc0\\x1a\\xea\\x0f\\xeb!\\xaa\\x9c\\xe1\\x9e\\xee\\xae\\x94\\xd0\\x19\\xe0\\xe5*\\xd3e\\xce\\x86\\xd10\\xd0\\xb3\\xed\\x98^\\xb97\\xf198x\\xba\\xfa\\xb3\\xcd\\xccn\\x04\\xfc\\x0f\\xc6\\xce4\\xe7\\xec;\\x0c`q\\xee\\x07#\\x8c\\x98\\x94,\\x06\\x045\\xc2\\x0fn\\x9c`z\\xbbm=\\xba\\x913\\xa3|\\x06v\\xe8al\\xe1\\xa4\\xaa;\\xa5d~.\\xe2w\\x07\\x81\\x1e#s\\x08\\xc1&\\xcb\\xe0\\x0c\\xdb\\x96\\xacpp:o2y\\x7f\\xf8\\x10\\x12n`"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xaf;\\x89\\xde\\xc9|97\\xf8\\x8b\\x89g\\xc4|\\xb7\\xad\\xe4\\xcf\\=\\xc1\\xe29\\xdb\\xa3-r\\xb9t\\x1a2mz\\xa5\\x05\\xa5\\xb0\\xd8\\x8do\\x9b\\xdcj)\\x17\\xf0\\x02\\x17\\x84\\xe6\\xb6\\xd6\\x85\\xb4\\xfd!\\xae_\\xc2\\x85\nul#\\xa7k\\xda\\xc4\\xff\\xe2\\xf4\\x86x\\xfa\\xcf\\xcb\\xda$\\xd8\\x1a\\x05\\xd3o\\xd2=\\xab\\xee-\\xe3\\x9fsm\\x01&\\xd4\\x91\\x84\\x0cs*\\xab\\xc9\\xe8\\xae+ \\\\xb8\\x18\\xd3\\xfa\\xac\\x866\\x89\\xb8\\x14x\\x837\\x0c \r\\xed\\x19?\\xc1\r\\xd0&\\xcc\\x92t\\x93q'\\x96\\xb52j\\x82\\xaf.\\x0fe,\\xfd\\xef\\x03n\\x10d\r,x\\xf48s\\;\\xc6\\xc0!\\xcf,\\xfe6\\x12\\x98\\xf0\\xd8\\x8a(a\\xfa\\xc4@\\xfdl\\x18\\x0f\\xdb\\x9b~l\\xb7\\xcf+\\x8a\\x9dk\\x1dz\\xf1\\x00y\\x16\n\\x97\\xcca\\x12sd\\x16\\xe0-\\xb2\\x9e\\x183\\xd9\\x96\\xaem\\xdc\\x9ds\\xba\\xc5\\x81yk\\x15\\xbc\\x02\\xc0\\x8d\\xb8\\xadu\\x0e\\xd5\\x8b_\\xa3\\xdc\\xe9\\xe3\\xe3\\xd5l\\xa7f#\\xd6)"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1e\\xfcz\\xc1\\x8a\\xd3\\xcc\\xed\\x1f\\x97\\xc6\\x11\\x93\\xd2\\xeai\\x03\\xbe0b\\x9b\\x16\\\\xfb\\x7f\\xfd\\xd7\\xb6i\\x9f\\\\x8f\\xb7\\x13c\\x10\\xfe=r\\xee/\\xe0v\\xc8\\xb9>,\r\\xca\\xc7\\xf8\\x98\\x1fw\\xd4\\x91\\xd2\\xd2\\xa7p%roh\\xe6#k.\\xdcl\\xd0r\\x8d\\xcfl\\xd0w7\\x8e\\xad\\xb1\\x84\\xabs\\xc5\n7\n\\xdc\\xbc|;\\xfbyq#)\\x88\\x9ci#\\xd2\\x11o\\xde\tjn\\x0e\\xeeh\\x12\\xf2q\\x84\\x8d\\xf30\\x1e:\\xad?w\\xaa\\x08\\x02\\xe0\\xbf\\x0b\\xc7\\x1cw\\xe3\\x07\\xc4\\xa5\\xb2 \\xcez\\x00\\x15\\x15\\x06\\xb8\\x93\\xd7\\x00iri\\xacc\\xff\\xe9h\\xac\\xa6\\x81\\xeeq\\xf6\\xee\\xb3\\xf5\\xac\\xdey@\\xc1\\xcb\\xa5\\x04\\xd1m\\xf5\\xd2d~\\x9c\\xb7\\xee-\\xa6\\x00\\xbea|\\xacyo\\xcc(\\x15\\xd3\\xbf\\xe4iga^\\xdb\\xdcp\\xf5\\x83z\\xe6\\xear\\x16*\n*\\x1b\\xebspa\\x00\\x93~\n\\x8d\\xd2xz\\xa4\\xb59\\xca\\xc9,\\xd21\\xe3m\\x1d-\\xb4+\\x1f\\xf4g"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93m*\\x1c\\xeao\\x8e\\xd2\\x9d\\xed\\xf8\\x9ay\\xa6g`\\x8d\\x80\\xb7k\\xe2\\x86\\x82\\x14\\xc4\\xff~\\x18\\xd7\\xabzs~\\xae\\x13\\xe2\\xf6<\\x9d@^\\xf5\\xc2\\xe8h\\x07\\xd8\"\\x8e\\x13\\xb9\\xae\\xac1\\x05\n\\xa8\\xa8\\x83<\\xde\\xc02m\\x05\\xbc\\x8e\\xf5c_\\xcc\n\\x82\\xbe\\xaa9\\x1e\\xfb\\xc9\\xea\\x84e\\xe5\\xa4\\x08\\xf03\\x843\\xb7\\x98\\xce\\x15\\xdb\\xf9|\\x0e:\\xc3\\x1c\\xed\\x95+\\x1a^\\xf3\\x13\\x15\\xe6#\\xd1\\x0e\\x10\\x86\\x02\\xba-\\x9a^^j<\\xdf2m\\x98b\\xad\r\\x90v\\x03\\xa3y\\x7fn3n\\x07\\xa1\\xfe\\xc8\\x87mw\\xd06j\\xce\\xa7\\xf0\\xf3\\xb28\r\\xee\\x0b\\xe8y\\xee\\xb5t\\xc20\\xe1\\xd3\\xd8*\\xa4_\\x13h7\\x9d\\xb0b\\x99'\\x1f\\x86\\xf7p;7\\xcal\\xbc\\x90\\x85\\x81\\x95m\\x90\\xabf\\xf9\\x11\\x0c\\xe40\\xe3f\\xba\\xe7a1_\\xd4/\\xed\\xbb2\\xda* %\\xb3w\\x82\\xd1i\\xe3io7h\\x05@\\x0c\\xde.aqx\\xb9\\x11\\x1cw~\\xf8\\x9c\\x91"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x91\\ics\\xab|g\\xb3\\xfc\\xe0\\x05\\o\\x81v\\xdd\\xec\\xcc\\xaf\\x84\\x90\\xb7\\xb1d\\xbb\\xbc\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x01\\x9f\\xb6\\xd1\\x95<\\x1e\\x1a1\\xa9(x\\x9d\\x06\\xd2\"4/\\x99\\xd4\\xf9\\xa7y?u\\xae<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1?\\xc7n*\\xaa\\x96;\\x82\\x1c%\\xdfd\\xef`\\xfd\\x7f\\xdfe&?\\x9a\\xe0r\\xb9d$\\xa0b&z\\x9b\\x10\\xab\\xe0\\xbc\\xfe\\x8d\\xfb\\xbcj\\x96\\xae\\x0b\\x11\\xbc2\\xfc\\x91g\\xe0p|\\x81k\\xdfj\\x0ci\rk\\x07q\\x8e\\xa6\\x07\\x1e\\x00\\x94e\\x8a\\x19\\x9d\\xd0w\\x02\\x10\\x8a\\xf8\\xdc6\\xcc6\\xb0\\xc7k\\xc6\\xa6l\\xe7u\\xe47\\xc7!\\x7f\\xf1ya@\\x07\\x001\\x7f7\\x85h0\\xba\\xc3o\\x08u\\xa3)\\xa2q\\xfe<\\xb5c\\xf9f\\x9f\\xfd\\xffc\\x93\\x97\\xd3\\x19\\xf3\\xbb\\x8d\\xf949\\xc3e\\x85\\x988\\xb3\\x05\\xd6\\x12\\xd0g\\x9e\\xb6\\xdb\\xd3uir\\xd9\\xe1:\\xf1\\xaf\\x9f\\x93\\x07\\x1a\"\\xfcu\\x9e\\x10\\xfd:q\\x83\\xce\\xf8qf\\xe0x6\\\\xa3~\\x07t\\x19,\\x11\\xba52:\\x89\\x0ce\\xfe\\xcbcz\"\r\\x96\\x83\\xa4\\x9a\\x8b\\xbd\\xc5\\xbc>\\xd0q\\xfd\\x9f\\xd8\\x81q\\xd5\\xca$\\x8dw2\\xc09\\x80q\\xae\\x8e\\xabw\\xbc\\x92\"u\\xb0\\xb1\\xf2r\\x9fq\\xe9\\xf9,\\xb8q\\xa2:\\xfe"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x182x`\\xcb\\xba\\xf9\\x19^\\xb9\"e\\x11\\x1e\\xb5\\xeav\\x0f=\\xbb,\\xeb\\xe4\\x07:\\x83,\\x9d\\xb3\\xa4\\x16\\xbc\\xe4\\x88\\x0cp\\xe7\\xb9i\\xf6\\xfcpbm\\x8a\\xa3k\\xc5\\xfb|\\x1c\\xed\\xef\\x12\\x89\\xea\\xf8\\x03d4\\xc4c\\xd4\\x1b\\x90\\xdd\\xff\\xfby`d$\\xd1\\xa3f\\x1b8\\x83\\xc8l\\xec\\xf7\\x7fh\\xb9\\x0c6\\xf8'\\x17\\x0bz\\x0b0\\xd3\\xc4\\xf4t\\xb2p\\xb0\\xbav\\x91\\xd4\\xab-p<\\xdb\\xd8\\x80\\x84\\xdc\\x11'\\xe5.\\x9c_\\x83\\x12\\x05+\\x13\\xd2\\xfe=\\xc1\\xe0l\\xeb\\x98\\xb4d\\xc7\\x8f\\xe4a\\xb7\\xda*\t\\xbc\\xd5\\xd7\\x03\\xdct\\x91\\xf9\\x06\\xec\\xca\\x95\\xa4\\xa3\\xd2\\xe9!\\x91ply\\xf0m\\x94\\x04\\xf3\\xfbj&a\\x974?\\xcc\\x89\\xf7\\xbc\\xc2\\xe1\\xc8\\xfb\\x8az5\\x8f\\xde\\xd4b_qd\\xf4\\x96b\\x8b\\x830\t\\xc9\\x15w\\xa7\\xc2\\xda`\\x97|'>\t\r\\xdc\\x849\\xb9\\y\\xfd\\x97\\xe8a\\xd7\\xcc\\xab+i\\x9c-\\xa4\\x05\\x1e>3'^\\x8f\\xfc0\\x9c|\r\\x12"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab1\\xf5\\x8dn\\x9c\\x0c\\xeau'\\xb3s\\xeb+9n\\xdel \\x7fw+l\\xa6\\x1b\\xbc\\x87\\x0e\\xa3\\xd1\\x9ce\\xe9\\xc2o_&\\xc0\\x14\\xb5$\\x84j/l\\xe3m\\x88d(+\\x80\\xc3m\\xf4\\xb2\\xb2\\xd5\\xf9\\x9b\\x82f\\xf3\\xfb\\x8e\\xbe\\xbcz\\xb8\\x9bp1\\x1a\\xd9\\xfc\\x1ced\\x1bg\\xce\\x03\\x05\\x9e\\xeac\\xb5\t5\\xb3\\x8a\\xc1\\xfd\\xde>'~f\\xb9n\\xb6&\\xc7hd(g\\xe8\\x16h\\x906\\xc8\\x18\\x89\\x9fh\\x19\\xe3\\xc0\\xf5+\\x85\\xa7o3\\xd4)\\xfd\\xec0\\x88\\xbby\\x08\\xe3\\xaf\\xf8\\xdfl\\xa3\\x96\\xfe\\x1ff\\x11\\x8az\\xb3\\xb2$\\x1f\\xd5\\x92g\\xfd7\\xd9\\xcf\\xeaij\\xddf'\\xbeg\\xfc_\\xdb\\x02\\xf3x\\x0e*'\\xf1*\\xab\\x16\\xd8^\\xfc\\x06n\\xf0\\xa6k=/;\\x89\\xbe:<d\\x08g\\xa3\\xe1\\x90\\x9e\\xf1\\xad\\x1f\\xbc\\x9a\\x1dpd\\x04\\xa8\\xa1.gg\\xd8\\xf3\\xe5h\\xa1\\x8c$\\x01\\xaf(\\xde\\xa9\\xc9d\\xb7\\x88\\xc7*<\\xfdkg\\xda\\x90\\x1b:\\x96\\xf5\\x909\\xc3\\x87"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xd2\\x88\\xb8*\\x96\\xbb\\xe8\\xaf\\x19\\xe23\\xadc\\xc5\"\\xa8\\xcf\\x1eh\\xe0+\\x05\\xae\\xdal\\x158\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x98\\xa8\\xed\\xa4\\x80\"e_\\xb3\\xb0(\\xd9\\x9d\\xcc\\xa3\\xf5p\\xb3\\xd1rn\\x8f\"\\x12\\xe3?s\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\x83\\xca\\xf0\\x94\\xcf\\x13\\x93+\\xaf\\xb6?\\x99j\\xa9.\\xd9j\\x91g\\x14\\x89k2\\xd3\\xa9g\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfus\\xba\\xa5\\xabs.\\xb0\\xb4t\\xde`\\xac\r6\\x8by\\x12\\x8f\\x8f:\\xf3iw\\x97 \\xa1\\xd1\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu%\\xe0\\xc7%\\x0en\\xed7\\xfe\\xde\\x0b\\xd4\\xc3\\xb3\\xad\\xaf\\xed\\xb9un\\xafy\\x85\\xf3\\xc9\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xe5\\xa5\\x1a#\\xbd@\\x03\\x1c\\xb0\\xae\\xd4\\x1f\\x9a\\x85g)_\\xb1\\xc2\\xb8\\xb6\\xd1\\xaf\\xab\r\\xd2\\xfc\\xfd\\xc3\\xbe\\xa1\\xdf\\xc8\\x846\\xc2\\xc9\\x19\\xa0\\xa4\\xe4\\x82b\\x08\\xdd\\xd0\\xd1z*i\r\\xc1u\\xf3\\x99n\\xf6\\xbeb%\\x05\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n=\\x02\\xef1%'xg\\xd7\\xa92\\xf6\\xd6\\x08e1yl5\\x0bi)\\xdf\\xe7z\\xd6t\\x9e\\x14\\xdcde\\xbd\\x0f\\x0c\\xab\\xb7\\x1a\\xf7v\\x013\\x00\\x86\\x93\\x8c"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xb5\\x0f\\xeb1\n\\xb8n\\xa6\\xf8\\xb8\\xf5\\xa7\\xe7$\\x7fe\\x00\\xe3\\xe9l7mi\\xb9\\xaf|&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xc4v\\x8d:2jw\\xbb\\xed\\x1e\\xb4\\x7f)\\xad1c\\x9f\\x01zw\\xed\\xdf\\x98\\x96\\x14\\x18\\x91\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\xc0\\x16q\\x88y\\\\x02\\x87\\xd5\\xae\\x8d'\\xa0\\xbc\\xe3\\xa9\\xacj\\x18\\xd9\\xce\\xda\\xcd\\xaa\\x0b\\xd6\\xffo\\xaf\\xdb\\xe3\\xbbl\\x9br\\xcb\\xb6xs\\xbc\\xf0\\xeca\\x18\\x07k\\x8a\\xb02\\x02\\x8be2;y\\x85\\xf5\\xe4\\xee\\x97\\xd9\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\x91\\xe0\\xa9\\xfft\\xc9#\\x02&-u\\x13\\xa3\\xed\\xd4tl\\xcbj\\xe5\\xbd\\x16tf\\x92\\xf5\"*\\xe0x\\x9c\\x91r\\x8d\\xe7\\xdd\\xe9\\x90\\x9a\\xb1\\x16\\xb0ei`ab"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab\\xad\\x88y\\xd7\\xa7\\xdc|\\xf6\\xb3imu\\x99ke\\xd1\\x89\\xb1\\x06\\x1e\\x92\\xa7t\\x19\\xd5\\xdf\\xfb\\x1dt\\x1e\\x7fv\\x02(\\xd2t\\x0c3\\x1e\\xb0\\xd7\\x8b\\xab!\\xef\\xf0\\x82\\xc7\\xc2\\xa9x\\xa8\\xa5q\\xb2\\xaev:s\\xeaz\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaam>\\xbe\\x8dq\\xfd\\xd0u\\x04x\\xeb\\x99\\xe8\\x8c/7$\\xfe1\\x0e\\xa7\\x14u\\x96<e\\x0fk\\x8b73\\x0c\\xd3\\x1b\\x98i\\xa4r\\xb59\\xd1\\xe4\\x84\nh\\xf27"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07\\x084:\\xd0t\\x0b14\\x0f\\xfa\\xd8l\\xd4z7\\x02\\xe0\\xb9\\xd0\\xf5\\xe6\\xeb\\x88\\x98\\xad\\x99\\x17\\xc2\\x0bt\\x81\\xe4fk\\x1a4wc\\xd9\\xd0\\xa6gxg\\xdb?@\\xe0z\\xfc+\\xde\\x05h:j\\xb9p\\x1e\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zzw\\x0ekkc\\xe4z\\x98g|\\xfd\\xa9\\x8d\\x8b\\xdf\\xeb\\x0e\\xed\\x82\\xfe-\\x00\\x93\\xfe\\x8f\\xa8\\xcb7bm\\x1ajba>\\x0eh\\x9dz\\xca\\xc3\\xa1\\xe0\\xb5\\xc7"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\x8f\n#-\\xbb\\xa5\\x89\\x158c\\xbd\\xc9^)\\xed\\xd1\\xf9\\xd3\\xddr\\x7f\\xb0\\xe7\\x1d\ru\\x00\\xa0\\xefz\\x90-i\\x17m\\x81\\xce\\x1a;y\\xe7\\xdfb\\x03\\x07\\xcc\\x89\\xc8ky\\x1d\\xa8u\\xba\\x9b<\\x18r\\xd6\\x89(n\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19v\\x1b k\\x1d\\xe2\\xf4\\xd4\"n\\xfb\\x91\\xab*\\xd5\\xff\\xc0t\\xdeu\\xe2_\\x89k\\xbf\\xbf\\xf7\\x1e4e;\\xd0\\xc0\\xd8\\xc7\\xa7cr\\xf2=\\xfc\\xff(\\xf2p\\xe7"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\x938m\\xf3q\\x80\\x13x\\xa1\\xa3\\xcf\"sl\\xdb\\xc2\\x17\\x85y\\xa4ca\\xe1\\xa9fp\\x15\\xf7k\\xdey\\xa6#\\xd6\\x92\\xb5hw\\xa1\\xe3/\\x1d\\x90\\xd0\\xf3\\x85k\\x06w(l\\x81\t\\xec\\xa5\\xae\\x13\\x9a\\x11&m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\xd4\\xc4m*\\\\xd3\\xdc\\xec\\xb6$\\x06\\x8c\\x08\\xfc\\xcf\\xc9\\x97\\x0c$\\xf2l\\xdf\\xd3\\xb1\\xe3aq\\xf4\\x96\\x07c/\\xb9\\xf2<\\xf5*e\\xf1\n\\x98\\xd7y\\xbc\\xdf\\xd3"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\x84y\\x9fa\\x1ae\\x0bajn\\x05\\xb6y\\xab\\x1a\\xf0\\xdf\rb\\xe2\\x8c\\xa7w=\\x05\\xce\ta\\x98\\x8d\\xa1\\xb0\\xa3)\\xf4\\x01\\x1bu\\xffx\\x1c\\x88a\\xe7\\xf8^%a\\xbf\\xa4o\\xf4\\xea\\xbf\\x90\\xbb\\xc3\\xad\\x9dnta\\x83.\\x9a\\xa9\\x0f\\xca\\xdf\\xdeaw\\xc0\\x8a\\xd0\\x0b\\x85w\\xd1\\x02\\xd7\\x81\\xd9\\x06.\\xcah\\xa2\\xf4\\x95\\x80'|\\xad\\xd3b.\\xb6\\xa4\\x96\\x89m\\x16\\xbf\\xa8\\x0f\\xc0n\\xe1\\xf29l\\\\xf7\\xcez\\x1dm\\xf7\\xbat.\\xefk\\x04\\x86\nt\\x88u\\xd2l\\xa5\\xc3)vxba_\\xa4\\x97b\\x05\\xa0\\xb2\\xbeu\t\\xa5\\x8e\\xa8\\xc8a\\xbch\\xb7\\x83\\x99\\x9cu\\xcec\\xca\\xa3\\xf2\\x82\\x96y\\x93z\\xcbt8\\xfa\\xeb\\x9f9gr\\x17\\xbc\\xfdx\\xbc\\xbe\\xe7\\xe78\\xa6\r\\xac\\x89\\xec\\xdcc\\xbe\\x1b\\xff\\xb7ic\\x94\\xb6\\xd7,n\\xae\\x01\\x83t\\xfd\\x85\\x11\\x05\\xea\\x8e\\x9cu\\xe6\\xa8\\xdfyc\\xb1\\x1b4\\xd5\\x93\\x90p\\x9c\\x94\\xc2\\x0bw\\x15c\\x8f\\xbbr:2y\\xd4"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x12cx\\x8ah\\x97+\\xd3t\\xf9\\x97\\x9a\\xbc\\xcb\r\\xbb\\xc6\\xc7\\xc6\\x80\\xcb\\x15r\\x8f_\\xe5p'ef\\xd2\\xead\\xbf\\x89_\\x14\\x1ed\\xb7\\xdb\\xfb\tj\\xbc\\x87k\\xa8\\x84\\xff$+\\x16i\\xa9\r\\xd5v)\\xfd\\xc6b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\x00\\x8e\\xdc\\xff\\xc9\\xda\\xf5f\\x86\\xb1\\xd2%g\\xf1\\xd9s\\xa0\r\\xd4\\xd9\\xabp\\x1e\\xc10\\xbd7\\xe6\\xd5\\x9e\\xf6\\xbd\\x15q\\xc1\\xbf0\\x19\\x18wm\\x9c\\xf5\\x7fk\\xea\n"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfud\\x17\\xc1\\xe9j*\\x00\\x0fi\\x7f\\x8bqrz\\x81\\x9f\\x0e\\x7f\\xa6\\xd0\\xb6\\xafw\\x93\\x1b\\xaa9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\xc2\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01h\\xcfu\\xb6c7\\xee\\x05a8)\\x1b\\x8f\\xbau3u\\x8d\\xf4\\xce\\xbed\\x01\r\\xcf\\xc8\\xc5\\x91\\xb5\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xe3\\xd6\\x97\\xb5\\x0bz3\\x8b\\x88\\xcb\\xf8\\xa3\\xfe\\x8di\\x9b\\xc7\\xa3\\\\xc7x\\xd4\\xfc\\x1d\\x9as\\x18\\x19\\x87\\xb1n\\x06\\xf9wm8\\xcbyu\\xc8\\xad\\xca\\xde\\x0c\\xb3\\xe3\\xb3)\\xc8\\xb3\\xbe\\xe7\\xd2\\x8d0\\x01d\"x\\x80\\x03\t\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc50\\x9f\\xd3\\xf1\\xe5ju\\xde%\\xc4\\xdf\\xc0m7\\x9a\\xc8\\xb5`j0\\xd6\\x82$\\xb2(4\\x13)\\x18\\xc2\\x01l2(\\x91\\xc8&\\xd6w\\x10\\xd9\\xcev.1\\xb8\\xe8"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\xb5\\x00\\xac\\xb3\\xe2\\xa0\\xa6\\x82\\x85\\xc4\\xf8ec^1\\x99\\xfc+\\xf8\\xd2\\xe4\\xc1vw9j\\xd9\\xad\\xfe\\x88\\xeb\\x8df\\xd0\\x1a8\\x07\\xd0\\xb0m\\x8d\\xe9\\x07\\xf9\\x08\\x17\\x83\\xca\\xde\\xca\\x02\\xd9k \\x07#\\xf2\\xabn\ry\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4ff\\x04$x\\xd7\\xc3o\\x0c\\xf9\\x96r\\x00\\x18\\xd3\\xd5\\x9c\\xe1\\xb0\\xaf\\xa6\\xff\\xf4\\xf8\\xf89\\xf5\\xc2\\xd4\\x04\\xc4\\xff\\xdb\\xa2\\xc9\\xb3\\x06\\x19\\x0e\\x98\\x8ar<\\x0c\\xbf"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\xed\\xc2\\x9c\\xbc\\x9ax\\x83\\xe9\\xe5\\x18\\xe4\\x1f\\x14\\xdc\\xe3\\x94(\\xda\\xb8\\xfb\\x18\\xc8q\\xa9p|\\x9e\\xd3\\x14e\\xe4\\x9e\\xab\n\\xfe(\\xdf\\x1b\\xa2hq\\xc6\\xdc^'\\x8b\\xf1\\x90\\xd4\\x10\\x9d\\x86\\xe4\\x0fu\\x1a.\\xb2s\\x95(\\x83\\xbc`\\x00)\\xc6\\xae\\x15ji 8\\xcd\\xb3u\\xf2byg\\x94\\xa9\\xe5a\\x0e\\x8b\\x1ea\\xd2c\\xaa\\xb42\\xa5 \\xbb'\\x8a$r\\x1e\r\\xe4\\xafgm\\xb2+\\xcb\r\\xc0\\xb5\\x85\\xce\\xbc!k\\x1f\\xd7\\x85z-\\x9dv\\xac\\xf7\\xc9\\x1e\\xcd\\x87\\xf2i\\x84m\\\\xc8\\xca\\x13\\xdem\\xef\\xde\\xf2\\xff\\xecv\\xefx\\xdf\\xbd\\xc3\\x92q\\xb5\\xb3\\x1am\\xaew\\xa6#\\x86\\xbe\\x0fiz\\xcb1\\x16\\xed)\\x15\\xf0w\\x02\\x96\r&/o\\xf9\\x93\\xbf\\x0f-\\xfd\n\\xe0<g\\xb7\\xce`\\x9c\\xed\\xec\\x15\\xdc\\xea\\xa14\\xe5\\xcf\\x8au#\\xca\\x83\\xb3-xm\\xbb\\xd2\\xc2\\x1a1'\\x00\\x90\\xa2t'.\"\\x1e\\x86\\x11\\xbd\\x15s\\x0b\\xc1\\xbd\\xf4\\x84\\xe9q\\xec\\xf6*\\xff\\x9d\\x88\\xd9\\xb4\\xe3"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0\\x87\\x8a*\\x00\\x9b\\xf5\\xa1\\xa6e\\xc38\\xf9\\x06\\x18\\xaf\\xfb\\x1fv\n\\xcc\\x81c\\x98\\xb33\\xca\\xcd\\x05\\x8d\\x15g\\x9e\\xe1\\x8e\\xd6n\\xcd\\xd8\\x00\r\\x91\\xaeg9\\xbe\\xf3\"|\\xe2\\x9cbt\\x87\\xd1\\xfb64\\xf6\\xdd\\x89\\xb4c)s\\x00\\x14\\xb9\\xa8\\x11d\\xbca\\x16\\xde'\\x81\\x12\\x07\\xfc\\x8cx\r\\x93\\xa8`\\x8e\\xbd\\x98\\xe8\\xa4\\xd7\\xe4/.(\\xd3\\x837\\xf6\\x98\\x9c\\xf6\\x13q\\xd9wa\\x9c=\\xb6=s\\x91ht\\x1ay\\xf5o\\xc9\\xc5rm\\x13\\xed3\\xc5\\xa8\\x1ct\\xb6\\x1fk\\xf0\\x07\\x87\\xfb9d\\x8b\\xcfbb\\x1d\\x08^f\\xa6\\x14\\xd2k\\xc9\\xcaq\\xb8b\\x12\\x1f\\xac\\xfb\n)\\x85\\x800?z/\\xd0\\x12d\\xa6\\x1b\\x81p\\x90\\xe9n\\xf9\\x98wz\\x9c\\xb0\\xf8ut\\xda\\xdc\\xb5\\xcd\\x114\\x10\\xbfjk\\x07\t~`\\xef\\x97\\x86i\\x1d/\\x82\\xad\\x81\\x946\\x1d.4;\\xd1\\x07\\x85\\xb4d\\xda\\x96\\x17x\\x80.\\xd5q\\xd1\\xcf\\xa7\\xb7\\x18\\xd5\\x93\\x1c\\x8b,:\\x1dkje\\xe6\\x12"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\x1c\\x1de\\x11\\x12\\xb5\\xa2\\xd0\\xff4\\x877\\xf9\\x1a\\xb7x8i\\xf3b\\xf5\\xe81\\xc62\\x9b\\xca\\xd7\\xf8\\xf5\\xa5f\\xad\\xf9\\xf5\\xab|?1n\\xf4d\\xd4y\\xd9f\\x91\\x1a\\xaf?\\x1a\\xa5,\\x9f\\x08\\\\xbc\\x95\\xd2\\xefb%\\xdf\\x95\\x93\\x12l\\x0c\\xec\\x02wf\\x921\\xbd\\x9a\\xe4)//\\xdf\\xa8\\x856\\x16kq\\x01\\x1eg,&\\xc3$\\x85(\\x1f\\xc9\\xb7\\xcfk\\xe80\\xd99\\x9d:\\x17\\xb0\\xb7\\x1e\\xfe\\xb0f\\x9a\\x9f\\xa6\\xfc\"\\xa0\\xcd\\xbd\\x00\\x19;\\x1e\\x91\\xc6\\xa0\\x85_4p+\\xcb\\xa6r\\x14j\\xe0\\xe3\\xaco\\xab\\xcd\\xb1\\xfb\\xed\\xa5\\xe4\\x0f3\\xbf\\x92%|\\x11mk;\\xc6\\x90\\x86-'\\xa3\\xfd\\xa1\\xdellt\\xe3\\\\xf3/\\xa1\\xdd\\xdd1\\xb1\\xfe`\\x0e\\xd51\\xe8\\xe6\\xfd\n\\xcc\\x12d0c\\x8e\\xdf\\x17\\xce\\x10\\x8f\\xda$\\xa9p\\xfe\\xc7\\x9d0t\\x14b\\x80\n\\x7f3\\x84tb\\xa0\\x89\\xfbh\\xd3\\x0f\\xac\\x0b\\xa2\\x06\"q \\x95\\xce\\xc4\\x97r\\xc6qwa\\x1e."
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\xb3\\x92!r\\xc7\\xbdhr\\x1f2!\\x8c\\x1f\\xa8\\xb10\\x9e\\x98\\x80\\xecycrg*\\x1fy`\\xf7ku\\x15\\xc2\\xbf\\xa5\\x18\r'~\\x07\\x152\\xb3\\x82d\\xc0\\xf6qt\\xb0\\xda\\xb6\r\\xa9o\\xcc\\x99\\xac\\x9d\\x92q\\xd9e3u\\x80\\x1ex\\xc7\\x07\\xce$\\xff\\xc3g$|\\xa9\\xee\\xa7\\xb6\\x86\\xd1\\x04\\xb6w\\xe0m\\xb4!\\xf1\\xdf\\xe0\\x1di-\\x94\\xb5-\\x12\\xc1\\x03\\xf9\\x0cy\\x03\\x03g;\\xe6f\\x89\\xf98f)\\xfde\\xd4r\\x8b\\xb8l\\xb7\\xc4\\x05q\\xef\\xfe\\xadgd\\x99\\\\xd6\\x83\\xd8\\x07>\\xa8\\x0e\\xb6\\x15\\x8c\\x86\\xfc\\x0f\\xfc\\xe6\\xed|?\\xde\\xf5\\xeb\\x01\\xb4\\x11\\xd8\\xc1\\x17\\xf3zx\\xfaxo\\xd0\\xd5kj\\x8e\\xab&w\\xd4<\\xec\\xd6\\x1d\\xf7\\x96\\xff\\xc5d\\xe1:\\xf1/\\xba4\\x1c8\\x98\\x8fv\\x0e.\\xf7\\xefex\\xab's\\x95+\\x91$\\x89;$\\x0721\\x1f\rf\\x03\\xbf\\xff\\xd7\\xcdvpd\\x08\\x97\\x81\\xb3\\x90\\x02\\x0c\\xf2\\x1b\\xdd|\\x84\\x0epck\\xc1\\x1fb>"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_r\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff\\xc0\\xf3\\xcf\\x17\\xd6\\x12\\xa7ocu\\xecn\\xf4\\x85\\xae\\xd0\\x0f\\x9a\\xfc\\x85\\x9e\\x99\\xc4\\xad\\xa7&\\x90py\\xe1k\\x87\\xba* )\\xbf\\x1akgxp\\x04o\\x82\\x05.\\xf9o\\xb7\\xedb\\x0e\\xeb\\x1a\\x8f\\xf2\\x1e\\x00\\xf3\\x9d<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x1c\\*x.\\x8d\\x83\r\\x9e\\xd39&\\xe2\\xc2\\xb55\\x1dg\\xc7ss\\xfe7\\x01\\xf8\\xba\\xb4hw,\\xfc\\xf6\\xee\\x06 \\xe9\\x1f\\xa2\\x13\\xed\\\\x8ap\\xdcbf\\xf2"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6j\\xf3ci\\x19\\x1b\\x0e\\xcd\\xa4\\xb0e\\xae\\xb1\\xeb\\x05\\x8bm\\x19\\x1e:|\\x15\\xf2\\xfd\\x19;\\xc1\\xf8=x\\xb5\\x9c|\\xbb\\x1b\\xaa\\xf9\\xa4^\\x18\\xc6-\\xccd\\x87$|\\x991a\\xd6g\\x0c\\xfa\\x84\\xb0_\\xe1\\x92wl\\x10j\\x06\\xbc\\x8e\"v\\x14/\\xd0/\\x13j\"\\xf5\\xf3\\x01 \\xb6\\xa1\\xc0f^x\\xdd\n'+\\xac\\x86\\xb5\\xa1v\\~\\xf2\\xa0#\\xbf\\x91\\xd4\\xd5u9\\x90\\xe2\\xf5\\xe7\\xfd\\x06\\xf2\\xbbv?\\xf1:\\xe7\\x9be\\xa9\\xa3\\xcev\\xfdzi\tvg6\\xcc\\xba\\xc8\\x0cn\\xa2\\x9d\\xd5\\xda\\x1e\\xee\\xf6%j\\xed\\x08c0u\\x94\\xf9\\x7f\\xa3!9q\\xe4\\x1b\\xe60\\xda\\xdbup\"w\\xcc\\x00k\\x17\\xc7j9\\xc0/\r\\xf1=\\xeb\\xe6\\xe1\\xe8q\\x1d(\\xa4\\xdf\\x06\\xdb$\\x83e\\x99\\x17a\\xf0y\\xb9\\xa5\\x08\\x81tu\\xf9\\x84h\\xf1s)=\\xf3\\x18\\x88,\\xae\\xfal\\xa2\\xd9otr/\\x9e\\xfe\\xad\\xdb\\xcfj\\x03\\x1dkg\\x9c\\xaa\\x916?n\\xe8)\\x8c\\xfe="
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\xc0\\xf8\\xcd\\x13p\\x16\\xd2\\x13\\xcc \\x93\\xcd\\xe3\\xb5\\xff\\xdd\\xa0\\x00~)\\xf5\\xfc\\xcf\\x97\\xd8-\\xf3n\\xf4&\\xeb\\xb5\\x9b\\xa3\\xac\\x0er@\n4\\xb4/\\x82\\xca:\\x8e\\x90\\xdd\\xca\\x9bb\\xb1\\xc4\\xcc\\xfd\\xea\\xa3e\\x83\\x8b\npb\\xb4&\\x9b\\x19\\xa9\\xf1\\x02\\xd0\\xa24b\\xa6\\xff\\xed\\x99\\xea\\xe33\\x16\\xb9\\x11\\xfd\\xb0\\xe4z\\xefd\\xfb\\xae\\xec\\xb0\\x00\\x1a\\x1e\\xf7\\xa0\\xe2e%\\x1ai!\\x18\\xbbzt\\x88s\\x1a\\xec\\x86\\xef\\x08\\xc5\\x00g\\xdf\\xbbb\\xaa4g&\\xb9\\x8ay\\x9f\\xc0=\\xd1?a\\x9d\\x81ls\\xd7\\xf4\\xce.\\x97\\x14\\xb8\"\\xc7\\xd5\\x99\\x0e\\xbf\\x89j\\xaa\\x07\\xd9d\\xab\\xc29\\xe3\\xa4\\xc2\\xbd\\xef\\xa8\\xffd\\x86\\x04:\\x89s\\x07/\\xcd\\x0e\\x88\\xc8\\x90\\xeaa\\xbc\\x84\\xa3t\\x08\\x1e\\x83\\x9e\\xefe\\xa2\\x0f\\xef\\xf4\\xd7\\xd4uj\tp\\xd5q'\\x19\\xaa-s\\xderl\\xf9\\x8f\\xd2j.s\\xdai\\xef1d \\xe3g\\xfbg\\xc0)\\xff\\xa5\\x066\\xc6\\x14\\x18\\x1d\\x85\\x8e\\x86\\xe9\\xe3d*\\x8a\\xce"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xfb8\\xden\\x82.\\x18h\\x90\\xbc\\xc8\\xab\"\\x8c\\xabn\\xc3&h~\\x0f\\x00\\xd4\\x9f\\x1c\\xa4w\\xf6^\\xe2s,\\x96\\xf8\\xb2h\\xff\\x15i\\x9a%\\xc0:\\xa3?\\xd4\\xc5\\x05\\xac\\x07s\\x9eo\\x16)rw\\x8b`e|\\xc0\\x0c\\xe5\\xfe\\x15\\xe6\\x9e\\xfft\\xfa\\x8e\\xc3\\xab\\x1b\\xd1\\xcf\\xf4\\xfa\\xf12\\xd7\\xd3*\\x94m\\x0e\\xc8)\\x00i\\xbbm5b\\xb6\\xdac\\xc0\\xb08s\\x10\\xe5wv\\xa5-\\x80\\xf4\\xfe\\xadg\\xaab4;j-|\\x15\\x06+d5l\\xe7\\xfa\\xb2=c\\x8e\\x88\\x01\\x0c\\xa4y\\xf8\\x08\\x11\\x11\\xf0&\\x0f\\xbd\\xf9\\xa7\\xb0\\xdf\\xf8\\x1f\\xeff\\x8ap\\xff.o\\x89\\x10\\xb4\\xaa\"n\\x7f\\xc8g\\x85\\xf2\\xc7\\xc6\\x86\\x88r\\xe8\\xe6*\\x8d\\xe5\\xc3v?\\xb8l63\\x19\\x1dc\\xa7y=\\xd9\"x\\xf4hg\\x0e\\xea\\x9d\\x0f\\x86\\xdfa\\xdb\\x93\\x98u\\xa5\\xf7\\xbd\\x1e;\\x99\\xe8ji\\xb9fq\n\\xc3\\xd1\\xe8\\xcc\\x9a/\\xeb\\x07\\xc1\\x04e\\xba\\xf9u5\\x9b\\xfffu\\xcb\\x81$\\x7fu "
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf3\\xb8mr&\\xc3\\xc2\\xab5\\xb8\\xef\\xd2_\\x8dd\\xa9\\xc2\\xad\\xc2\\xc3\\x9fl\\x8as\\x1d\\xf2\\xd3d\\xf2\\xcd\\x1d\\x19(f'\\x13(@\\xdd7f\\x7f\\x94(\\xee\\x84\\xe0\\xc9\\xa8u\\x95gsp\\x97\\xef!\\xb8\\xcc^\\x93\\xf0\\x9f-\\xf9\\xb8\\x05h\\xe0\\xb3\\xdf\\x1e\\q\t\\x81\\xbd\\x02\\x03\\xae\\x87\\x1da:\\x9ac\\x83o\\x87\\x91/u\\x8f\\x02\\xc4!\\xa5\\x1d\\x15i\\xc6y\\xbd\\x13l\\xd1\\xe5\\xa5\\x0b\\xf7l\\x13\\xc5\\x1bt\\xfe^c\\xe4\\xb5'!\\x8a\\x16\\xbb\\xefnr>\ro\\x17\\x16jo\\xee\\x81k\\x8d\\x86\\xebw\\xb8\\x84\\xc3\\xe9\\x02\\xf4\\x9a53\\xcct\\xad\\xcf\\x88\\xe3\\xed\\x89-2\\x8f\\xfa\\xdfzg\\xc3\\xebc b+\\x00@\\xc7\\x9a\\x07 |i3v\\xf5c\\xa9urj\\x97s\\x1b\\xac\\xff\\x84\\xa8\\x86\\xeb\\x908\\x07\\xed\\x1d7:qw(\\xa0\\x7f\\xe3\\xa6er\\xcb~\\xbd\\xc6\\xde\\xe7\\x8b\\x03\\xb4\\x9c\\xa3\\xc9c^e\\x8epz\\xea\\x16:\\xd6\\x12\\xdd\\xbe&\\xd9`e\\xb7"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\x15\\x04\\xf0\\xb5\\x01\\xaf7\\xd4\\xcew\\xbci\\xfa.$uo\\xe5\\xd0\\x97\\xfc(\\x86w\\xc8\r\\xdb\\xb7~\\x13\\xc6u\\x9f\\x0b<\\xc3i\\xdd\\x9f\\xb5\\x86\\xea\\xedy\\x00q\\x8b\\x02\\x91\\xe78d~\\x8f9\\xd0j\\xd8\\x83\\xd3\\xaf~\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\xb8\\xb1\\xaexq\\xcc\\x11\\xd4\\x18\\xb4\\xac\\x95\\xea\\xa5@\\xa8dg\\xe6\\xf8\\xcc \\xa7y\\xd0\\xd7\\xad\\x84\\xe9\n\\x9az\\xb7p\\xd4\\xa1\\xed\\xcfy\\xc6?w@\\xe8\\xa0\\x0c\\xc7"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x7f\\x1a\\xf9\t\\xfec\\x94\\xfe\\xb2\\xf6o1\rn\\x05\\xf2\\xff\\x9ft$3\\x12\\xee\\x84\\xfc\nv\\xf0\\xbdi\\xbch\r\\xd9w\\xa3?\t&\\xb8j7\\xc2\\xe1\\x16\\xfe\\xb6?k\\xb6vd\\xd9\r\\xb4\\x97\t\\xe2#\\xb5\\x89\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\x851\\xa4\\x86\\x98\\xf9\\xfds\\xf05\\x19w\\xf1\\x04\\xc9j\\x06\\xc7\\x85\\xc8\\x1c\\xd4c\\xe7\\xde\\xbea\\xc0c\\xee\\xebs\\xa0g\\x8cshb\\xacx\\xa3\\x98\\x95\\x1ayn\\x93"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\x18u\\xde\\x05\\xb3\\x1f\\x90n\\x08\\xa9)\\xb2\\xbc*f\\x8d\\x8e2\\x0eh\\xd4v\\xb5\\xbb\\xbe\\xfeeb\\xdd\\x95@\\xfa\\xbc\\xd9t\\xc8\\xc6z\\x97m\\xdd5fs)5t\\xe7a\n\\x05r\\xe2|\\xa1) g\\xcc@\\xa5\\x8e\\xbb\\xb3\\xda>#_\\x1c\\xf2&\\x1eq\\xd0\\xcaa\\x8a\\x08\\x91\\xb6\\xb9\\x05\\xf3\\xce\\xfa5\\xc0?\\xf6\\x02\\xb33\\x9e\\xb5;\\xd0t\\x97\\\\xf2\\p\\x14\\xbe\\xe85\\xc7\\xad\\x11\\xad@\\x84\\xe9\\xe7\\xb5\\x91\\xff@\\x86#\\xb7x\\xdb\\xf3m\\x8d8c\\xc9\\x14?\\x8c\\xbe\\xe1\\xb2fk\\xac9x\\xe4\\xcb\\\\x83\\x00\\x05\\xba\\x89\\xfb&\\x93am\\xab%?\\xcd/`\\x93a^c?\\xbe\\xcf\tx#\\xf0\\xb8s\\xa0\\xfa\\xa3\\xabgn\\x85\\xca\\xb1|\\xea!\\x15\\x85\\x08 \\xd8\\xe5-\\xbb\\x7f\\xefv\\x0b+i\\xd4d?\\xde@\\x9e\\xa8\\xb0\\x80\\x9brz\"k\\xa4\\xe9+edh\\x9e\\xea\\xe89<\\xa2\\xea\\xa0\t\\xe6\\x0b\\xd9z\\xa6\\xe5\\xaf\\xdf4@l\\xcb\\xf1\\xcc\\x95\\xc9\\xe3\\x8di"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe\\xc7=\\xf9\\xa3\\xd2\\xf2\\xe9\\x99\\xf0\\xabk\\x08\\xb3r\\xa4\\xa6x\\x9d,b\\xce\\xf6\\x16wa\\xd7\tyb\\xfd\\xea\\9\\xdb=\\xfa\\xfc\\xa5\\x01j#\\x1f\\xd1\\xaa\\xfeqou\\xbe\\\\x12~\\xd2%p4o2@g\\x04\\xb6\\xbd\\x9e\\xb8\\xa9\n\\x19\\xc6\\xc48.\\xbc\\xec\\x0c.ekg\\xcd\\x8f\\xb2\\x0b\\x91\\xb6\\xf4\\xe0\\x12m\\xfa\\xbf\\xcad\\xff\\x8f\\xb9\\xa1'\\x1c\\x1eq\\xa9\n\\xb5cad\\xe7k\\xd3\\xbd)\\xf56\"?\r5\\xac\\xc6w\\xdf\\x9b_rv\\x89=\\xd2\\xc8\\xdc\\xfb\\x1e\\xd0\\xd6 k\\xb1\\x98\\x88\\xda\\xa4\\xe5\\xfa\t\\x04r\\xfe\\xad\\xd3 lyj\\x1fj\\x031\\x8c|\\x1d\\xd2\\xad\\x8c:\\xa8?\\xfa\\x89\\x10\\x0e3x\\xa4\\x14\\xc5^t6y\\xa9\\x1e\\xaa\\x86f%\\x96m\\xda\\xc5\\xb0+\"\\xde0o\\xf4\\xe9mf*\\xaf\\xc5\\xfa\\x8a\\xa8\\x1b8z\\xa9j\\x7f<\\xfc9m\\x12i\\xc6\\x1d(\\xd6\\x87\\xe3\\xd5\\xf9\\xb8\\xc4g!\\x9d\\xc4j\\x11\\x9b\\xe0\\xeap\\xac\\xd2k^\\xdf"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0106\\x03\\xbd;_\\x16\\x80\\xe6\\xe8b\\xb5fh\\xfd\\xce\\xbc$\\xfc\\xdeh\\x82\\xfb3\\xb9!-j\\xb7\\xfc$\\xe1\\x01zoq\\x89\\x0c\\x17g8\\x8b\\xa2\\x9ag\\xad\\x91\\xc5\\x96\\xed\\xdf\\xb7\\x93i\\xafq\\xaf\\xdc\\x18\\xbd\\xe7\\xbbf\\xd9\nd\\xf6\\xd2\\xa4\\xc4)\\x8d\\x1e)\\xcd\\x88\\x16\\x10\\x1b\\xbb\\x01i\\x95nh\\xa7&\\x1bh\\xf5\\xb1\\xa2mbov?\\x95\\x01jpj\\x85\\x032\\xa2\\xf4*fjg\\xbf\\x9b4\\xa1\\x80\\x9d\\xdcjr\\xaa\\xa7vx\\x7fl\\xd0\\xae\\xb1\\xc4\\xb72\\xbe\\x0b=\\xb8\\x8e;\\xfa\\xea\\xa4\\x8c\\x06a\\xd0%\\xe2it\\xa2\\xd5\\xea\\xd7\\x17\\x08\\xdfqr\\xacc\\xe4_\"c\\x8f\\xbd\\x85\\x9f 1\\x85n.\\xb9\\x15?\\xe2\\xd9\\xe1\\xfbb\\\\xfd\\xc2\\x16\\xc8\\x83\\xca\\x8cto0\\xd3\\xf1\\xf8\\xcc~\\x82\\xb9\n\\x81mzf\\xfc\\xe9\\x9d\\x0e\\xf8\\xcb\\xd9\\x9f\\x8amk\\xdf\\xd3\\xca\\x89\\xed\\xadep\\xdet\\xa0\\xb1`o\\x94\\xeb\\xe6e\\x8al!\\xef\\x1c\\x18\\xcc\\x8f\\xc2\\x7fp"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: tue, 16 jul 2019 05:01:15 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  703.  
  704.  
  705.  
  706.  
  707. "Description": "Creates a hidden or system file",
  708. "Details":
  709.  
  710. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~WRL0001.tmp"
  711.  
  712.  
  713.  
  714.  
  715. "Description": "File has been identified by 41 Antiviruses on VirusTotal as malicious",
  716. "Details":
  717.  
  718. "TotalDefense": "Thus.A"
  719.  
  720.  
  721. "MicroWorld-eScan": "W97M.Thus.EW"
  722.  
  723.  
  724. "CAT-QuickHeal": "W97M.Thus.A"
  725.  
  726.  
  727. "ALYac": "W97M.Thus.EW"
  728.  
  729.  
  730. "VIPRE": "Virus.MSWord.Thus.fp (v)"
  731.  
  732.  
  733. "Arcabit": "W97M.Thus.EW"
  734.  
  735.  
  736. "Baidu": "MSWord.Virus.Thus.cm"
  737.  
  738.  
  739. "NANO-Antivirus": "Trojan.Macro.Thus.byppsa"
  740.  
  741.  
  742. "F-Prot": "W97M/Thus.M"
  743.  
  744.  
  745. "Symantec": "W97M.Thus.M"
  746.  
  747.  
  748. "ESET-NOD32": "W97M/Thus.A"
  749.  
  750.  
  751. "Avast": "MW97:Thus-A"
  752.  
  753.  
  754. "ClamAV": "Doc.Trojan.Thus-8"
  755.  
  756.  
  757. "Kaspersky": "Virus.MSWord.Thus-based"
  758.  
  759.  
  760. "BitDefender": "W97M.Thus.EW"
  761.  
  762.  
  763. "Ad-Aware": "W97M.Thus.EW"
  764.  
  765.  
  766. "Emsisoft": "W97M.Thus.EW (B)"
  767.  
  768.  
  769. "Comodo": "Virus.MSWord.Thus.a"
  770.  
  771.  
  772. "F-Secure": "W97M.Thus.EW"
  773.  
  774.  
  775. "DrWeb": "W97M.Thus"
  776.  
  777.  
  778. "McAfee-GW-Edition": "BehavesLike.Thus.cr"
  779.  
  780.  
  781. "Sophos": "WM97/Thus-Fam"
  782.  
  783.  
  784. "Cyren": "W97M/Thus.M"
  785.  
  786.  
  787. "Jiangmin": "MSWord/Thus.ew"
  788.  
  789.  
  790. "Avira": "W97M/Thus.AH"
  791.  
  792.  
  793. "MAX": "malware (ai score=100)"
  794.  
  795.  
  796. "Antiy-AVL": "Virus/MSWord.Thus.ew"
  797.  
  798.  
  799. "Microsoft": "Virus:W97M/Thus.FP"
  800.  
  801.  
  802. "AegisLab": "Virus.Msword.Thus!c"
  803.  
  804.  
  805. "ZoneAlarm": "Virus.MSWord.Thus-based"
  806.  
  807.  
  808. "GData": "W97M.Thus.EW"
  809.  
  810.  
  811. "McAfee": "W97M/Thus.gen"
  812.  
  813.  
  814. "AVware": "Virus.MSWord.Thus.fp (v)"
  815.  
  816.  
  817. "VBA32": "Virus.MSWord.Thus.aa"
  818.  
  819.  
  820. "Tencent": "OLE.Win32.Macro.700215"
  821.  
  822.  
  823. "Yandex": "WORD.97.Thus.Gen"
  824.  
  825.  
  826. "Ikarus": "Virus.MSWord.Thus.AA"
  827.  
  828.  
  829. "Fortinet": "WM/Agent.GB!tr"
  830.  
  831.  
  832. "AVG": "MW97:Thus-A"
  833.  
  834.  
  835. "Panda": "W97M/Thus.A"
  836.  
  837.  
  838. "Qihoo-360": "macro.office.vba.gen.3022"
  839.  
  840.  
  841.  
  842.  
  843. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  844. "Details":
  845.  
  846. "target": "clamav:Doc.Trojan.Thus-8, sha256:7d7ffe5cd5c10728cb8f83336ac9c81775e5812f3486917b056660dc8cb79b96, type:Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Title: UBD Lesson Plan Template Stage 1 Desired Results, Author: Habersham County Schools, Template: Normal, Last Saved By: Habersham County Schools, Revision Number: 1, Name of Creating Application: Microsoft Word 11.3, Total Editing Time: 10:00, Create Time/Date: Wed Dec 3 23:32:00 2008, Last Saved Time/Date: Wed Dec 3 23:56:00 2008, Number of Pages: 9, Number of Words: 2542, Number of Characters: 14493, Security: 0"
  847.  
  848.  
  849. "dropped": "clamav:Doc.Trojan.Thus-8, sha256:de776903a23ef27be3657da6b61ed15c87d2b8bb81f0067eb3bb485b55efeddb , guest_paths:C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm, type:Microsoft Word 2007+"
  850.  
  851.  
  852. "dropped": "clamav:Doc.Trojan.Thus-8, sha256:7d7ffe5cd5c10728cb8f83336ac9c81775e5812f3486917b056660dc8cb79b96 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_013bfd13141ca2ac25473b23d979e551.doc, type:Composite Document File V2 Document, Little Endian, Os: MacOS, Version 10.3, Code page: 10000, Title: UBD Lesson Plan Template Stage 1 Desired Results, Author: Habersham County Schools, Template: Normal, Last Saved By: Habersham County Schools, Revision Number: 1, Name of Creating Application: Microsoft Word 11.3, Total Editing Time: 10:00, Create Time/Date: Wed Dec 3 23:32:00 2008, Last Saved Time/Date: Wed Dec 3 23:56:00 2008, Number of Pages: 9, Number of Words: 2542, Number of Characters: 14493, Security: 0"
  853.  
  854.  
  855.  
  856.  
  857. "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
  858. "Details":
  859.  
  860. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\Macintosh HD:Users:drubin:Desktop:Normal"
  861.  
  862.  
  863.  
  864.  
  865.  
  866. * Started Service:
  867. "osppsvc"
  868.  
  869.  
  870. * Mutexes:
  871. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  872. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  873. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  874. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  875. "CicLoadWinStaWinSta0",
  876. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  877. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  878. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  879.  
  880.  
  881. * Modified Files:
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_013bfd13141ca2ac25473b23d979e551.doc",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCC354C638128B9EE.TMP",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_013bfd13141ca2ac25473b23d979e551.doc",
  885. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS2650B905-8538-4112-8413-5CBE4752B0A6.tmp",
  886. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  887. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  888. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1CECCDC4-BE0D-4722-AE8D-BC78B6D30F28.tmp",
  889. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  890. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2175.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2176.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF46F90B78-3255-4E0A-BEFE-E8462FEF6F48.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~WRD0000.tmp",
  896. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~WRL0001.tmp",
  897. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  898. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48B6.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48F6.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4906.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4907.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4918.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4928.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4939.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab493A.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\cab494B.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495D.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab494C.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495C.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495E.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495F.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4980.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4990.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49B0.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A03.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49C2.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49B1.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49F2.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A32.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A53.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A73.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4AC2.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B50.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C1C.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C2C.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C7C.tmp",
  928. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C8C.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C9D.tmp",
  931. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D4A.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D6A.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DA9.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E38.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E08.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E39.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EB8.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E59.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F36.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F76.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F86.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50B0.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50B1.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50F2.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5113.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50E1.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5133.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50F3.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar51A1.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5339.tmp",
  952. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53B7.tmp",
  954. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  955. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  956. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5415.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5445.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5457.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5468.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5446.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5600.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5610.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5642.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5621.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55EF.tmp\\PictureFrame.glox",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5666.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55EF.tmp\\Content.inf",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5643.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B7.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56C7.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56EA.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5632.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56D9.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cab571B.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab572C.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab572E.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5676.tmp\\ThemePictureAccent.glox",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5655.tmp\\APASixthEditionOfficeOnline.xsl",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab575F.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5687.tmp\\ieee2006officeonline.xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5644.tmp\\HexagonRadial.glox",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5676.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab57A1.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab57A0.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56C8.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56EB.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5644.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar572D.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5790.tmp\\Element design set.dotx",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5770.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar572F.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar57A2.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab588F.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56FB.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5687.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5790.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar57C3.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5890.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD591D.tmp\\BracketList.glox",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD593E.tmp\\pictureorgchart.glox",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD591D.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD598D.tmp\\Berlin.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5A6F.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59CC.tmp\\Headlines.thmx",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A2E.tmp\\harvardanglia2008officeonline.xsl",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD593E.tmp\\Content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A6E.tmp\\chicago.xsl",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A0E.tmp\\content.inf",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A70.tmp\\ThemePictureAlternatingAccent.glox",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5B30.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FD.tmp\\content.inf",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B42.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B43.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A90.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5AFF.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A0E.tmp\\Quotable.thmx",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A70.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5B31.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FD.tmp\\View.thmx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A2E.tmp\\Content.inf",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5655.tmp\\Content.inf",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5BC3.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FC.tmp\\chevronaccent.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5B63.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B1F.tmp\\gostname.xsl",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59CC.tmp\\Content.inf",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AB0.tmp\\VaryingWidthList.glox",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C42.tmp\\Banded.thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A6E.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5BE3.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C62.tmp\\content.inf",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FC.tmp\\Content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D71.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C62.tmp\\Frame.thmx",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D41.tmp\\content.inf",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD1.tmp\\gosttitle.xsl",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD0.tmp\\CircleProcess.glox",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D81.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5E04.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BB2.tmp\\Equations.dotx",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5E16.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AB0.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D20.tmp\\iso690nmerical.xsl",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D41.tmp\\Wood_Type.thmx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD598D.tmp\\content.inf",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B1F.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD2.tmp\\content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD1.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5E47.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C42.tmp\\content.inf",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD0.tmp\\Content.inf",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BB2.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E15.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE6.tmp\\sist02.xsl",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD1.tmp\\Badge.thmx",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E67.tmp\\content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD3.tmp\\TabbedArc.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D82.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D20.tmp\\Content.inf",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E68.tmp\\InterconnectedBlockProcess.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD2.tmp\\Metropolitan.thmx",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5E17.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE6.tmp\\Content.inf",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5DE4.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F16.tmp\\Crop.thmx",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD3.tmp\\Content.inf",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E67.tmp\\Parallax.thmx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E15.tmp\\Content.inf",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60AF.tmp\\turabian.xsl",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E68.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6050.tmp\\gb.xsl",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA3.tmp\\architecture.glox",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA3.tmp\\Content.inf",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6238.tmp",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6258.tmp",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F16.tmp\\Content.inf",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60AF.tmp\\Content.inf",
  1093. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6050.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63D0.tmp\\content.inf",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63D0.tmp\\Dividend.thmx",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6538.tmp\\Feathered.thmx",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6579.tmp\\iso690.xsl",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6568.tmp\\rings.glox",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD1.tmp\\Content.inf",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6568.tmp\\Content.inf",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A9.tmp\\Circuit.thmx",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6636.tmp\\content.inf",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6636.tmp\\Slate.thmx",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6579.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6647.tmp\\Basis.thmx",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6696.tmp\\content.inf",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6791.tmp\\content.inf",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6696.tmp\\Savon.thmx",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD685E.tmp\\content.inf",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6791.tmp\\Droplet.thmx",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD681F.tmp\\mlaseventheditionofficeonline.xsl",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD685E.tmp\\Mesh.thmx",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69E9.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD681F.tmp\\Content.inf",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6647.tmp\\content.inf",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69C7.tmp\\content.inf",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D8.tmp\\RadialPictureList.glox",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D7.tmp\\ConvergingText.glox",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A48.tmp\\ThemePictureGrid.glox",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69C7.tmp\\Main_Event.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D8.tmp\\Content.inf",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6538.tmp\\Content.inf",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D7.tmp\\Content.inf",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A48.tmp\\Content.inf",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A9.tmp\\content.inf",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1150. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1151. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1152. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1154. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E5F.tmp\\content.inf",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E5F.tmp\\Vapor_Trail.thmx",
  1163. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1164. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1165. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FAA.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6FAB.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F99.tmp\\TabList.glox",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F99.tmp\\Content.inf",
  1170. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD70C5.tmp\\content.inf",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7104.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD70C5.tmp\\Damask.thmx",
  1175. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD726D.tmp\\Insight design set.dotx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD726D.tmp\\Content.inf",
  1178. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1179. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1FB3EF0F-1872-4647-90E5-040063FF62A3.tmp",
  1180. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm"
  1181.  
  1182.  
  1183. * Deleted Files:
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2175.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2176.tmp",
  1186. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~WRL0001.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1188. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50B0.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50F3.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50B1.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5133.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar51A1.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50E1.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55EF.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5457.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5445.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5468.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5446.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5644.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5655.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5600.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5610.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5687.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5676.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5790.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5621.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5632.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab57A1.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar57A2.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56C7.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab572C.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD591D.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56C8.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD593E.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar572D.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56EA.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56EB.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD598D.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab572E.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar572F.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5642.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59CC.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5643.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5644.tmp\\HexagonRadial.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A0E.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FD.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab588F.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A2E.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A6E.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab575F.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A70.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5770.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FC.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5890.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55EF.tmp\\PictureFrame.glox",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab56D9.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EB8.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4907.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AB0.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar56FB.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B1F.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab57A0.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BB2.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5676.tmp\\ThemePictureAccent.glox",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar57C3.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4980.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C62.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C42.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5A6F.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A90.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD0.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD1.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D41.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D20.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD2.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD1.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E15.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD3.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5AFF.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5B30.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5790.tmp\\Element design set.dotx",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5B63.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E68.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5B31.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE6.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E67.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F16.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C8C.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A2E.tmp\\harvardanglia2008officeonline.xsl",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD591D.tmp\\BracketList.glox",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5687.tmp\\ieee2006officeonline.xsl",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495E.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48B6.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD593E.tmp\\pictureorgchart.glox",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5BC3.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A53.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495F.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA3.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5E04.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6050.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5E47.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60AF.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A70.tmp\\ThemePictureAlternatingAccent.glox",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495D.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D81.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5DE4.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D71.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5E16.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5E17.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D82.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AB0.tmp\\VaryingWidthList.glox",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59CC.tmp\\Headlines.thmx",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48F6.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A6E.tmp\\chicago.xsl",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4DA9.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C1C.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63D0.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD598D.tmp\\Berlin.thmx",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6238.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53B7.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6258.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD1.tmp\\gosttitle.xsl",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C62.tmp\\Frame.thmx",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E38.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A03.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CD0.tmp\\CircleProcess.glox",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4939.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6538.tmp",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D20.tmp\\iso690nmerical.xsl",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6568.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6579.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4990.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C42.tmp\\Banded.thmx",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5A0E.tmp\\Quotable.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A9.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD3.tmp\\TabbedArc.glox",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D6A.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EE6.tmp\\sist02.xsl",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5113.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4B50.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4906.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6647.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B1F.tmp\\gostname.xsl",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6636.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5655.tmp\\APASixthEditionOfficeOnline.xsl",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49F2.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F36.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6696.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6050.tmp\\gb.xsl",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FC.tmp\\chevronaccent.glox",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4928.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\cab494C.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6791.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD681F.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA3.tmp\\architecture.glox",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cab494B.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD685E.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F16.tmp\\Crop.thmx",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E67.tmp\\Parallax.thmx",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BB2.tmp\\Equations.dotx",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F76.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C9D.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6568.tmp\\rings.glox",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E68.tmp\\InterconnectedBlockProcess.glox",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\cab495C.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A32.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69C7.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D7.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D8.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60AF.tmp\\turabian.xsl",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A48.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E15.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D41.tmp\\Wood_Type.thmx",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C7C.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD2.tmp\\Metropolitan.thmx",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E39.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59FD.tmp\\View.thmx",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C2C.tmp",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD681F.tmp\\mlaseventheditionofficeonline.xsl",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4AC2.tmp",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6579.tmp\\iso690.xsl",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6647.tmp\\Basis.thmx",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49C2.tmp",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD63D0.tmp\\Dividend.thmx",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D4A.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DD1.tmp\\Badge.thmx",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6538.tmp\\Feathered.thmx",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD65A9.tmp\\Circuit.thmx",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A48.tmp\\ThemePictureGrid.glox",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F86.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D7.tmp\\ConvergingText.glox",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E59.tmp",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5666.tmp",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5339.tmp",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49B0.tmp",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cab493A.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6791.tmp\\Droplet.thmx",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\cab571B.tmp",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69D8.tmp\\RadialPictureList.glox",
  1381. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A73.tmp",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E5F.tmp",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD685E.tmp\\Mesh.thmx",
  1384. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6636.tmp\\Slate.thmx",
  1385. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69C7.tmp\\Main_Event.thmx",
  1386. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6696.tmp\\Savon.thmx",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56B7.tmp",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B42.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5415.tmp",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F99.tmp",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6FAA.tmp",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6FAB.tmp",
  1393. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E5F.tmp\\Vapor_Trail.thmx",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD70C5.tmp",
  1395. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6F99.tmp\\TabList.glox",
  1396. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60DF.tmp",
  1397. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4918.tmp",
  1398. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD70C5.tmp\\Damask.thmx",
  1399. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69E9.tmp",
  1400. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD726D.tmp",
  1401. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD726D.tmp\\Insight design set.dotx",
  1402. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7104.tmp",
  1403. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_013bfd13141ca2ac25473b23d979e551.doc",
  1404. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS2650B905-8538-4112-8413-5CBE4752B0A6.tmp",
  1405. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1FB3EF0F-1872-4647-90E5-040063FF62A3.tmp",
  1406. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1CECCDC4-BE0D-4722-AE8D-BC78B6D30F28.tmp",
  1407. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1408. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1AAE.tmp.cvr",
  1409. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF46F90B78-3255-4E0A-BEFE-E8462FEF6F48.tmp"
  1410.  
  1411.  
  1412. * Modified Registry Keys:
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\.$9",
  1414. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\924251",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\924251\\924251",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1666. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925",
  1667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0",
  1668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\(Default)",
  1669. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\FLAGS",
  1670. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\FLAGS\\(Default)",
  1671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0",
  1672. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0\\win32",
  1673. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0\\win32\\(Default)",
  1674. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\HELPDIR",
  1675. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\HELPDIR\\(Default)",
  1676. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1677. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0",
  1678. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\(Default)",
  1679. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\FLAGS",
  1680. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\FLAGS\\(Default)",
  1681. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0",
  1682. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0\\win32",
  1683. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\0\\win32\\(Default)",
  1684. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\HELPDIR",
  1685. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\34BDF893-E05B-4C58-9F42-1100BB887925\\2.0\\HELPDIR\\(Default)",
  1686. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1688. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1689. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1690. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1691. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1692. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1693. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1694. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1695. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1696. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1697. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1785. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1786. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1787. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1788. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1789. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1790. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1791. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1792. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1793. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1794. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1795. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1796. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1797. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1798. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1799. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1800. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1801. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1802. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1803. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1804. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1805. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1806. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1807. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1808. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1809. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1810. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1811. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1812. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1813. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1814. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1815. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1816. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1817. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1818. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1819. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1820. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1821. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1822. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1823. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1824. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1825. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1826. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1827. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1828. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1829. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1830. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1831. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1832. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1833. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1834. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1835. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1836. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1837. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1838. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1839. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1840. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1841. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1842. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1843. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1844. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1845. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1846. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1847. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1848. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1849. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1850. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1851. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1852. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1853. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1854. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1855. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1856. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1857. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1858. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1859. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1860. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1861. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1862. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1863. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1864. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1865. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1866. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1867. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1868. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1869. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1870. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1871. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1872. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1873. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1874. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1875. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1876. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1877. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1878. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1879. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1880. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1881. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1882. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1883. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1884. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1885. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1886. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1887. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1888. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1889. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1890. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1891. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1892. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1893. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1894. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1895. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1896. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1897. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1898. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1899. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1900. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1901. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1902. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1903. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1904. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1905. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1906. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1907. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1908. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1909. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1910. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1911. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1912. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1913. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1914. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1915. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1916. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1917. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1918. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1919. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1920. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1921. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1922. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1923. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1924. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1925. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1926. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1927. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1928. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1929. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1930. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1931. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1932. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1933. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1934. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1935. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1936. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1937. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1938. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1939. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1940. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1941. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\Identities\\Anonymous\\Settings\\1170\\00000000-0000-0000-0000-000000000000\\Placeholder",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\Identities\\Anonymous\\Settings\\1170\\00000000-0000-0000-0000-000000000000\\PendingChanges\\Data",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\FriendlyName",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\Save",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\ShowButtons",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\ShowIndicators",
  1948. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1950. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1951. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1952. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1953. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1956. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  2311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  2312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  2313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  2314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  2315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  2316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  2317. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\PropertiesWindow",
  2318. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MainWindow",
  2319. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\MdiMaximized",
  2320. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Dock",
  2321. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\FolderView",
  2322. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\Tool",
  2323. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\CtlsShowSelected",
  2324. "HKEY_CURRENT_USER\\Software\\Microsoft\\VBA\\7.1\\Common\\DsnShowSelected",
  2325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  2326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  2327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  2328.  
  2329.  
  2330. * Deleted Registry Keys:
  2331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\.$9",
  2332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\LabelText",
  2337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\NoLabelOption",
  2338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\NoSaveOption",
  2339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\NoButtonOption",
  2340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Smart Tag\\Applications\\OpusApp\\NoIndicatorOption",
  2341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\.;7",
  2342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\924251\\924251",
  2343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  2344.  
  2345.  
  2346. * DNS Communications:
  2347.  
  2348. * Domains:
  2349.  
  2350. * Network Communication - ICMP:
  2351.  
  2352. * Network Communication - HTTP:
  2353.  
  2354. "count": 1,
  2355. "body": "",
  2356. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2357. "user-agent": "Microsoft-CryptoAPI/6.1",
  2358. "method": "GET",
  2359. "host": "ocsp.digicert.com",
  2360. "version": "1.1",
  2361. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2362. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2363. "port": 80
  2364.  
  2365.  
  2366. "count": 1,
  2367. "body": "",
  2368. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2369. "user-agent": "Microsoft-CryptoAPI/6.1",
  2370. "method": "GET",
  2371. "host": "ocsp.msocsp.com",
  2372. "version": "1.1",
  2373. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2374. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2375. "port": 80
  2376.  
  2377.  
  2378. "count": 4,
  2379. "body": "",
  2380. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2381. "user-agent": "Microsoft-CryptoAPI/6.1",
  2382. "method": "GET",
  2383. "host": "crl.microsoft.com",
  2384. "version": "1.1",
  2385. "path": "/pki/crl/products/microsoftrootcert.crl",
  2386. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2387. "port": 80
  2388.  
  2389.  
  2390. "count": 4,
  2391. "body": "",
  2392. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2393. "user-agent": "Microsoft-CryptoAPI/6.1",
  2394. "method": "GET",
  2395. "host": "crl.microsoft.com",
  2396. "version": "1.1",
  2397. "path": "/pki/crl/products/microsoftrootcert.crl",
  2398. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2399. "port": 80
  2400.  
  2401.  
  2402. "count": 1,
  2403. "body": "",
  2404. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2405. "user-agent": "Microsoft-CryptoAPI/6.1",
  2406. "method": "GET",
  2407. "host": "crl.microsoft.com",
  2408. "version": "1.1",
  2409. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2410. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2411. "port": 80
  2412.  
  2413.  
  2414. "count": 6,
  2415. "body": "",
  2416. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2417. "user-agent": "Microsoft-CryptoAPI/6.1",
  2418. "method": "GET",
  2419. "host": "crl.microsoft.com",
  2420. "version": "1.1",
  2421. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2422. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2423. "port": 80
  2424.  
  2425.  
  2426. "count": 1,
  2427. "body": "",
  2428. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2429. "user-agent": "Microsoft-CryptoAPI/6.1",
  2430. "method": "GET",
  2431. "host": "crl.microsoft.com",
  2432. "version": "1.1",
  2433. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2434. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 16 Jul 2019 05:01:15 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2435. "port": 80
  2436.  
  2437.  
  2438.  
  2439. * Network Communication - SMTP:
  2440.  
  2441. * Network Communication - Hosts:
  2442.  
  2443. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!