API tools faq
paste
paladin316

Docs_20dce54d319d7e9ed52fad367a518446_doc_2019-07-09_18_30.txt

paladin316
Jul 9th, 2019
2,350
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 281.36 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_20dce54d319d7e9ed52fad367a518446.doc"
  7. * File Size: 199680
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: William, Template: Normal.dot, Last Saved By: Windows, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Dec 31 13:23:00 2016, Last Saved Time/Date: Sat Dec 31 13:23:00 2016, Number of Pages: 2, Number of Words: 0, Number of Characters: 5, Security: 0"
  9. * SHA256: "a5d793d4342073b7267db718e469007c26bd0528f538f6410a5aa02581ed14d2"
  10. * MD5: "20dce54d319d7e9ed52fad367a518446"
  11. * SHA1: "c1f022f17fc4f9182e8931b829f158ecbeed7189"
  12. * SHA512: "37b9c7796a337be8ec02ef6df10cd50b3fe6fdfac195c670b0ddf147f83d9b1fd04c0ea61364680ab6e840df6a0b3364b1375c5c046e02a6d37404c8ed2260dd"
  13. * CRC32: "DA9C01D9"
  14. * SSDEEP: "3072:jHQH+EAxJi9Zo5WRi/JDc46N1/2ZtwWqzKY7R+u3A6K2tB8DOmpm:d9xSZo5dJDcF/bWMp3pXB8D"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "verclsid.exe"
  19.  
  20.  
  21. * Executed Commands:
  22.  
  23. * Signatures Detected:
  24.  
  25. "Description": "A process attempted to delay the analysis task.",
  26. "Details":
  27.  
  28. "Process": "verclsid.exe tried to sleep 1140 seconds, actually delayed analysis time by 0 seconds"
  29.  
  30.  
  31. "Process": "WINWORD.EXE tried to sleep 521 seconds, actually delayed analysis time by 0 seconds"
  32.  
  33.  
  34.  
  35.  
  36. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  37. "Details":
  38.  
  39. "IP": "52.109.16.5:443"
  40.  
  41.  
  42. "IP": "65.52.98.231:443"
  43.  
  44.  
  45. "IP": "104.18.24.243:80"
  46.  
  47.  
  48. "IP": "23.15.4.26:80"
  49.  
  50.  
  51. "IP": "69.192.108.32:443"
  52.  
  53.  
  54. "IP": "72.21.91.29:80"
  55.  
  56.  
  57. "IP": "23.199.190.133:443"
  58.  
  59.  
  60. "IP": "52.109.16.4:443"
  61.  
  62.  
  63.  
  64.  
  65. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  66. "Details":
  67.  
  68. "ioc": "sist02.xsl"
  69.  
  70.  
  71. "ioc": "ontent.inf"
  72.  
  73.  
  74. "ioc": "ieee2006officeonline.xsl"
  75.  
  76.  
  77. "ioc": "e.gu"
  78.  
  79.  
  80. "ioc": "quations.dotx"
  81.  
  82.  
  83. "ioc": "ist.glox"
  84.  
  85.  
  86. "ioc": "chevronaccent.glox"
  87.  
  88.  
  89. "ioc": "ext.glox"
  90.  
  91.  
  92. "ioc": "mlaseventheditionofficeonline.xsl"
  93.  
  94.  
  95. "ioc": "set.dotx"
  96.  
  97.  
  98. "ioc": "content.inf"
  99.  
  100.  
  101. "ioc": "rame.thmx"
  102.  
  103.  
  104. "ioc": "adial.glox"
  105.  
  106.  
  107. "ioc": "rid.glox"
  108.  
  109.  
  110. "ioc": "..3b"
  111.  
  112.  
  113. "ioc": "ccent.glox"
  114.  
  115.  
  116. "ioc": "turabian.xsl"
  117.  
  118.  
  119. "ioc": "architecture.glox"
  120.  
  121.  
  122. "ioc": "gb.xsl"
  123.  
  124.  
  125. "ioc": "harvardanglia2008officeonline.xsl"
  126.  
  127.  
  128. "ioc": "rocess.glox"
  129.  
  130.  
  131. "ioc": "rings.glox"
  132.  
  133.  
  134. "ioc": "iso690nmerical.xsl"
  135.  
  136.  
  137. "ioc": "anded.thmx"
  138.  
  139.  
  140. "ioc": "rame.glox"
  141.  
  142.  
  143. "ioc": "gostname.xsl"
  144.  
  145.  
  146. "ioc": "rc.glox"
  147.  
  148.  
  149. "ioc": "iso690.xsl"
  150.  
  151.  
  152. "ioc": "gosttitle.xsl"
  153.  
  154.  
  155. "ioc": "asis.thmx"
  156.  
  157.  
  158. "ioc": "pictureorgchart.glox"
  159.  
  160.  
  161. "ioc": "chicago.xsl"
  162.  
  163.  
  164. "ioc": "adge.thmx"
  165.  
  166.  
  167. "ioc": "iew.thmx"
  168.  
  169.  
  170. "ioc": "eadlines.thmx"
  171.  
  172.  
  173. "ioc": "nline.xsl"
  174.  
  175.  
  176. "ioc": "arallax.thmx"
  177.  
  178.  
  179. "ioc": "ividend.thmx"
  180.  
  181.  
  182. "ioc": "uotable.thmx"
  183.  
  184.  
  185. "ioc": "etropolitan.thmx"
  186.  
  187.  
  188. "ioc": "rop.thmx"
  189.  
  190.  
  191. "ioc": "avon.thmx"
  192.  
  193.  
  194. "ioc": "ircuit.thmx"
  195.  
  196.  
  197. "ioc": "g.n9"
  198.  
  199.  
  200. "ioc": "ype.thmx"
  201.  
  202.  
  203. "ioc": "roplet.thmx"
  204.  
  205.  
  206. "ioc": "erlin.thmx"
  207.  
  208.  
  209. "ioc": "eathered.thmx"
  210.  
  211.  
  212. "ioc": "late.thmx"
  213.  
  214.  
  215. "ioc": "esh.thmx"
  216.  
  217.  
  218. "ioc": "amask.thmx"
  219.  
  220.  
  221. "ioc": "rail.thmx"
  222.  
  223.  
  224. "ioc": "vent.thmx"
  225.  
  226.  
  227.  
  228.  
  229. "Description": "Performs some HTTP requests",
  230. "Details":
  231.  
  232. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  233.  
  234.  
  235. "url": "http://crl3.digicert.com/Omniroot2025.crl"
  236.  
  237.  
  238. "url": "http://api.ipify.org/"
  239.  
  240.  
  241. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  242.  
  243.  
  244. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  245.  
  246.  
  247. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  248.  
  249.  
  250.  
  251.  
  252. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  253. "Details":
  254.  
  255.  
  256. "Description": "Looks up the external IP address",
  257. "Details":
  258.  
  259. "domain": "api.ipify.org"
  260.  
  261.  
  262.  
  263.  
  264. "Description": "Executed a process and injected code into it, probably while unpacking",
  265. "Details":
  266.  
  267. "Injection": "WINWORD.EXE(2988) -> verclsid.exe(2516)"
  268.  
  269.  
  270.  
  271.  
  272. "Description": "Behavior consistent with a dropper attempting to download the next stage.",
  273. "Details":
  274.  
  275. "File": "/ls5/forum.php was requested from hosts: peronbifo.ru, jechissoco.ru, hatannaso.com"
  276.  
  277.  
  278.  
  279.  
  280. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  281. "Details":
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xbe\\xcevt\\xb2\\xf3\\xd9a\\x18\\xb5c*\\x8c\\x1d\\xbc\\x8d`\\xb5\\xa7e,m\\xca\\x92m\\xb1\\xea\\x90\\x94\\x1a\\xa7l-\\x88\\x82r\\xe3ic\\xb7\\x95\\xea\\xee\".bs\\xf2\\x08\\xdb\\x0c\\xb9tv\\xc3\\x90\\x04\\x1f \\xc6\\x82\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84n\\xc41\\xa8\\x98\\xedse\\xe3\\xeft\\x17\\xd3u\\x15\\x94\\xfa\\x98\\xa8\\x92^;\\xc1o'\\xf4\\x9c\\x86m\\xe6\\xe8g\\xb1c\\xf3=\\xf9x\\xbd&\\x8e2j\\x91\\x93b "
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xbd\\x11\\xb4\\xd1\\xb3\\x11\\x1c\\x9e3\\xf5a\\xcd\\x1be\\x9e\\xa1\\xb8\\xf5\\xb0\\x14\\xc3\\x08*\\xc2\\xa1\\xaae8\\x91\\xac\\xd50%\\xfb\\xfdr\\x00\\x81\\xc4\\x1bs\\xed\\xb5\\xb0\\x0f\\x02\\x13$\\m!\\xb2?\\xd8\\x86d'g\\xb2\\xe7\\xb0\\x93\\xfe!\\x9b\\x9b\\xb13m\\x0b\\xd7\\xe7\\xb0g\"%\\x11r$m\\xc6\ts\\xe8\\xfcf\\x0b\\x08\\xd1\\xccq\\x18\\xaeh`\\x0f`\\x81 j\\x99z\\xbf\\x10\\x90\\x9b\\x92\\xe0\\xf9\\x0ejwe\\xac\\x07\\x80\\x96\\xcen\\x11*\\xfc\\x83\\xdf\\xed\\x84@\\x06\\xfd\\x11\\xc3\"\\xf5>\\x1b<\\xe0y\\xad\\xa7+\\x07\\xd6\\x81\\x95\\xab\\xd5\\xa0\\xa8#\\xab\\x7f\\xe0>h\\x06\\x89\\xbc\\x19\\xd2\\xd3<\\xcb\\xa2\\xe6\\xf3t\\xfa_\\x05qq\\xfe\\xdd\\x96\\xda,3\\xd0k\\x9a\\xe1pelt\\x9dd5\\x11$\\xf0x\\xe8\\xe6\\xaf\\xcbx\\xe7\\xad\\xde\\xfb\\x9a\\xe0\\x08.\\xf1\\xfc;\\xa1\\x9ce\"\\x0bo\\xffc\\xd2\\xfcp\\x85\\xa7\\xe8=\\x1at\\xc2\\x0ch\\x85\\xa9/eb\\xee\\xcf\\x00\\xa6\\x94\\x11k"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$\\xd6\\x19+\\x03\\xeb\\x16\\xcdx\\xd2\\xa2\\xa1\\xca\\x93\\xe5\\x0c\\xf4&$i\\x87\\xe3\\x027p\\x92s\\xc2u\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$\\xd6\\x19\\x05g \\xc5\\x98\\x93\\xfcw^f\\xc4\\x9c\\xec\\xdbt\\xf3\\xa6oc'\\xecn\\xa6\\xa9o\\xf6\\xa9p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc79v\\x9a\\xa4\\x98\\x8b\\xba\\xf06\\x9c;\r\\xc3\\x06\\xbb\\x9a|1i\\xc0\\xc6\\x9e\\x18\\xe1\\xd5c!\\xe3c\\xf4oz\\xe1z\\x882\\xf6\\xc5\\xf1$\\xea?\\xc9\\x07`\\x07s\\x98\\x04s\\xee>`\\xe5\\xa6&\\x1f\\x1cn\\x1bn\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3y\\xc7r\\x0cp\\x99\\x89\r\\xefku\\xf1\\x06\\x06?\\xb0\\x1f\\xa0\\xe6s\\xc7\\x16&_6\\xdah\\xcb\\x06\\x1c1 \\xd0\\x84s\\xb0\\xd8\\xa2\"\\x1b\\xe7\\xfb\\x90\\x83\\xd5\\xdd\\xa4"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85\\x90\\x1d\\xe5\\x02\\xfcg\\xba\\xa2n?\\xc7\\xb4k\\x84e\\xc8\\xe6d\\xbf\\xc8\\xdc\\xf64&\\xc98\\x1d\\xba\\xab$ga\\xd9\\xb6\\x81n\\x9a\\xa9\\xb4\\x08\\x0e\\x0bzb03c\\xe3^'0\\xe3$\\xe4\\xe8tt\\xc5\\xff\\xcf\\x84\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6^(\\xac\\x1d\\xf5\\xe43\\x9c\\x10x6\\xd1\\x9ank\\xb0\\xcd\\xd9\\xc44\\xaf\n5\\xd3\\x95b|\\x04\\x80\\x00hm\\xa4u\\xc3'\\xe8 \\xa45*\\xe6fd\\xa1ug"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pxx\\x02\\xa2\\x02\\x91\\x111\\xaf\\x96\\xc1\\xdc\\x95\\xe5\\xfa\\x90&\\xfaur\\xdf\\xeb\\x01\\xa7ze=\\x06uw\\xe4\\xfa\\xc7\\x17\\xf7\\xcd\\x84\\xa2=\\x1f\\x9a\\x18\\xc0\\x0e\\xa6\\xbc\\xc4b\\xfc\\xb4\\x19\\x16\\xb1\\xfd:\\x8e\\xcd\\xa2v \t\\xf1-k\\x9e\\xd7\\x19\\x8e88v\\xx\\xd1\\xed\\x9dk\\xd3\\xe0\\x89\\xe2\\x99\\x82\\xf0l\\xc7@\\xa4\\xd0\\xe6\"\\x00\\xb3vz\\xe7t,\\xd4j\\xf1\\xb5%\\x1b\\xd1\\xd3\\x8f\\x1c\\xb39l\\x88\\xd4\\x9a\\xc1\\xff\\xde\\xe2\\xa8\\xa7\\xf4'\\xf1im\\x1b\\xa4\\xa4\\x80\\x182\\xbb\\x03\\xca\\x872\\x98\\xdc1\\xaek\\xb9\\xa2\\x93j\\x83;\\x8c\\x07+\\xaa?>\\x19\\xa1\\xb8l\\x8f\\xb6\\xe4\\xf0\\xb1\\xf9\\xa98\\x0e\\x97\\xf3\\xe3\\x81\\x1e\\x12\\xb5\\xeci\\xafo\\xcae\\xec\\x11\\x0b>\\xab\\xc5\\x177'\\xa1!\\xb6\\xfa\\xd3\\xf2\\xbe\\xb0\\x19i\\x12a_\\x96c\\x13\r\\x8e\\xb2 ffx\\x8c\\x0f\\xaa\\xa1\\xb1!e \\x97\\x1f\\xa77d/w\"\\xb6!\\xbcl\\xbav\\xef\\x07\\x10\\xcd\\xb05\\xbfx\\x84\\xca\\x92"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_get /omniroot2025.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl3.digicert.com\r\n\r\n"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01$\\xd67)\\xdc\\x1dlegwu\\x1f5\\xd9jw\\xd5\\xc7\\x90\r\\xc5\\xf7\\xabd\\x7fo\\x18\\x9c\\xb5o\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa7\\x02\\x8fn\\xe2`c\\xcbo\\x90\\x02\\xa9\\xdes\\xac\\xfa\\x15\\xa2u\\xdd\\xfc\\xbbq\\x93\\x18\\xc4-\\xc6a\\x98\\xf6\\xc5n^yra\\x1f\\xf8l\\xfc\\xae<n\\xc8\\xf6\\x1c`\\xf8\\xb4zu\\xb2\\xc6\\xbe\\x9d\\xacj|\\x92\\x94\\xd5e\\x95p6\\\t\\x06\\x1edu\\xd8e\\x8d\\x97j\\xb1.\\xe97\\xfeg\\xf4\\xee\\x90\\x93\\x18wq\\xf8/\\xfc\\x05\\xd2\\x0e\\x93n\\xf2r?\\xed\\xf2\\xe7\\xc8\\x93\\xdd.\\xf1\\x92\\xa50\\xfb`n\r\\x98>\\x94\\xb2\\xe3\\x87\\xdf\\xb3\\xd5\\x91uh_\\xb9b\\xc1\\xea\\xe8\\xdc\\xcc`n\\xa76\\x07zy`\\xae7\\x86w\\x1c\\x92(\\xf0\\x98w\\xc8\\x9a\\x00\\x04\\xd9\\xf8\\xa8\\xcc>\\xdd\\xf3p\\x91u\\xc4x3\\xd5\\xb5\\xd5r\\xe0\\xdc\\x0b\\x93\\x8c\\xbc\\x1d\\xb9\\xd0\\\\x12q\\xc5r)\\xd0\\xdc!\\xe5\\xackd\\x1f\\xda<\\x84@\\xa2~\\x80l`\\xb1\\xf0\\x9a3\\x93\\x91\\xf9\\xb28y\\x0fk\\x80`\\xe0\\xaa\\x82\\xb71\\x133d\\xe6\\xb2\\x07x(\\xc4l\\x7f\\xe2\\xa7x\\xd2t fna\\xd6"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x94\\x8d3\\x17\\xbf86\\xc7\\x9a\\x87g\\xa6\\x9e(#~\\x18\\xbf\\x14co\\x01\\xe5\tmf\\xe2m\\xd7\\xbb\\xb0\\x04j\\xd6m\\xeec\\xa2\\xdfa\n\\xdc\\x01\\xf4k\\xe6g&\n\\xfc\\xdf\\xdf\\xb9b.\\x16\\x1a\n\\xd1\\9h)@\\xeb\\x9cc(.,\\x7fm(_\\x91\\x86\\xb1\\x14\\xa0\\xf8*a\\x1a\\x82\\xec\\xfe\\xf3\\xa5\\x0ft\\x11(\\xd2\\xb7\\xcb\\xa4\\xfc\"8ky\\xacu\\xffov\\x9ewn\\x13\\x9c\"pf8\\xe2f\\xb8\\xb6\\xdb\\x0f\\x90\\x9b\\xd4^g\\x06\\xe3\\x89\\xd1\\x1b\\xd5\\xfb\\x05\\xb7h\\x8akc\\x81\\xcc\\x14n\\xdb\\x03\\x9f\\x81\\xddy\\xe7\\xbfw\\xa4p\\xa1\\xeb\\xa1\\xf1\\xaf\t\\x89du\\xc0\\xa14\\xab\\xda\\x14`\\xf2\\xc8+m\\xa5\\x8b:\\xb7\\x91\\x1a\\xa3+x\\xf4;\\x06v\\xd6\\xac\\x89\\8:\\xd9q\t\\xf0\\x83\\xd0\\xa7\\xc7u\\x97\\xce\\xdb\\xf0,00\\xc3\\xcd7z\\x9e\\xa1\\xba\\xf8\\xf3r\\xac|\\xea\\xdb7@v\\x89a7\\x96?\\x0c\\xe0\\x0c4\\x84\\xbb3\\x89i\\z\\xb3\\xdd\\xd4\\x87\\x12\\x98"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xed\\x9cp^q0 z\\x9d\\xa0\\x82\\x81$\\xb2\\x13\\xdd\\xbf\\x04o\\x9a\t\\xe7\\xe1\\xe0\\xe0kx\\x95\\xda\\x05\\x1f\\xe2=\\xcb\\x94u\\xcb\\xf8\\xe8\\xa9i!\\xea\\x89\\xcc\\x1f\\xfb\\xfd\\xc1m\\xb4\\x97+h:w\\x96!\\x1b\\x9a\\xbet\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06(\\xe7s\\x05\\xee\\xe9=')\\xe4>\\xf5\\x9bmg\\xd7#\\x87`\\xe6k*\\xa9qv\\xb2'jb\\xb2k\\x83z\\xbb\r\\xf8\\xa74i\\x06o\\x1e\\x18\\xfb\\xffo\\xd9"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x84\\x86\\xce\\xf2\\x9d\\xcb\\xabom\\x92\\xb8\\xc7\\x88i\\xcb\"\\x94\\x8e\\xb3g\\x07\\x8b\\x99s\\x1e\\x96n9\\xa3o\"\\x99u\\x1a\\x95\\xe9\\xa1\\xb6z\\xe8\\x15 \\xc2\\xda\\xe3\\xfe*\\xb7\\x8e<8\\xf5g\\xfcz\\xb8\\xd1\\x87\\x1e\\x0c\\xd6q\\xc8\\x89\\x0f\\xa9e\\x94gyd-\\xbc\\x98\\x8f\\xa7\\xb2\\xc6,\\xf5_`\\xdcsw\r\\xc4\\xd8\\xbf\\xea \\x03\\x8e\\x8av\\x08l<\\xb3\\x18h\\xba\\xb7\\xf3\\xb5\\xf6i\\xba\\xffr\\xde\\xe7\\xaa\\xc1\\xe3\\x8f(\\xb7\\xe3t\\x9f\\x04\\xe5\\x8d\n0yw\\x89\\x82\\xda\\x84\\x15\\xf3\\x1eh\\xc4\\xad\\xcd^\\x88\\xa2|\\x1a(&\\x18\\xa6\\x02\\x1fe\\xf54-ox?3^o\\xb7\\xd9\\xb7\\x9c\\xf7\\x9e,k\\xaa\\x13\\xe2\\xfdw\\xa6q_\\xa6v\\x19\\x05~b\\xf8\\x05\\x9f\\x193\\xe8)$m\\xd6\\x85w\"\\x02#\\x8e<\\xe1j\\x83\\x80\\xc9\\x12\\xbf\\xeb\\xd4\\xe4\\xb7qt\n\\xd4\\xd8|\\xa7\\x8f\\xd3\\xe8\\x13\\x98\\xcbn\\xc2wx\\xef\\xb3s\\xfbj\\xf7u=\\xd1h\\x94\\x9fo'\\xff\\xf0\\xbbyn,\\x1ba"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;ag\\x14\\xf1\\x03\\xb11\\xcf\\xac\r)\\xd9\\x88+\\xc7\\xbfq\\xd0\\xec\\xf4\\xae\\x90\\xad:\\x8c\\x13\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xaf\\x8e\\x80k\\x0c-\\xc2h\\xda\\xaa\\xb3dp\\x88b\\xab\\x1cj\\xb6'\\x06\\x8f\\xad\\x06\\x17\\xe3\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;q\\xec^x\\xa1\\xe0v1kgq\\xf8\\x0b\\xe1\\xc4mb\\xac\\xdfn5\\xbf\\x05\\x99r\\xb9\\x18\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;n:\\x16ykd\\x0c\\xa1gc\\xfb\\xd9\\x08\\xdc\\x1b\\xb6a\\x04\\x05\\xcd\\\\xaa\\xdc\\x16\\xb3u\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xce\\xb8\\xc8\\x03\\xabc\\xa5#\\xd7\\xa2\\xef\\xc3\\xa0\\xd6n\\xad+\\x90l!\n2'\\xb4/\\xcce\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xb7c\\xc0\"c\\x93u&\\x02\\x9f\\xc2\\xa3\\x14\\xd4\\x07\\xed!\\xd6\\x87\\xd3l\\xdar\\xb5i\\x9a\\x18&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xa2h\\x7f\\x05\\xc0\\xfew\\xdf\\xf1\\xf0\\xd7\\xe2\\xee\\x07\\x18\\xe1\nu\"\\xca\\xdb\\xe6 \\xdb>)\\x8d\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\xa2\\x05\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xf8\\xc1\\xd5\\x0b\\x0c\\x15\\xb22|5/\r\\xe2p\\xc8n\\x91\\xf0\\xadl w\\xce('p7s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x03q5n\\x00\t\\xbe\\x93:\\x94sa\\x88\\x95\\xd6\\x9afo\\xb7\\xaa\\xdc\\x93rj5\\x02\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x86;\\xd0y\\x9bc\\xa3`\\x07\\x1f\\x9b\\x85\\xafwt\r\\xdb\n\\xe6&s\\xb6\\xc1r\\xfe\\x96\\x18y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;'\\x80\\xda\\xc44k(\\xd9h\\x18\\x8d/\\xb2&\\xddu\\x00\\xf3x<\\x06\\xba\\xcf\\xaen\\x96\\xdc\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;'\\x0f\\xb2bw\\xbb\\xb9f\\x05k9\\xb9\\xce\\xce1\\xe2\\xe5\\x00\\xea\\xa6\\xa9\\xb2+\\xed\\x1ds~\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xf2\\xff4\\xfa\\xfa\\xaa\\xd2w\\xd9\\x91bu\\x04\\x05\\xf5\\x81\\xe5\\xfc\\xc6\\x01\\xedm\\x98>\\xacq\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xa1\\xc1`\\xf8:\\xcf%\"\\xb3\\xbbx\\x13ei^\\xf9\t\\x7fp\\xa2\\xb3\\xd9~;p\\xdd\\x97\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xe1\\xb1b\n\\xebhd\\x1a\r\\xf8\\x87=k\\xe5s\\x02j\\xd0>:\\xc7,\\xbfa\\x1d8'j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\n\\xa4z\\x17\\xf89\\x18\\xda\\xf1q1\\x18v\\x82\\xaa\\x1e\\xcd\\xd1\\x80\\x18\\x00(\\xc7\\xa5\\xbf\\xa2c\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xbdw\\xc5%up\\x16g\\xbb\\xabi\\xb7\\xa5\\xcf\\xdf\\xbc\\x92*8\\xf6\\xe1d\\x97\\xdf\\xbf|hg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;k\\xed\\x9e|l\\xd0v\\xd7i\\xc5\\xdfh)\\xc8\\xec\\xa0\\x81\\xfci\\x01n\\xe6\\xd9:\\xd5\\xc1g\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x92y2\\xae\\xab\\x11\\x06\\x86\\xb2\\x90\\xfc\\xcagi\\xb4\\xde\\xb0\\xc0\\x9bb\\x92z#v\\xeaw\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xe1$b\\x81j\"\\xe3\\xc8sp\\x10o\\xd9ot-\\xb6=g\\xf01\\x17\\x03\\x06\\xbd\\xce\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\x90\\xa32\\x15\\xf7>\\x82f#f+\\xd3f\\xe4g\\x7fd\\x04$\\x89\\x0c)sxi\\xde\\x82\\xc3\\x13gx\\x92b\\xcd?.\\xc0\\x9d;\\x96\\x1c\\xc0\\x84\\x98\\x0f\\xaei\\xfe\\xa1u\\x1e\\xb6\\xe7,\\x00\\xe8q\\xd7\\x01\\xee\\xc3u\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98ozo\\x8a\tf\\xcb\\x95:\\x9bd\\x114\\x0f\\xbb\\xd5\\xc5w\\x16\\xa6\\xf7;\\x94\\xac\\xe4\\xb2xy\\xd2&n\\x93\\x05\\xdc\\xa8\\xabl\\xf7uqq\\xc4.\\x13>\\x9c\\x0c"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=e\\xd7\\xb8d'\\x86p\"l\\x94sst\\x86\\x04vu\\x06\\xdb\\xfa\\xe6\\xbd\\xb9\\xbc\\xed\\xf1\\xef\\xca\\xe3\\x9b\\xad\\x96\\xaa9\\x0f\\x00\\xe7\\xce\\x91+4\\xc1rdp\\xdd\\x9e\\xde1\\xdc\\xc1gh\\x05dy\\xd2wf\\x1b\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xdd\\x04\\xd0\\x17ga\\xb5r'\\x9d\\x15s\\x1f\\xe8w\\xac\\xdb\\xca\\x1e \\x12\\xeej-\\xc7\\xfc:\\xd9*\\x9b\\xc7\\xc1s\\xe7\\xcf\\xe8hyb\\xa2t\\xcd\\xf1p9\\x8f\\xf6"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xb1=\\x02\\xc6y\\x915\\x83\"3\\x1b\\x1d\\xe8)\\xec\\xb2m\\x97(y\\x95v\\xd1\\xaann\\xf4a\\xfc\\xf6\\xf8s\\xe4\\xf4\\x10\\x1c\\x89\\xaf&\\x7f\\xd6\\xf3\\x89\\x93\\x8b\\x0e?\\xa6\\xa9k\\x91\\x02\\xf1f\\x0b\\xba\\x93\\xf1\\x7fs\tc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\x9c\\xc0u\\xcb\\xf4\\xe9\\xccc\\x1f\\xba;.,\\xc8s\\xf37f\\x04gq7>=x\\x86\\xff\\x8c-\\x10bz?\\xea\\xbc&\\x92\\xd3\\x04\\x9f\\xcc\\xbc\\xadv"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3`#\\x98\\xc2\\xa1\\xfe\"\\xebp\\xdd\\xc9\\xf9\\xbev<k\\x7fn\\x8e\\xdf\"\\x9c\\xd0b\\x0c\\x14y\\xafhj\\xcd\\xd6\\xb0a\\xfe;\\x14%3\\xa0\\x91\\xc9\\x05\\x875\\xf5\\xebo6\\xb2\\x972l\\x0e/\\xf9\\xf3e%\\xce\\x0c\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b.\\xc4#\\xb7\\x0e\\xf5\\xcc\\xa6\\xeat\\xed\\xe5\\xbf\\xe0\\xf8\\xccb(\\x1byr\\xfe=)\\xb5\\xf3\\x01\\xd6\\xdc\r\\x87idn\\x8e\\x04~l\\xc17\\x8cn5\\xa8xte"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xc1u\\x14\\xf1n\\xd0\\xa52mlia\\xfb\\xee\\x00h\\x7f\\xd6\\xfb\\xf6\\xea\\x14\\xacvw\\xde\\xc9\\x1e\\x16vs\\xbb\\xf4k\\x0f\\xf0\\x9554\\x02\\xa8,oc\\xf8\\x19x:8\\x8a\\xc7\\x1f>\\xb8do;\\x81ei\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\xc65f?4\\x85b\\xf2pb\\x8b\\x08\\x07\\x1dtcd\\x10\\xa1v\\xcc\\x13\\xcac\\xdf\\x8fr\"7\\xeb-\\x93\\xca\\x98\\x11\\x19\\x85\\xd9\\x00\\xc7\\xe4\\xb5\\x1b\\xa5z\\x83"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\x1d\\x84\\xc4\\x\\x02\\x9a\\xc1\\xd5ga\\xd1\\xa1\\xc1\\x1d\\x12\\xbd\\xdb\\xbe\\xda\\x10d_y\\x8b\\xb7\\xc3\\xf3\\xcc\\xb4\\x1ex\\x9b\\xfe\\xa8\\x94\\xed\\x95j\\x83\\x91\t\\xde\\x8ed\\xe7r\\xf8\\xaf\\x83p\\xc6\\xa7\\x12\\x13\\xf9:x\\x9b\\x88\\x9f\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda>\\x9f\\x80\\xd7\\xb0\\x84y\\x8c-\\xdcn0\\x0fk\\xa4\\x1f\\x1e\\xc3\\x1dg\\x8b\n\\xf4\\xb9\\xee\\xe6+\\xedx\\xc69\\xd3l\\xe6\\xdc\\x08\\x83\\xc1d\\xd5\\x11\\xb2\\xaa\\xc5"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0d?\\xd9\\xafxy\\xb0-\\xb6+\\xe9\\xc40\\xe9\\x1f\\xd2\\x9e\\xd6\\x96\\xff\\x84\\xe7\\xb9\\x8d\\x91\\xbf?\\x0f\\xae\\x86\\x9a\\xb3\\x1c\\x94\\x19)\\x07#\\xe5a\\x97xsu_\"8j\\xfc\\xda\\x9e\\\\xaf\\xb5\r\\x82\\xf8\\xbb\\xf6\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bt\\x7f\\x80\\x1d\\x12\\x07:5\\xa3\\x16\\x84\\x03\\x1b\\xce\\x085\\xac?j\\xb7\\xc6\\x97\\x9d\\xbf\\xaad\\x1e\\xdd\\x0eb8\\xca\\xc9\\x90-a\\xe9\\xdd\\xb8\\x0f\\x82_\\xd0\\x89\\xf1?z"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048=\\x8c~\\xb1w\\xae3c\\x0e\\x0b\\x9e\\xc7v\\xc2\\xf2\\xf6'9\\xe0\\x9a\\xf7\\xefy@\tm;t\\xab\\xd5\\xae\\xcd\\xfa\\xd8@_\\x01w^\\x95\\xcd\\xa3\\xd0\\xb69\\xad\\xabf\\xd4\\x04\\x0f\\xe1\\x03\\xc1ch\\xe1\\xd4\\xc5\\xde\\x9e\\x14\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\x9b\\xbdn\\x15p\\xa9d\\x8b\\xb2s\\x03\\xff\\x11\\xbde\t?\\x94l\\x819\\xeb\\xddc\\xf2\\xf5\\xf7t|q\\x0e5\\x90\\x8f\\x07\\xbc|\\x9e<#nqs8yb$"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\x9fp\\x19\\xb2\\xd2\\xae;-3\\xe5\\xae\\xbe\\x81(z\\x8c\\xcdr\\x19_\\xa9ti\\x03bs(t\\xce\\x1e\\xef1\\xb6\\xd0r\\xceet\\xb2\\xa3\\x8a@!\\x91\\xf8\\xc7\\x05\\xba\\xc6\\x8ew\\xed\\xc4\\xdd\\xe0\\xe2y\\x91\\xfc\\xed\\xa6h\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xfd\\xa05\\xdc?\\xa7\\xfe\\xe2\\xbf\\xdf?*x\\xb1\\xff\\xb3\\x8a\\xf9(p\\xafj\\xb5\\xe1\\xb5 /\\x9bg\\xbc\\xb7\\xa5\\x85@\\x02$\\x8e\\x99\\x0e\\xe3\\x12r\\xeb\\xa9v\\xf3"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10?%\t\\x04\\xbaxw\\x10\\xadxa(\\xc5\\x13\\x0c\\x81\\x82.%\\xd8^\\xeav\\x83q\\x08l\\xdcl0\t\\x10%\\x8d^\\x05x\r\\x1f5_|(2\\xa1?\\xf1\\x8br@o\\x91\\xca~\\xe6'v5\\x8b\\xc0v2\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\xc0z\\x9e\\x1f\\x1ba\\xd8\\xa4p\\xc0\\x13\\x9b\\xbb<?\\x9e\\x16,\\xe4/\\xcf\\x14\\x0b\\xaa\\x11`\\xae\\x0c\\x7f\\xea\\x00\\xdd\\xf9\\xbe\\xfd\\x83j\\xa6kc\\x00) jt\\xa4\\xab"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xbd\\x8eh\\xa7\\xa0\\x84\\xae\\xbc\\xad\\x1ai\\xfei\\x9c\t\\x06\\x8f\\xd7\\xb8\\xc3\\x91\\xeb\\x85\\x10\\x12b9\\x03b\\xc9\\xd1:n\\x01:r\\xc9\\xa0\\x986\\xcf\\xec\\xe6\\x12q\\x96kq\\xd9m\\x0f\\xc2lm_c\\x7fn\\x9f\\x0e\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7x\n\\x97\\xa9\\x9a\\xd4/\\xaa\\x82n!~\\xd6\\xd5\\x9dt\\xbe\\x8be\\xe2\\xf8\\xa70\\x94\\xec\\x1c\\x9a\\xd7rmb-\\xcf\\xea\\x94\\x8f\\x19\\xfaw6d7`'~\\x07\\xa5"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xc5\\x98\\xb8)@\\x03x\\xce\\x9f`\\xbd4i-\\xcdm\\xee\\xe0s\\xac\\xaf\\xf4d\\xe1n\\xfap\\xe9\\xd5\\x9c0ij\\xb7\\xdai\\xe1\\x9e\t!b\\x01\\xb2\\x85\\x89p,,\\x10\\x8c\\xf8)\\xd7\\xb7\\xb3diaq\\xcc\\x8d\\xb6:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb07\\xc7\\xc2a|\\xcc\\x0c\\xdf\\x04w\\xcd\\xeb\\xe4\\x82n\\x1c\\x81f\\x1b\\x8b\\x8a\\xc8@\\x13\\x9d\\xc1\\xa8\\x9bf\\x04h\\x88pf\\xba\\xec#8*l\\x89\\x04\\xdc\\x15\\xb7"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bq\\xf4\\xf4\\xdb+\\xb2\\xeey\\x8a\\x88\\x04\\xcd \\x12'\\x1e\\xd9\\xf0\\x025\\xfa\"\\xae0<\\xc8\\x87d\\xc0:\\x12\\x81\\xdfezj\\xdd\\x00\\x9f2'\\x9d\\x9a\\xee'\\xed\\xab\\xea/\\xe2\\x81\\xcc\r\\xb40_\\x070\\x16\\x14\\xf4+\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xa7\\x89\\x91\\x1fx\\x97k\\xb7\\xb8\\xad<\\xa3!k\\xe4\\x13o\\xbe\\xed\\xfd\\x13n@n\\x8a8t\\x1f|\\x08\\xc1g\\xb7b\\xc9wlm`p5!j\\xdb\\xf1\\x0b^"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xa3\\xfd\\xba$\\xbe\\xf6\\xb5\\x95v\\x82\\xb3\\xfa\\x8a!\\xd0\\xca\\xae\\x1b>\\x81\\xa7r\\x83y\\xfd\\xb5)\\x08\n\\xcc\\x7f\\xb5\\xfe\\xbc\\x82u\\x9b\\xa6\\x19h\\xa9\\x7f\r\\xd8\\x0bn\\x81\\x8a\\x07n\\xff\\xbe\\xcb\\x81~v\\xdc\\x94\\x94\\xf3\\x99\\x15\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xbc\\xf9\\xb8\\xfdj\\xdfm\\xd5' \\x98|u\\x81\\xabsx\\xf3\\xd6z\\x91\\x9c\\x13\\x14\\xa5\\xed\\xcb\\x9d\\xb4_\\xd1g\\xb7\\xd2zx\\xad\\x84\\xd1\\xef\\xf9c\\x9c\\x19\\xce"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\xc7\\x1c\\x88gp\\x1e;c\\x90uo?\\x86?\\xdc\\xbdu\\xd9\\x81\\x0b\\xba\\xc2\\x90\r\\x0b\\xe6re\\x03\\xb5\\x8e\\xde9\\x05\\x81\\x08\\xc2\\xd9\\xf5\\xb3\\x08\\xa5r\\xe0\\xec\\\\\\xffm?\\x80p\\x14\\xf6\\x86>7uc\\xd7a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xb3\\xd0\\xb7\\x18\\xbc\\x8b\"\\x87\\xe3l\\x0c8\\x98\\x14=g\\x18\\x8f\\x8d3\\x8b~\\xb2\\xc0\\x1a\\x90*\\x83\\x9a_\\x961k\\x99p\\xeb*tb)\\x94r\\x99\\xd0\\x11\\x89\""
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10d\\xb6\\x15\\xbf\\xab\\xadc-\\xed\\xa5v\\xe0e\\xc2\\xe22\\x11\\x8b\\x8c#\\x83\\x87b\\xc0\\\\xc4\\xbb\\xa0\\xd8g\\xae\\x14.\tb\\x1f\\x1e\\x9d\\xb15\\xdf\\xa4\\xc52\\xbbh^s\\x9b\\xf85ogk\n\\xb9\\x8as\\x8d\\x151\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1\\xe0mi\\x9a\\x04\\x986\\xf8\\xc4i\\xeb'x\\xe8\\xe2\\xeb\\xdc\\xf7\\xab\\x94\\xbae\\x02\\x1e\\xf7\\xbc+\\xa8\\xccwv\\x97\\x7fw\\xae\\x04\\xc4\\xaa\\xc8\r\\xea\\xff\\xe7t\\x14"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x98\\x9e\\xd4\\xe2^\\xa4\\x07\\xc6\\x17\t\\x15\\xe6\\x0b\\x81\\xe6xw\\xc0+ps\\x89\\x9fw\\xdc\n3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xb6\\xdb'j \\xe7a\\x8d\\xca\\xfb\\xdb\\xbdz\\xd5'\\xa9\\xa5\\x16\\xb7\\x9d\\xc3\\xe6o\\x0c\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x86\\x87\\x18\\xda:\\xc0u\\x0e\\x95\\x99q\\xd5\\xc3\\x87cvv\\xfc\\xd6\\x04\\xc4\\xc7\\x10\\xb0\\x99\\x05\\x83f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;l\\x85zt\\xec\\x9c`9i\\xcdr-\\x01\\xba\t\\xffjw*^\\x8a\\xf4~\\xb0\\xc5o\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xc7e\\x9b\\xde\\xb8\\xbe\\xa5\\xfcp2kna\\x11\\x89\\x80\\x17\\xf3\\xe2\\xfe v\\x1f\\xb5_hv\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;d9\\x05e?\\x8e\\xf7w\\xdd9\\xa4t\\xa7rqh_\\x06gx\\xb1\\xe5\\xfd\\xf1\\xd4\\x88\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xf1\\xa8\\xba\\x83\\xaakp\\xfc\\xdb\\x8f/!\\x9f\\xdfl'\\x91\\x92\\xecf\\xc6p@2\t\n\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;d@\\xad'\\xd5\\xe6\\xd7\\x1f\\xad\\x07|1\\x07v\\xcf\\xed\\xcd<\\xf0\\xe0%\\xc6\\x17\\x18\\xc9\\xadk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xa4\\xde\\xa1\\xccdu\n2\\xb0pq\\xa5\\xf1\\x9a\\xf8\\x19\\xec\\x1b3i\\xeb\\xafx\\xea\\x99?\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;rv\\xb9\\x0b.!\\xdc\\x08\\x01\\x9f+-\\x86\\xaf)4\\x10m\\xd1\\xa9\\x8c\\x9d\\x9d\\x99,5h\\xa3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x0f\\xc0y\\x05\\x85\\xc1\\xa8j5\\xf5y=:\\x9b\\xaf\\xbf\\xce\\xfc\\x10\\xc3q\\x15\\xea\\xcc\\xa7r\\xea\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;thf\\x16\\xdd\\xe1\\x9c\\xe9b\\x02\\xa4\\xd9\\x96\\xc8%^\\x08\\xf4p\\x81\t\\x96@\\x96\\x15 \\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x1e`;\\xbc\\x11;y\\x98\\x86@\\xb7\\x02\\xd6\\x84\\\\xf5l\\xb2k\\x88\\xe0)\\xc1\\x0f\"\\xbbx\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xc3m1'\\xdd+c\\x8f\\xd8\\x94!\\x98dd^qw\\x06\\xd9\\x8c\\xc4\\x91f\\xc5\\x16gv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;w\\xfc\\x91\\xb1\\xa7i\\xa1\\ja\\x8c:(\\xf2\\xef\\xedo?\\xdb\\x0b\\x9ab\\x86(\\x0f\\x16\\xf8\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x00\\xec_\\xf7\\x8ac2\\xa8\\x16y\nm\\xc8\\xa6\\x01pf\\xf8\\xe2\\xb6\\x99\\xa6\\x94\\x05v\\xd9\\xc2\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x10z\\xee\\x9f\\x10\\xf5\\xad\\xd4r\\x9e\\xd36<\\xb4j\\xda\\xcfwx\\xcdj\\xb5\\xeb\\x02cc\\xe6s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x95\\xab\\xe5\\x0e\\xaa`\\x18\\xe9\\xe60hm\\xaf\\xc6z\\xe4\r\\xf8\\xdbx\\xa4r\tgp\\xc1^'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x9d\\x1e\\x10b\\x06s\\xf63\\x03\\xd5zf\\x07!f\\xde\\x01\\x84\\xfb\\x86\\xb5\\x14\\xa0\\xfc?\\xe9\\xd6\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x1c\\x83\\xb1\n\r\\x16\\xd6\\x86\t\\xe3\\xc4r\\xa5\\x86\\xdf\\xec\\xf5h\\xcet\\xb4\\x8b\\x80\\x7fe\\xbd\\\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;u\\xfa\\xa0e\\xde\\x8c\\xba\\xac\\xe6\\xadl\\xef\\xee\\xfdy\\xa0\\xd6w\\xdb\\xe1\\x9b\\xb7\\xb9\\xce\\xd7\\x8b8\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xc5\\xfb-~\\x86\\xff\\x0bt\\xc5y\\xb3\\x88\\xca\\xe0\\xc8\\xbanio\\xd3\\x8f\\xd1\\x93\\xc4\\x87\\xafb\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x9fo\\x9bc\\xc3\\x82|yl\\xea\\xbc%u\\x85\\xee\\xb3\\xe4\\x84\\x85vq,\\xb1\\x87\\xd1i\\x04f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\"~qei\\xbe\\x97qm\\x00\\xb3bz\\xba\\x94\\x1f\\x84g\\xb3\\xd3\\xbc\\x8e\\xc1\\xd3w\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a\\x08\\xfb$\\xde\\x84\\xbae\\x83m\\xa6\\x16cf\\x19\nom\\xc5\\x92(^\\x96\\xa4l\\xf1\\xc0\\xa9\\xde5\\x01\\x10\\xb0l\\xc3\\x03\\x1e\\xf3%,\\xfeo\\xc9\\x1a\\xcd\\xdd!j;\\xfa\\xce\\xdd\\x10&t\\xc5\\xc5jmt\\x93\\xb02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc13\\xb9\\x7f4\\xd8\\x10\\xfd<\\x9b\\xd2\\xbb\\x85\\x96\n3\\x84\\x16\\xcf\\x06\\xb3\\xd7?\\xd0,\\xd8o\\x8cv^\\x97\\x97\\xd1\\xa0\\xdd\\x17j\\x9du\\xa6\\xb1\\x06o\\x0b\\xdc\\xa8\\x88"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4b1y\\xd7\\xa7\\xba\\xf7o\n\\xddo\\x80\\xf6\\xe5\\x18\\x0c\\xafh\\xb4\\x1b\\x8b\\xb9\\x85\\xa9*2\\xc0\\xb0\\xf8\\xbap\\xcc\\xbc=m\\xa7\\xf7fk\\x0f\\xb6\\xc9k\\xebp\\x0bk\\x8b\\xebc\\x91\\x02\\xe8|\\xcag\\x19\\x8b$\\x80\\x0e_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)%\\xe2\\xa8sa\\xd281\\x9b\\x14\\x83\\xeb0\\xaep\\xbc\\xbf\\x8b\\xc2\\x85\\xb3lx\\xc7\\x88\\x05\\x0eh@\\xc0\\x02\\xf8\\x938\\x11\\xd0x\\xd3\\xba\\x04\\xef\\x88\\x99\\x14\\xe0\\xf6"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\xde\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04q?<\\\\xec\\xdc>k-\\xd6)\\x85\\x99\\xa9r\\xab\\xea\\xf8\\xdf\\xf0\\x1e\\x8e\t3\\x82\\xb3\\xff\\xd6\\xd9;'\\xf0\\x16\\xbe7\\xb9\\xa1\\xd9\\xa6\\x8dl\\xd5w!\\x04\\x15\\xc3\\xf0\\x02\\x1e^o\\xa0~o\\xda\\x83\\xa0\\x82if\\xa7\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\xab\\x11\\xa7\\x0fwqw\\xd3\\xea0i\\xab\\xd5>3\\xfe\\x90\\xdd\\xd0\\xee\"\\xa5$\\xe2\\xca\\x8a^_\\x84w\\xe6\\xe1\\x18\\x8c\\x7fw\\x8e\\xa8\\x11\\xd9\\xe9\\xf1?g\\xfd\\x9b"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xc3\\xca\\xe5\\xb3\\x93\\x01\\xc7fi\\x94\\xcf\\xf9\\x1do\\xfe\\xaa\\xcbc+%\\x7f\\xectokq\\x96\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xa7\\x17hc\\xddha\\x00\\xc8\\xbf\\xc5\\x8b0t\\xe5\\xa4c\\xeca5b\\xce\\x1a\\xd1\\x8b\\xae\\xa9\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x87\\x1eyk\\xcf0/\\xd2:(\\xd3\\xfb\\xfc\\x99o\\xb7\\xd8j\\xd8\\xa3\\x03\\xe1\\x1a\\x11y\\xdb\\xd7\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xe6\\xa3e\\x10k\\xe3j\\xb6\\xe9~q\t$\\xe5\\x10\\x16?\\x14o\\xcd\\xbamq\n\\x98\\x83\\x15\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x8b0\\6\\xc7_\\xcf\\xc7\\xb8k\\xad\\xafre\\xe6\\xe2\\xf1z\\x0b\\xfcp\\xf7:b9\\x08\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\x7f\\xcc\\x8f\\xbc\\x05\\x08\\xbc\\xed\\xa9\\xfd\\xfclm\\xf7\\x10\\xd6\\xf9\\x86\\xe6\t\\x01\\xf00\\xbdc\\xd6\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89.q\\x89\\x9b\\xa2r\\xea\\xdby\\x9ed\\xcd\\xef\\x98q\\x1e\\xe0%:\\xd8\\xa1\\xdd\\\\x89\\x9e4\\xce`\\x84\\x87\\x069j\\x11\\xeaxj\\xc3^\\xa8t\\xefm\\xf9\\xc4\\xc1w\\xf9i\\xe3\\xa3\\x10\\x1c\"\\xf6v\\xb5\\x1a\\xd0`-\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\x9du\\xe5\\x10\\x88\\xda\\xcc\\xf0\\xfe\\xa2\\xa2 y\\xec\\x9f\\xfd\\x0e\\xb5\\x7f\\xf1\\xc3u\\xc2@\\xd4e\\xae8x\\xef\\x16\\x96\\x02\\xba\\xef\\xb1^8>\\xbe\\x92\\xed\\xe8\\xcd;\\xff\\xd0"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\xb2\\xc8\\xf3m\\xbc446\\xbd\\xc5\\xf9#\\x10\\xd5\\x07\\xea\\xe3\\x0fj\\xe4\\xc9\\xab\\x01\\xffk\\xd9\\xb7\\x8d\\xc1\\x1d|a\\xba1*\\x10\\xd8\\x83b)\\xd0\\xb8\\x9a\\xa0\\xa2\\x11\\x1e\\xe4\\xe1\\x019)uo:\\xe0l\\xafk\\x19\\xfbb\\x95br\\x0cq\\xa8\\x86g\\xbc\\xde\\xc2\\xd2\\xcc\\xf5~\\x864k\\xa1\\xdf\\x85im\\x0c\\x18\\xb3\\x9d\\xf0\\x9bwn\\xcc\\xcf\\xdb\nj\\x03\\x85$y\\xe0\\x11\\xbe3#&^<\\xda\\xc9\\xad\\xe2\\\\x9b\\xca\\xe6\\xa8x\\xbb\\xcc\\xf9/y\\xb4\\xc2\\x85\\xcdh\\x8bsm\\x0e\\x01y\\xedzm\\xdb\\xed\\xbb\\xb5\\x1d\\x0b\\xc0rw\\xa7'\\xc9\\x98f\\xd6\\x1c\\x01\\xc7\\xf4c\\xed'\\xad\\xa04\\xad\\xc7\\x8ay\\x97\\x8et\\xf6\\x1fai\\xf26\\xd0\\xc08v96\\xad\\x08ub\\xe3\\x98\\xc1gfv\\x9c\\x05%\\xe1\\xe1\\x89\\xa1\\x9e\\xbe\\xdd\\x1b\\xc0+\\xfe\"31\\xa4\\x86\\x8e\\x83\\x8d\\xce\\xf4ix\\xfa\\x99\\x95|\\x0fm\\xdd\\xb3\\xa7=\\x9a\\xbf\\xb3\\xee\\xa5\\x8b^z\\x86\\x99\\x9c!\\x8b`\\xa9\\xb9\\xc6\\xbc"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x1a\\x1a\\\\xef\\xbda\\xe3+\\x11:\\xff\\x80\\x01.\\k\\xeb\\xddu\\x8fo\\x03\\xa2\\x0f\\xf2\\x93,\\x80\\x8c\\xc9\\xfeu! c\\xff\\xb4\\x0cm\\x9eb\\xe1\\xe1\\xe1\\x1a9p\\xeen\\x12\\xa9t|n\\xdf\\xdd\\xbd\\xd7\\xf8\\x90\\xf3skux\\x1b\\xcf\\x1c$f\\xbe\\x87\\x1bf\\x96\\x8cpqgb,e\\xe1\\xd3\r\\x9f<h\\xab\\xc9\\xe1\\x1f>6\\x8a\\xfa\\\\x0b\\xb8.i\\x94!r\\x8f\\x9a\\x03\\x88\\x07\\x86\\x00m\\xa5\\xb6\\xca\\xa3\\x99\\xa5\\x10\\x05-a\\x85\\xff\\xc8\\x90pk\\x068\\xa6\\xc4@g\\xe0\\x93\\x07df\\xa1\\x93\\xff4uk\t\\x93\\x98\\x84\\x15\\xca\\x91y\\x10|\\xee\\x0e\\xbf\\xf0~\\xc7e-\\x9anag\\xb7\\x0f,\\x8do\\xf2@:\\xdew;%\\xa2\\xfc\\x12\\xd8\\x9a\\x80\\xf2a\\xd8\\x08\\x97o\\x92\\x9en\\x81r\\x1e\\x91\\xad\\x13r\\xd9l\\x1d\\x01_\"ge\\xd3\\x98\\x87\\xf0\\x1aj\\xddl\\xf0s\t\\xcdv1au\\x0e\\xa1v\\xa5hb4hf\\xe7\tdj\\xfc\\xab\\xbcs\\xf54"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\xf5\\x8d\\xc7? \\xf6\\x98\\xbe\\x12s\\xb7\\x96h\\x82\\xc8\\xb1\\xbf9\\x84v\\xfe\\x9ew\\xc7qqsm\\x95\\xaf\\x9b\\xe0!\\x94\\xc7aw0b\\x1b\\x18f\\x06\\xdfz\\xb1\\xd4b\\x86\\xe0`\\x86\\x8a\\xa4f\\xb5\\x06\\xe0e\\x8aq:\\xd5\\x92\\xdaq\n\\xcf\\xe6\\xd2\\x1d\\x04\n\\x96\\xac$>v\\x10\\xef\\xa1!3ni\\x18.9\\x04\\x9e7\\x1cf\\x1e\\xa5k\\xead\\xe7\\xa5\\xcb\\xfa\\xc0\n\\x82\\xd8\\xd1\\xf5\\x1au\\xaf\\x90~\\xf6\\xcc\\xfd\\xa9\\xb0\\x89e\\x0b8\\xbc\\x0e\\x8b\\xd0\\x9bva\\xef\\xe0\\x0c\\x0b\\xa6\\xe2y\\x18\\xeel\\xb7\\x03n2b\\x97\\xca%\r-\\xd3\\xfb-ds\\xfe2^ig\\xf0\\xfd\\xbf\\xd3\\x83ve\\xd4#\\xe2\\x18f\\xd8)&3\\xb0k>m\\xf3\\x96\\x04\\x99\\xad)\\x03\\xfb\\x1e\\xab\\xa4k\\xbf\\xe1\\x7fn\\x9f\\xe9\\xb0\\xb5\\x0f3k\\x9c\\xa7ah\\x8f\\xdc\\xcel\\x8cy\\xfa\\x8c\\xf8w\\x80im\\x10\\x87!\\xc0\\xd2\\xa8z\\x1bu\\x9c\\x9f\\x9d\\x8e\\xe5\\x9aq\\xa1\\xb9\\x9e~\\xee\\x85\"\\xd6xg5\\x9a\\xf6"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x88^\\x83\\x0e0\\x0c\\x0e\\xb3\\xe4=$\\xdb\\x0bo\\x14\\x9cw:r\\x83\\x14|u\\x0b\\xc9\\x97h\\xb8\\x89\\x8fq\\xd4@\\xd1\t\\x9c\\xbfl(8n\\xe9\\x82h\\xbamw\\xf9\\x1e\\xb7x\\xd2\\x98\\x1d\\x17\\x08\\xba\\xa4\\xf83yw\\xd5\\xda\\xad\\xea\\xbdm\\xcc\\x0fe\\xf45\\x8a\\x17\\xf7\\xa9\"\\x8c1\\xdbd\\xed\\xaa+vf\\x99\\x9b\\x19\\xf6b\\xa7o\\x8en\\xdbyj$\\x13\"s_\\xf5\\xbb\\xda\t\\x86^\\x15\\xb6\\xfa\\xb0\\xecn\t.\\x8a\\x1f9y?\\x0c\\x9c\\xdd\\x05\\xd6\\xf21\\x80c+\\xcb\\xb3=\\xe5\\xcd=z\\xab\\xda\\x13tt\\x86s\\x06sb'\\x12*d\\xf5\\xd2\\xf06\\x9f6\\xd5\\xc0\\xae\\xa1sf\\xfe\\xbf\\x17$:x#*\\xc1\r\\xeck\\xa2\\x8a\\x9f\\x17\\x15\\xa0yv0m\\x14g|\\x1e\\xa9\\x7f\\xdd\\xa3\\xe7&\\x88\\xfb\\xe8\\xe2\\xfej\\xdf!\\x7f\\x82\\x07\\xaej@h<m\\xfe\\x89\\xf7\\xcb`\\xc5\\x945\\xdc\\xd1z\\x8c/-\r\\xc1\\xcd\\x88f\\xae\\xa0\\xf5\\x93\\xbc\\xe7e\\xbd\\xd0\\xfb\\x0c\\xe8\\x13\\xc0\\x0fn\\xb3"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;3\\xf7\\xe9\\x03\\xb1k>\\xe7,\\xc6\\xb0\\xb6/\\xe5\\x91\\x1b\\x04\\x18\\x0f'\\x04y\\x08\\xe1\\x11\\x8f\\x9d\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010md\\xec\\x9a\\xf9\\xedvv\\xfb\\xe0\\xff\\x13\\x1c\\xae\\xcbx\\xb4l=/\\x13i\\x83\\xaa\\xb5\rf\\x95e\\x88\\xc2\\xe6\\xb5\\x14\\x15\\xba\\xb9\\xa3\\xb1\\x1a\\x158\\x90\\xb4\\x03\\x17\\xe7\\x9c\\xaaj;\\xd8\\xa6\\xb3\\xa2d!\\x1f\\xc1\\xdd\\xed?\\xdc\\xea\\x00\\xc3\\xe5o\\xc6\\x0e\\xd7\\xa8\\xd9ti(a\\xdd\\xee\\x10n\\xcc!\\x18\\xc6\\xf8x\\x11\\xc0\\xbf\\xbb\\xfe\\x97\\x0c\\xeb\\xe1@\\xe74\\x90u\\x83^\\x1f\\xe2_@\\xff\\x7fg\\xf1\\xfc);\\xaf0\\x85\\x13\r\\xacg\\xc7\\xc7\\x1d7\\x9fs\\x17\\xe4g\\xec\\x08\\xbb\\x00\\x1e\\x99d\\xda\\x9cu\\xa01\\xdc\\x98\\xa5\\xa7'\\xc3,\\xa7cc*\\x1epemoe\\xdf\\xf6\\x88\\xa0u\\x94\\x1c\\x95\\xa2z\\xdb\\xc8/\\xf1ht\\x9aj\\xd1u\\xcb\\xc4rc82\\xc5\\x07\\xb2\\x92\\xf9 \\xc5\"r\\xa9\\xad/az\\xc6\\xad\\x12\\xd5\\xc5\\xb5\\xc0\\xffk\\x9c\\x9d\\x1bg3\\x86\\xe2\\xf3\\xad\\xcd\\x8b\\x9ca\\x91\\xa8\\x98\\x84\\x8f\\x13|\\xdc\\xb2n\\xe9\\x86\\xad\\xf5@j_<\\xa4\\xc7\\x17k\n\\xc7\\xd7"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\x05\\xfcq\\xee\\x95\\x83\\xff\\x0b\\xc0\\xf5w\\x84n\\x82\\xe1r\\xf8\\x1c\\xae\\x01m\\xaa\\xbb2<\\xb2\\xd9\\x9a\\xe8\\xf3\\x0b\\xcd\\xde\\x80\\x1d7%#\\xc2t\\x14\\x89\\xec\\x85\\xdfd\\xdd\\x1eui\\xb8\\x90\\\\xb9\\x08%~\\x89\\xca\\xd9td\\xffot\\x91b\\xa0\\xb9\\xc9s~\\xe8\\xcb\\x16\\xa1\\xfb\\x96\\xdd\\x160\\xde\\xe8.\\xffi!kc\\x0cg\\xc8\\x9d\\x18\\xdd\\x06\\x97`y\\x1d\\xdf(\\xd8b\\xbe\\xbd\\xd4\\xd5i~.\\x88,j\\xeb\\xd0\\xc6\\x99z\\x18\\xad\\x0ewa\\xef \\xe5\\x95&x\\xb6\\x8ar\\x90\\x04\\xc9f\\xf7_\\xda\\xb4\\x9d\\xe3\\x11\\xba\\xf6\\x0el\\xf6\\x9ed#u\\xca\\xa6\\xe8\\xf8\\xa9\\xd1\\xf7\\xc5p\\x1ff+\\x1az,y\\xdb\\x93qyr\\xc1\\x0b\\x85\\xa8\\xad\\xf0c\\x19\\xaf\\xe1\\x7f\\xc5\\x91\\xcd\\xf9mj\\xea\\xbb\\x87\\xebq\\xf2\\xd00\\x02\\xe9\\x90h\\x7f\\xa9,@\\xb7h\\xbc\\xb2\\xd28h\\x1b3\\x15z\\xf9\\xbdr\\xce\\x10\\x13\\x89h\\xdc\\xd1\\x9a$h#\\xa5\\xfb\\xc0\\xdb3\\xa8c)\\x07\\x87h\\xafkq.\t"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xcc\\x14;\\x8f\\xd3\\x89~\\x17\\xfcnkes\\x87\\xf4\\xfa\\x8a\\xbd\\xcc\\xab\\xb3\\xa6h\\xdf,\\x85\\xac\\x9c2&\\xda\\x15\\x8f\\xa1\\x8c\\xba\\x9d\\x8fp\\xf8\\xb0\\x84\\x97\\x17\\xac\\x8f\\x8b\\xee\\x9e\\xb3s\\xa5\\xed\\xb5\\xef\\xdau\\xd4\\xd2\\xbf\t^\\x9b\\x0c\\x9e\\xb6\\xd5\\x80o\\xb0\\xda\\x02|q+\\x89\\x0c%j\\x1d\\x12\\xa1\\x95\\xa6\\x90n\\x9d\\xc8ra\\xca\\xdf\\xeb\\x13\\x13\\x8du2\\x8e\\xe0\\xc8.\\x9bx\\xd9\\xacp\\xb1n\\xad\\xbf!\\xd3q\\x9b\\xba\rk\\xf7\\xc8;\\xf9\\x90vn\"gi\\x80\t\\x14\\xe9\\x12\\x8e\\xc7\"\\xed+\\x13t//@4(\\xd0\\xb3\\x10\\xaf\\x92\\x1dmw\\xe5fcd\\xf9#n!\\x10\\x8e\\xaf\\xcd\\x8c/>\\xd6\\x7f\\xc6\\x92#m\\xa5p\\x7f\\xa5\\xe3\\xc0\\xc7\\xcb\\xdcg\\xa2\\xeej\\xdb\\xcf\\x87\\xc4\\xeeu\\x07\\xefb\\x984x\\xee\\xd0\\x1bh\\xbev\\x19,\\x945\\xae\\xec\\xfa\\xbf\\xa52ok\\xfa\\x191\\xe4k\\xc8'i\\xed\\xb39\\xac\\xa5d\\x1c\\xa3\\xa4\\xac$!gw\\xd3\\xb0\\xd6\\xd4\\xbe\\x82\\x9d\\x86"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\xbf\\xffa\\xec\\xae\\xb2\\xc7\\xd1\\x9cb\\xb1\\xab\\xb1\\xfan\\xfbh`g\\xe5\\x7f\\x9a\\xb0\n\\xd7\"\\x19i\\x17\\x92\\xd2f\\xa0\\x18\\xa0?\\x92\\x9d4\r\\xd4lmdtl\\xbee\\x03n\\xf1\\xd6p\\x06\\xa8\\x84o9\\xcd\\xf5\\x9b#s\\x91l\\xff\\xab\\x95\\xb2hw\\x10\\x01z\\x91\\xd9\\x0bq\\x182 #(e\\x8c3\\xc4\\xbf\\xbe\\xbc-\\xbao|\"\\x19\\xb0\\x7f\\x05\\xbfr\\x0f\\xf6\\xc1\\xf2\\x11d@#eft\\x8a\\xe4,5\\xc5\\xd0\\x9c1.n\\xae7\\xea\\xdcer/\\xec\\x87\\xa4\\xe3\\xe2 \\x81\\xce\\x93\\xe2!(\\xa9\\x95\\x99\\x90\\x8dp\\xe3\\x02\\xf5ij\\xdfc0\\x86\\xb2smb\tbkh\\xea\\xc4y&$51\\xad\t\\xd2;a\\xca\\x15fl\\x81\\xbe\\xfa\\xd9d\\xa35\\xd8i\\xd7/\\x00w!l\\xf3=\\x00m-n4\\x9b<\\xd2\\xc0\\\\xd8m\\x9c\\xc2\\xff\\xc5\\xc6\\x82\\xff\\xe6\\x0c\\xcc\\xeen\\xdf\\x023hi\\xb2-\\xb1c\\xd6\\xd6\\xd4h\\xf3\\xcf\\xf7\\xe2\\x85\\xd0\\xdd\\xc5\\x05j"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;!.\\xba\\xfa\\x1b0\\xea\\xa6ze\\xfbha`bc^\\xe7r\\xe5\\xe7\\xbej\\x8d\\xc68\\x0e\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;\\xfa\\x17w\\xc9y\\xfc?ob\\xa0\\xd6\\xc2\\xbc\\x98fp3\\xcf\\xd8\\xb6;m\\xdaimfdk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;a_\\xb1zp\\xaam:\\xee\\xb5l\\xb7!\\x9ahj\\xff\\xb4f\\x0f\\x19\\x85\\xab\\x7f6\\x9a\\xed\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$\\xd6;^|\\x8f\\xd9\\xe5\\x0f;(\\x92\\xb6\\x04\\xbc8x\\xb4\\x7f\\xa9h\\x8ce\\xdcyu_\\xae\\xc6\\xc3c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\xbc\\xa8!x\\x04o)\\x88\\xb7\\xa2g\\xfa\\xd2\\xdb\\xab\\xe6\\x98o\\xfb\\x8d\\x90\\xc9\\xe2\\xd0\\x00\\x9d\\xf7\\x80\\xc4\\xaf#\\x87\\xaab\\xe1\r|\\xeby\\xa1a\\xec+\\x0f\\x89\\xa9\\xa0\\xc1\\xb9\\xa6\\xba\\x00k\\xffs\\xebt\\xd0\\x80\\x0e\\xeac\\x9f\\x86g_v9\\x8d\r\\xb9\\xe0\\xf0a\\xcd\\xb1\\x86\\xd5\\x15s+\\x14j\\x1a\\xafg\\xf3\\xa4\\x8a\\x1b0\\xf1d\\x1ea\\x8b,\\xc1\\xd9y\\xf69q\\xfb\\x9a\\xd8b\\xc3\\x15\\xe0\\x8e\\xf0`fi\\x88\\xeap\\xbe+\\xe0\\xf3c\\xf3\\xfe\\xdd\\xad\\xba\\xfe\\x83\\x03\\xde\\xf8\\x92e|b_\\x9b+xq?(>\\x9b\\xa3eeq\\x00b\\x07\\xc3/\\xb2+\\\\x92\\xf1\\xbb\\xc4\\xff#\\xbe\\x05xj\\xb3\\xff`i\\xe8y\\xf7\\xa7,n\\x1e\\xfet\\xf2\\x8a\\x97y\\xed\\x9a\\xfaop\\xf1\\\\xa5hq#\\x84\\xad\\xaf\\xfa:\\x8f\\xab\\xe8\\xc8$\\xa4\\xc44%\\xac<\\xf1+\\xad;\\xa7\\xa9-\\xd2\\x0e'\\x98\\xa7\\x86\\xc1\\xf0j\\xcc\\x1a\\x85\\xfa\\xc3\\xa8\\x93\\xec\\xb5\\xcd\\x99f\\xbexv3(\\xe9t\\xd2\\xf6b"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x841\\x96\\xd7\\x02\\x9b9\\xa2\\xc9\\xfdc\\x15&@\\x14\\xcd\\xe7\\x1f\\xce\\xd4\\xcc\\x83/\\xeb\\xec\\x04\\x9e\rd\\x81\\xd8\\xb3!\"\\xeb\\xa8\\xb7\\x85\\xe2p\\xd4\\x1efcj\\x8c\\xde\\xf3s\\xa8\\x95\\x8bo\\x0c\\x1a\\x96\\xfcpp\\xf4r\n\\xcd\\xe0k\\xb9\\xc8u\\xccq\\x1bcw!\\xadu\\xdb/5\\x9a\\x96k\\xbf\\xabyr\\xcb\nb\\xfb2\\xa8ff\\xc1\\\\xe7\\x9a\\x94\\xec+\\x9eg~\\xeb\\x03\n\\xc1\\x9a\\xb9+\\xbd\\xd5h\\x9d;\\xac2\\xff3\\xd8\\xac\\xe5\\xf7~c\\xb1\\x97\\xc3\\xc3\\x9c\\xf5\\x899\\xab\\x9f\\xae\\xc8\\xbb\\xbb0\\xdb\\xa2\\x1a\\xb1\\xd6\\x9ac1\\x96\\xf3,*\\xa1\\x8fi\\xe7\\xb0\\x99\\xef\\xbf\\x06\\xf6s\\xeer\\xf6\\xb3\\xb4c\\xca\\xd4.\\xcche\\xbc< f\\x0c\\xb7\\xae\\x04\\xb4i\\x93$=\\xc2\\xfad?:\\xa9\\xcc\\xf5\\xb9\\x08%\\xb6\\xc5\\xee\\xd2\\xc0\\x9f9rb\\xe9~k\\x9c\ti\\x9d\\xd8k\\xb8\\xd5\\x05\\xa0\\xd7lv\\x0f\\xdb\\x1f^\\xf0$\\xbfv\\xae7-\\xfby\\x97\\xf9n>\\x05\\x16\\xd2\\x93"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8t\\xa0\\x18\\xc0)\\x16\\xbe\\xc6\\xdd_\n\\x85l\\xe7a\\x1e\\x13.\\x81'\\xa1\\xdav\\xfa\\x17d\\xb2\\x18\\x19i\\x8e\\x9a\\xef\\x0er\\xe3\\xed\\xf31\\x1b\\x13\\x97\\xff\\x11`r\\xfay\\x95+\\xa2\\x91t\\xe5\\x13\\x07\\xdc\\xd9\\x91\\xa2`\\x1d\\xc2\\x16y\\xbc\\x19\\xa8\\x0c\\xb4\\x1ceg=\\xae\\x00y\\xba`\\xdd\\xbax\\xad\\x148t\\xbaw\\xa0\\xd7\\xfff\\xd9p\\x1c_\\x84\\xc13\\xd7^\\xb8y\\x997\\x9b\\xe4(i\\xea\\xf3\\x01\\xcc\\xc0\\xbb\\xbe\\x1b$-p\\x81p\\x12\\x9f`\\xddd\\xe1\\x0f\\xcd^<\\xa0\\xe9\\xa9\\xae\\x8dy\\x84\\xf2\\xd0\\x17i\\xefz\\xf2\\x03iwf\\xfcs\\x19\\xe0\\xc9\t\\xf6a\\x86\\xae\\xea\\xe0>\\x7f\\xaa\\xa9\\xae\\xbc\\x15\\x80\\x1b\\xaeo\\xbev\\xc8\\x9b\\x80\\x14\\x1c\\xee\\xd6\\x85'c\\x90\\xde\\x18\\xeb'u\\xa22\\x87|1\\x96\\x1a\\x8a\\x04\\x05=\\xab\\xa5p\\x9c\\xb0+m\\x90\\xb7\\xae\\x08bp2\\x8e%\\xc0\\x17n\\x83\\xa94|\\x9b\\xae\\x06\\xe3\\x89\\x8a\\xfc^\\xd6a_\\xfe\\xf6\\xf2p\\xbf3\\x19vm\\x84w\\"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vq\\x8d\\xc9\\x1a\\xeen\\xe4\\x01\\x15\\x1a)\\xefa;8n\\x8f\\xa2~\\xbf\\xc4\\x87w&-|\\x84\\xafk\\xec\\x9apf\\xfe\\x1d\\x0bf+\\x11^\\x19,\\x93t\\xf2\\x11\\xb9z\\x87\\x14\\x1e\\xc70\\x15\\x92\\xb3\\x19\\x0f\\xfb\\xc8\\x98o\\xaa\\x9b\\xbea\\x9b\\xf4\\xcbp\\xe7\\xd52@\\xc9\\xa7m\\x9cwxd>\\xbb\\x98\\x8a\\x1d\\xd9\\x10z\\x975\\xed\\x05\\xd2=g\\x90i\\xc7\\xf2\\x13\\xa39m\\xc0\\xda\\x95\\xf1b\\xd4\\x8f+n\\xb1\\xa6\\x99\\xff\\x03u\\xc4g\\xda\\x19\\xf8\\x95z\ta\\x9co\\xa7p\\x0c\\x9da5q`\\xab\\xb4f\\x82\\xee\\x9fn\\x90\\xe0\\xf2\\x99\\xc41n\\xe7\\x19\\x02\\xfdc\\x9b\\x82\\x04\\xb1\\xb8\\xa1&\\xd9\\xebz(\\xa7r\\x00!2\\xf6\\x9e\\xb2\\x1a\\xf8\\xfc\\xb10\\x0c\\xa2p\\\\xbb\\xa0\\xee\\x1d\\x7f\\xc9\\xc1\\xa5\\xfd\\x15\\x00\\xc4\\xd9,\\xf2\\x0e\\x92g\\x8c\\xeb\\xb4\\xd3\\xcaq\\x98-@\\x1da\\xa2*\\xf0hm\\x95\\xec\\x00\\xab>b\\x7f\\xf7r\\xff\\x9d\\xf5c\\x9bg\\xbeb\\xd0\\xf5\\xdf\\xa8\\xb3's\\xa4"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe2\\xa4\\xa4n\\x8bl\\x18\\xbf\\x1c'\\xbc\\x9e\\xb4\\xcd\\xaa\\xe5\\xa3j\\x13\r\\x87x%y\\xd55\\xe6\\x1d\\xa3\\x9ad\\x053=\\xd5\\xf9\\xed\\xb4f\\x9c\\xf9i\\x9a/\\x056\ny\\xf3\\x1f\"\\x02\\xd0\\x9e%o\\xa7\\xee\\x8fn\\x8a\\xc6\\x9bp\\xd6\\x86\\xe0^4e\\xc6-\\x00\\x8c\\x9d\\x99\\xe1\\xc12\\x05\\xd8y\\xe9\\xe2\\x05\\xf6\\xca\\x91\\x0f\\x0b\\xabk\\xd8uvcc\\xd7\\xc3=\\x9e:\\xb5x\\x98\\xaf\\xe7\\xdd\\xc9\\x9b\\xd9s\\x89\\xf0\\xde<\\x18x\\xab\\xb3%xe\\xb4\\xecox\\x99|vj5\\xe9\\x03\",\\x92 \\xdf \\xad\\xff\\xddvct\\xb1\\xce\\xd0\\xf1\\x16\\xdd\\kqbp\\x8e \\xec\\x7f\\xf9\\x7f?\\xd3\\x14v\\xc91\\xd4g3\\x80\\x99j\\xff\\xca\\xb1\\x92\\xfa\\xdd\\x86\\x1f\\x1a|\\xa0\\x9e\\xdf\\x89\\xd6\\x97\\x17\\xc6\\xdf\\xe8\\xfcp.\\xb5q\t\\x17\\xfd\\x97\\x08\\x01\\xcd\\xacs\\xf1\\xdd\\xd1a8\\xd3;\\xfa\\xdey\\xb4u\\x9a\\xb19hw\\xff\\xbf\\xc2\\xdc\\xf8i\\xeej\\xb6/\\xf1\r\\xea\\xa2\\x82\\xd7\\xefr"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\xf7\\xffg7\\x02r\\xc7\\xc6r\\xb1np@\\xa3\\x1c\\x0f\\xf8\\xfa\\xd7\\xd7\\x80\\xbe\\x10\\xd1)5\\xb6_\\x88\\xb6\\x07`\\xd6g\\x94\\x10\\x11\\x82\\xe7ep\\xd7j\\xa5\\xe1\\x1c^+\\xde\\x04\\xd9\\xab\\xe0o\\x8f\\x9b\\x85\\xa6\\xa9\\xed\\x10\\xf4\\xff/$\\x0fi,6/\\xb7\\xaa^\\x93\\x01<+\\xd0f\\xc1y\\xdap\\x17\\x951\\x9f\\xd6\\xb4\\xce:?5j\\x90f\\xd5#\\xa3\\xf4\\xd1\\xc4\\xf0\\x85;\"q\\x9b\\xba\\x88\\xb0-\\x0ce-\\xa2\\xe0\\x85\\xb5;\\xf6\\x8a\\x1b\\x00\\xaf0\\xea\\x02\\x86\\x8d\\xf5xp\\xda\\xed\\xbdj\\xe0\\x8a8@\\xa85\n\\xa5y\\xc0\\xfa\\xb7\\xad\\x11\\x1d\\x9dd\\xeb\\xc9\\xb1bg\\x05:9\\xea\\xa4\\xb2\\xb9\\x82\\xa6\\xe3\\xf5\\x92\\xa4k\\xab6\\xc0\\xc1\\xcag\\x9e\\xcb.n\\xfc$\\xef\\x9f\\x8b\\xc8l\\xb8\\xb2b\\xa9\\x93\\x87\\x11\\xe9\\xbb\\xd8\\xc6\\x1a\\xfc\\xa4\\xa4#s\\xc1\\x18\\xf4\\x94l\\xb6%a\\xe9\\xca\\x0b%\\xfa)\\x9bu\\xf28\\xdch\\xab\\xd9\\x0f-\\xf6!\"\\xda\\xeb\\x13\\x8d\\xa4\\xa3\\xe4:\\x8e\\x1af^\\xef"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\x1f\\xa2\\xde\\x00\\x8f\\xdeqz.\\xe0\\xd9\\x14\\xe4je\\xf5|\\xa7\\xce\\x7f\\x12&(%u\\xe7dm7\\xf9\\xb12\\xcc\\xe4\\xbf\\xb5\\x87hl\\xcd\\xad\\x02\\x11,\\xcc\\xc2c\\x882\\xde\\xed;\\xd8\\xf9j\\x17,\n\\x1b\\xddb\\xb7\\xfc\\x0fed`\\x10\\x15\\x93p\\xda\\xd8\\xcb\\x04w\rr_t\\xadp\\x86`7\\xd8z\\x15\\x8d0\\x01\\xc7\\xa84tfojc=\\x841\\xf4=\\xf7\\xaa\\xd7\\x7f\\x9ap\\xb60zcu \\xa4\\x00;\\x0f\\xaf\\xf5s\\xd6\\xd4\\xe0\\x83\\xe72\\xae&\\xa2\\xe4\\x12\\x16e\\x94nv>\\xd5sf5\\xfc\\x9f\\x88\\x96\\xe8\\xca4p\\x0e\\x9a\\xc2\\xe6\\x91\\x82\\xb6\\xd2\\xaa\\x11\\xed\\x01\\xbd\\xd3g\\xa5@\\xd3\\x97b\\xf5$\\xb9\\xef\\x1a\\xe1cs\\xd0q1n\\xdb\\xbfw\\x1eg\\xde\\x983\\x95\\x8e\\x91\\xf4i\\x0cu\\xb1\\ak\\xe2\\xc4\\xa7\\xd7\\xe9$\\xf5\\xe2yq8+\\xcf\\x08m#\\x9b\\xab\\x1cm\\x107\\xeag\\xac\\x86oh\\xaa\\xf0\\xdc\\x02'\\x92\\xec\\xf2evl\\xa1"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xa6z32bx\\x12q\\xcf\\xe0j|\\x06\\xd2\\x96\\xd5\\xb4q\\x11n\\xaa\\x01\\x8a\\\\xbd1i\\x14\\xce\\xab\\xa7\\x14zp\\x1c\\x05l\\x10\\xaei7\\xa5\\xa7s\\xde(`\\xc3\\x1c\\x14o\\x1a\\xa3n\\xbb\\xe5\\xdc\\xc17\\xcd\\xae\\xcd#\\x88s\\xdd\\x0bhp\\xbe\\xc4\\xce\\xf5\\x8cd\\xd6\\x03\\x08\\xf3\\x9d\\xd4\\x9a\\xc0\\xd9\\x8c\\x97~\\x91\\x9bx\\x7f7\\x1f_\\x93\\xb7\\x11\\xb1/\\xb5f&\\x15\\x1e\\x12\\x97\\xe3\\xe5\\xe0f\\xb6\\x99\\xbed\\xb1\\xd2\\x94\\xa3\\xf3*\"\\x03lmq\\x1c\\xc9\\xd8&\\xc2hv\\x96\\xf6h %\\x8e2\\x9dw\\x04\\xd4&\\xf5y\\x00\\x00)\\xd4|\\x0bz\\xe7\\x7ftxp\\xd9\\xb6\\xf4\\x16\\x8a\\xf5\\x8b\\xfc\\x98\\xda\\xa7m\\xde\\xe795\\x8f\\x91w\\x8b\\xffa\\xef\\x11\\xfc\\x95\\x86\\x8c\\xdcj\n\\x16c\\x0f\\xff\\xfc\\x18\\xdc\\xcf\\x9bj\\xbco\\xcewj\\x07f\\xecn(\\xa2\\x13\\xf7\\x8d\\xaf\\x88\\x9d\\xf6d\\x1d\\xcd@ws\\xfb\\x8dnx\\x0c\\xab\\x17\\x89pnm\\xd8q\\xee\\xdd-\\xe5\\xc2\\x00\\xdf\\\\xd2\\xd1"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\x9a\\x10\\x1c\\xc5\\x08\\x15gf\\x19\\x97\nw\\x12)x\\xa6rw=l\\xe4:\\xb2&\\xad\\x84\"w\tvs\\xbevs\\x01p|p\\x1e<!\\xb04\\xf7_\\x8c)0\\x18\\x10f\\x1a\\xd1\\xd9\\xff)sn\\xae\\xa5*=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4j\\xfe\\xddxf\\xd5o\\xee7\\xc00`\\x8f\\xc7t\\xdad\\xaa\\x18\\x7f\\xa9n\\xa8\\x1d\\x8d\\x1d\\x03\\x05b\\x9a\\x99\\xa1\\x99=v\\xc1\\xe9e\\xf7$u\\x86\\x150\\x90\\xedv"
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8am%`\\x1f\\xe5\\xbe\\xe4\\x8bk'b\\x9a\\xc2)&e\\xb9\\x17=\\xfd\\xe53s\\x15\\x04\\xd4:\\xa2\\xbe\\xe8)\\x8f\\xce|\\x1e\\x89\\xf2|\\xfe\\xd2\\x1c\\xf2\\xc9s\\xeb\\x16x\\x8d\\xb9tj\\xfc\\x8d\\xe9\\x9f\\xdc\\xf2y\\xec\\x9dv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\xcf\\xd74\\x04\\x04\\xfdej\\xfb\\xee\\xd6\\xb1\\x9d\\x0f\\x99\\x1b\\x8f\\x98\\x9e\\\\xd15\\xa5\\x19f\\p\\xef\\x11xoa+\\x0bus\\x83\\xdd\\x1e\\x80i\\xcf\\xed\\xd1"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046\\xe4\\x11_\\x009\\xf3.x\\xf8m\\xcc\\x15s\\xdd\\x01\\xd4\\xc0-\\x8b\\-\\xbd\\xa6\\xbe\\xb5\\x06&ex\\xb6(\\x19\\xa9!5\\x85\\x16\\xdd\\xcd\\x0e\\xad\\xa6\\x08\\x0b\\xe3h\\x83\\x9c\\x18\\x7fn\\x93\\x10\\xfbv\\x00\\x90\\x9d\\xdb!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd4\\x13\\x9fl\\x0b\\xfc\\x05k\\x91\\xc4\\x1d0\\xaa)\\x1e\\x97\\xefc\\xf0\\xb7\\xe95\\xa7up\\x15/\\xc4\\xe3\\x1ceg\\x9eu\\x0bg:h\\x8c\\x1eue\\xa6\\x11>\\xc4\\x85"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1cvu\\xc1j\\xdc\\xa6i\\x92j\\xfc\\x9a\\xf3l\\x9e\\xb6\\xcel\\xf1\\x1a\\xbfp\\xa3\\xc8`\\xd8\\xaf\\xed\\xbe\\x1e\\x1d\\x8b\\xdb\\xa6qm\\x8b\\xb5\\x18e\\xfbm\\xea|\\xd4z6\\x85\\xdd\\x14>r\\x94\\xd7`\\x84\\xd38\\x1d\\xad\\xa8k\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#)\\xcd\\xa2\\xa1\\x86\\x80o\\x92m\\x0f\\xf0e\\x11\\xe3x\\x94/kt\\x0b\\x10\\x18|\\xac\\xd5\\xd4\\xe6\\xc4a\\xd1,o:\\xb2:.m\\xa3$\\xe3c\\xee\\xd6\\xe6i\\xd2g"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6sjy\\xef*\\xe5\\xce\\xe0a\\xb2\\x80\\xcf\\xd9q+\nz\\xf4h\\xaa\\x14\\xe0\\x18\\xefu\\x90\\xa87\\xbc\\x02d\\xa8r2\\xaf\\x15\\x0fs\\x7f\\xeag\\x96\\x1d\\xd3\\x8fh\\xf5\\xd3\\xdd\\xa8\\x82\\x8d\\xaa\\xf5\\x981\\xa6\\xab/\\xa5\\x13\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xabm\\xd4\\x84:\\xee&\\x0e\\xc1c$\\x1c_\\xdb;\\xbco\\xe7j<\\xa2\\x82\\x94n\\xf7\\xb0\\xb5pgx\\xb1@\\xd8g\\xb4\\x98\\xde\\x91\\xfep\\xfd\\x97\\x9as\\xe5\\xf3\\xab\\xc3"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\x92\\x88\\xd9\\xb4\\xbe\\xab\\x96\\x92\\xf5\\xbb\\x04\\xd9\\xfe\\xb5\\xc3\\xb8\\xb7g2t\\x89\\xda)\">*.\\x9b`\\xdd\\xd8\\x0c\\xb3o\\x0b\\x0f\\xf6\\xfb\\xfcf\\xf3l\\xaap9\\xab\r\\xfe\\x04\\x0bt\\xdbr\\x08\\x9b\\xd4\\xaar2k\\x15b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xbd\\x0e\\x17q\\xdf\\x89\\x01\\x86\\xed\\x9d\\x94\\x8b3\\x02\\xc9\tt\\xa2a\\x19hk\\x9c~\\xf5\\x18\\x81!\\x1ek\\x0emas.\\x9a\\xc7w!\\xfev\\xac\\xb0w#\\xa2\\x99"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xceb\\xdd\\x8a\\xcc\\xb8\\xc2>\\xd7\\xb7?\\xcdab\\x93\\xde\\xe60\\xf9\\x91\\xff\\xe3\\x8d.e\\xcf\\xd9\\xfa)(\\xd5\\x93\\xa2&\\x17\\x92\\xd1\\x03\\xaf\\x0bm\\xe1`\\xfe\\xad\\x85b,x\\xab\\xad%\\xd7\\xc6\\xfd\\xa4j\\x13\\xe8\\x04\\xd4\\x94^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbfqs\\xd6\\xfb\\x0f\\xda\\xd5;\\xbe\\xe1\\xe2\\x85\\x1d\\xfd\\x1c\\xe1\\x08\\xd2m6n^:)\\x17d\\x9c\\x85\t<\\x9a\\x9d\\xef\\xc1n9\\x01\\x97\\xe8\\x86\\x12\\xb3\\xa4\\xdeiy*"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04pu\\xa11\\xad\\xe4$\\x9a\\xd5\\xd5g\\.\\x9e\\xda\\x95d\\x03\\xdda\\x90\\xaa\\xed\"%cz\\x02\\xd1\\xb4\\x10\\x81\\x93\\x04\\xd0\\x10\\x06\\xc6\\x0b\\x0c@\\xbe\\xbf\\x11h\\xc5\\xc7vm\\xac\\x9e\\x8597b*pz\\x12q#\\xc3\\xe5\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1$3k\\x10\\x86\\xcf\\xb0\\xed\\xf6.\\xdcd\\xf0\\x15\\xb9\\xab\\xb7p\\xad\\xc7\\x1d\\xdb\\xa7@)6b\\x80\\xd49\\x81\\x18z7\\x19\\xe6tq\\xe5x\\xe3\\x965\\xe9\\xc5\\xf6"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7`thkq\"\\xf2o \\xd9\\x06\\xa5\\x1c\\xc0\\xbf\\x81mx\\x99\\xa2\\xeb\\x97+\\xc3\\xfa\\xef\\xef\\xfft\\xc3\\xc1\\x8dr\\xd9n\\x13i\\x04\\xda\\xad\"\\x89\\x89en\\x90a\\xc0\\xd2\\xcfz\\x95\\xc5\\xc3k/\\xea\\x1a\\xd0\\x8c\\x8e\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa|!\\x8b6\\x12b\\xe2q!\\xcdt\"\\xea6\\xd1\\xa0\\xa3\\x99i\\xa8\\xdev=\\xf0\\x12\\x12\\xb1d\\xcc#\\x97\\x87\\x9f\\x7f\\xa8z\\xdcy\\xa3f#\\xf3\\x82p&"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\xe4\\x10\\x9d\\x01\\xf3\\xdcdn\\xf6g\\x93<\\xd5a\\xe6 ;r\\xa6\\x0e\\xd8\\x0cc\\xd2\\xf0\\x179\\xf3\\x95\\xe2\\xdfi\\xc9sg\\x8amba\\x0e=\\xea1\\x98\r\\xcc\\x9f\\xc4\\xa3\\xffx\\x97%g`8\\x8e\\xf4\\xf0\\xa8\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x11\\xb5ch\\xc4\\x0f\\xcb7_\\xad\\xf1j\\xd0\\xd1\\x9c\\x15\\x15\\xea\\xc9\r\\x0f\\x8cd\\xa7\\xcd\\xca\\xdf\\x013\\xa2y\\xd9\\xe8\\x03\\x9c\\x98@\\xf5\\x91\\xa0\\x06 \\xa3\\x83r\\x91b"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t\nl#r%q\\xbe$\\xf57\\x7f\\x81\\xca\\x1e^\\xe9\\xb1\\xa6n\\xe6d.\\x93\\xdcyy\\x15\\x7f\\x1csu\\xd6u\\xf1.l3\\xdd\\x9a\\x99\\x7f\r\\xfa\\x8e\\x1f\\xcf%\\xc3h\\xed\\x19\\xd2\\xb0\\xb4\\x8b\\xe0h\\xb3\\xc0\\xa5\\xed\\xd4@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\x8b1n\\xdbl\\xe2&\\xb83\\x89@1\\x1a\"\\xb1q\\xe2\\x96\\xe9\\xd9\\xb6f\\x1b\\xcf\\xef6\\xcc\\xe9\\x9f'\\xbb\\x02\\xd1~\\xb0\\xcb\\xa5\\xdc\\x8c\\x80\\x01q\\x12\\x84\\x84e"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x04\\xc7\\x83l\\xdd\\x7f<\\xd1?\\x8f4\\xf9\\x8b\\x847\\x8ee\\xf4\\xf7-*aby\\x15\\xeb;g\\x00s`\\x0b\\x02ca\\x9bi\r\\xe0\\x91\\xf98?\\x9a\\xb9\\xf4g\\xa5\\xc3\\xf0d\\xcbb\\xd8\\x80htyi\\xba?\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ra@\\xd5\\x1f\\xa2i\\xbd\\xed\\xae\\xc2\\xd2\\x8e\\xcd\\xad\\x89'h\\x98\\x144\r\\xe2\\x8b\\x8eo\\xbe\\x83d\\x8d\\xc64\\xf8a\\xba\\x86|\\xcd\\x0c\\xd0c\\x00\\xd2@\\x00\\xcfg\\xc6"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa\\xa0:\\xe44\\x8d~\\xf1g\\x1f\\xf6\\xac\\x8c\\xeb\\xe2,\\xc02x\\x03i7x\\xfa\\x8ef\\x12p\\xb0k\t\\x01\\x9a\\x9fz,\\xed\\x161x\\xb3\\xbf\\xd9\\xf2\\xc1/\"\\x87wl\t\"q\\xf77\\xb2\\xe5\\xe8\"\\x96s^\\xf0)\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18i\\xac\\xaf\\xc3k1\\xe2>eb)\\xda\\xef\\x0f\\xa6\\xd2d\\xe4j\\x05|y\\x99\\x0f\\x92\\x10\\xf4\\xfe\\xdc\\xb2\\xa1x\\x14\\xe0m\\xe5\\xa13\\x16\\xe4\\x8e\\x87d\\xb5\\xee"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99k\\xc4\\xfd\\xc4\\xe1\\xf7\\xc1'\\xaat\\xc8\\x85\\x95\\xf8\\xacz?-pqc\\xf2\\x80f3q\\xea\\x97\\x9e\\xbe\\x90\\xd4c\\x8d>v\\xed&\\x91v\\x1f\\xfd\\xd2\\xb4\\x96\\xaesgk\\xf2\\x10\\\\xe4\\xd7\\xf2bo>\\x8e\\xcc\\x87x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$ \\xd2\\xe1\\xff\\x0e_\\xbd#o~\\x00b\\xb1\\xb5\\xa8pkz\\xf5\\xc3\\xc0\\xd2\\xa7\\x1a\\xbd_o\\x85\\xd22\\xdd\\xc3 t\\x8a^\\xc9~\\xd7;\\xe3\\x865\\xbc\\xf5g"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\xc6\\x01u\\xbak\\xb16\\x8e\\xaa$\\x8dcrw\\xe2\\x9b\\x19\\xcb \\xf1\\x91t2\\xba\\xd0\\x04\\xf8\\xe2\\x9f\\x80\\xf5\\xa5l\\x11\\xcd\\x1de_\\x85\\x0b\\xbb\n\\xdb \\x8f\r\\x9f0\\xc1*\\x1ba\\xbb\\x07t\\xbb\\xdf\\x93\\x81fp\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xd5\\xda2\\xd59\\xd2;\\x99\\xf0\\xe7\\xec\\xf9\\x0c\\xc6\\xcch\\x16\\xe6\\xc8\\xbb\\xb2_\\xce\\x91\\x18\\x92\\x1c\\x9e\t\\xaa\\xe0\\xbf\\x1f\\x11\\xe8s\\xd0\\x01\\xde|\\x04\\xba\\xa2\\xf5\\xa6"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04=%k\\xf1\\xedfd\\xfa\\xab\\xd7\\xad\\xf6o\\xd9\\xa5uh*\\x8d\\xb2\\x85u\\xe1e\\xdab\\x93\\x1cx\\x8a\\xf0\\xa7oate\\x83\\x99\\xb6\\x0e\\x17\\x1b\\x08y\\xec\\x9a\\xa3\\x0b\\xbf\\xf1n\\x1e\\xc2\\x1d\\x06\\xf2j\\x13\\xf5\\x18t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\x8ep\\xc1iaejr\\xec\\x7fg^\\x083\\x18\\x87bm\\x08\\x93\\x18>u\\x0f\\x87t0\\x0ep\\x19?\\x8dg:\\x15\\xa8\\xff\\x9b\\xa3\\x86d6\\xc9\\xd8\\xbe\\xf39"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xe6\\xcb5\\x0b\\xffu&\\xca\\xd6\\xdd\\xb2f\\x1b\\xccpq\\x80\\xa5\\xc9\\xdd\\x99\\xa9\\xcbb\\xf8\\xb3\\xb2\\xf1\tkw5\\xfc\\xb2^\\xcb\\xa6q\r\\xdf\\xf1\\xf7\\xd5\\x117\\xb7\\x17\\x7f\\xa0>\\x03\\xa0zx\\xf8\\x025\\x7f\\xd3\\x87n\\xf98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\xe4\\x08\\x9fu\\xdb\\xb8\\x86\\x81e\\x1f\\xd15\\x1fx\\x9f*\\xfduq\\x8a\\xae,\\xcbx\\x820\\x86\\x91\\xc9\\xf4,\\xd6\\xfb\\xe5\\xc2!\\x9c\\xad\\x03\\xbb`\\xd3\\x1f\\x033\\xf1u"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf|\\x13v\n\\xd7\\xa1\\xca\\xc1t\\xa2\\x9e.\\xe6l\\xa2 \\xce\\xef\\x8b\\x9e35\\\\x80p\\xd5^hv~\\xbf\\xa2\\w\\x0b\\xa6\\xc0\\x91\\xec\\xef&\\x0f\\xc0.8~\\xfe\\x1f\\x1dp\\x8c\\xcfn:\\xc5\\xe2\\xd1\\x8c\\xed\\xec\\x17y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xc8\\xd4o\\xca\\x05\\xd1\\x86\\x14g-\\x0c\\xbd7\\x91\\xf2\\x94\\x7f\\xf3\\x15\\x02yy\\xd1\\x0c\\xc9\\xe6aa\\xb0s\\xf9h\\xddsp\\xca5\\xd1\\xdb~h\\xd9s\\xc7\\x1a\\xda\\x16"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\xd3\\xf9\\xc8\\x84go\\xbd\\xe4t\\x0bv\\xc7\\xe2\\xd0\\xdc\\xcb-\\x1d\\x04n\\xb0\\xcao\\xec\\x0f\\xcf\\x16\\xe6\\x8ap\\xef\\xb6\\xda\\x9ed\\xcdyq\\xfd\\x0c\\x826\\xb0\\xab@\\x19\\xcf\\x9f\\x83\\xf3^f\\x97(\\x8c\\xef\\xa8b\\xa8b$\\xd7\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\x85=\\xc3q\\x11\\xc3%\\xb5\\x01\\x07\\x01|\\x86\\xb6\\xde\\xd2\\xd3\\xff3\\xab\\x18`;\\x17h\\xd8\t\\xe9d\\x9amw\\xd4om|\\x960d\\xc9\\xdc#\\xa1\\xab\\xcc"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s$\\xefjl\\x82\\xd4\\xa8dfe\\_\\xe1u'f!\\x87x\\x99c?\\xd5\\xac\\xfe\\x9e,\\x81>\\xe2\\x9e\\x12 ,\\x8d\\xadm\\x13\\xf3\\x17\\xb0@c\\x95y\\xb1n`|\\x07\\x01\\x13\\x8c\\xc8f\\xc6u\\x08\\xde\\xc2\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1&\\xa3=\\x843\\x84\\x91\\x81\\x0b\\xb9j\\xbf\\x97\\xb7.ha\\xb7d\\xf1jo\\xf6\\x17\\xd42r\\xd3e\\x83%\t\r\\xef\\xf8\\xa2\\x90\\xecj\\xaau^|\\x82\\xe2\\x7f"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04aey\\xeeeo\\xac\\xee\\xd8\\x19\\xcc\\xd92k\\x91im7g\\x03\\x03!oc\\xf7\\x91+;\\xdb\\xba\tt\\xd4kyg\\xb8\\xeb\\xad\\xfb&\\xbb4\\xf8v\\x02in\\x0cmw\\xd6\\xe4\\xf6\\x98m&\\xaayjv\\xadi\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x8a\\xd5\\xd2)\\xa7\\x1f1\\xd1\\x87\\xae,\\xd1\\x18\\xb4\n7b\\xee\\x03y(y\\xb7z`\\xe5a\\x88c\\xdd\\xae\\xcf\\x01\\xa7\\x1bsp\\xad\\x98\\x15\\xad\\xe4m\\x9a\\xe3\\xf6\\xc8"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1s\\x97\\xc2\\x0b\\x05\\xb8\\xb9\\xdbi\\xd7\\x99\\x8b\\x94j\\xdc\\x08\\xb9\\xa2\\xcd\\xbb\\x1a\\xc2\\xf2h\\x90\\xf9\\xf6dv\\xabp\\xe8\\xc7\\x94\\xd3qvy\\xe3\\xfd\\x9b(\\xe0a\\xc9\\xd3\\x9af\\xcbd\\xed\\x1f2\\xf6\\x92\\xfffi\\x10n\\xf0\\x9fez\\x884\\xd8ml\\xc7\\xef\\xe4m\\xe3\\xf8\\x80\\xd3\\xb2\\xbe\\x90\\x8a\\x18\\xb2\\xbd\\x1a\\xbde\\xa8\\x17\"\\xeb\\x90\\x9c\\xa1\\xed\\x89\\xd3#w\\xb3b\\x1d\\xf8iv\n^og.\\xdcj\\xd4\\x1b\" \\xae\\\\x83\\x94\\xdc\\xf4\\x8a\\xb5e\\xe3\\xf4k\\x9c\\x14\\xb8\\xc1\\x97\\x06\\xc3\\xe7\\x86\\x9f\\xd9\r\\xef\\xe5l\\xe2z06~\\xe2\\x8c\\x07\\xb6gq\\x0c\\x01\\xb9y\\xf1\\xeer\\x9c\\x0c#\\xe1\\x9b\\xb9\\xe1~a\\x97(\\xadd\\xd9\\x8f6\\x8a\\xd1\\xb3\\x9d\\xdf\\x8b\\x96\\x03\\xea\\xca1)g\\xfb\\xe8?>4\\x19w\\xc5\\xcf\\xda^\\xf5\\x98\\xcfr\\x1cx\\xfa\\xe0\\x1cq\\xb5\\xfe\\xb2\\xbc\\x06\\x19\\x1c;\\xe1\\x1e\\x07\\xc5u\n\\xe4\\x08\\xbc\\xf6\\x12\\xdb\\xe0\\xae\\xb4\\xc8\\xd6\\xd0e7\\xbd\\xd0\\xc4\\xa9\\xe4wa"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xb0\\xf7\\x90\\xc3\\x9cy?\\xe3?\\x9f\\x07\\xb2\\x18\rgq\\xc7\\xe88o\\x9fif\\xfd1\\xaa\\xd4\\xc0ni\\x1c-\\xf9\\xbd\\xad\\xb7\\xf7\\xf3*\\x18n\\xe7\\xe9\\xed\\xcf\\\\xb7\\xd2\\x94\\x92\\x9a\\x82\\x1d4\\xb8\\xb5\\xb5#\\xeb\\x85)\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000kz\\x83l-\\xc2\\xec\\xb1f0\\xb41\\xc3\\xed\\x96\\xb7\\xda\\xa1\\xd2?\\xb8=\\xfc\\xdf\\xbbv\\x96x\\xb3\\xf3amk\\xe4\\x80\\xda\\x1d\\xb4\\x1a\\x80-\\xfb\\xa7\\x1d\n\\x9b\\xf9\\xa6"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x1e\\x00\\x92d>md\\xd6\\x99~\\x97\\xdc\\xd4\\x9f\\xdfn\\xa5\\xee\\xf0\"h/$\\xf7gkhg\\xe1\\xa7\\xe9\\xfb\\xdct&g\\x03\\x8a\\xdd\\x7f\\xde\\xc3\\xa7\\x97\\xbb\\x8d\\xcb\\xfc\\xd6\\xbc\\x10e\\xa0njco\\x90^\\x15iw!v\\x99>\\x1c6\\x87|^\\x01e%\\x9e#\\xd4g\\xa8\\x00\\xe28\\xea\\x06\\x91\\\\x85q\\x93\\x1b=\\xa52rxv\\x1f\\x8b\\xa3v\\xab\\x8a/\\xd2\\x9b\\x90s\\xac\\x10\\xbb\\xbc^=\\xa7\\xafi\\x810\\x91\\x0b\\x9ez\\xda\\x01'c\\x16\\xa7\\xa7y\\x84\\xedo\\xfb\\x80\\xf2p\\xf0t\nbz\\xc4\\xdb\\xd4\\xb2$$a\\xd7\\xc6h\\xe9\\x06o3&le\\x15\\xdb7\\xe7s\\x14\\xb6\\x9d*\\xa0\\x1c\\x0f\\x0f\\x85\\xce\\xd5\t\\x9e\\xb6\\xb3\\xb9:\\x9a(\\x01'7\\x8b\\\\xc3\\x07i\\xe6x\\x8dp\\x89\\x829\r2\\xd8\\x148\\x1b\\xa2\\xe0\\xbe\\x18\\xcb\\xafq\\x13\\x8a\\x17\\xc6%kx\\xa1\\x18\\xac3\\xb5z>\\xe0m\\xf1=x\\xd5\\x05hgw2j*\\xc5\\xcc\\xd1r\\x06\\xe2n\\x19\\x0c\\xf9g"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\x8b\\xb9k\\xb8\\xc5\\x1f\\x98\\x9f\\xe4p\\xe2\\xddc\\x1c\\xc5&\\xc9\\x88xg`\\x96zto\\xc3d\\x89\\xb2\\x90\\xa1\\x8eez\\xb6\\xb8w\\xe0\\x92\\xd3\\xb8x\\xfer\\xa1x\\xb6\\x93@\\xa6ari\\x1c\\x8dw\\xa9\\xf3f\\xd6\\xe7\\x16\\x158\\x94x\\x81\\x9aug\\x9cd\\xe7\\xb9(\\xc6a\\xb8\\xe1l|\\xf3v=\\xea\\x17\\xf0ako\\xc5g\\xf2k\\xe2\\x80l \\x01\\xfc\\x0b\\xb7_mj\\x95\\x94z\\xc7\\xfd\\xab\\x8d\\xa6\\x0c\\x08\\x8d\\xac\\xa5;ua\\xf1\\xdc\\x9d\\x13\\xa2&\t\\xca\\x07\\xe5\\xc5\\x80y\\x99\\xfc\\xd5\\xed\\xf7\\xdc\\x84\\x11-\\xa3v\\xdb\\x1c|$\\xc5,\\x8f\\xa5k\\x8f\\x92s<f\\x05\\xa7\\xee8\\x94\\xb6q\\xa3,\\x14\\xb3\\xb6+\\x1e\\xc7\\x87\\xb4\\x18\\x7f\\xa2\\x07\\x92\\x8c\\xf1\\xd6h'\\x85\\xd4m\\xc7\\xb7\\xf2\\xeb\\xb5\\xb4\"\\x03\\xfe\\xd5\\xc9\\x02\\x956\\xc4\\x9d\\xa1l\\x9e\\xfa\\xc2e\\x82=\\x02~zq\\x7f\\xcf\\xaah5n\\xc3gf9w\\xdbs\\x13l\\xf3\\x0b\\x0bd\\xa1\\x1d\\x05\\xcd$w\\xc2v"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8\\\r\\x08v\\xe1~|\\x16\\x12q\\xe9\\xff\\xd4\\xb5\\x94hk\\x00p\\x10\\x0f-\\x89\\x9e\\xdbk+\\o\\xd3\\x19\\xc8\\xd3r\\x9f\\xc0>\\x99m\\x1d\\x89\\x03g\\xbd\\xc7\\xce\\xc7\\xaf\t\\xb3\\x02\\x8b\\x997\\xad\\x8cg\\xea:\"\\x87\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\xa7\\xbch\\xdf0\\xa4\\xddl\\x9e\\xb3p\\x9dzy\\xce\\xcb\\xc6q\\xc5e\\x91?3\\xd5($\\xd2\\xb3\\\\xa5\\xa0\\x9d^>q\\xf7\\x9c\\xba\\xb8\\x8e\\xe1\\xdekh\\x99b\\xb8"
  677.  
  678.  
  679. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x96ev\\xd9\\xd26\\x9e\\x12\\xbd;at7+\\xda\\x10\\\\xce\\x80\\x08r\\x98\\x9ep#\\xaf\\xd8\\x1c\\x9b\\xf3\\xc1\\xef\\xd3\\x97\\xab`g\\x99\\x7f\\xc2\\xd9\\xda\\xbd\\x9ck\\xea\\xab\\xea\\x05\\xe7\\xe2j\\x19\\xbc\\xfa\\xdbu0\\xcb&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\x8d1\\xaam_\t\\xd97\\xa4o\\xe3.\\xed\n\\x96\\x98\\xa6\\x97\\xa2\\x84i\\x0f\\x9f\\xa2\\xb8\\x9fo\\xb2\\xbaccp\\xb6\\xde;\\xf3>?\\xde\\xc5\\xe3\n\\xdcc\\xf6\\xf3\\xa9"
  680.  
  681.  
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@b\\xde\\x8e\\x0c\\x10gq\\xb47\\xba\\x00\\x86\\xc6\\x13\\x82y\\xd3\\xc02hw\\xa2'\\xe7/\\x07\\xbe\\xd8m\\x97\\x04\\\\x03\\xees\\x10\\x7f\\xde\\x88\\x11\\x93\\xe5\\x94\\xecu\\xd0\\x95\\x03\\xc7\\xa7\\xa8\\x13~\n\\xda\\xbd\\xbb\\x07\\xa6w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5e\\xf3\\xa7\\xfa\\x9e\\xce\\xe5\\x9a\\xfa\\x1dw|6\\x10\\xf0\\xa4@\\xb6>u\\xb5\\xf0\\x05\"\r\\x8a0\\xe8\\x9e\\x9b\\xb9\\xf0s\\xfb\\x1f\\x89\\x9d`\\xea\\xf9mr\\xfd(5_\\xd4"
  683.  
  684.  
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\x83\\xb1\\xce\\xc9<\\x86h\\xe3\\xa0\\x80\\xa6\\x10^\\x8b\\xd7\\xbf2\\xb6\\x9cmom\\x84\rwo\\xd2\\xf8\\xb3#'\\xcabf\\x9f\\x8d\\x1b3\\xa5\\xaf\\xc08\\x0c\\x13\\xe8\\xd8\\x01\\x8bjd\\xeb\\x87 \\xef\\xd6m\ns\\x19\\x81\\xcc\\xa0y\\xca\\x19\\x8c\\xb4\\xfe$\\x81\\x8a\\xff\\x81f\\x0ea\\x16y\\xbb\\xe2:\\xb0\\xf1\\x0b\\xa5\\x03\\xcbd\\x8dl\\xe0\"\\x87\\x8a\\x08^\\xa4\\xef\\x0b\\~\\x81\\xf9\\x90\\xf0\\xaf\\x82w \\x11\\xd2\\xbd\\xa2tb\\x16qgu<a`\\x02\\x9di\\xdej\\xa2\\xa3\\x84\\xc0\\x1f\\xdfoa\\xd4\\xbb;\\xeb\\x01\\xa4\\xe91mzi\\xdc\\xa1\\xe8&\\x99h\\x9a\\xcf\\xff\\x1ch\\xcc\\x97j-\\xd5\\xf9q\\x83 \\x04\\xee\\xa6\\xea0\\xdc2\\xc6\\x83\\xbdv\\xbbu\\x12hskl%\\x13\\x15\\x9e\\xba\\x92 \\xb8\\xb8\\xf1&\\x83\\xe8a\\x85k\\x1c\\x08\\x995\\x03\\xc9a\\xd23\\xa1\\xd9e\\xd3\\x14\\xffc\\xc2\\xca\\xfa\\xb52\t|\\xa7\\xa0\\x8b\\xf8o\\xd1&\\xbd6\\xce\\xea\\x81g\\xe7\\xd3\\xb9\\xba\\xc5q\\xca>\\x88n\\xed"
  686.  
  687.  
  688. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05wv\\x83\\x9de;s\\xbdf\\xf7k\\xf6t\\xd3q\\x82\\xaf\\xe6x\\xc7\\x89\\xf0\\xcb\\xb0#\\x99\\x12\\xb8f\\x81\\x82\\xab\\xd4\\x88q\\xae\\x12\\xdb\\x9d\\xf7jlbu\\x12+\\xed\\xb2\\xde\\xfa\\xa8n\\xd8@\\xd778\\xed\\x90m\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\$\\xf4d\\xc6.\\xd8\\x02'\\xc8\\x02\\x07\\xed\\xa4\\x95 \\xf5\\xa5n\\xf0\\xd4\\x0br\\xa1\\xb2\\x92\\xc0\\xd8\\xb9\\x1br\\xf8i\\xcc\\xe8\\xc7,#\\x9b\\x9f\\xf6m\\x84\\xe2\\x0eb\\x19\\xd4"
  689.  
  690.  
  691. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa\\xad$\\xf86:\\x06ri\\xbc36\\xde\\x12\\x90\\x19gj\\=-\\x97l\\xe3\\x93\\xbe\\xd0m@\\xf7\\x8e\\x15mbg\\xd5x\\xdc\\xf1\\xcc\\xd9\\xadl\\xb2\\xc7\\xef\\xdf\\xe3y9x*.1+\\x17\\x15\\xe9\\xdb$)\\x9b\\xd3\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\x89\\x01\\xd2\\xa2\\xd3\\x0e\\x86g\">\\x96.\\xe7s\\xb9w)\\x87o\\xee\\x1a\\xb9c\\xeai\\xf4\\xc4\\xa9\\x87\\xc1y\\xd8y\\x1e<\\xee)*\\x8a\\x1a\\xd6y\\xf0\"\\xcd\\xce"
  692.  
  693.  
  694. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1e\\xac\\xa8qhw\\xa8\\xe3a\\x00\\x9bc\\xc9m\\x90\\x1b+<\\x83\\x13d\\xdb\\xe3\\xc8\\xe2?\\x1e\\xfe\\xd1\\xd9\\xfe\\x1fd>\\xce?\\xa2\\xb0\\xaa\\xdep\\x81e\\xf7\\x13\\x84?u\\x85\\xd8\\xd6au\\xe4v\\x83*.\\x98\\x8c$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000,\\x0b\\xe9<h\\x82r\\xba\\xc4\\xf0\\xf3\\xeb\\x1c\\xb3\\xfa\\xe7c\\xc6\\xfe\\xca\\xe4l2s\\xab\\xb1\\x8f*f\\xbc1u\\xcd\\x81\\x88tk\\x94\t\\xcf\\xe8g\\xda`7\\x07o"
  695.  
  696.  
  697. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\xb0\\xa3cmtqq\\x86\\xd6\\xed\\x13\\xec\\x88f\\xad\\xfd<\\xf2q\\x04h,/\\xbd\\xd5\\x1a\\xf2\\xe4\\x03\t.\\x04\\x94\\x81\\xf1\\xe9y\\x8f\\xd9%\\x8fy\\xac\\x1f\\xf5\\x1f\\xa4r\\x01\\xc11\\x19\\xd4\\xfdj.\\xd4\\xfb\\xe3\\xa2\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d$o%\\xc1\\xabt\\xd1\\xeb\\x0bg=/qk\\x1f^m\\xdb\\x80\\xeb\\x9c\\x8e\\x92q\\x98\\xb7\\x7f\\xf6tf\\xf2^\\xee\\xcapv\\xb6\\x12\\xda\\x08ip^\\xf0"
  698.  
  699.  
  700. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xed\\xacei\\x1az\\x91\\x1bue\\x8fb\\x8c\\x86\\xda\r(m\\xa9\\xb5\\x1e\\x02\\xf5\\xba\\xed^-\\x8f\\xaa\\xc4\\x13\\x10\\x1b`c\\xd2\\xd88\\xac\\x0ft\\xe4\\xe3\\e\\xd4\\xd6m\\xa8`d\\xeb\\xb7k$h\\xc1\\xe7b\\xde\\x987\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\x9a\\x9e&\\x1a\\xbe\\xaa\\xc9s\\xd4q4v.\\xfd\\x12\\xb5i\\xf3\\xd1\\xc1\\x83\\x9fk\\x82\\xf3\\xd2\t4\\xbb;\\x90b\\xeb\\x00b\\xea\\x06l9\\xf5wq@"
  701.  
  702.  
  703. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xb3\\x00\\xc8bdw\\xb5#\\xe6\\xaa\\xb2ik\\x15f\\x90\\xcb\\xa3jv\\xd4\\xd7\\xc81\\xb7?)\\xd4\\xd4s\\x91\\x92\\xe9~\\x1b\\xfd)\\xee|\\xb2b\\xa1d\\x0e\\xe7\\xcd\\xd1q1\\x87\\x85\\xb3\\x15\\x078\\x1a\\xa8\\xc3\\xff\\xf6fx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\xc2e\\x02\\x97\\x12\\x9f?)\\x93k0\\xbdyy@\\x14\\xdef\\xc8\\x05\\x85\\x81\\xc1,6&=93\\xff\\x07\\xa5q\\xcb\\x9c\\xc72\\x14\\x95o\\x1c*\\xbca@\\x15$"
  704.  
  705.  
  706. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xc1y\\xc8\\xd3\\xdal\\xf5\\xaejp\\xe8\\xf7\\xfb \\xc58w\\xcb \\x8a\\xe02\\x13h\\xbd\\xe8\\xbbs\\xa8\\xc5u\\xa2\\xa9\\xfcu%\\x84\\xed\\xc2o3z\\x19\\xf3\\xa1\\x83e\"*\\xed\\x1d\\x14\\x86\\xdf\\x9cy;?\\xb4\\xe0\\x00\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&\\x0b\\x9c\\x10\\xd4\\xca\\xae\\x1du\\xca\\xd1yf-\\x16\\xf19\\x86\\xc1#zp\\x12\\xcasmu\\x0f\\xef\\xc1\\xca\\xc5(\\x8e\\xfc \\xcb\\xf9\\xfa\\xb6\\xda\\x9a=gn\\xf6"
  707.  
  708.  
  709. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ts#\\x95\\xfb \\x1ab\\xc7\\xf8\\x0b\\x11\\xcah,\\xebt\\xfb\\x87\\xc1\\xcaz\\xe0\\xdbu\\xca\\xa6zt\\xfbw7\\xe2s\\xd2\\xec\\x03\\x06e\\xa6\\x06\\xcb\\x1b\\xc7a\\x8a\\x9ep\\xf2\\x18\\x1e\\x89\t\\xc54\\xa3%j>\\xe0\\xa6b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000za\\x1b\\xc0\\xa8%\\xee\\xd3\\xf9\\xac9\\x8b 62\\xa9\\xfe%\\xd0\\xfb\\x8498\\xd5u\\xee\\xcc\\x8a,\n^\\xccb+8b\\x82u\\xb5\\xd3\r\\x1e\\x80\\x8b\\xa7\\x1c\\xc6\\x15"
  710.  
  711.  
  712. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0f\\xe7\\x1e\\x99l(\\x16z\\xe2\\xa8/\\x84\\xffw\\xc7\\x8a\\x00\\xc9\\xd8\\xa5`\\x85\\xd0wbb\"i\\xa0\\x97\\xc0\\x8fl\\xd5\\xf6\\x16\\xfd\\xa2\\xfa\\x1ee\\xd35\\x04@83\\xca\\x93xb\\xe9;\\x1a\\\\x0f4n\\xe7\\xe5r\\xd6\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xfa;\\x88u\\xb1\\xc4 ;e\\xbe\\x19\\x9d\\x8b\\xf6+\\x9d\\x85zi%\\xf0\\x9c7(\\x8ch\\x1b\\xe1k\\xb7\\xb2\\x1f\\xa6\\x1cb\\xec\\xf3\\x98\\x84\\x0fx,6\\xa7\\x82pg"
  713.  
  714.  
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\x0c\\xd5^\\xa0\\xd6\\xba\\xc6\\xbd\\xa0\\xdf\\x86j.\\xf3\\xe0\\x03*~q\\x8d\\xf7u\\xb2p,\\xd0&d\\xcf\\xcd\\\\xe2kz\\xed\\xe3|\\xc1h\\x9d\\x8b\\x17l.\\x1e\\x12\\x15\\x06a\\xdb\\x07\\xee8\\xc1f\\xb2g\\x9d\\x9a\\xf6tv\\x8c\\x84\\x95\\x15q\\x17\\x92\\xa57\\xd0\\xb4\\xc9\\xec\n\\xb1cktl$\\xc7\\xb6\\x92x\\xf5\\xe2f\\xcb\\xa0\\x07u\\xdc\\x84\\x96\\x10\\x81\\xd2dp\\xca\\xc6\\x86\\xb5\\x833(\\xa8\\x89\\xfa\\x19\\xac\\xf4\\xe9\\x95\\xb4\\x82\\x82h\\xab\\xf0\\x8a@)\\x02\\x01\\xff\\x9c\\xb5h+$t\\xf8\\xe0\\x89\\xbb\\xcbm\\x0f\\xd8\\xd0.\\x0eu\\xb7\\xf2\\x01\\xee\\xe6>/\\xadr\\xdc\\xcc\r_\\xc2\\xb7\\x05\\x9a\\x11\\x1a3\\x98\\x97\\xfa\"\\x16c\\x15\\x132\\x13a4\\xa8w)\\x11\\x84\\xce\\x8bf\\xfd\\xa8zm>\\xcc/\\x06k\\x1d\\xc9,\\x86\\xed\\xec\\xd1\\xd9>~\\x084\\x8f\\xdb@+b\\xcc\\xb5\\x81\\xd1d`f\\xfa\\xb0\\xaa\\x06\\xbe\\xac?\\xeezd0\\x12\\xa5y8.\\x99\\xf1\\xfc\\xf8\\xda\\x95z\\x00\\xe1\\xdc"
  716.  
  717.  
  718. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3\\x88\\x87\\xf7\\x94\\xd6m\\x99\\x08\\x88\\x91_o\\x8er\\x80h\\xa3.oc\\xc2\\xa1\\x92\\xbc\\xaf\\xa1\\xed\\xb2m\n4a7\\x13hu\\xd3\\x0f1e\\xc9\\x8c\\xe1\\x9dh\\xe7_\\xb6|\\x82o\\xcag6\\xc2\\xafh_\\xed\\xb7i\\x0f\\x92w\\x1e5\\xdf\\x8c\\x84x('\\x06\\xefu\\xc3\\xdc\\xeey\\xe6u\\xbfj\\x92\\xc4pxzi\\xce\\x7f\\x9b\\x857,g\\x8a\\xad\\xa2\\xea\\xcc\\x01d!+\\xa8c\\cr\\xcf\\xc1j\\xf7\\xed\\x82\\xe3\\xe9\\xd1\\x14\\x88\\xa4\\xa8ovl\\xc6\\xf3\\xb9+\\xe6\\xc8\\xb0\\x83\\xa5\\x93\\xe45k\\xa6w\\x04\\x84\\x03\\xbdq\\xbca\\x10\\x1c\\xeb\\xdcy\\xef\\xdf\\x95\\xb9\\(\\xd7\\xe4\\xf2\\x1c1\\xa0\\xdem3\\xcd\\xe7\\xf3\\xc7\\x1f\\xe7/\\x14\\xf7@\\xe7$it\\xfb\\x17\\xf4\\x0c\\xcf\\xb4i~$y\\xa1\\x9dgq\\xd8\\xf0\\xc1`\\xa3n\\xd4\\xd1\\xdf\\xaf\\xea\\x16+\\x91\\x86x\\x0f\\xf6d\\x17j\\x88\\x06\\xd8\\xe62%\\x83\t\\xc1\\x1c,q\\x9a\\x13\\xa7?d\\xe8\\x1d\\xcd\\x18\\x89ps"
  719.  
  720.  
  721. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\x8b\t\\xa6op\\x94w\\xc8y\\x19\\x0c\\x86w\\x1e\\x7f\\x8a5\\xd6\\x8b\\x90\\xed-\\x01\\x8d\nq\\xb2\\xb8\\x9c\\xaf\r\\xe0e\\xea\\x08a\\xc6\\x1a)qq\\xbf\\xff!@k\\xdf\\xc54\\xb4\\xd1\\xda\\xbf&f \\x81\\xa4\\x85\\x0c\\x873\\x95\\xe7\\x9e\\x04`k\\xf4\\xa5g<\\x98\\xc7\\x1a\\xbc\\xfdi\\x91\\x13'e\\x8d\\xf4\\x18\\x95\\x8a\\xa2\\x80\\xa3z\\xee^\\xd5\\x06\\x03\\x10\\xfbh,\\xaf\\x96\\xc7\\x10\\xfb(\\xa8\\xfdp\\x0f/h\\x9a\\x13\\xf90o\\xe5pq\\x1ej\\x82\\xb6\\\\x1abzd\\x01='n\\xd0e\\x8f<\\x81:\\x1d\\x18q\\x8f\\x1c\\x85\\xf5\\x9a?j\\xd0\\xbe\t\\x88\\xb2\\xea\\xbek\\x9d\\xd6d\\x86!\\xe2\\xf5\\x8f\\x00\\x8f\\x1d=fs\\xbek\\xe7%m\\xabp\\xc8\\x80$\\xa7x\\xcf\\xcdr\\xea\\x0e\\xe7\\xe9.\\xc9\\xc7\"\\xb5\\xe9\\x89\\x00\\x17\\xd3\\xbf\\x94\\x05\\xf0(\\x15\\x98v\\x8ed\\x18s^\\xffh\\xdc\\x19\\xe2\\xa9\\xa4t\\xd1jfmt!\\xff\\xfdb\\xc586\\xac\\x87\\xbb\\x89\\xcbl\\xf0:\\xfa\\x9c\\xe3\\xd8\\xa1qs\\xa8"
  722.  
  723.  
  724. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\xe9r<ux\\xb7\\xae\\xf0\\x11w\\xe3\\x0cmh\\x06+v|\\xe00\\xf7\\x9bxb\\xfdi\\xce\\xbe>\\xc5\\xa9k\\xc5\\xa5\\xb5\\xf9\\xe2\\x82\\x1bf\\xc2\\x9a\\x8ce\\x04\rm\\xd9\\x8a\\x8a\\x93\\xe3\\xa3\\x87\\xac\\xe3\\x1e%\\xd5\\xc4\\x97\\x0bal\\xfb8ob\\xb2\\x12\\x0f\\x01\\xba5\\xbcg\\xbc\\x9f\\xd8\\x86,.\\x01\\xe6o\\x94g\\x01\\x15\\x86\\xdb!\\x8a&\\x98c\\$\\xe2\\x8c\\xbe:\\xfb\\xd1\\xc9\\x8a\\x100w\\xc8zj\\xc2\\x17\\xbc\\xd3h\\x1d\\xbc*\\xe8\\x91uc\\x01\\x85\\xaa\\xaa\\x17:p\\xfc\\xaah\\x93\\xecw\\x95\\xa6\\x122\\x91\\x9c\\x85\\xa0k\\xc0\\xde\\xf6\\xf6s\\xe9\\xde,:\\xd5\\xf9\\x8cj1@\\xec9\\xa6\\x11\\xb6\\x04\\xea\\xbd\\x1c\\xe6\\x1ar\\x8b\\xa8\\xa5\\x8c\\xa4d\\xa6p\\x10\\xa4\\xf8\\xa6p\\xb6\\xc0\\x96\\x0c\\xfd\\x90\\x17\\xa3\\x89.k\\xce\\x1aj\\xe1\\xb5\\x06\\x90x\\x9d\\xc3\\x8e\\xc18\\xc9\"\n\\xed\\xf9~\\xf8\\xd6*\\x86\\xear\\xff\\x1e\\xe7\\xbc\\xf3h\\x12\\x89\\xdcw\\x89\\xc3|\\xf04\\xb6s4g\\x8b\\xc5\\xa0\\xfd\\xed\\x15"
  725.  
  726.  
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\xa9aq'~j,\\xdc\\xd4@\\x9a\\x95\\xb1\\xfet\\xd8\\xc9\\xceptc\\xba\\xfd\\x8b\\x0c%w\\xe7\\xa7r0\\xc25\\x89\\xa5\\xa9\\x7f\\xc4\\x12\\x1c\\x96\\xa6y\\xdc#<\\x1b\\xd0\\xd2rr\\xa0\\x92\\x8fo\\x10\\xf9\\x94\\xed\\x9d\\xa8i\\xe8w\\xe7_\\x19a\\xd4v-\\x07+^\\x1a\\x0c+\\x85\\xd1v\\xa1\\xd3\\xe4\\xe2\\xae\\xf6r\\xd36j\\xf3n\\xd7\\x9b\\x1a9\\x15y\\x16\\xf2\\x8d\\xf9\\xe8h\\xfa\\x19f\\xc4up\\xe5\\xcd\\x0e\\x13\\x8a\\x84>\\xef\\xcf\\xaa\\xd81\\xccn\\x9f9^\\xb2\\xb6\t\\x080\\xb1\\x98\\x1b\\x8cvi\\x915x\\xd2&\\xb0\\x97a\\xa0\\x81b\\xe5/\\x1fgne\\xaf\\xec\\xb5\\xbcw\\xe8\\x92*\\x89\\xd9\\x88\\xdf~\r\\x13\\x87re\\x94\\x1a\\x12\\xc8e?\\xd1\\xb9\\xe2\\xb7\\xb0\\xedh\\xaa\\x03\\xd8(\\xa1\\x0b\\x93\\xdd4\\xe2\\xef\\x07\\xe3\\xcbs3o|x\\xaa\\xc4\\xe3\\xaa\\x08\\xf0\\x00q\\xcf\\xff\\x97\\x18\\xfb\\x96m\\xc2l\\xca\\x8b\\xd9_\\x87\\x00\\x9d?\\x96\\xfa\\x17\\xf3_b\\xa4\\xbf\\x95\\xd4\\xe7\\xd0"
  728.  
  729.  
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\x9ftw5tu\\xec\\xd6\\xce\\xfa\\x05\\xbc\\x97\\xe8t\\x94\\xabu\\xdf\\x19\\xb3\\xc7\\x8buvv\\xc3e::\\x04\\xe2\\xb05k\\xeae\\x867\\x12\\x1e\\x0c\\xdd8\\xf1*\\xbc\\xc0pkohv\\x92\\xcb\\x19>\\xc3\\x11\\xccl\\xc0\\xb9r\\xb5\\xc8sy\\xd3\\xc3\\xb6\\xf0\\xc6\\x1b\\x96ip\\xf1*#o\\xb9\\xcfhyo\\xe7o\\xc4!\\xc2\\x0f_\\x00\\x91;\\xc4\\x93\\x8d61:\\xd6\\x87|\\xfd\\x94\\xa2t\\x0b\\x08\\xb8#\\xe3u\\xf0\\xe6\\xb7\\xfc\\x0f\\xb4\\xaaj\\x135q\\xee\\xa6\\xc1\\xb8\\xabgl\\xd5\\x19\\x8c\\xd4mg\\xf7\\x8b\\xd2=/xy+\\xa59\\xb2t?k\\xa2\\xa8\\xc6\\xba\\xa6\\x06\\x10\\x84hai\\x0es\\xbai\\x18\\xf7\\x02\\xb7\\xeecp\\xb1;\\xd9w$\\xcc\\x08\\xb9\\xb2\"\\xdb\\x8b\\xf9\\xf0\\xf6\\xe4^\\xd1pt\\xd4\\xdf\\xc5g\\x9e\\xb4\\xa5\\xdeu\\x0cq:\\x19u~\\x1cw1iw\\xa4\\xc6\\x917\"\\x1b\\x8a>\\xec \\x11\\x18\\xfe\\x12\\xf6\\xcf|q\\xeb\\x902\\xac\\xf36/\\xb9\\xff@\\xb0\\x13"
  731.  
  732.  
  733. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x937a\\x94\\x10\\x00\\x16\\xcf\r\\x1d:\\xfc\\xf6\\x8d\\xfc\\x06'%\\xbda\\xc3\\xb6mk\\x0b\\xe2\r1j4\\xces\\x81\\xc96\\x1f@hx\\x84\\xb9\\x08\\xd6(\\xc9\\x82\\xc8\\x80\\xb0\\xa0\\xde\\x1f\\x9f\n\\xa4&\\x89$6-\\xdb\\x18g\\xcf\\x99\\x0e\\x9b\\xf9s\\x0e\\x8d\\xc1\\x94\\xd4\\x8e8\\x8c\\xcc\\x0e9k\\xaf\\x0c\\xb4i\\xd9\\xe8\\x83m\\xbal\\xe6osg\\x01\\x12\\xd4\\xc0\\xee`\\xa3\\xe6\\xc8\\xa9v\\xc3q\\xbd\\xd5t\\xb9\\xce\\x8a\\xb3\\xbawvlz\\xbf\\xa0\\xa40\\x1c\\x8e\\xae\\x1c\\xe8\\xdb\\xc3 \\xb0\\xaex@\\x00\\x96\\\\xd3\\xb7i\\xc1\\xb4\\xa3\\xfd\\xbag\\xe9\\xa7\\xe4,\\x81\\x13\\x8a\\xfb\\x8d\\xcfi\\x8c\\xc3\\xd7\\xe66 \\xcd\\x0f\\x19%\\x07\\xaco\\xe0e!\\x1cw\\x9ay@\\x98^m\\x90\\xd9\\x12\\x9c\\xed$hc9\\xdb\\x92\\xc5\\xa4\\xb1\\xcb\\x9f\ry\\x1b4-\\xc6\\xbd\\xc1:i\\xd91rj\\xa1\\xb1\\x1f\\xb0@e\\xeb\\xf4g%\\xab\\xa4v\\xfc\\xa9\\xc3\\xe8>\\xacm\\x03\\xcbe\\x1b\\xb0\\xc16\\x85\\xfcd \\xc5"
  734.  
  735.  
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00:@\\xac\\xf5\\xb4\\xa3e\\xfa\\xfa=\\x16\\xa6\\xe1\\xfej\\x8e5h\\xeb\np\re\\xaaqr\\xc1u\"\\x9a2\\xddn\\x89#\\x8ap\\x85*\\x17\\xf1\\x97\\x0e\\x9a \\xe8\\xf2\\x18\\xdc\\x92\\x96\r\\x8e\\xe5\\x0e\\x1fm\\xac\\xe7\\x8c\\x88\\xa0\\xc5 \\xc2\\x96g\\xa7y\\xf5!\\xa4\\xa7!o\\xfd\\x99\\xb8>t\\xf6j\\x84o\\x9a\\xb47x\\xd8\\xb3';z?v;\\xf9j\\xfe\\xc2u\\xd0\\x16,\\xe3k\\x99v\\x97\\xeem\\x9c\\x99\\x97\\xaa\\xec\\xb0\\xb8\\xc0t\\xa8\\xef\\x8f\\xd6\\xefk\\x15c\\xb4l\\x8b\\xca\\xc3\\x92\\xdb\\x15\\xebs\\xc5l\\xc6\\x9f\\xfao\\xb3\\x08\\xc0y\\xd5\\xe5~\\xa05r\\x00u\\x14\\x12\\x86#\\x18\\x83\\xc1\\xdb@\\xa3\rp\\xc7\\x9e\\xc1\\xe7d\\x04\\x94\\xd0\\xfe\\xd7\\xf0pm\\xaanh!\\xd9x\\xf0c$\\x8a\\x8av\\xd3o\\xb3\\xc8z\\xd3\\xa9\\xc2fr1\\xb75\\x83\\xacvop\\x99od\\x97\\xf6k\\xf5\\xc5\\xc2\\xcb\\xae\\x80r\\xfey\\x01\\xb9\\xbb\\xb6\\x1f\\x9b\\x83\\xb5+\\x91\\xc4,\"\\x03|\\x80?\\x1f\\xdc\\xb7"
  737.  
  738.  
  739. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mn|\\x90`5\\xff\\xeb\\xfd\\xfer\\xb5\\x18\\xb8\\x80ic\\xeb\\xa7\\xf2|s\\xbf\\x94g1e\\x00\\xd7\\x87\\x02\\xe6n\\x9d\\x9f\\xa7\\x06\\xf7\\xf8o\\xf4\\xc1\\x1a\\xe0\\xa8?\\xdb\\xac\\xf9w\\xf5\\xac\\xd4s\\xa4\\xbfx`\\x0f\\xc7\\x9ds\\x1e\\x06\\xeeb\\xce\\xf2v\\xde\\x01_\\x87\\\\xc2\\xff\\xe7\\xaa\\xea\\xa8\\xdc\\xf9\\xf0\\xf4\\xf9\\xde$\\xe7\\xd2\\x90=\\xc7\\x0fmuo2\\xf3%k\\xec\\xd7\\x02(\\xe9\\xbf\\xe4|\\x8f\\xfb\\xef<\\x9a\\x80j\\x1c>\\xfc\\xd5q\\xa2\\x12x\\xa6\\x15\\xd5n\\xe3$;\\xba\\x94\\x15\\xdc\\x97\\x1d\\xdf\\xc2\\xd1|\\x9bu\\x10\n\\xa8n\\xbb \\xb2g\\x91\\xd2\\xc1\\xb2\\xc3\\xe3\\xb8\\xeb;\n\\x99\\x01f\\x1b\\xa2rw1i\\x12\\xe5\\x96\\x10\\xdf\\xd6\\x05\\xda\\xa0\\xd5\\xd6kk~\\xa0ra\\xd1\\x81\\x0e\\x0el\\xe4\\x17\\x93tm\\xe5\\x1ba/\\xb9g\\xc4\\x0c\\x06\\xcf&\r\\x97\\x04\\x8e-n\\xef\\x00\\xd4\\x98*_\\x88\\xa7m h\\x04\\xc3\\x99dg h\\xcb\\xf7\\xf5\\xf4b\\xe8ly\\x0e\\xae\\xa7\\xc8\\xbcd\\xf7\\x0bb"
  740.  
  741.  
  742. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\xba\\xbc\rqp\\x9d\\xebq\\x8a\\x7ff\\x93t\\xb0\\x8c3\\xa8\\xa1\\xf5^\\x0f\\x99\\xea\\x93n\\xd6\\xc2\\x18\\x1a?\\x0c\\x03\\xbds\\x95\\\\x8d7\\xa57\\x18\\x02t\\xd8z\t\\xe2l\\x0cc%\\xc4k\\xf9\\x16c\\xae5\\xb4<\\xa1\\xfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;e\\x14l!\\xfc\\xcbea\\x16\\xd3\\xff\\x88\\x0bt\\xeb\\x02\\x1d$s\\x19\\x02\\xbf\\xc3\\xc3\\xc98)x,\\xf2\\xd8\\xbc\\xe4\\xb0y\\xad\\x15\\x02\\x81\\x86\\xb3\\xd1\\x8cx\\xf6_p"
  743.  
  744.  
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbba5\\x99?\\x7fo\\x828\\xd7<\\xbe\\xbd\\x86\\x85\\xdd_\\xdf\\x12a\\x12\\xb0%\\xaa\\x05\\x00\\xc1\\xa7\\xbb\\x1e\\xdb\\xd99\\x88?\\xad\\x08\\x8d\\xdf\\xf4/\\xd1\\xdd\\xd3\\x03\\xb1\\xb5\\xb5\\xd9\\xa5l\\x08\\xc6\\xf4\\x05w\\xfez\\x9dw\\xae>(\\xfda\\x15=\\x9b8\\x01\\xea;k_\\x18\\xc8\\x16#a\\x9b2\\x89ac\\xe3<kr\\x95\\x07\\xda_f\\xef\\xedt\\xb3\\xbd\\xb8\\x9d`d\\xe4\\xf8#\\x82y7\\x87\\x84lk\\xe4\\x1d\\xfb\\xdb\\xe6\\x06\\x10\\xdck\\xe6^$@\\xd5\\x95\\xd7&\\xe5\\xe5\\xf0z\\x95z\\x84\\x1c\\xc9)ldk\\xc9c\\x98%p\\x07\\xc5?\\xdb3\\x1f\\xa6m\\xe7\\x11\\x15\\xfa\\xf2m\\x0f\\xfa+\\x84\\x06(\\xfa\\xe8\\x9d\\x1a\\x05\\x8c\\x98\\xf4\\xde\\xd0\\xd5\\xdf\\x04\\xd2\\xb4\\xb9\\xaa\\xf6\\xcc\\x1a\\x805\\x93\\xed\\xa9w\\x1c\\xc6<\\x90x\\x08v\\x9f\\xbd;\\xc9\\xd4\\x95\\xc8y\\x84\\x0b\\x84yf_6hu\\x01\\x9d\\xf4-\\x94#\\x06\\xdfu:r+\\xeeof&\\xedb\\x18)t\\x8b\\xdbdj\\x8c\\xa4|"
  746.  
  747.  
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010%\"\\xfb\\x933\\x05\\x7f\\x8ax'\\xdc\\xf5_\\xbe\\xc1@+~v\\xdc\\x8a6\\xaf\\xcdh\\xa1\\xd6hy%t\n\\x96\\xf4\\xads\\x1f\\xea\\xc9\\x94\\x83\\x93gk\\xebd\\xd4\\x04(:\\xd8f\\xf6\\xa4*p\\x1a\\xa7\\xc5?\\xb2\\xe8\t\\xcb\\x14\\xa8\\x7f\\x92\\xd2\\xcf#\\xd7\\xdcdt\\xd3o\\x11\\xd4\\xb0\\xf3uo(p\\x15\\xa0\\xcd4\\x83\\x82\\x8d\\x8c\\xfe\\x98$\\xe82\\x80\\x98\\xcb\\xa2\\xb0q\\x12\\x8a\\x08\\xd3\r\\xc7=\\x1b\\xeb\\x8f)\\x0f0elo\\x83\\x8b\\xfb\\xff\\xb4\\xaa\\xa6%\\xf2\\x8dlh\\xda\\x7f\\xb6\\x8d\\xe3\\x8a\\xd1\\xdf%=d\\x1d\\xde\\x04\\xe1\\xff\\xb66\\x1c\\x94\\xb4cfa|+\\x96r\\x9b\\x80r`\\xce\\x1bl\\xe5wu+i\\x03\\x02\\x0c\\xe3\\xa3\\xc7g\\xa3&:\\xb3\\xb3\\x03\\xc2=\\xca\\xb7\\xf1a\nv<\\x02\\x05\\xcd\\x18\\xb8c\\x94o\\x12+\\xf8\\xfc\\xabr\\xdb\\xb8\\xb6\\xb3\\xa5\\xf8\\x84\\xe5\\x19x\\x02\\xc5%a\\x0f~\\x9e\\xa7n\\x83\\x8ck\\xd6!\\x9e\\xd8\\xc1\\xaa\\xf2\\x9c\\xd4\\xb5:\\x04\\xf3\\x02\\x8f\\x1a5"
  749.  
  750.  
  751. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\xee\\x9c\\xfd\\xf8\\xfc(h\\xa9)\\xa7\\xabh\\xe6\\xb5\\x05\\x81qg\\xfe\\xc7 \\xa3\\x7f\\x8e\\x12v\\xac\\xaa\\x14sh\\d\\xce\\x9f-\\xd2\\xfb5<,\\xf3\\xbf\r\\x8d^o\\xa0\\xa0,r\\x8e`\\x8f\\xa2c\\x99\\x8d&\\xbbnx\\x18\\xf2<v-0\\xe6\\xae\\x88\\xf2\\xf3\\x94\\x07\\xf6\\xf70\\x9ad!\\xe3\\xe6c\\xe5w*\n\\x8b\\x0b\\xf3\\x92\\xb5\\xe2kj\\xd3\\x91\\x04<\\x15\\xb2\\xf3\\x00\\x8a\\xe5c\\x1b07<*m\\xb4\\xafnw\\xb6\\x8d\\x01e\\xe5\\x03\\x97-\\xe46\\x12,~\\x15\\x95\\x1c\\x0c\\xae\\xd6\\xaf\\x16;\\xe5\\xca_\\xf5^\\x12\\x91\\xe4\\xe6\\x8a\\xa0\\x9f\\x850\\xe2\\xdf5\\xefq\\x92\\x10gdg\\4\\x066\\xc71(z\\x165)a\\x85\\xebb1\n\\xcf\\x16x\\x8bo\\xa1#&di\\xba\\xce\\xbe\\x04\\xa7o\\xa3\\x8f\\xf6>\\x93\\xa6\\xb6\\xaf\\x87\\xfc\\xc0\\x92\\x80\\xea\\xc5\\x0c\\xf3y\\x1c\\xfb\\x92\\x12\\x12\\xa7\\xaf2\\x8ffl\\x9f\\x11\\xa7\\x80\\xcc,j>6\t\\xd2n\\x96?\\xf0\\xc9\\xf8"
  752.  
  753.  
  754. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xwq\\xec\\xf7\\xf0\\xdb\\xee\\x82\\x8b\\xa7\\xee\\xc5:\\xbb\\xef\\x93&\\xe7\\xf2-\\xae\\xb5\\x8cbao`\\xac5>\\xdc\\xf5\\xed\\xfa\\x92u\\xa5\\x0c\\xe5\\x1e4\\xa80\\xea\\x0fd(\\x1eu\\x1b\\x03\\xacu\\xb5v1\\xcfh\\xa2\\xfdef\\x93\\xb07jvg\\x11c\\x05\\x1c\\xb5\\x06\\\\xa5w\\xcf\\xb7j\\x92\\xb5n\\x0c\\xb9k\nl\\x11ft\\xba\\xc7gug\\x85\\xf9x#\\xa6\\x10\\x89$\\x11\\xe6\\x0f\\xfa\\xd2*\\xfb\\xcfyj\\x98'*-0\\x17f\\xea\\xd3_\\x8c\\xc3n\\xbb\\xa1\r\\x9cs\\xb7\\xd0\\\\xe7\\xf9\\xaft\\x95\\xfd9\\xc9\\x11z4\\xba\\xce>\\xb5m\\x966\\xe0\\xc9\\xbe\\xa2\\xaa%\"\\xd4\\x0e\\xd6\\x8a\\xe9\\xe5r\\x02\\x02\\xe4&\"\\xc9\\x9b\\x1b\\xf7\\xa0\\x8e^ \\x82\\xb7y\\x1eb/\\xa5\\xe5\\x14\\x9c\\xae\\xcf\\xe7\\xbf\\xa6\t\\x0b\\x8ed\\xb7\\x1d\\x02x\\xca\\x11\\x14\\xee\\x12\\x98\\xd7\\xfd\\xea\n\\x03?\\xf0?\\xa0j\\x9f\\x13\\xc1\\x99i\\x9e\\xe1i\\xc1\\xe9<f\\x7fz5\\x89p\\x9e\\xef\\x7f\\xa5\\xae\\xee"
  755.  
  756.  
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x98\\xe3\\xdd\\xa7\\xbe\\x172gi\\x94\\xb9w\\x86t\\xc6d\\xe4\\x9fh\\xff;\\x87\\xees\\xff\\xa0\\xd2\\xd3\\x86\\x7f\\xc0i\\x15\\xa4\\xba\\x05\\x05\\x9a\\x15\\xe3\\x1al\\xb5\\xd4\\x08j/\\xec\\x11\\xe6\\xeet%\\x102\\xd0pv\\x17\\xbc\\x02\\xda\\xc0u\\xea\\xbd\\xd7\\x81p.bx\\x18)\\xd4vk\\xafmm\\x97h\\x99e%\\xb2\\x81\\xf0b_\\xefp\\x98!\\xc2c\\x16n\\xe8:\\x93\\x12\\xa5>\\xa5b\\xec\\x01\\x9d\\x86yk\\xbb3\\xe4\\x9eb\\xe3.\\xba\\x14\\x9b\\x13\\xc5*\\x94h\\x8b\\xd1\\x16\\xee\\xd6\\xf1blz\\xe6\\xd3h\\xf6ho\r\\xf2\\x85\\xb2\\xd7?\\xc9_\\x89\\xbc<\\xe8,\\xb3\\x82\\xf6\\xc7\\x86u\\xa1a\\x99 \\xa1\\x0f\\xd0e\\xb8@\\xd0\\xe2g\\x82\\xe9\\x0f\\xf0iv\\x95hph\\xc4t\\xfc\\x80\\xca\\x98/$c\\xd5\\x8b\\x0c\\xa8\\xde\\xe1eoo\\xb6mk0*\\xb8\\x8f\\xe97\\xcf\\xdb\\x91\\x1a@3\\xf2\\xbah\\xdc\\x89jr\\xa9d\\x91i\\x07\\xb9\\xd4y\\x90s\\xda\\x14bp\\xd59\\x9c8\\xa6\\x0er\\xb6"
  758.  
  759.  
  760. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\x9e\\x9fq\\xd1\n\\xee0\\x11<k\\xecg\\xef\\xa3b\\xf1l9\\xb5\\xc6\\x8a\\xdcd1\\xca\\x15\\xc0r\\xe5\\xc0\\xca\\xa2\\xa6\\xbc>ng\"\\x08t\\xf9\\x95\\x8ae\\xa5\\xfc1\\xa9\\xa1\\xc2\\xd8w\\xccz\\xfd\\xa1\\x98zdwe\\x06\\x9a\\xf3\\xcb\\x06\\x94c\\xa8k\\xca\\x93\\xed8\\xfc\\x80\\xeaxf\\x92\\x83\\xfa\\xfej`\\b\\xd8\\xa2\\x12\\xdeu\\x8f\\xa0\\xd6\\x18hs\\xac\\x15\\xbe%\\xf6a\\x18\\xce^\\x16\\xe2\\xc6\\xe2\\xf2v\\xa8fn\\x8fw\\xc1i\\xfc\\xbfl\\xa4\\x81\\x1af\\xe9&\\x1b\\xf2\\xab\\x93\\xde\\xcc\\\\xf8\\xa2%\\xae5\\xd74\\x8e?\\xfb\\xfb\\xb7\\xf3\\x8f\\x1d5\\xdc\\x8eia\\xaa\\x1c\\x1ce\\xc8%\\x9bwiu\\x07\\xe8`>\\xfd\\xb0\\xc5\\x97y\\x92p\\xb5\\xab\\xff\\x17%l: \\x89i\\xd0j\\xc6vm\\x88\\xce\\x86q\\x05\"\\xe2-\\x86@u\\x13f\\x0e\\x86\\x83\\xcb\\xb6v\\x85\\xf75\\x18\\xfd\\xe6\\xea\\xd6k\\xc9\\x0b\\x93ip\\xbb;\\x96\\xeb$\\xee\\x02\\x013\\x04vm\\x10\\x14\\xaf\\xdc`\\x92\\xbc-\\x1f\\xeb7\\x1e"
  761.  
  762.  
  763. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xb7\\x19a\\xd5\\xc1\\xa6\\x87\\xa8\\xedno\\x85o\\x8d\\xde=8\\x02u\rcq~v\\xackp$\\xa2\\xea\\x93\\xcbq\\xf2\\xa3\\xd6\\xabp0l\\x91\\x9a\\xa4\\x01\\xdb\\x94ja\\xc5v\\x89\\xe2hd\\xdcf\\x94\\xd5\\xd8\\x9d\\xb5\\x0c\\x97'\\xd6\\x7f\\x95^\\xcfav\\xa7\\xec\\xc4\\x14\\xa8\\xfa*\\xe0\\x8b\\xf5u\\x93nf\\x8bw\\xa4\\xb1_s\\xaa:\\xe4e\\xfc\\xacaqde\\xf0\\xad\\xa8\n \\x8a\\xaffk2~1k\\xe9\\xfeu@\\xcf\\xb0s\\xc7;#\\xe4a\\x054x\\x9fi\\xe8r\\x18\\xde\\x11\\x07\\xd6\\x06\\xe4bc\\xde\\xc2\\xea\\xb3$\\xe5y\\x08l\\xae\\xed\\x9c\\xa6e7\\x06\\xcb\\x89\\xf85d\\xf7\\xb4\\x96h\\x86\\x1c6\\xe9\\xc0\\x940\\xf6\\xdez\\xcb\\x9d\\xdbod\\x9a\\xfe\\xd3\\x8c\\x86\\x9e9\\x1c\\xb5\\xb5\\xb0\\xe6\\x01\\xae5y\\xb4x\\xdaz\\x13\\xdf\\xc0`5z\\x8b\\xd6\\xcfd\\x0b\\xb6\\xd8\\x04\\x1d\\x94b\\xea_\\x088p\\xfa\\xc6\\x18\\xd4s\"\\xbb\\xe6\\xc3\\xef\\xa7\\xc8c\\xcam\\xab\\x1e-\\x11\\x9d\\xacp\\xe8"
  764.  
  765.  
  766. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\x87i\\x9ab\\xc0\\x1e?e\\x7f\\xc1)\\xc5\\xdc\\xf2\\xa3d\\xd1\\xbd\\xb1\\xc2p$\\x1c\\xd7\\xa1\\x9c\\xa0b\\x1e\\x0e\\xf8$o\\xf6\\x94\\xfaw\\xe2\\xfd\\x99\\x94\\xe6e\\x03\\xf4\\xd9\\x99\\xe85p\\xbd\\xcdz6o\\xe0|1\\xcd\\xa5\\xc0\\xc5\\xf3\\xb0bnf\\xa50\\xc6\\xf4\\x10\\x8d\\x17\\xa8\\xc7\\x12_\\x16\\x8144 \\x0f\\xbc\\x1c\\xe9\\xfcw\\xdc(\\x12r\\xe0b:\\x9f\\x9d\\xe4e\\x12q\\xe7\\xf2sl \\x0bobx\\xb8\\xc3\\x97\\xea\\xd6\\xe2x\\xcb\\xcd\\xae\\x89\\x1e\\xb6\\x95\\xd3vxr\\xe8_\\xe8\\xb3=\\xe2\\x985\n\\xe6\\xb8\\xae\\x12\\xc2:\\xe51\\xdc_)\\xe1sjkz\\xb3\\x01*\\x0f\\x831\\xac\\xddh\\xa1>@\\xe2\\xef\\xbd3;^k3m03s\\xdah\\xe9\\xdeq\\xdc2\\x83\\xf9?\\xcd\\xfb\\x9c\\xb2\\xf2\\xbc^\\xbe\\xb001\\xf2\\xe8\\x06_\\x03\\x81\\xa7\\xda\r\\xb3q\\xa01j\\xe8\\xe3*\\xc2\\xfekb\\xca\\xd9\\xa5\\x92\\x91\\xdc\\xc2\\xca\\x1d\\x1a\\xa6-\\x87>\\xed\\xf1\\xc9\\xcd'\\xfa\\xbd\\x07\\xd5\\x86\\xa2%\"\\x88"
  767.  
  768.  
  769. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xad\\xe2\\xe3%\\xc7\\xca\\x19\\xcd\\x9c%\\xde\\xd0u\\x0c\\x8b\\xad\\x12\\xdc\\x90\\x92\\x1b\\xf8\\xea\\x82\\xf2!\\xe8\\xd1\\xdb\\x81#\\xe1\\xe2\\x85-\\xd8\\xd7e\t\\xbd\\xc4\\xdda\\xd3fhd\\xbc\\x9e\\x13\\x1d\\x83z\\xc8;,@\\x85\\xac.\\x95\\xc8=6\\x90\\xcd7s\\xac\\xb1\\xde$l\\xcd\\x1c\\xdb\\xf9\\x97\\x1c*&\\\\xdfva\\xe5\\xefx\\xacj>s\\xf0\\x99\\xd3#\\x92!\\xa2\\xbcd\\x8f|?\\xed\\xb5n\\xbb\\xb6\\x06\\x17i\\x07\\xb0\\xf8z\\x8ek\\xcb\\xc6\\xb9\\xa5\\xab\\xae\\x96\\x80f\\xab(^\\xe4\\x1d\r\\xe4\\x08\\x01\\xaf\\xfd\\x07pn\\x08m\\xb7n\\xb7c\\xf5\\x15\\xf9\\xcf\\x16 \\xf2a\\x8bg\\xfb|h$\\xd4<a\\x8c@o\\x96\\xfe\\x00\\x0e\\xa4\\x93h\\xc5l\\xd1nd\\x0bj\\xfb\\x9b\\xd1\\x81''x\\xad;\\x8e\\xc6\\x03a\\xfesl\\xaa\\x8f\\x8d\\x00\\xb7h\\xf1\\x86\\x05\\xeahk\\xe5'\\x7f\\xd9j\\xf4b\r\\x9d\\x90\\xb6`\\xae\\xd9\\xc3\\x00@\\xb9\\xc2\\xb1\\xc3\\xfa?f\t\\x9d\\xef\\xe8\\x11qmj\\xcd<y\\xf0\\x10\\x1e\\x1b"
  770.  
  771.  
  772. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\x924\\x08r\\xa5kxt\\xe55\\x01\\x9f!\\xda\\x18\\x1a\\x12\\xfb\\xddc\\x907\\xf3/\\xfb\\xfd8\"\\x7f\\xb2\\xfbz\\xf9x\\x0b3to\\xf3fu\\xe6\\x98\\x12\\xc28\\xb1 \\x8c\\x97\\xd5\\xdebn'5%-\\x8ct^x\\xa8\\xf4\\xee\\x91\\x1dt\\xc6\\x9e\\x83\\xc1\\xce\\x90e\\xb9hd`c\\x16\\x95\\xd4c=d\\xcc\\x8d'\\xee\\xf1/\\xba\\xcaj!a2yz\\xbc\\x88\\x15\\xe1-d\t7\\x9a\\x85s\\x19\\xe0r`\\x9c\\xd0e_\\x97\\xfd j\\xd4\\xb9\\x08l\\xe9\\x96v\\x96ut\\x0b%|\\xdf\\xfcs0\\xa4|\\x88\\x11\\xbd6\\x88`\\xd3\\xbaxro\\xa9\\xb0\\x1a\\xe0\\x91r/q*\\x86\\xff\\xefd\\x02\\x1b_\\xf5\\xf9\\x06\\xc2\\xeah\\x85\\xbdg\\xcc\\x0b'z\\x96\\xa2\\x08\\x08\\x9cl\\xe5v\\x8b\\xfa o\\xc22\\x8b\\xa5l6o!s\\xb9\\xa5\\xea\\x8c)\\xeai\\xe9mmz\\x17s>h\\xe2\\xa3\\xc2v#m\\x84\\x8da`\\xd1y\\xdf\tud\\xf6\t\\x7fl\\x10x\\xfb\\x1f\\x1c`"
  773.  
  774.  
  775. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xdd\\xf8\\x9b\\x07\\x86\\xc03|&\\xbe\\xec\\xf37\\x9d\\x1d\\xd94v\\xe2\\xb15s\\x90`<\\xca\\xf9\\x0emqq\\x84e\\xe6\\x12\\xb0w\\xb9\\xce\r\\x93ltv\\xb0\\x99\\xc0@\\xcf\\xfd\\x12p\\xa0\\xeb\\xfe\\xe0`\\x12\\x99\\xd2\\xce\\x15c\\xfa\\x9du\\xe66s\\xe3x\\xfa\\xc1\\x11\\x0e\\x8d\\xa2.7\\xdb@\\x8a\\x0e\\xba.\\xadn\\xbd\\xfe\\x0c\\x0e\\x82?\\xd1\\xc7\\xcfzu\\xf9ak6^\\xc1gr\\x99\\xa8\\x1f\\xb6\\xbdu\\x90\\x9a\\xf7\\x8ayiv\\xba\\x0e\\xff\\x89\\xcc;g/\\x82h\\xe6\\x08\\xa9s\\\\xf0\\x1cn\\xed1\\xd4\\xea|\\x90\\xeer\\xe0v\\xf8\\x90\\xc3\\xa4$h\\xfc\\x12+zvf$\\x90\\xddcx\\xfbn\\xd8\\xc37\\xf3w\\xd6wi\\x00\\xfc\\x99\\xaa\\x11.\\xce\\xcc?\\xff\\x0c\\xc1\\xbbv\\xfe\\x1a:m\\xa5\\xf0.`wc\\x0f\\x15\\xfd\\xc9\\xfaf\\xe3\\xb8\\x14\\xff\\xcde9+\\x92\\xf9\\x96-\\x98<p\\xa9f\\xc6\\xb1\\xff\\xcc\r\\xf30\\x02k\\x0c\\x05\\xd9\\x15g\\xb3\\xe9\\xf4f\\xe8\\xa4\\xd6*\\xd9\\xf7\\xee\\xa9d"
  776.  
  777.  
  778. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x83\\xbf\\xa5\\x8f\\xf7r\\x08\\x8ao\\xd17\\xa2*.3\\xb1\\x9f\\xe57e\\xf3\\xa5\\x94\\x12,p\\xa4\\xce\\xdcn\\xc3\\xfc\\x16\\xb5\\x8epw(\\x0e\\xe7<\\x120\\xd8\\xd3zr\\x93\\xd5\\x14\\x9f\\xa9\\xcavjw\\x87\\xc9-\\xef\\xf3k\\xf7\\xa6c\\xf8\\xb00\\xd0\\x0c9\\xff\\xa2\\x17\\xf4\\x9f\\x1d\\xed\\xa2\\x11\\xfd^\\x1d\\x82\\xb5\\x91\\xfb\\x9c\\x04t\\x93\\xed\\x8e>\\xa3\\x8d\\xf2p\\xa7v\\xb3\\xc4\\x1d<\\x89w\\xca\\\\x0ba\\x11\\xe4\\xfe\\xb5\\xe3\\xf9\\xad\\xf9qxqm\\x8e\\x04\\xbdb\\x82^o\\xfb#\\xf32\\xf73+\\x80p\\xaf\\xb7\\xf97s\\xe4\\x86r9\\x83\\x06\\xc1\\xbd.x)m\\xaa\n>\\xe0\\xc4\\x0b\\xd8\\x06\\x9c\\xc0/\\x9cn\\xf6\\xd3v\\x18\\x94bp\\xf2\\x9cp\\xf0\\xb9_i\\xa1\\xb1s\\x04\\xeb\\x9a<lm\\xa4\\x9a\\x86s\\xf7\\xeb\\x88t\\x82\\xc7b\\x9d\\xc8?\\x99\\x9b+\\xfb\\xeb\\xea\\x0e\\x0b\\xc4\\xf8\\xf0\\xd7io(\\x1f\\xcc\\x8e\\x8d'\\xec\\x7f\\xaa\\xbd\\x1as\\x96\\xf8\\xf8,v\\xf4l\\xb4\\x0f\\x0b\\xe3\\x1a\\\\x80gc"
  779.  
  780.  
  781. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@*r\\xae3\\xef\\xe0\\xbc_\\xf4w\\x16\\x89\\x1d8\\x0c\\xfb;\\x9e\\xf9\\xa9\\xea\\xea\\xcd\\xfd\\xbc\\xdf\\x01w)z\\xe7\rk\\x0f\\x0f\\x04\\xa1:\\xe2q\\x8c&\\xa8\\xd5e\r\\x98\\xaa\\xef\\xf0\\x1c>\\x07\\xf0r%\\xc4\\xd1!4\\xfc\\xc3*\\x018mr\\xdb\\xb8\\xed:hl\\xd3\\x8e\\x17\\xc7\\x05\\x01z\\x04e\\x92\\xff\\xbd$\\x13\\xaf\\x8d\\xea\\xccjl\\xcd<\\x87\\xf0vt\\xd1\\x9e\\x01\\xff\\xbf\\x10\\xb1\\x0c%\"\\xa0\\xcbj\\xa9+e\\x0e\\xc8\\xd4 \\x1f\\xbe\\xc4\\xae\\xb7\\x92\\x8bg(o\\xb0q4+ig\\x7fv\\xdcd\\xad\\xb6\\x1e\\xa1\\xde\\x18nb|a`\\xbc\\x86\\x8a\\x97\\xc0\\x02jp\\xad\\xd9\\xbd\\xee2$h\\x11\\xb3\\xa8j3n=|\n\\x04:m\\xae\\x9e\\xca@\\x19\\xa9\\x04\\x04\\\\xc5\\xb6\\xc4\\xd2\\xc5\\xc7\\xab\\xaft\\xd6#r*\\x08g\\x1b`4m\\x1e\\xb2\\xf1\\xa6\\xeet\\xa8\\xb9\\x9c\\xb8$q\\xa4\\xfauk\\x01\\xd5\\xc6g\\xcc\\x08i\\x1d\\x98!\\xb1\\x9a`,'\\xcd\\xb7\\xb3\\xcd\\xa8\\xfa\\xec\\x96\\x98\\x11\\x17"
  782.  
  783.  
  784. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6y\\xb6*<\\x98s\\xfev\\x97\\xd1\\xf5\\xa73yn\\xa6%\\x98&o\\xb4\\xb3\\xe3\\xf2s\\xb5\\xa9\\x9fnpp\\x8cm\\xcd3\\xf2=\\x0f\\x1bi\\x90#\\x06e\\xdd\\x1e\\xd2-\\x8d\\x85\\xa5\\x84\\x18^\\xb0v\\x00\\x07\\xef7bwv\\xb1\\x93\\x88,s@\\xd6\\xcav\\x02\\x83) u\\x1b\\x97!1\\xb1*|_\\xc8\\xcce\\xda\\xf1g\\x91\\x9eb\\x89\\xb5\\x04v9o\\xd5\\x05\\xf9\\xec\\xf6j4t\\xb6\\xd1y,\\x1e<z\\xf2+\\xa8\\xb4\\xf2\\x8f\\x82\\xc5$\\x8f\\\\x8b\\xc9\\xe7r\\xef\\xab\\x03\\x91i\\x1d\\x18c\\x15\\xa4xi\\xa9\\x82\\f\\x01\\xed\\xd4\\xb3\\x1b@\\xac\\x12\\x81\\x9f\\xb5\\x80\\x00\\x8d\\xc0\\xdem\\xcf\\xcb\\xef\\xe9\\xe3n\\xfe\\xb5\\xfcq\\x15\\x0f\\x85x\\xf5k\\xb4\\x88\\xc2\\x07\\x9e\\x08\\xc0\\x0b\\xf0\\xce3\\xfc\\x86\\xd9v\\xf4\\x0en\\xaf\\xf2\\xaf\\x84,\\xae\\xc1\\x9d\\xea\\xfc\\xc3n:\\xed\\xab\r\\xe6\\xd5\\xa5\\xac\\xa4\\xe3\\x19\\xf2\\x17\\xd7\\x9b\\x9e\\xde\\xf4\\x19m\\xd4h\\xe0&\\xb2\\xd5\\x18\\x01\\x90\\x08z\\x85\\x98\\xd6\\x05\\x0b8\\xa2u\\xa4"
  785.  
  786.  
  787. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f\\xcf\\xba\\x85\\xf4\\xd6v^\\x9e\\xbbh\\xb4\\xd3\\xc2\\x10\\x0c\\xbb\\xc4\\xd3\\xdf\r\\x84\\x93cl\\xe2=\\xb1\\xb7\\xc27\\x1e\\xfc\\xe4\\xa82\t\\xaase#z\\xe0e\\xdesuec\\xa8.e75\\x83\\xa8\\xe0\\x81!/\\xcd:\\xae\\xb4\\xc1\\xb9,\\xf1\\xb9\\xff\\x95 \\xd3>d;o\\x8f\\x97\\xc6\\x9c\\xa5\\xd1m\\x02\\xc7\\x94\\xf8\\xee\\xc6+8i,\\xc5\\xda\\xde\\xae\\x06\\x962.\\xf4\\xb2\\\\xf8\\x8c'h\\x85\\x8c\\xb4#\\x87\\xe9\\x8e\\xde\\xcf\\xcd\\x1d\\xf4\\x00\\x8d\\x81\\xb6\\xe8\\x8a\\x86\\xe1\\xe9\\xc0r\\xeb;ip\\xe7pb.\\x08p\\xcf\\x87 cu=yi\\xf7\\x14\\xa0\\xa5\\x0e\\x89\\xbf\\xe1g\\x1e\\xfb\\xc4s~\\xce\\xd9f\\xb7f\\xd5\\xa2\\x9b\\x99\\xcd>a\\xb9gj\\xb4x\\xc14\\x1d'\\xac\\x95\\xa0\\xc4\\xab\\x8f\\x16dr\\xaf\\xef\\x85\\xa7z\\x02l\\x83%\\x8e\\xc7\\xc4~\\xfd\\xebo\\xbc\\x83\\x84\\xd0w\\x9b\\xacz_\\xec\\x06\\xe7e\\xb2\\x06\\xf4\\x7f\\xea\\x13\\x9a\\xa4\\x03z8%pj\\x0c\\xcf\\x84o\\xc3\\xb6\\x11\\xe2"
  788.  
  789.  
  790. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad7\\xe3i\\x86\\xa7\\xa9\\x10\\x0c\\xbet9\\x88y\\xafd\\x07\n\t\\xbbo7\\xd2(yr9\\x8a\\x11 \\xec(\\xd9p\\xe9!ky\\x9e\\xaa\\xd9\\x9e\\xfcq\\x83@\\xbe\\x04vu\\x04q\\xa2\\x8e\\x144\\x96\\x08\\x9f$\\xf4\\xba,\\xe7\\x9fh\\\\x85s\\x9b\\x1a6\\xabg\\xcc\\x8fq\\xf6\\xe3sdv\\xe8\\xba\\xeet\\x95\\xf4\\x1ax\\xf7\\x88\\xee\\x07;\\xd0l\\xff\\xe2\\ng\\xa5,\\x037\\x02\\xcc(\\xce\\xe0\\x94xn\\xb0\\x0f\\xb0\\x91c\\xf1\\xdc8\\xe4\\x9f\\x8f\\xd4s\\x81\\xed\\x0b\\x0c\\xcd\\xdb,y\\x08\\x8d#\\x0b\\x97\\x1d\\xf7\\xe2\\x9cwi\\x0cv\\xea\\x9ae\\xe9\"-\\x05\\xb3c\\x96\\xcd\\xa7\\xca\\x94\\xa7\\x93\\xf9\\xfd4\"\\x04ir\\x0b\\xf5r\\x98\\xa1\\x16\\xdf\n\\xcb\\xf2\\xf6\\xf8\\x0b\\xa3m\\x12\\xef\\xc0\\x15\\xe0(\\x01g\\xf2\\xf9\\xa5v9j\\x06\\xe8\\x9a-\\x88o5\\xc8\\xe4x\\xfa\\xc7t\\xae\\xdcx\\x8a4-\\x94\\xd7$\"\\xda\\xa3\\xcf\\xa6jfxc\\x1ay\\xa5+k\\xa8\\xe6\\xb3<\\xfc\\x19\\x91e8"
  791.  
  792.  
  793. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,4m\\xbcu\\x9f\\x10\\x986b\\xff\\xd9\\xce\\xedte\\x8fcx\\xc3\\xd6\\x11cr\\xa0;!\\xe2\\xdf\\xc3\\x95<\\xf4\\xd2x\\xad\\x8f\\xa6j\\xde\\xb8\\xa3mf\\x03\\x11\\x8d\\xc9l\\x0f\\xde\\x0eis\\xe7\\x12\\xbe\\x8f\\x8a\\xf6\\xd5\\xbc0\\x92\\xe8g\\xff*\\x98\\xa0b\"\t@\\x90\\x15?\\xf6\\xa5\\xa5\"\\xb5\\xdat4j\\xbb\\xf9\\x82\\xc5%\\xff\\x7f>\\x00\\x0e\\xf5\\x97\r\\xfa8\\xb9(\\x93\\xcd\\xe3,\\xa6%e\\x9b|\\x8d\\xd5\\xbc\\xb1ip\\xafy\\x11\\x7f\\x96x\\xb5\\xe7\\x97\\xce\\x90g0v7\\x11n\\xb2\\x11<@\\x15\\xffzf\\x8el\\xe4\\xb0\\xb9\\x8a\\xa9\\x90\\xd5\\xb6\\x98\\xbe\\x04\\\\xba)\\xf0u3\\xe9f*\\xbcg\\x1d\\xb2nz\\xd8r\\xc0\\xa5\\xaf\\x909\\xda'r\\xe4t\\x90d\\x02d+rp%\\xb1r\\xac\\xf6\\xf4\"\\xcd\\x169.\\x910\\x1c\\x06\\xe0e\\xf0km\\xfc\\x05\\x8f=\\xb0\\xc3q@d\\xe3s\\xf7d\\xfc\\x88\\x13\\xfc\\xfe\\xc7vf\\x98+\\xae\\xcb\\xc1\\x08o\\xd16\\x7f-\\x0c`p\\x85\\xe7\\xf0"
  794.  
  795.  
  796. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\x91r\\xe8\\xe4\\x1crh\\xc1~\\xf5n\\xd9\\xbb\\x81vy\\xcc\\xb4\\xaeq\\x01\\x90\\xe9\\x91.\\xfd\r\\x19.\\xef)\\x8b\\xa4`\\xa5\n\\xba`\\xe5\\x927:\\xbb\\x8ca\\x1d\\x86\\x1f\\xe3&\\xc5b$\\xbe\\xcf\\xac\\x1b\\xd2\\x06\\xfa\\xb5\\xbe\\xd3\\xe2 \\x18\\xc0\\xb4p.\\xc8\\xb6l\\x94\\x13%j.e\\x82\\xbdi\\x84\\xe8\\x9b\\xf2\\x86%\\xf6+e\\xf79 b\\xf7\\xb8g\\xf4\\x8az\\xe8\\x0b\\x00\\xe4\\x0b\\x9c\\xb8?z$\\xa19\\xbcm\\xe5-\\xe8\\x9a\\xca\\xd1\\xd7?:\\x9c\\xfa\\x958\\x1a/,\\xdf\\x90\\xae\t\\xbf5\\x0c6\\x10\\x9e\\x1a&\\xc8p\\xcb\"\\x98\\xd3\\x7fn\\x96\\xd0\\x1d\\x7f\\xaf\\x8fr\r@\\xbe\\x9b\\xd9\\xc8\\xa8\\xaek\\xaf\\xf6aq\\xbbp\\xb3\\x02\\xdc\\xd6p\\xf8\\xb6i\\x9e=\\x0c\\x0f\\xe8\\xc1\\x01ut49\\xbeq\r^\\xa9\\xe3\\x84\\xd8\\xb7\\xeb\\xa2k\\xfd\\xac\\xb4\\xda\\xf48\\xef\\x03\\x9f\\xb5\"l\\xced\\x040\\xc7\\x944\\xff1\\x9fpt\\xb5nd\\xb0\\x08\\xec\\xff\\x8b\\xdd$\\xad\\xd4d"
  797.  
  798.  
  799. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08\\xf7f\\x17\\xbe\\x8an\\xedr\\x0c\\xd6\\x0e\\xfei\\xa9\\xd0ht%\\xccy\\x84\\xb7o\\xb8\\xfb\\xce\\xc8?\\xfa\\xb4\\xcc\\x12\\x04\\xa5l\\xf6l\\x04\\xdb\\xab!\\xdbp\\xff\\xac\\x14\\xcfy\\xd4\t@\\x0e\\x8e\\x01\\x86b\\x80\\xa8/\\xa0q#\\x89zm\\x8e\\xd5\\xbd\\xe9\\x13\\x8f\\xc5=_vovp&\\x05\\xf4h<\\xee\\x16\\xb4\\x12+)\\x98\\xeb\\xfd\\xea\\x89\\xfc\\xc7\\xc5\\xad\r4p\\x89\\xba@z\\x9c\\xf9\\xcf\\xe5<\\x85?o-\\x92@s\\x11\\xc2\\xc8\\x82x\\xf9\\xf8\\x05\\xfa\\xde(\\xc7\\xb4\\xe1~\\xcc\rik\\xcbd\\xd0\\xbbp\\x03\\xfe\\xcb\\xb3\\x8bi\\x1c*\\xc9;\\x8c\\x9c\\x8a\",\\xb9-\\x98\\xdd#\\xdcx\\x8a\\x05\\xc9(v\\xeb\\xd3/\\x92q\\xba\\x7f\\x89\\xec\"\\xcd\\xca\\x830z)\\x13\\x8arp\\x03\\xfd\\xeb\\x02\\xba\\x05\\xe2q\\x02\\xd9\\xcb\\xce/e\\xc7\\xe7\\\\x94\\xd75rl\\x80r\\x81%\\xea\\x82\\x0cwv\\xec\\x0c\\xc0\\x1ce\\xa5\\x8e>\\x8d\\xe2\\x81\\x94;z\\xe5!\\xfc\\xac\\xdd\\x90w\\xf5;\\xbb"
  800.  
  801.  
  802. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\x12\\xc1.w\\xf2e\\xa5\\xe6/\\x138\\xc3\\xfb\\x90\\x19\\xda2t;e\\xeft\\xa1\\xde\\xb9\\x17\\xe1g\\xe4\\xd3\\xb6\\x06c^\\xc6\\x1b\\xb6\\xef\\xc5m(;d\\x80\\xdeqsq7\\xa3q\\x9c\\xc7\\xcd\\x91\\xc0\\xa6\\xb1@d\\x9e\\xb5a\\x13\\xe4\\x86k\\xf3;7\\xd0\\xe8=6\\xcb\\xeahkm\\xe4\\xce\\xa3\\x85\\x03\\x90\\xde\\x9cn\\xe2;tn\\xd9\\x13n\\x943\\xa8\\xe4\\x8fy6\\xb0\\x864\\xf3\\xe54\\x84\\x0e\\x8e\\xa6\\x87.\\xacb\\xa1r\\xf6\\xa0\\x82\\xd1\\xf6y\\x8f\\x03\\xeac\t\\xbb\\x10\\xd4a\\xb6?\\x99\\xd2\\x87y\r\\xcdu\\x16zbp\\x02-\\x8f\\xfb\\xe4m\\x87\\xe2x\\xfe+\\x89\\x9al\\x02c\\xcd%0\\xbat\\xc8\\xeds\\x9e&\\;\\xdc3j\\xc5\\x0b^\\xc5(\\xa9\rg\\xab\\x85\\xa9\\xcef\\x198ah\nq\\x86\\xca\\x19\\xee\\x0c0\\xeb\\x96r8#w\\x0b\\x1e\\x85\\xf6\\x84\\xe0a'\\x7fu\\x8c\\x15\\xb5\\x91j\\x16j\\x14\\xf3\\xfdp\\xc4\\xa5\\xb9\\xd8\\x83\\x9e\\xc9\\xefl\\xbc*\\xd8vw\\xe5\\xa7"
  803.  
  804.  
  805. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xabzz'ua=\\x12w\\x8e8\\xad\\x80\\xf7\\x9e\\xac\\xd9\\x9c\\xa2\\x93\\xf9\\x9dk\\x03@\\x88afj\\xee\\x94\\xea<a\\x9c\\xf0\\xb4\\xf8*\\xa7\\xa2;\\x1bz\\x03\\xcd\\xb89\\xa6\\xe5\\xe4t\\x01\\xca\\xf6p\\xb8n\\x1ef\\xf9\\xd6\\xc5\\xa5\\xd99\\x92(\\xab(gp\\xb6\\x15pc\\xed\\xa8^\\xf6<\\xf7\\x12~\\xf2\\x0bn\\xa8\\xf5\\xd9>\\xeb\\x1f9\\x8b\\xb7\\x04(\\xa1z|l\\x1f\"=u\rm\\x7f\\xd9\\xacp\\xca\\x9e\\xb83bz\\x14\\x03\\x002\\xac\\x81t\\x90gznxu\\xf05m\\xe9\\xd5\\xfb\\x12s\\xe1\\xd8x \\x1f\\xfc\\x10\\xd1<\\x8e\\xec\\x0b\\xe6'\\xb5\\xc7h.\\xb1\\xc5z7h5(\\x11\\x9f\\xfc\\xcf\\xac\\xf3r\\xb4\\xb6\\xf3\\x17e@4\\x8b=xin\\x99\\x03\\xe2\\x1a;\\xfd\\x1f\\xb3\\x1b\\xfd\\x97a\\xed<\\xb5\\xde\\x9c\\xccb\\xb4\\xa7\\x8e7\\x12\\xe0\\x01\\x9fu\\x9f\\xf1\\x83\\x83j\\\\x02\\x8bni\\x96\\xfa\\x0f\\xa3\\xd7\\x8ag\\xc1y1\\x914\\xd3\\xd3x\\xad\\x83b\\x1b\\x86\\xe4\\xa6x\\x85l\\xf9\\x19"
  806.  
  807.  
  808. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\g@\\xc5\\xf41\\x1b(\\xbc\\x04\\xe3b;\\x08\\x8e\\x9c\"\\xe1;\\xe0\\x0f\\xa9\\xdd\\xba\\x9aq\\x93@'9\\xb7dq\\xbcof;\\x8b\\x0bh\\xab\\xed\\xcf\\xfe\\xc0\\xbci.pn\\x9by\\x86\\x0e\\xfc\\xed\\xf5\\xc8\\x03v2\\xc8\\xbdf\\x12#(\"\\xa6q\\x033\\x9c\\xb3oe\\x16\\xa3\\xd1os\\xaf\\x8d\\xf2@d\\xca\\x9e*\\x04!\\x15\\x10~8m@u\\x0bk\\xb5a,*\\xd4z@\\xee\\xe1\\x19u/\\xa7*dpw\\xcc\\\\x0b\\xa6\\x83\\x87\\xee\\xa4\\xce\\xadr*\\xb5\\xa5\\xe5\\xb1h\\xf7\\x88j\\x99\\xb2bn\\x063\\x93\\xd9\\x9a\\xb0\\x8b\\xf8i\\xca\\x92\\x800|d\\x94m\\xc1h\\xd8\\xb30\\xbcr\\xba\\xbf\\xbf\\xfa\\xe6\\x9d$l\\xe0j\\x8c</bth.\\xd8\\xa7\\xb7d\\xcb\\x04\\xe9\\xa9\\x9e\\xe4m\\x86\\xa0w\\xcb\\x11ra\\xf6\\xda\\xef\\x82\\x01\\x855i\\x08\\xff\\xb9\\x89\\x1c\\xf0\\xa43\\xe8\\x85m\\x1d\\xa6\\x83q\\x00\\xe5\\x8bg\\x95\\xf4\\xd6s\r\\xcd\\x01\\xb3\\xdb\\xb0k\\xd6@\\x82i\\x1d\\xbd\\xec\\x8a\\xe3"
  809.  
  810.  
  811. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\xe7\\xa7\\xb7\\x06wv\\xf8h0m\\x8a1\\xae4\\x86,\\xfb\\x1d\\x8a\\x9d\nl\\xef^\ro\\x14\\x80h\\xaf\\xb0r\\xed<\\x03\\xdbt\\x8d(\\xb6\n\\x9b\\x8b\\xca\\x17m\\x96\\xfb\\x9e\\p~\\xfa\\xf5\\xd5\\xe7\\xc8m,\\xdew\\xab\\xe5\\x90\r\\xc3\\x1cm!2&\\xf4im\\xa43\\xec\r\\xfe\\xf6\\x16h\\xd1\\xc1\\x93x\\xf5gx\\xbe\\x10g0;\\xd8e\\xd0?\\x8a\\xc8\\xd7m\\x93.\\x07\\xaab\\xdd\\xc6\\xacf@8\\x90\\x918\\x83\\xf0\\xa4q\\xbe\\xd0#\\tf\\xce\\xba+\\x13\\xc0\\xcet\\xf7\\xa2t!\\xd5*g\\x8ch;zl77\\x89\\x11im\\x15\\x9f)\\xf1\\x8b\\xe7\\xda\\xa1\\xf8\\xd6?\\x87\t\\x83\\xca\\xabb\\xcd\\xf2\\x0b\\xeaf!t\\xb8\\xbb\\\\x9f*\\xe2xj\\x99\\x9b\\xe1n\\xcb\\xcd\\x9d\\xbb\\xba\\xd0\\xa5\\x02uk)\\xed\\x9fm\\x9f\\xb6\\xfa\\xe4\\xb6\\xeds\\xf3$g\\xf8\\xa7<\\xf0\\xde\\xed\\xf3\\x08\\x98+`\\xd4\\xd5z\\x82\\x13\\x1a\\x06u\\xda!<\\xcb?\\x9a\\x9c\\xec\\xa0\\x0eoq\\xfea:\\x91\\xadn"
  812.  
  813.  
  814. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x93\\xe0f\\xec\\x9bn;f\\x92#\\xd5\\xee\\x1b'\\xa7\\xcc\\xc91\\x89\\xcd\\x87 \\xb1,\\xf4`\\xa2\\xc1!\\x85\\xec\\x1a\\xb1a\\x16\\xb83\\xe3n\\xa8\\xba\\x03k\\xd7\\x84\\xfb\\x1e\\xea\\x03\\xd6\\x1f),\\xf7\\xf7\\x03\\xf2x\\xf3\\x1fz\\x17\\xbd\\xddb\\xac.\\xa9;\\xaa\\xa5\"\\xda$\\x039\\xb2\\xcbo\\xd2s\\x06rx\\x8b\\xb1\\xa4he\\x920\\xeb\\xfa\\xf6\\xda\\xa6w\\xa0\\xa6\\xd2q\\xe3c\\x19\\x02\\xa2\\xa9s23o\\xbch\\xb2\\xcf\\xb4\\xeb\\x81\\xdd\\xf9\\xf3t\\xe4\\xdf\\xdfpf\\xcb\\xf1\\xe7\\xfdj\\xn\\xe2\\xd0`\\xfc\\xeb\\xb8\\xea\\x0ey\\xdb\\xef4m\\x90\\xfc\\x858\\x14y\\xd2t\\xe0\\xaf;\\xd24\\xe2\\x98\\x9a\\xb5\\x97v\\xe9\\x9e\\x96q\\xf8a\\xbdq\\x00t\\xce\\xde\\xd5\\xb8\\x8fw:%~\\xc5\\xa1\\xeda\\x8a\\xf9\\xa4\\xcf\\xf6\\xac\\xb5vy\\xbe>\\xbd\\xaa\\xf3\\x8b0\\x9c\\xc4sb\\xe2\\xe6\\xa4\\xa9\\xb0p\\xb69\\xd2\\xa6;b=\\x7f\\xd5\\x14\\xf5yc\\xce&a\\x1c\\xa8\\xe54i\\x04\\xcas\\x96\\xfe\\xe9\rqm"
  815.  
  816.  
  817. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xeb\\xe3\\x83\\x13\"\\x0b\\x83\\x8d3~\\x84m:\\xf0\\x92\\x03\\x1a\\xa8\\xe6jw\\xec\\xfe\\xf5l\\xf7\\xfb\\x93\t\\xf0\\x864\\xa6\\xc0_!r\\xd5\\x14\\x03@vl\\x01s~d\\x96\\xb9e\\xe9\\xf7\\xdf\\x8e\\x9a\\xcf\\xa0\\xe6\\xba\\xe8\\x88\\xfdka\\x0b\\xdf\\x97_\\x97v+\\x95\\xaa\\xf3\\xa8\\xca\\x15h@9i\\x9e\\xcd\\xf4\\xe9\\xda\\xaf\\x13\\xc1\\xd7\\x0c)\\x80)\\xdf\\x97\\xc7\\xbcq \\xc5\\x95\\x0c\n\\xcfh\\x0e\\xd0k\\xe5m\\xe7|\\x96\\xbf\\x84\\xc8\\xa2\\xe0\\xd6\\xcd-\\xff\\xe4\\xe5\\xadth\\xf1\\x05\\xcd\\xef\\x98okg\\xbdi\\x0ci'\\x93\\xfb\\x9d\\xad\\x8a5f#f\\x80\\xe5\\xd2y\\x82`\\x92.o\\xae\\xcc\\x08\\x9e1\\xd9\\x816&)w\\xcf\\x8d\\x10a\\x1f5y\\xbe\\xab\\\\x1d^u\\x9f\\x85wq\\x1c\\xa8\\xad\\xfa\\x92\\xaf\tr\\xf4\\xd4~&\\x995\\xa0~r4i\\xe8\\xe5\\xf1s\\xa1\\xa4\\x819\\xfb\\xef,\\xae\\xc3\\xb2\\xcct5n>z\\xbcm\\x93\\xe5\\x9f|u6\\x11\\xb3&\\x14\\x12/\\xc9\\xc7\\x90\\x14\\x9a>"
  818.  
  819.  
  820. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3m\\xc7\\xdf\\x92e\\xc2\\x9ce~_wg\\x9du:\\xb6\\x97~\\xee\\xbf\\xef\\x035r\\x1c\\xdbl\\xc5\\xbf\\xc5\\x93\\x8dj\\x89b\\x9e\\xe6_\\x04\\xe0f\\x890x\\xc9'\\x1c\\x8c\\xf4p\\x04*\\xc9\\xbca\\x90f(c\\xbb\\x16l\\x91w\\xaa\\x9b\\x10\\x7fdz\\xe8\t\\x95\\xcc\\x88\\xc9\\x8f~\\x9e\\xb3\\xe2x\\xb7\\xef\\x08\\xfb\\x8erc\\x93bi\\x1d\\xbc\\x15\\xc3\\x90\\xa6\\xcf\\x17\\xe5\\xa3\\xdf\\xe1\t\\x8ei\\xc7v\\x03q\\x12<\\xd1\\xban;\\x1a\\x8cg4\\xc03y\\xfdo\\xd6\\xb0\\xe7\\xea\\x0b\\xc6.:\\xbcw\\x8bi\\x18\\xfe\\x8d\\x83\\x02|q2\\xa7\\x13:\\xbd(\\x91\\xc8\\xbek2\\x80z0\\xeb\\x1db\\xc5\\xbf\\x10y\\x05\\x8c\\xb7\\x97\\x9f\\xf6\\x85s\\xae\\x19\\x8e\\xc9\\xdd\\x93\\xe6\\xc6\\x81r\\xe1:\\xc3\\x90\\x1f\\x11\\xcc\\x8d\\xack\\x9a;q$\t\\x12\\x05g\\x8a\\x91\\xbes\\x13\\xeb\\xf9b\\x94\\xa2\\xab8\\xb1\\xa3\\x05o\\xaf\\xbcq3\\xba\\xa0\\x1b\\x92\\x83,pm\\x11\t'\\xe4\\x98\\x0c \\xe5c\\xff\\x10\\xc5\\x9e\\xb5\\xa0\\xcb"
  821.  
  822.  
  823. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  824.  
  825.  
  826. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$\\xd6r\\x1f\\xc7\\xcet\\xd67\\xaa\\xd7\\x1bt\\xa8\\xb9\\xe6fc`\\x10\\x0c\\xd8\r\\x94)\\xa1\\xd5\\xae\\xc4c\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  827.  
  828.  
  829. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00y\\x9b\\xb3\\xbb\\xe1\\x80y\\xb29\\xd0\n\\xdd\\x02\\x02\\xc5\\xb1\\xc6d\\xac\\xdc \\x01@\\xe0'\\xc6\\xe4\\x1b\\x1f\\xc2\\xd1\\x88nr\\\\x07y\\xc9^l\\x9a\\xe2\\xd3\\x1e\\xce\\xa5,\\x07\\xd8\\xf1\\xacx\\xfe\\xd2\\x19\\xf9(n\\xb9v\\xae\\xfe\\xef\\xe5\\xd6\\xfa\\xb5\\xda\\x01j\\xe5\\xc5l\\xc2\\x9fe\\xe6\\x173\\x14\\xf9\\xdar\\xaco\\x94\\xec\\xe2\\x0c\\x90o\\xc8(\r\\xc1\\xe8g\\x99\\xedpn\\xd7\\x04\\xdb\\xf3\\xb2\\xe0\\xab\\x18\\xb8\\xef~\\xa5\\x0c\\x00\\x1dy\\xcb\\xb3w\\xcf\\xb6\\xec`\\x19\\xb5\\x94e\\xf6%\\x9f\\x15\\x9d1\\x9c@\\xc5\\xf63\\xe6\\xaab\tc\\xc5mo\\x13\\x0fh\\xfb\\xa6?~b\"\\xfb1\\xa5t\\xdag\\x8e4\\xfa\\x94)\\xeb\\xf0\\x89\\xb0v\\x8e\\xcd\\x9a\\xeb\\xa3|d\\xc0z\\x97\\x02\\x17\\xb8elu\\xac\\xd4\\x026\\xd8$h\\xe2\\xb3\\xfcnk\\xb6\\x8f\\xfex\\xa1xu\\xaa\\x0b\\x91\\x01\\x98+n\\x97\\xe2a\\xf6\\xbb\\x7fhco\\x9d\\xbc,8\\xf5\\x98\\xff\\x8c\\xf0\\xf7\\x94\\x83y\\xd8=w\\xa9\\x10"
  830.  
  831.  
  832. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xbd=\\xf9\\xd1\\x86\\x93\\xb6\\x0eo\\xe66\\xfdu\\x8b\\x0f\\x90pms\\xf6\\x08\\xc5\\xcaz\\xd7\\x1e\\x89%/\\xfc\\x9bhk~\\x7f\\x00\\xe4?<ok\\xcd\\x1e\\xdfp\\xd4e\\xf5\\xe8t\\x9a<\\xf1<q\\xf9\\xc1\\x16e\\xaa\\xef\\x8af\\xd3\\xbe\\x97\\xde\\x8c\\xe3\\xda1@\\xca\\xf9l\\xd7\\xf3\\x04\\x14\\xeb\\xff\\x97\\xaa\\xebf\\xfd\\xfa\t\\xe7^wlt\"\\x05\\xd9\\xa8\\x1c<\\xa4\\xe8\\xd1\\xab\\x96<\\xd7s\\xad\n\\x04b\\xc8w\\xde2\\xf0\\x03\\x9ehg/\\xc5\\xfc\\x03jq\\x8b/ \\x8cy\\xd31\\xce\\x96\\x85u\\xfe!h^\\x1fx\\x1d=\\x0c\\x18\\xb3\\xe6\\xb6\\x82\\x02\\\\x93\\xb53\"g\\x99\\x04`\\x977\\x80\\xda\\x98\\xdb3\\xf6z\\x88\\xb0c\\x9c\\xacg\\x94\\xb1\\xd9\\xf0\\xd4\\x00\\xa6a\\xdb\\x13\r\\xd6\\xd1\\x17\\xe0\\xa2c'\\x15\\x9e\\xcf\\x8cs-\\x06\\xd2\\x82\\xd2\\xf3\\xa2vt\\xa4\\xc3)\\xae\n\\xff \\x9dw\\xb1\\xdft\\xa7*\\x9f\\xbc\\x9fb\\xb4t\\xca\\xca\\xb8\\xa5+\\xf6\\xa4\\x1d\\xc6\\xe0\\xce\\xef\\xf0\\xf7mh\\x9e"
  833.  
  834.  
  835. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x194\\x991\\xc6\\xe3\\xb2\"\\x8dgd^\\xb7\\xa8\\x16j\\x811\\xd1~\\xbe\\xee%\\x98z\\xf9'\\xbf\\x89o\\xecf\\xb9>\\x07h\\xbc\\x9dr\\xb3\\xa6\\x93\\xf8\\x89>\\xf9\\x10o\\xda\\x7f\\x8b-\\xddu\\xa8os\\x80\\x8ej\\x02z\\xd7\\x1a\\xe6\\xd6v\\xcd:\\x05\\x9e\\xc4\\xa9\\xe3i \\xf1\\x0e\\x9f`\\x00\\xa4\t7l\\x89f%t*v\\x8bk\\xdd\\xb4\\xcb\\x9flm\\x14\\xe7\\x9a\\xc7\\xf8\\xd1\\xfa\\xcc\\xd5,m\\x93j\\x18j\\xa79qf\\xdb\\x8c+-\\xd1\\xd9\\x13\\xf95\\xaang\\xfa\\x80.\\xa1\\x92\\xe4.\\xc9\\xe9e_(hpa\\x99w\\x9eu\\x13`i\\x0f\\xd9\\\\x85>\\x9b\\x1b\\xe0.1+\\x80\\xc1\\xde2\\xd4\\xe36\\x02\\xae\\xdc\\x8c>\\xcd\\x00k\\xd19\\xbcz\\xe5\\xed\\x9a?\\xe1\\x9cz\\xdb\\xfe\\x9a89\\x05\\x03\\xfd\\xe8\\x97_\\x98r\\xddl\\xfc\\xf9b\\xca!\\xbd\\xa1\\x01>\\xce\\xf9\\xd8\\x95*\\x92\\xc8\\xc0\\x83j\\x93.\\x9e\\xcc\\xd8)c\\xb7\\xfd\\xa8\\x08\\xd9\\xd0\\xb7\\x98\\xd6\\x8b;\\xee\\x1e\\x15,"
  836.  
  837.  
  838.  
  839.  
  840. "Description": "A process sent information about the computer to a remote location.",
  841. "Details":
  842.  
  843. "Beacon": "verclsid.exe: GUID=13962714691609739288&BUILD=3101&INFO=Host @ Host\\user&IP=0.0.0.0&TYPE=1&WIN=6.1(x64)"
  844.  
  845.  
  846.  
  847.  
  848. "Description": "Creates a hidden or system file",
  849. "Details":
  850.  
  851. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  852.  
  853.  
  854.  
  855.  
  856. "Description": "File has been identified by 43 Antiviruses on VirusTotal as malicious",
  857. "Details":
  858.  
  859. "MicroWorld-eScan": "VB:Trojan.Agent.CZVU"
  860.  
  861.  
  862. "CAT-QuickHeal": "W97M.Downloader.XP"
  863.  
  864.  
  865. "McAfee": "W97M/Downloader.cpg"
  866.  
  867.  
  868. "Arcabit": "VB:Trojan.Agent.CZVU"
  869.  
  870.  
  871. "NANO-Antivirus": "Trojan.Script.Downloader.espncc"
  872.  
  873.  
  874. "F-Prot": "New or modified W97M/Donoff"
  875.  
  876.  
  877. "Symantec": "W97M.Downloader"
  878.  
  879.  
  880. "ESET-NOD32": "Win32/TrojanDownloader.Hancitor.I"
  881.  
  882.  
  883. "TrendMicro-HouseCall": "W2KM_DLOADER.AUSUAZ"
  884.  
  885.  
  886. "Avast": "VBA:Downloader-EHP Trj"
  887.  
  888.  
  889. "ClamAV": "Doc.Dropper.ZwMacros-6057750-0"
  890.  
  891.  
  892. "Kaspersky": "Trojan-Downloader.MSWord.Inject.g"
  893.  
  894.  
  895. "BitDefender": "VB:Trojan.Agent.CZVU"
  896.  
  897.  
  898. "Tencent": "Win32.Trojan.Inject.Auto"
  899.  
  900.  
  901. "Endgame": "malicious (high confidence)"
  902.  
  903.  
  904. "Emsisoft": "VB:Trojan.Agent.CZVU (B)"
  905.  
  906.  
  907. "DrWeb": "W97M.DownLoader.1510"
  908.  
  909.  
  910. "VIPRE": "Trojan.OLE.Generic.a (v)"
  911.  
  912.  
  913. "TrendMicro": "W2KM_DLOADER.AUSUAZ"
  914.  
  915.  
  916. "McAfee-GW-Edition": "BehavesLike.Dropper.cg"
  917.  
  918.  
  919. "FireEye": "VB:Trojan.Agent.CZVU"
  920.  
  921.  
  922. "Sophos": "Troj/DocDl-HDH"
  923.  
  924.  
  925. "SentinelOne": "DFI - Malicious OLE"
  926.  
  927.  
  928. "Cyren": "W97M/Donoff"
  929.  
  930.  
  931. "Jiangmin": "Trojan-Downloader.MSOffice.t"
  932.  
  933.  
  934. "Avira": "HEUR/Macro.Dropper"
  935.  
  936.  
  937. "Antiy-AVL": "TrojanDownloader/MSOffice.Agent"
  938.  
  939.  
  940. "Microsoft": "TrojanDownloader:O97M/Donoff"
  941.  
  942.  
  943. "AegisLab": "Trojan.Script.Generic.a!c"
  944.  
  945.  
  946. "ZoneAlarm": "Trojan-Downloader.MSWord.Inject.g"
  947.  
  948.  
  949. "GData": "VB:Trojan.Agent.CZVU"
  950.  
  951.  
  952. "TACHYON": "Suspicious/W97M.Obfus.Gen.6"
  953.  
  954.  
  955. "AhnLab-V3": "W97M/Hancitor.Gen"
  956.  
  957.  
  958. "ALYac": "Trojan.Downloader.W97M.Gen"
  959.  
  960.  
  961. "MAX": "malware (ai score=100)"
  962.  
  963.  
  964. "Ad-Aware": "VB:Trojan.Agent.CZVU"
  965.  
  966.  
  967. "Zoner": "Probably W97ShellA"
  968.  
  969.  
  970. "Rising": "Downloader.Inject!8.4A00 (TOPIS:E0:vXnyrLJiAkH)"
  971.  
  972.  
  973. "Ikarus": "Trojan-Downloader.VBA.Agent"
  974.  
  975.  
  976. "Fortinet": "WM/Kryptik.AP!tr"
  977.  
  978.  
  979. "AVG": "VBA:Downloader-EHP Trj"
  980.  
  981.  
  982. "Panda": "Generic Malware"
  983.  
  984.  
  985. "Qihoo-360": "virus.office.qexvmc.1075"
  986.  
  987.  
  988.  
  989.  
  990. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  991. "Details":
  992.  
  993. "target": "clamav:Doc.Dropper.ZwMacros-6057750-0, sha256:a5d793d4342073b7267db718e469007c26bd0528f538f6410a5aa02581ed14d2, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: William, Template: Normal.dot, Last Saved By: Windows, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Dec 31 13:23:00 2016, Last Saved Time/Date: Sat Dec 31 13:23:00 2016, Number of Pages: 2, Number of Words: 0, Number of Characters: 5, Security: 0"
  994.  
  995.  
  996. "dropped": "clamav:Doc.Dropper.ZwMacros-6057750-0, sha256:e46321b4e3b327698a521de1cccc1aca4c0d7c9a3996ff6370c3906fa69ddba0 , guest_paths:C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFB75EBC01-D930-4048-BEB9-C32555B269C4.tmp, type:Composite Document File V2 Document, Cannot read section info"
  997.  
  998.  
  999. "dropped": "clamav:Doc.Dropper.ZwMacros-6057750-0, sha256:baad1491c25eb7c251b4b7489d217aa09437b912c7c37eac9836865adca29d58 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_20dce54d319d7e9ed52fad367a518446.asd, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: , Author: William, Template: Normal.dotm, Last Saved By: Windows, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Feb 1 00:23:00 2017, Last Saved Time/Date: Wed Feb 1 00:23:00 2017, Number of Pages: 2, Number of Words: 0, Number of Characters: 5, Security: 0"
  1000.  
  1001.  
  1002. "dropped": "clamav:Doc.Dropper.ZwMacros-6057750-0, sha256:a5d793d4342073b7267db718e469007c26bd0528f538f6410a5aa02581ed14d2 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_20dce54d319d7e9ed52fad367a518446.doc, type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: , Author: William, Template: Normal.dot, Last Saved By: Windows, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Sat Dec 31 13:23:00 2016, Last Saved Time/Date: Sat Dec 31 13:23:00 2016, Number of Pages: 2, Number of Words: 0, Number of Characters: 5, Security: 0"
  1003.  
  1004.  
  1005.  
  1006.  
  1007. "Description": "Martian Subprocess Started By Office Process",
  1008. "Details":
  1009.  
  1010. "office_martian": "c:\\windows\\syswow64\\verclsid.exe"
  1011.  
  1012.  
  1013.  
  1014.  
  1015. "Description": "The office file has 2 macros.",
  1016. "Details":
  1017.  
  1018. "content": "The file appears to have no content."
  1019.  
  1020.  
  1021.  
  1022.  
  1023. "Description": "The office file created a suspicious child process.",
  1024. "Details":
  1025.  
  1026. "Processes": "WINWORD.EXE -> verclsid.exe"
  1027.  
  1028.  
  1029.  
  1030.  
  1031.  
  1032. * Started Service:
  1033. "osppsvc"
  1034.  
  1035.  
  1036. * Mutexes:
  1037. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1038. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1039. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  1040. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  1041. "CicLoadWinStaWinSta0",
  1042. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1043. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1044. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  1045. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  1046.  
  1047.  
  1048. * Modified Files:
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_20dce54d319d7e9ed52fad367a518446.doc",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA9AD4993822766D9.TMP",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_20dce54d319d7e9ed52fad367a518446.doc",
  1052. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS51813AD8-D0E5-4DB8-A256-0CE1EC9D3B5B.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS584FEAAD-15EE-437A-89C3-177EEC99C91B.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  1055. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFB75EBC01-D930-4048-BEB9-C32555B269C4.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF67A99D226CE62A5A.TMP",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  1058. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5A905223B0A872CE.TMP",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD467AB566C59761E.TMP",
  1061. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1062. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1063. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F",
  1064. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\82CB34DD3343FE727DF8890D352E0D8F",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_20dce54d319d7e9ed52fad367a518446.asd",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF383E3171C3FDCDD.TMP",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1068. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1069. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2934.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2935.tmp",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4E60A3703A738F62.TMP",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42F8.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4309.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4319.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5366.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5368.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C7.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5367.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A26.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CC.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C8.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CB.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDC.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CA.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C9.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F8F.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FCE.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7E.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5ECA.tmp",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EEE.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDD.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7D.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDB.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FCF.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6225.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EEF.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6138.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6149.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6139.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6237.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7C.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6236.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6882.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6871.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BA0.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7342.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\cab773B.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7836.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA1.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA487.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB179.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB802.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB999.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD70.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB9AA.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDD81.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB9CA.tmp",
  1120. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1121. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1122. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TarE002.tmp",
  1124. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1125. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE821.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEA16.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEC79.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEE9E.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDECC8.tmp\\Element design set.dotx",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDECC8.tmp\\Content.inf",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2D5.tmp\\chevronaccent.glox",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2D5.tmp\\Content.inf",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF798.tmp\\HexagonRadial.glox",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF836.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF886.tmp\\ConvergingText.glox",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF798.tmp\\Content.inf",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF885.tmp\\iso690.xsl",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF886.tmp\\Content.inf",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58C.tmp\\mlaseventheditionofficeonline.xsl",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A.tmp\\architecture.glox",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD577.tmp\\Equations.dotx",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD577.tmp\\Content.inf",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD578.tmp\\Banded.thmx",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B.tmp\\PictureFrame.glox",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF885.tmp\\Content.inf",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58C.tmp\\Content.inf",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A.tmp\\Content.inf",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579.tmp\\Basis.thmx",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA52.tmp\\content.inf",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D.tmp\\ThemePictureAlternatingAccent.glox",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F.tmp\\ieee2006officeonline.xsl",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\ThemePictureGrid.glox",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA12.tmp\\gosttitle.xsl",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D.tmp\\Content.inf",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA7.tmp\\content.inf",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14B2.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B.tmp\\Content.inf",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA53.tmp\\Headlines.thmx",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA6.tmp\\sist02.xsl",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E.tmp\\VaryingWidthList.glox",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA12.tmp\\Content.inf",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6E.tmp\\content.inf",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10E8.tmp\\content.inf",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA7.tmp\\Quotable.thmx",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA52.tmp\\Frame.thmx",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1087.tmp\\Badge.thmx",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14B1.tmp\\harvardanglia2008officeonline.xsl",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1056.tmp\\TabList.glox",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\Content.inf",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E.tmp\\Content.inf",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10E8.tmp\\Dividend.thmx",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDE.tmp\\InterconnectedBlockProcess.glox",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6E.tmp\\View.thmx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C7.tmp\\TabbedArc.glox",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1521.tmp\\CircleProcess.glox",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA6.tmp\\Content.inf",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C6.tmp\\gostname.xsl",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1522.tmp\\turabian.xsl",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD578.tmp\\content.inf",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1076.tmp\\content.inf",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1056.tmp\\Content.inf",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDE.tmp\\Content.inf",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F.tmp\\Content.inf",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C7.tmp\\Content.inf",
  1189. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1736.tmp\\Crop.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14B1.tmp\\Content.inf",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1521.tmp\\Content.inf",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17A5.tmp\\iso690nmerical.xsl",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1775.tmp\\APASixthEditionOfficeOnline.xsl",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198C.tmp\\BracketList.glox",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1087.tmp\\Content.inf",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579.tmp\\content.inf",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C8D.tmp\\chicago.xsl",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198C.tmp\\Content.inf",
  1200. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1076.tmp\\Parallax.thmx",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198D.tmp\\rings.glox",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B72.tmp\\content.inf",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18FE.tmp\\content.inf",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C00.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA53.tmp\\Content.inf",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1522.tmp\\Content.inf",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18FE.tmp\\Savon.thmx",
  1210. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2009.tmp\\pictureorgchart.glox",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198D.tmp\\Content.inf",
  1213. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C00.tmp\\Content.inf",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C6.tmp\\Content.inf",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B72.tmp\\Metropolitan.thmx",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17A5.tmp\\Content.inf",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20C5.tmp\\ThemePictureAccent.glox",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\cab255B.tmp",
  1220. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1221. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C8D.tmp\\Content.inf",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2009.tmp\\Content.inf",
  1224. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1225. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1226. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1227. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1228. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20C5.tmp\\Content.inf",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2337.tmp\\RadialPictureList.glox",
  1231. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1775.tmp\\Content.inf",
  1233. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1234. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1235. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1236. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1237. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2337.tmp\\Content.inf",
  1239. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2954.tmp\\Circuit.thmx",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1736.tmp\\Content.inf",
  1242. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DBB.tmp",
  1244. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EA6.tmp\\content.inf",
  1246. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EA6.tmp\\Droplet.thmx",
  1248. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B68.tmp\\content.inf",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B68.tmp\\Wood_Type.thmx",
  1251. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1252. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1253. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1254. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1255. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30F9.tmp\\gb.xsl",
  1257. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1258. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\cab330D.tmp",
  1260. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1261. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1262. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1263. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1264. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1265. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1266. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30F9.tmp\\Content.inf",
  1268. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1269. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2954.tmp\\content.inf",
  1271. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1272. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1273. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1274. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A71.tmp\\Feathered.thmx",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B3E.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BEB.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A72.tmp\\Berlin.thmx",
  1279. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F95.tmp\\content.inf",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F95.tmp\\Slate.thmx",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB6.tmp\\content.inf",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FC6.tmp\\content.inf",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A72.tmp\\content.inf",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FC6.tmp\\Mesh.thmx",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB6.tmp\\Damask.thmx",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A71.tmp\\Content.inf",
  1288. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1289. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1290. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C6.tmp\\content.inf",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C6.tmp\\Vapor_Trail.thmx",
  1293. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1294. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49EA.tmp\\content.inf",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49EA.tmp\\Main_Event.thmx",
  1297. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1298. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5303.tmp",
  1300. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545C.tmp\\Insight design set.dotx",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545C.tmp\\Content.inf",
  1303. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx"
  1304.  
  1305.  
  1306. * Deleted Files:
  1307. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  1308. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1309. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2934.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2935.tmp",
  1312. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_20dce54d319d7e9ed52fad367a518446.asd",
  1313. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1314. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\CabB9AA.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TarB9CA.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDD81.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TarE002.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDECC8.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2D5.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF798.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF885.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF886.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58C.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD577.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD578.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA52.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA12.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF798.tmp\\HexagonRadial.glox",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF2D5.tmp\\chevronaccent.glox",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA53.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA7.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6E.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA6.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1056.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CA.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42F8.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDE.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1087.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1076.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C6.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10E8.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C7.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDECC8.tmp\\Element design set.dotx",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14B1.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1521.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1522.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1736.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6139.tmp",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17A5.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18FE.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1775.tmp",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198C.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198D.tmp",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B72.tmp",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD577.tmp\\Equations.dotx",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C00.tmp",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C8D.tmp",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6871.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7E.tmp\\VaryingWidthList.glox",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2009.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4309.tmp",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA12.tmp\\gosttitle.xsl",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20C5.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6237.tmp",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF886.tmp\\ConvergingText.glox",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5368.tmp",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1522.tmp\\turabian.xsl",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2337.tmp",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F8F.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF885.tmp\\iso690.xsl",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57A.tmp\\architecture.glox",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CB.tmp",
  1381. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C7.tmp",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE7F.tmp\\ieee2006officeonline.xsl",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA52.tmp\\Frame.thmx",
  1384. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA7.tmp\\Quotable.thmx",
  1385. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1056.tmp\\TabList.glox",
  1386. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD14B1.tmp\\harvardanglia2008officeonline.xsl",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EEE.tmp",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDC.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7342.tmp",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53CC.tmp",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB999.tmp",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1087.tmp\\Badge.thmx",
  1393. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB179.tmp",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD578.tmp\\Banded.thmx",
  1395. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58C.tmp\\mlaseventheditionofficeonline.xsl",
  1396. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2954.tmp",
  1397. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC09.tmp\\ThemePictureGrid.glox",
  1398. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCA6.tmp\\sist02.xsl",
  1399. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE6E.tmp\\View.thmx",
  1400. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6BA0.tmp",
  1401. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5367.tmp",
  1402. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1775.tmp\\APASixthEditionOfficeOnline.xsl",
  1403. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A26.tmp",
  1404. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EEF.tmp",
  1405. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B68.tmp",
  1406. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB802.tmp",
  1407. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD579.tmp\\Basis.thmx",
  1408. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDB.tmp",
  1409. "C:\\Users\\user\\AppData\\Local\\Temp\\cab773B.tmp",
  1410. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B72.tmp\\Metropolitan.thmx",
  1411. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EA6.tmp",
  1412. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C7.tmp\\TabbedArc.glox",
  1413. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6882.tmp",
  1414. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA53.tmp\\Headlines.thmx",
  1415. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD70.tmp",
  1416. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4319.tmp",
  1417. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10E8.tmp\\Dividend.thmx",
  1418. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEDE.tmp\\InterconnectedBlockProcess.glox",
  1419. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D.tmp\\ThemePictureAlternatingAccent.glox",
  1420. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30F9.tmp",
  1421. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7C.tmp",
  1422. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6149.tmp",
  1423. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA487.tmp",
  1424. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD10C6.tmp\\gostname.xsl",
  1425. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C00.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1426. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD17A5.tmp\\iso690nmerical.xsl",
  1427. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6138.tmp",
  1428. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2009.tmp\\pictureorgchart.glox",
  1429. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198D.tmp\\rings.glox",
  1430. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2337.tmp\\RadialPictureList.glox",
  1431. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1521.tmp\\CircleProcess.glox",
  1432. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1736.tmp\\Crop.thmx",
  1433. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FCF.tmp",
  1434. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD18FE.tmp\\Savon.thmx",
  1435. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C8D.tmp\\chicago.xsl",
  1436. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B68.tmp\\Wood_Type.thmx",
  1437. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD20C5.tmp\\ThemePictureAccent.glox",
  1438. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2EA6.tmp\\Droplet.thmx",
  1439. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B.tmp\\PictureFrame.glox",
  1440. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7D.tmp",
  1441. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C9.tmp",
  1442. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6236.tmp",
  1443. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5EDD.tmp",
  1444. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6225.tmp",
  1445. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEE9E.tmp",
  1446. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA1.tmp",
  1447. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEA16.tmp",
  1448. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5ECA.tmp",
  1449. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FCE.tmp",
  1450. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5366.tmp",
  1451. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD198C.tmp\\BracketList.glox",
  1452. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD30F9.tmp\\gb.xsl",
  1453. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE821.tmp",
  1454. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A71.tmp",
  1455. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2954.tmp\\Circuit.thmx",
  1456. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F7E.tmp",
  1457. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A72.tmp",
  1458. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C8.tmp",
  1459. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1076.tmp\\Parallax.thmx",
  1460. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEC79.tmp",
  1461. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F95.tmp",
  1462. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7836.tmp",
  1463. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB6.tmp",
  1464. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FC6.tmp",
  1465. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A72.tmp\\Berlin.thmx",
  1466. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF836.tmp",
  1467. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FB6.tmp\\Damask.thmx",
  1468. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3A71.tmp\\Feathered.thmx",
  1469. "C:\\Users\\user\\AppData\\Local\\Temp\\cab255B.tmp",
  1470. "C:\\Users\\user\\AppData\\Local\\Temp\\cab14B2.tmp",
  1471. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C6.tmp",
  1472. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F95.tmp\\Slate.thmx",
  1473. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FC6.tmp\\Mesh.thmx",
  1474. "C:\\Users\\user\\AppData\\Local\\Temp\\cab330D.tmp",
  1475. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49EA.tmp",
  1476. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2DBB.tmp",
  1477. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C6.tmp\\Vapor_Trail.thmx",
  1478. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B3E.tmp",
  1479. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49EA.tmp\\Main_Event.thmx",
  1480. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BEB.tmp",
  1481. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545C.tmp",
  1482. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD545C.tmp\\Insight design set.dotx",
  1483. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5303.tmp"
  1484.  
  1485.  
  1486. * Modified Registry Keys:
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\k&#",
  1488. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7C00E0",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7C00E0\\7C00E0",
  1496. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1509. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5",
  1510. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0",
  1511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\(Default)",
  1512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\FLAGS",
  1513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\FLAGS\\(Default)",
  1514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0",
  1515. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0\\win32",
  1516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0\\win32\\(Default)",
  1517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\HELPDIR",
  1518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\HELPDIR\\(Default)",
  1519. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1520. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0",
  1521. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\(Default)",
  1522. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\FLAGS",
  1523. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\FLAGS\\(Default)",
  1524. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0",
  1525. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0\\win32",
  1526. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\0\\win32\\(Default)",
  1527. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\HELPDIR",
  1528. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\AF1E5922-A2A5-44C4-BC94-172E7ED7B7D5\\2.0\\HELPDIR\\(Default)",
  1529. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1530. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1531. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  1532. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  1533. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1534. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1535. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  1536. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  1537. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1538. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1539. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  1540. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1541. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1542. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1543. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  1544. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1545. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1546. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1547. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  1548. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  1549. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1550. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1551. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  1552. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  1553. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1554. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1555. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  1556. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  1557. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1558. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1559. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  1560. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1561. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1562. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1563. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  1564. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1565. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1566. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1567. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  1568. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  1569. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1570. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1571. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  1572. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1573. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1574. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1575. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  1576. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  1577. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1578. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1579. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  1580. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  1581. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1582. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1583. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  1584. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  1585. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1586. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1587. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  1588. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1589. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1590. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1591. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  1592. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1593. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1594. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1595. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1596. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1597. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1598. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1599. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1600. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1601. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1602. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1603. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1604. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1605. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1606. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1607. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1608. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1609. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1610. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1611. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1612. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1613. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1614. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1615. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1616. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1617. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1618. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1619. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1620. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1621. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1622. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1623. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1624. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1625. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1626. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1627. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1628. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1629. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1630. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1631. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1632. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1633. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1634. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1635. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1636. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1637. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1638. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1639. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1640. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1641. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1642. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1643. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1644. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1645. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1646. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1647. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1648. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1649. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1650. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1651. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1652. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1653. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1654. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1655. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1656. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1657. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1658. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1659. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1660. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1661. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1662. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1663. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1664. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1665. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1666. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1667. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1668. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1669. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1670. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1671. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1672. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1673. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1674. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1675. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1676. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1677. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1678. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1679. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1680. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1681. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1682. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1683. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1684. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1685. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1686. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1687. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1688. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1689. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1690. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1691. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1692. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1693. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1694. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1695. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1696. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1697. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1698. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1699. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1700. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1701. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1702. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1703. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1704. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1705. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1706. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1707. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1708. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1709. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1710. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1711. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1712. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1713. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1714. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1715. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1716. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1717. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1718. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1719. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1720. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1721. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1722. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1723. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1724. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1725. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1726. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1727. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1728. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1729. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1730. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1731. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1732. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1733. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1734. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1735. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1736. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1737. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1738. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1739. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1740. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1741. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1742. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1743. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1744. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1745. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1746. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1747. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1748. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1749. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1750. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1751. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1752. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1753. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1754. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1755. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1756. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1757. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1758. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1759. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1760. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1761. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1762. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1763. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1764. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1765. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1766. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1767. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1768. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1769. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1770. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1771. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1772. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1773. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1774. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1775. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1776. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1777. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1778. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1779. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1780. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1781. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1782. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1783. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1784. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1785. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  2027. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  2028. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\7C00E0\\8F3C7C",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  2091. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  2096. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  2097. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  2098. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate"
  2392.  
  2393.  
  2394. * Deleted Registry Keys:
  2395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\k&#",
  2396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\.k!"
  2401.  
  2402.  
  2403. * DNS Communications:
  2404.  
  2405. "type": "A",
  2406. "request": "crl3.digicert.com",
  2407. "answers":
  2408.  
  2409. "data": "cs9.wac.phicdn.net",
  2410. "type": "CNAME"
  2411.  
  2412.  
  2413. "data": "72.21.91.29",
  2414. "type": "A"
  2415.  
  2416.  
  2417.  
  2418.  
  2419. "type": "A",
  2420. "request": "api.ipify.org",
  2421. "answers":
  2422.  
  2423. "data": "54.243.198.12",
  2424. "type": "A"
  2425.  
  2426.  
  2427. "data": "54.204.36.156",
  2428. "type": "A"
  2429.  
  2430.  
  2431. "data": "50.16.229.140",
  2432. "type": "A"
  2433.  
  2434.  
  2435. "data": "107.22.215.20",
  2436. "type": "A"
  2437.  
  2438.  
  2439. "data": "nagano-19599.herokussl.com",
  2440. "type": "CNAME"
  2441.  
  2442.  
  2443. "data": "23.21.121.219",
  2444. "type": "A"
  2445.  
  2446.  
  2447. "data": "54.243.147.226",
  2448. "type": "A"
  2449.  
  2450.  
  2451. "data": "54.235.124.112",
  2452. "type": "A"
  2453.  
  2454.  
  2455. "data": "elb097307-934924932.us-east-1.elb.amazonaws.com",
  2456. "type": "CNAME"
  2457.  
  2458.  
  2459. "data": "50.19.247.198",
  2460. "type": "A"
  2461.  
  2462.  
  2463.  
  2464.  
  2465. "type": "A",
  2466. "request": "hatannaso.com",
  2467. "answers":
  2468.  
  2469. "data": "",
  2470. "type": "NXDOMAIN"
  2471.  
  2472.  
  2473.  
  2474.  
  2475. "type": "A",
  2476. "request": "peronbifo.ru",
  2477. "answers":
  2478.  
  2479. "data": "",
  2480. "type": "NXDOMAIN"
  2481.  
  2482.  
  2483.  
  2484.  
  2485. "type": "A",
  2486. "request": "jechissoco.ru",
  2487. "answers":
  2488.  
  2489. "data": "",
  2490. "type": "NXDOMAIN"
  2491.  
  2492.  
  2493.  
  2494.  
  2495.  
  2496. * Domains:
  2497.  
  2498. "ip": "",
  2499. "domain": "peronbifo.ru"
  2500.  
  2501.  
  2502. "ip": "",
  2503. "domain": "hatannaso.com"
  2504.  
  2505.  
  2506. "ip": "54.235.124.112",
  2507. "domain": "api.ipify.org"
  2508.  
  2509.  
  2510. "ip": "",
  2511. "domain": "jechissoco.ru"
  2512.  
  2513.  
  2514. "ip": "72.21.91.29",
  2515. "domain": "crl3.digicert.com"
  2516.  
  2517.  
  2518.  
  2519. * Network Communication - ICMP:
  2520.  
  2521. * Network Communication - HTTP:
  2522.  
  2523. "count": 1,
  2524. "body": "",
  2525. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2526. "user-agent": "Microsoft-CryptoAPI/6.1",
  2527. "method": "GET",
  2528. "host": "ocsp.digicert.com",
  2529. "version": "1.1",
  2530. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2531. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2532. "port": 80
  2533.  
  2534.  
  2535. "count": 1,
  2536. "body": "",
  2537. "uri": "http://crl3.digicert.com/Omniroot2025.crl",
  2538. "user-agent": "Microsoft-CryptoAPI/6.1",
  2539. "method": "GET",
  2540. "host": "crl3.digicert.com",
  2541. "version": "1.1",
  2542. "path": "/Omniroot2025.crl",
  2543. "data": "GET /Omniroot2025.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl3.digicert.com\r\n\r\n",
  2544. "port": 80
  2545.  
  2546.  
  2547. "count": 1,
  2548. "body": "",
  2549. "uri": "http://api.ipify.org/",
  2550. "user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
  2551. "method": "GET",
  2552. "host": "api.ipify.org",
  2553. "version": "1.1",
  2554. "path": "/",
  2555. "data": "GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko\r\nHost: api.ipify.org\r\nCache-Control: no-cache\r\n\r\n",
  2556. "port": 80
  2557.  
  2558.  
  2559. "count": 1,
  2560. "body": "",
  2561. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2562. "user-agent": "Microsoft-CryptoAPI/6.1",
  2563. "method": "GET",
  2564. "host": "ocsp.msocsp.com",
  2565. "version": "1.1",
  2566. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2567. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2568. "port": 80
  2569.  
  2570.  
  2571. "count": 6,
  2572. "body": "",
  2573. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2574. "user-agent": "Microsoft-CryptoAPI/6.1",
  2575. "method": "GET",
  2576. "host": "crl.microsoft.com",
  2577. "version": "1.1",
  2578. "path": "/pki/crl/products/microsoftrootcert.crl",
  2579. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2580. "port": 80
  2581.  
  2582.  
  2583. "count": 1,
  2584. "body": "",
  2585. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2586. "user-agent": "Microsoft-CryptoAPI/6.1",
  2587. "method": "GET",
  2588. "host": "crl.microsoft.com",
  2589. "version": "1.1",
  2590. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2591. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2592. "port": 80
  2593.  
  2594.  
  2595. "count": 1,
  2596. "body": "",
  2597. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2598. "user-agent": "Microsoft-CryptoAPI/6.1",
  2599. "method": "GET",
  2600. "host": "ocsp.digicert.com",
  2601. "version": "1.1",
  2602. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2603. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2604. "port": 80
  2605.  
  2606.  
  2607. "count": 1,
  2608. "body": "",
  2609. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2610. "user-agent": "Microsoft-CryptoAPI/6.1",
  2611. "method": "GET",
  2612. "host": "ocsp.usertrust.com",
  2613. "version": "1.1",
  2614. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2615. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  2616. "port": 80
  2617.  
  2618.  
  2619.  
  2620. * Network Communication - SMTP:
  2621.  
  2622. * Network Communication - Hosts:
  2623.  
  2624. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!