API tools faq
paste
paladin316

Docs_2c8484635e2f145526169e04f069fc53_doc_2019-07-18_17_30.txt

paladin316
Jul 18th, 2019
2,185
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 195.17 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 3.1999999999999997
  5.  
  6. * File Name: "Docs_2c8484635e2f145526169e04f069fc53.doc"
  7. * File Size: 607078
  8. * File Type: "Microsoft Word 2007+"
  9. * SHA256: "9618ef6b3eadd73e7b1249417f495908458f007431788fdd46ce8fb5814f9632"
  10. * MD5: "2c8484635e2f145526169e04f069fc53"
  11. * SHA1: "5f1cb2490efc45ab40fb26d4bede2322d36eb096"
  12. * SHA512: "8a9ec5657eab05b787e09eb31a3b0ce80480b7c16c756b6867c5530f90f632e22dba9b9cbc70adb1518869bc7e23a713bf8e738b0143c4fa20be023234360b4a"
  13. * CRC32: "B9B1195B"
  14. * SSDEEP: "12288:L8YK1HZFtAf/HG65nFzgWgUgT2RIQ8yuLz/jrcWBRQNwM:oVt0tbzgWTRIpyObjrcWBRw"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  25. "Details":
  26.  
  27. "IP": "23.59.214.201:443"
  28.  
  29.  
  30. "IP": "69.192.108.32:443"
  31.  
  32.  
  33. "IP": "52.109.6.40:443"
  34.  
  35.  
  36. "IP": "65.52.98.231:443"
  37.  
  38.  
  39. "IP": "52.109.92.24:443"
  40.  
  41.  
  42. "IP": "72.21.91.29:80"
  43.  
  44.  
  45. "IP": "104.18.25.243:80"
  46.  
  47.  
  48.  
  49.  
  50. "Description": "File has been identified by 4 Antiviruses on VirusTotal as malicious",
  51. "Details":
  52.  
  53. "SentinelOne": "DFI - Malicious OPENXML"
  54.  
  55.  
  56. "Jiangmin": "TrojanDropper/MSWord.Agent.gj"
  57.  
  58.  
  59. "Endgame": "malicious (high confidence)"
  60.  
  61.  
  62. "TACHYON": "Suspicious/WOX.Obfus.Gen.2"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "Performs some HTTP requests",
  68. "Details":
  69.  
  70. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  71.  
  72.  
  73. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "The office file has 3 macros.",
  79. "Details":
  80.  
  81.  
  82. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  83. "Details":
  84.  
  85. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xa0b\\xa1\\xa7\\x01+\\x87\\x05h\\x98\\xf7\\x80\\x8c4\\xdbb\t\\x01\\xcb\\xb2wp\\xdf\\x07 \\xa8g\\x81\\xc3\\x990\\xb3m\\xd0\\xe6 \\xd0s\\xf1\\xa6\\xf9k\\xe5\nw\\xd9`\\x87\\xd9\\xa1\\xd7hod\\x95\\x98lj\\xf1<\\xfa\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xd5b\\xa8x\\x96\\xe4\\xb6y\\xca\\x12\\xc2\\xaan\\x98\\x17\\xd1\\xe3\\x9e\\xa3\\x80\\x90\\x10\\x15\\xfdz\\x8a\\xfd\\x87\\x1d|\\x0e\\xed\\xbdk\\xb8\\xba\\x03\\xfe\\xed9t\\\\x99\\x1cws\\xbc"
  86.  
  87.  
  88. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1e\\x1f\\xf8^\\xf6:*\\xb2\\x1e\\x83\\x1f\\x1f\\xd9\\x87\\xe2\\x81\\xa2!\\xcc\\xdfi\\xb0\\xf2k\\x86z\\x1b>\\x19y\\xab2f\\x1e\\x19\\x05\\x04\\xe2p\\xff9\\x95cl\\x17s\\x14n\\x1ay/lw\\xd8d?f\\x08\\xfdxt\\xa2l\\xba\\x84~5$\\x07z\\xd7\\x9b\\x8a@\\xd1\\xc69p\\xc5\\x9c\\xc0p7\\xced/\\xf1\\xd3ojr2\\xd4\\xd2\\xe9g\\xf9\\x03\\xb8\\x92\\xc9\\xf5r\\xfc\\xa1m8\\xafz\\xba\\x96:\\xf4\\xb5\\x94)? $\\xcd\\x15\\xca\\x96\\x8f?!o\\xc0(\\xc7\\xdd\\xe5\\x99\\xdbc\\xa2\\x8a\\xf3.`\\x04\\x14|k\rlb\\xda\\xe0:\\xdb\\x10\\x1f\\x1e?t\\x98\\x08\\xa1\\xd2w\\xae\\xbd\rw.\\x1a\\x17\\x92\\x1ck\\xca\\x1b\\xbd\\x08g\\x96)\\x1cm\\x9a\\xe5\\xff\\xb1\\xdd\t\\xac7\\xcf\\xdal\\x85\\xae\\x86\\xfds\\xe4p\\x9f\n\\xb7\\xcf\\xa8v\\xd7\\x8a\\xa5hn9\\xb6\\x7fgo_\\xa7\\xd2v(c\\x90\\x0c\\x10\\xa6\\x18\\xbev\\xc8\\xc8\\x02\\xea\\x0e\\xa9\\xfb\\xdc\\xf5hb\\xb3\\x8e\\xc9g\\xef\\xfa\\xd9\\x9e\\x86"
  89.  
  90.  
  91. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x010\\xa3\\xf0\\xfd>2>\\xbb\\xfe\\xbf\\xafn\\xed\\xf8\\xfd\\x85\\x9a\\xf0\\xe5&\"\\xc2d\\x81\\xc4 \\xca\t\\xd9\\xd9\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  92.  
  93.  
  94. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\"$\\xb5\\xfe\\xb7\\x83\\x8b\\xc2\\x03\\xe8\\xb8\\x95\\xf1\\xa7=\\xfds9'hmtf\\x87\t\\xaei\"\\xb9\\x1f\\xdd\\xec\\xf9\\x956\\xa7\\xc0\\xe5u\n\\xf8\\xb7fr\\xe4\\xfe*\\xc1\\x9d7\\xc1\\x11\\xca\\x18\\xd7\\xaf\\xee/\\x9d\\x83\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xf5\\xf3\\x902p\\xcfaqbit/\\xa1\\xea\\xbf\\xdc7\\x02;s\\x92\\x8c\\xff\\xc6\\x10')3\\xe9\\x1d\\xeb\\xde5\\xf2!\\xca5z\\x96\\x9c\\x84y\\xe1\\x86\\x82x"
  95.  
  96.  
  97. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x010\\xa3\\xf1\\xd8:\\x1d\\x8e\\xc9\\x93\\x81\\xf7\\xf4\\xa4\\xd5 \\xa2\rp:,\\xc3\\xc6a7\\x14k\\x9c\\xc4v\\xf3\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  98.  
  99.  
  100. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\xaas\\x82\\xa5yc7*\\x15\\xa0k\\xda\\x00b\\x87\\xe0\\x82s\\xac\\x1e\\x9a\\xd3\\xc8\\xd6=\\xc7\\x01\\x03\\xc6\\xc4\\x9a\\xb1oc\\x13np\\xb5\\x88\\xb8i\\xd7\\xa6\\x94\\xe7\\x13\\x12:\\xf6\\xdeg\\xe4\\xc2qm\\x82e\\x8a\\x86\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb4\\xb9\\x16\\xde\\xf8\\xbd\\xed\\xb4bu\\xddan\\xed\\xde6hs\\xd9\\xe4\\xfe\\xbcit@\\x9d\\xde\\xd0\\xb5?\\xban@\\xd9\\x7f\\xc9\\xc1yt\\xa3\\xabedq\\x9a\\xf9"
  101.  
  102.  
  103. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p`q\\xafz\\x8bc\\xd4\\xad\\xdb,\\x08\\xff$y\\xf4\\xa58\\xa9\\x82z\\x84\\x0f\\x1b\\xf5\\xc3\\xd8\\xc4\\xda\\x05\\xb6c\r?\\xa0\\x8b\\xa6i\\xcf\\xd9\\x9b2\\xc0\\x12\\x1b\\x87\\x1ay\\xdc\\x9bn\\xe1u7c\\x88r(\\xde\\xb1!n\\x8d\\xe6\\x03\\xf4\\xbfh\\x1ah\\x8dp\\xbb\\xb2\\xba\\xcel(\\x89\\xc3\\x05q\\x91\\xc1\\x9a\\x92\\xda\\xca\\xa2\\x8c\\xc9\\x0e\\xd6e\\xb5c\t\\xacy\\xa2\\x94_y\\xaa\\x1er\\x90\\xf5=^g\\xbd\\xcft,\\xa2\\x84i\\xae\\xd7\\xb8\\xc1kk\\xb8\\xfd\\x183\\xd4&\\x13x\\x91\\xc6\\xb9\\xee\\xbc\\xe0f`\\x0eh\\x1b9t\\xff\\x85\\x88\\x97;\\xb5\\xfb\\x01\\x16\\xf8*\\x00\\xd3\\x02\\xb7\\xbdv\\x10\\x1br\\x04-uxt\\xe5cp2tb\\x85\\xaf\\xad\\xa7z\\xb1\\xfa\\xef\\x0f\\x80py\\xe9'\\xff\\xbc8\\xa4d\\xfd^|\\xb1\\x19\\xc6c\r\\x12\\x12\\x1f\\x99\r\\x80r5a\\xb9p\\xed\\xa7\\x0b\\x98;\\x05;\\xbc\\xd2+\\xcb&\\xe9*?d\\xfb/vyu\\xe4a\\x89\\xf1\\xc0\\xd5\\x18s\\xa3\\xf6r\"\\x93s"
  104.  
  105.  
  106. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  107.  
  108.  
  109. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  110.  
  111.  
  112. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xff\\x03zy#ve\\x00\\x97\\x1e8:\\x9d\\xad\\x16-\\x95/\t\\x16\\xc9\\xc2\\x80=\\xc5\\xd2z\\xd0k\\x1axe\\x1c\\xdc\\xcf`\\xcc\\xdf\\xf2\\x1e\\x97e\\xa0\\xc1\\xfd9\\xa5\\xdd\\x91@\\xac/\\x84h\\\\x81\\xda\\x94\\x8d\\xa4\\x0c\\xfag#\\xeda\\x90n\\xe2u=\\xd5\\xf8uzu\\x16\\xdb\\x87l\\xd5\\x84\\x0c\\x10\\xa1\\x80\\xd83m\\x9f\\x85\\xaa\\x19\\x1d%t\\xf4d\\xdft\\xd8\\xd5\\x18\\x8c\\xc5c\\xc8\\xaf\\x9e\\x1d\\x8e\\xcd\\xcc\\x84\":v_\\x044+@=ug\\xa0\\x95r\\x9e\\xfd\\x8c\\xbe\\xcc\\x02>\\x9a\\xd6jm\\xca\\xee\\xd6\\xabh\\xbc\\xfb\\xbc\\xa7\\x8f\\x08\\xa2\\xf7lf\n\\xff\\xc5\\x83\\x01\\x8e\\x91>nt\\x99\\xc5\\xd9\\xc5c\\x1e\\xfc\\xa6\\xe7z\\x8f\\xdb\\xee\\x80\\xb5\\x93\\x12\\xc8s\\xfb!os\\xc0j\\xd7\\x04\\xe8\\xb2dk\\xd2 \\xcc\\x02\\x85\\x01\\xf9\\xa1\\x99\\xb0\\x86\\xe8\\xf5\\x17\\x00\\xbf\\x92i\\xed \\x82\\x97\\xf2\\xac\\x9a\\xfb\\xed\\xe7\\x0c2\\x1fbb+h \\xfc\\xba?u\\x12\\xfa\\xeb\\x04cb8\\x94d5\\xc0\\xb5\\xd5\\x9b"
  113.  
  114.  
  115. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xe5qmu\\xd9\\xf5\\xca\\xdf\\x00u\"\tk\\x8dqp\\xdaw!kgt\\xc0_\\xbe\\xa9\\xc6\\x82\\xd0\\xc6\t\\xfd\\xcc\\xa2c\\xa5c\\xcb(ta7\\x89\\xc64\\xacqh\\x82.6\\x9e\\xb4h\\x98g@y\\xa8l\\xe7\\x10\\x8e>r>\\xd9\\x19\\xc7\\xf0\txtp\\xd3\\x17\\x8f\\x14c\\x01f\\xf2\\xa7\\xb3\\xad4\\xf4\\x1fr\\xad\\x02\\x8be\\xc9\\xaa\\xa3\\xf6\\xfd\\xbfr\t\\xa2\\xd5\\xaa\\xadn\\xa81\\x9f0\\xd2_h;\\x99'$io\\xad\\x1b\\xe3\\xf3\\xd8\\x9bm\\x90\\x1c\\x02\\xd4u#\\xee\\x15\\xbc\\x8fu\\xaeb\\xc9s\\xbbwx\\xd4\\xd2\\x8e&\\xe5\\x1f\t\\\\xd8\\x9bx\\xb9>\\xcd9\\xb1*csej\\xe0\\xdcd\\xe1\\xf6\\x87\\xd3\\x8d\\x13b^\\\\x8c\\x95\\x94u7\\x1f\\x17\\x90\\xdd\\x0er\\x04\\x9e\\x1bli \\xa1\\x98\\x17\\x17k8\\xc2\\x1d\\xb3\\xb6\\xf7\\xf4\\xd2\\x90\\x94\\xfc@\\x90#\tku\\x9a\\x84\\x98\n\\x81\\xf8dvn\\xb1u\\xb6`r\\xdb\\xb7i\\x1a\\xe4\\x1c=\\xf4*\\x91\\xce\\x85tp=\\xa22"
  116.  
  117.  
  118. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x010\\xa3\\xf7ir\\xd5e(\\xb9\\xdd\\x8f4\\x01m\\xb3%igb\\xa7\\xf5\\xc5\\x8cn3\\x94=h?\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  119.  
  120.  
  121. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xaa\\xd9\nvu=\\xe8dg;\\xec\\xb0g\\xfe\\x0c|<\\x1c\\x11 \\xe9m\\xae\\x1f\\xcf0\\xfd?\\x83\\xf5\\xaa\\xe5\\xfen\\xa8\\xd6\\x18\\xce\\x92)\\xc1\\x1a\\xf0b\\x1egoi\\x9a\\xd8\\xce\\x0e\\xf2n\\xfe-\\xb5p\\xce\\xa3d\\x89\\x14\\xea\\xdb;\\x83\\xd4m*\\xacm\\xe2'\\xccz\\x01\\x08\\x16\\xb3\\xa1k\\xd85\\xd0\\xd4\\xa4\\xb5\\xf71~\\x9e\\x90\\xf8f\\x84\\x08k\\xf8~\\x14\\x89\\xbf\\xf8\\xf9o\\xa3\\x94y\\x8c\\xae\\x1a1\\e_\\xad&uh\\xc7\\x0en\\xf5\"\t\\x1bx\\xbf\\xb1\\x03\\xba\\x1cn\\xf2\\xcaw\\xac\\xc0\\xce\\xf7\\xa3\\xdb\\x19\\xc8!\\xc2:\\xac\\xad\\xc0\\xdf\\xb2\\x9c\\xf3\\xaf\\x07\\x1dv\\x8d\\xf2\\x03\\xf7\\x10m\\xc0>\\xbc\\xa3\\x9f\\xa7\\xaa\\xe2\\xcd'\\xc2\\xed\\x0e\\x91\\x8a\\x00\\xc0\\xc5j\\xbdsq+\\xd4^\\xaa(i<\\x03\\xa6\\xcd\\x10\\x83jh:i\\x0e-\\x10|\\xa0\\x02\\x86\\x03\\x91\\xce/\\xae\\xc5\\x84&\\x9a\\xd1\\x12\\xa1\\x10\\xcb\\x03&\\xae\\x9c\\xea-t`\\xa5\\xd3\\xdc\\x18)(lt"
  122.  
  123.  
  124. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`3n\\x00\\x89\\x16\\xe3eq:\\xd5\\x13\\xabi\\xaf\\xe3e\\xd8\\xb9f\\x99v\\x19\\x9f4\\xf2\\x17@\\x88\\x8c\\x84\\xc4q\\xdftvo\r\\x88\\xae:\\xaef\\xb2\\x83\r8\\xd4\\xd6\\xf6\\xb8\\xc26\\xdb\\xd9#\\xe1;\\xb7nh\\x03\\x82@\\x0buc\\xd4\\xa8\\x15\"k4\\xf0z\\xdch\\xc3l\\xc7t\\x03\\x8b\\x1c\\xb3bx\\x89\\xaa\\x16*e\\x05\\xa0\\x03\\xf2\\xb1\\xc9b\\xd1q\\x04\\x89\\xd0\\xbex\\xa7\\xc2\\xe4\\xf3\\xb4j\\x0el\\xcddd1\\x92\\xb1l\\x92\\xbf,\\x8d\\xc9\\x03qg\\x8d\\x0e\\xbc\\x81\\xbe\\xf3(j\\xeb\\xff.\\xf45\\xf9-\\xeb\\xeb\\xf1c\\xee\\x96\"xb8\"\\xfd=\\x11%\\x1f\\xc7\\x83`x\\xb9\\x18\\xdc\\xc5n\t\\xca\\x08\\xdf\\xd9\\xfa\\x07\\x1c\\xe2ks\\xd5\\xdd\\xa7h\\x85\\xbeux%\\x7f\\xeb\\x0e\\xc1\\xae\\xdf-\\xe9*7\\xe0\\xfcz\\xfd \\xb8\\xa3\\x9b\\x18\\xf1wg\\x8a\\xbb\\xa3\\xf1\\xe8\\xb9\\x80h\\xa7+\"\\x93\\x1c\\x92\\xf4\r\\xf8#\\xbc\\xf3w\\xdf\\x0e9n>\\xaca\\x8b\\xc7\\xd3\\x94\\x14v>o'\\\\xb2"
  125.  
  126.  
  127. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x92\\xe5\\x197\\xc7\\xde\\x91\\xaf\\xb1\\x87\\xd5\\x1c\\xea\\x9f\\xa1\\xf7\\x9d\\xe4ebn\\xbd\\xf3\\x7fh\\xeb\\x82c\\xf9\\x1e\\x8b\\xcedl\\xbe\\x83gr\\xf6=\\x7f\\xc6\\xaf2r\\x82\\xa1ad\\xe7\\xb0\\xde\\x9a\\xa9\\xc6\\xd4531\\xd3\\xcfq<\\x95)\\x9dk\\xbd\\xb6\\xdc\\xb4s\\x7f\\x10\\xcf:\\xbfu\\xaa\\x91\\xc8\\xef\\xe6\\x86$f\\xc0\\xae\\xc1\\xa1$x\\xf5b-\\x06\\x97\\x8d\\x02\\xc6\\xc6\\xd9\\xb4\\x0c\\xbb\\xec\\x9e\\xc4\\xad\\xb3(\\x84\\xdb\\xb5/\\x7ffg\\xc3\\xe0\\xca&\\xfa6-\\x93\\xa4x$~\\xe1\"\\x15\\x89\\x01\\xc9ozxo\\x06\\xec\\x84\\xd1c\\xf2an\\x13\\x1e\\xd46\\x94\\xf6\\xce\\xc7\\xa2i\\x08t;\\xc2\\xbfn\rq\\xfb_\\xc9i\\xd7\\xa5p3\\xc4/h\\xc7\\x98\\xe3\\x10r\\x85\\\\x12\\xd9\\xdc\\xd7%\\xe9\\xf8\\x8fy\\x7f\\xe4\\xe2\\xdb|\\xed\\x9e\\xe2\\x9ax\\x1f+\\xf3\\xdae\\xf0\\xe6\\xe2$6v\\xc7\\xfc\\xa5\\xe4\\xa4\\x87\\xa5x\\x8a\\xd5\\xdb6\\x1d\\xc127\\x11\\x06%kf\\xe2\\x9em\\xc8#\\xbb\\xea\\xceu"
  128.  
  129.  
  130. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x010\\xa3\\xf9\\x03\\x81\\xb9\"\\x87\r\\xb5\\x19q\\xfa\\x06\\x84\\xd9\\xb1\\xd2\\xac\\x19?s\\xaf\\x9dr=\\x8b\\x93\\xee\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  131.  
  132.  
  133. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7^\\xbf^\\xf0\\xa6\\x835\\xd2w\\x04\\x19\\xa1z\\x9f\\xfc\\xba\\xaak\\x89\\xbc\\xfa\\xf9w\\xaf\\xc7(\\xfc\\xc2\\x0e\\xcf\\x06\\xa2a\\xaa\\x91\\xf7\\x80d\\x08\\xae\n\\xd4t|$\\x1c\\xb9\\xa1\\x13\\xbe\\xd4\\x95\\xf7\\xbe3#8\\x0e\\xe5\\xee\\x9fbt\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\x81p\\x14\\xde3\\xb4\\\\xd9\\xc2\\xe4\\xae\\x0b=\\x1co:\\xc7\\xc7\\_\\x8a\\xaf\\xd5`\\xa0\\xce\\xa4\\x93\\xa28\\x9cr\\xeb\\xe7j\\x98a n\\xe3\\xb4\\xf4\\xeeg'"
  134.  
  135.  
  136. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xf7l\\xef\\xb55\\xf1\\xbbm\\xeb\\x07\\x82\\xad\\xad&-\\xee\\x95\\xa7\\x08\\xe8^\\xb8\\xa0\\xd5t\\xe7\\xd16\\xb8\\x16\\xbc\\xdb\\xa6\\xfd\\x8a\\xd8_\\xfa\\xf6\\xc4\\xad\\xf7\\xf88\\x13i\\x9d,`\\xd3\\xb5>\\xd4lb\\xba:\"e\\xcc#\\xbb\\x9ed2\\xc2v\\xbcb|\\x97\\xf0\\xf9\\x96\t\\xddi\\xfa\n\\xc1l\\x96\\xad#\\x00+&\\xd2\\x8cl2\\x01\\xe4x\\x97\\x8a\\x88!4l\\x02\\xfa\\x9c\\xa59\\x0b\\x97:n\\x1a\\xf5\\x8f\\xec\\x07vth\\xe1\\x02\\x90\\xc69na\\x8dh\\xeaw>\\xed\\xa6)6p\\xc5\\xa8\\x9a\\xc1ul1)\\xab(\\xcd\\x07b\\xee\\x1e\\x9aq~xq\\x83\\xdc\\xe9\\x8b\\x1f\\xbe\\xf6\\x1d,\\x92\\x96\\x92+\\x12\\xbfn\\xf9\\xa0=\\x9bf\\xbda\\xe4\\x9c\\xf9\\xaa%\\xf7\\xca\\x9b\\xef\\xdf\\xe5u\\x98\\x02\\xbb\\x8c\\x9a\\x92\\xd3\\xe9c\\xf8pdx\\xcd\\xbd\\xdc\\x9c`\\x89ijl\\xd9\n\\xdc\\x14\\x04\\xaa\\x85\\x18\\x9f\\x94\\xd6&\\x9f\\xe6l\\xd6\\xfa\\x19\t\\x05\\xbc\\xb0\\x93d\\xdc\\xa7\\x07\\x18\\xe2<8\\x1ek0n\\xf3"
  137.  
  138.  
  139. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbh2\\x8a\\x15\\xe1\\x87\\xc9\\xf3\\x05\\x01\\xf1\\xf4\\xbe\\xd3\\x99\\xb9\\xf2\\xe9\\x83\\xae!\\xb1?\\x9e-\\x0e\\xa9\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  140.  
  141.  
  142. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xca\\xc2\\x94\\xadckgr\\xaa\\xf3\\xb5?;lvy\\x9b\\xbe\\xb7\\x85\\xbc\\xbb\\x08\\x07is\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  143.  
  144.  
  145. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xe1\\x00\\x91\\xfa\\xed\\xa5\\xb2\\xd8>\\xc3\\xb8tqx\\xac/\\x10\\x80\\xba\\x83\\xad\\x14\\x8aj\\x91\\x8a\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  146.  
  147.  
  148. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb,zm\\x0b\\xac\\xff\\x10\\xe8\\xb4h\\xdc\\xdd\\xd4\\x05\\xe1\\xc9\\x0b\\xd0\\x18,m\\xce%\\x0b<\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  149.  
  150.  
  151. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x87\\x15jg$\\x84\\x19\\x94\\xcf\tlt\\x12\\x04\\x9e\\xda\\xf8\\xde\\xff\\x85\\xa1_q\\xecf\\x1b\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  152.  
  153.  
  154. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbx\\\\xe7a\\xf3\\x8d\\xa4 \\xbd9\\xa4\\xa3b\\\\x1a^\\x97\\x95\\xd0\\xe7\\x9a\\xcc\\xbabn+\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  155.  
  156.  
  157. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xd8\\xefe\\xb8\r\\xddz\\x84\\xfe\\xeb\\xc39\\x82\\xb3\\x00\\xfdp\\x8c\\x19\\xb6\\xb4\\xbe\\x01-z\\x7f\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  158.  
  159.  
  160. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbn\\x99\\xdbm\"\\xeel\\xcc\\xc1\\xbd\r\\x94\\xe4\\x1a\\xf2\\x812\\x00\\x07\\xb6\\xea\\xd1\\x8c\\xd7\\x85k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  161.  
  162.  
  163. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xe9\\xb9^gd\\x01\\xa9-0\\xcb\\xdc\\xf98\\xcb\\5+\\x81\\xec2\\x03\\x85\\xed\\x87\\x901-\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  164.  
  165.  
  166. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xd0 \\xd0j\\xbd\\x91\\xd5\\xb5?g\\x8fec\\xaa\\x19\\xf1\t-\\xbc\\xc7=\\xf7i\\xa6\\x96ta\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  167.  
  168.  
  169. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x89\\xe9#\\x84\n\\x82\\xe8\\xbe\\xe1g\\x9bal\\xbf9\\xe6y\\xa4e\\xb9\\xdd\\xc0\\x8b\r\\xc5\\xf1\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  170.  
  171.  
  172. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xddo\\xf1\\x0b\\xbb\\xde\\x98\\x85\\xc7\\xab\\xb7\\xc6\\xbd\\xcd)\\xd2\\x1a7\\\\xa2\\xc1l\\xe7j=@\\x8fh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  173.  
  174.  
  175. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x9c\\x8d\\x85\\xc7\\xe9\\xb30\\x80gakr\\xe5\\xc7\\xc8h\\x9bau\\xc9l\\x17d\\xc3i\\xcd9\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  176.  
  177.  
  178. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xc4\\xb7\\xadea\\x88\\xac\\x1d|\\x8a:\\x83\\xccq\\xd2\\xdc\\xd3\\xcd\\x90\\xab\\xfd\\xd8%\\xdb\\xf5>p\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  179.  
  180.  
  181. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xa2f\\xba;\\x14\\x16js%z2b\\x1e\\xd3\\x80\\x18\\x13\\x18\\xc1\\xaa>s;\\x8f`\\xe7\\x1d\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  182.  
  183.  
  184. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbfs\\x13t\\x90\\xec\\xb8z\\xbf\\xc9\n\\xcb\\xa4y\\x88,\\x9d\\x9b\\x8f\\xb5,-mkz\\xe3\\x14\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  185.  
  186.  
  187. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x88\"\\x90\\x94\\x18q\\x95j\\xe89\\xac5\\xcc\\xcf\\xee\\xa5\\\\xbc\\x99\\x96\\xfc$\rx\\x84\\xd6\\xfd\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  188.  
  189.  
  190. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x1d\\xaf2\\xae\\xd9\\xbb\\xd3%t\\xf8a@4\\xc8w\\\\xa0y\\xff\\xf5\\xc8\\xf4\\xe3\\xa8>\\xb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  191.  
  192.  
  193. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xd9\\x0c\\x18n\\x0c/\\x98\\xf9\\xb6z\\x89\\xe9\\xb2r\\x0f\\xfc\\x1a\\x92\\x07\nq|\\xd2nxe\\x93\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  194.  
  195.  
  196. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xf2\\x7f\\x93y~\\xfe*\\x80u\\xfc\\xee\\x7f\\xe1\\xe1c\\xa7\\xcdg\\xf8#\\x04\\xcbc\\xc1\\xa6\\x83k\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  197.  
  198.  
  199. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xc7qmru\\xb9-8\\xf1u\\x1a'o\\x10\\xf8e\\xf3\\x14\r=\\xca\\xf0\\xeb\\xfe\\xed\\xc2\\xc6@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  200.  
  201.  
  202. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xbb\"\\xaf\\x1e\\x03\\xacs\\x02\\x16\\x85\\xa8\\xe6\\xdc\\xfc\\xc1,v\\x1d\\xcc\\xd0\\xdd\\xc8\\x11\\xf1\\xc6a\\x9cl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  203.  
  204.  
  205. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xdb\\xe0\\xc7d!/\\xb6|i\\xdf\\xc0\\xc1\\xcdwl\\xd2c\\xe6_\\\\x93\\xf4\\x14\\x12t^\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  206.  
  207.  
  208. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb,\\xd5=\\x05\\xe1\\xe68i\\xbf:\\x9a\\x97ln\\xefd\\xf6\\xf6\\x00\\x91vg\\xa0\\x7f\\xe3m\\x03\\xa9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  209.  
  210.  
  211. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbg\\x97vo@\\x1cw\\x8b\\x04>\\xac\\x9b\\xbd\\xf3y\\x16\\x9c\\xcd\\xbfv\\xad<zy\tf\\xb0\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  212.  
  213.  
  214. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x84\\xae\\xf7\\xc1\\xf5\\xed\\x90\\xbcpf\\xcd\\x94\\x85\\xe0\\x8bfm\\x80\\xa7\\x8d\\xc0oa=\"\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  215.  
  216.  
  217. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xd1\\xcd\\x8b\\xc1s\\xbc\\xaa\\xf9p\\x90\\xe4\\xab\\x80\\x90i~j\\x1b\\x7fmk\\x15\\xd8*\\xab\\x19\\x1eq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  218.  
  219.  
  220. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xc6\\x1dd\\x9eu\\x92\\8\\xa4*\\xa6\\xe7\n;\\xf0\\xff<|\\x96j\\x9do.a\\xc3-y\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  221.  
  222.  
  223. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb;c\\xb4o\\xe8v\\xac\\xe2\\xa7(hh\\b\\xf8\\x1d\\xf9\\x12\\x91\\xd0\\x88!\\x0bn\\xbd\\x90\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  224.  
  225.  
  226. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xf2\\x1a\\xde$7\\xb0!\\x0e\\x08\\x13g\\x02@\\xbc\\xc5\\xc4\\x10\\xc1i\\xeb\\x943\\x81\\xd8ml\\x13b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  227.  
  228.  
  229. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xb6\\xa0\\x0c a\\xa7v\\xf2\\xd9\\x04\\xe0\\xc6\\x0e\\xc5\\xb8t\\x89\\xf3\\xadh\\x03\\x81\\xa2\\xf3\\x1d2\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  230.  
  231.  
  232. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x98\\x1f\\xef\\xf6\\xf3@;\t\\x00\\xc3\\xc8\\x8e\\xd0\\xd79\\x94\\xdb\\xdaj\\x99\\x17\\xc43\\x02 \\x1b\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  233.  
  234.  
  235. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x0b\\xe3s\\xc5\\x80p_\\x94\\xe8\\x86\\xfa\\xb4\\xd6\\xf3\\xaf\\xad\\xcd\\xf8\\x94\\xe0\\x9dcl&l~\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  236.  
  237.  
  238. "http_request": "winword.exe_WSASend_z\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xffi\\x89^qe\\x12`\\x15\\x97\rd\\x80\\x87\\x0b.\\xcf\\xe86\\x06\\x14\\xb5?hb\\xbf\\xec\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  239.  
  240.  
  241. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb7\\xed`l\\x06n\\xa0\\xfa$\\xe8\n1a\\x1bbq4\r\\x83\\xacq\\x03\\xa2\\xbc\\xb7\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  242.  
  243.  
  244. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x94\\xa2\\xfeo\\x1c\\xb5\\xe2\\xc3b*\\x16\\xe6l\\x14\\xd1j\\xda\\xfa\\x8eg\\xdc\\x07\\x8e/\\xc1\\xe4\\xc7\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  245.  
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x18\\xdb\\xea\\x05\\x03\\x97\\x93\\x9d\\xfe\\xd9v\\x9dc\\xb5\\xee\\xbf~2\\xbd\\x8d:\\xc4\\x84\\x05\\xa8\\xf6wp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb1g\\x04\\x8e\\xd5j|\\xe05<\\xdew\\x81\\xf8\\xa2\\x85\\x93b9\\xf7\\xbfa\\xb5\\xdf\\x94\\xff\\xef\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbs\\x9a%r\\x88\\x08\\x99\\xff\\xf4\\xbe\\x9f\\xc9\\xcbtz\\x0f\\xd4l\\xc0p\\x86\\x85\\xec\\xa3\\x9d\\xffz\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbaus\\x03m\\x8e\\x87\\x01\\xb2@\\xbe\\xa81\\x02\\x9ag-\\xeb\r3b\\xca\\x950/\\xc7\\xf2\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x9b\\x83\\x82d\\x11ra&f\\x94&\\xbc'^\\xe3\\xd5\\xbck\\xd9\\x84\\xc6\\x18\\x93\\xa5u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbw\\xebp\\xdb\\xbf\\xd6\\x854\\xe5\\x8en\\xc2\\x18\\x1ew\\xe2\\x06\\x16a#\\x00\\xe8\\xcdf\\x852\\x89\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xac\\x19j\\xaf\\x82\\xdf\\xec\\xb0x\\x17\\xbete\\xec\\xec\\xb8\\xb1\\x98?(v\\xc7\\x9cs\\x84\\xb5t#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb1\\xb50q\\x8d-\\xc5j\\x9d\\xb8\\xcamg\\xda\\xaf\\x85a3\\xd33e\\x8f\\xcav\\xf4b\\xec9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbq9\\xdakxd\\x82#\\xac\\x12e\\xaa9\\xfb\\xdd\\xb5(\\x898\\xb1\\x07\\xd4\\x8c\\xf0@\\x05hg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_f\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb:\\x82:\\xf4\\xf0\\xf1?\\x11?\\xbd\\xd4\\xa33\\x96\\xb0\\xc6?\\xdc\\x19i\\xe0\\xf7\\xf1\\xbf\\xa4\\x98\\xf5y\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xff\\x9f\\xc8\\xfe\\x0bw\\xfb\\xb4@\\xec\\xaa\\x8d\\xe8\\xd4\\xeb)\\x81o\\xf6\\xe0\\xc6\\xb7v=\\xe9\\x86=\\x1f\\xd9\\x0b\\x1e&'o\\xf6jz\\xf0\\x07ah\\x85\\xe7g\\xdaho\\x7f\\xfd\\x01t\\x9a\\xdb\\xb1\\xc2\\x89\\xf7\\x9f\\xed\\x8d\\xc9dl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xb0\\x1ayo\\x1dd\\xc1\\xae52\\xcd\\xbfj`#\\xae\\xb3\\xa0\\xea\\xe4\\xbd\\x9b\\xd1\\x85\\x84xhj\\x18\\xf9\\x8c\\x0c\\xc8r\\xf0n\\x8e\\x04\\x0ff\\x15\\xefk\\xc3\\xfc\\xd7%"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xbcj\\x9bst\\xe0hl\\x9b?\\xe2\\xef?p\\xd8\\x93\"bg\\x91\\xfd8eg\rf\t\\xbe\\xf4|r\\x91n\\xa4\\xe1p-\\xb1\\xc2\\xd3\\xac\\x14\\xe0\\x7f\\x17 \\x13\\x82z\\xdb\\x14#\\xc0\\x9c\\x84\\xa6q\\x9ejc-\\xd2\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xd7^\\x15)\\xfc\\x81\\x81f\\xfez\\x1a\\x05fo~\\x89^2\\xffm\\xc63c\\xc4\\x96~\\m\\x85g-w\"*\\xa1\\xa7\\x00\\x99l\\x0e\\x02v\\xb1\\xfc\\x15\\xca\\xc1"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xb1\\xaa\\xf6\\x06\\xa3\\xdf\\xf7\\xbc\\xfc\\xfbb\\x15\\xf0q\\x06\\xffkv\\xaf\\xdb\\x93`\\x90\\xa6k+\\xf3g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x97e\\xad\\xb7cgm\\x16g:%\\xb8\\xa8\\x0e\\xd4\\x97\\x0fl\\x10r\\x1d\\x84~\\xeeta^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\x8a\\x0e\\xea\\x97\\x82\\x12\\xbei\\x01e\\x0f\\xd1\\xea>\\xe5\\xd3hls!\\xd6*ns:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfby$\\x18\\xaftc\\xf4\\xe3\\xd1d\\x98\\xf8\\x87.>\\x97\\xa2\\xab4\n7\\x9d\\xa7\\xe0\\xb0\\x86\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb9n\\x9bp\\x80\\x18 \\xe0l\\xd2`\\xe9\\x03f\\xbe1:\\xb4\\xba#r0\\xb45\\xfe\\xcbc\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xab\\xb7g,\\xfbc\\xc3\\xb6\\xa9j&\\xc7\\x088\\xf5\\xa2\\x06k\\x00\\xd9n0*\\x91\\x7f\\xa5id\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xecn\\xd5i\\xfbf\\x00\\x8d\\xe0\\xff9\\x08\\xc5\\xea\\xfa\\xe3dq\\xf2\\x1cx\\x1c\\xefh^e\\x02\\xb2 2\\xd8\\xef\\xb6y\\xaf\\x8a=\\x8d\\x8cj\\x1b\\x93\\xa3w\\xd9\\xe5\\x11k\\x8c\\xfb\\xcbu\\xcf\\x85\\xec\\xb6\\xef\\xe0(\\xefy\\x01\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\xb8\\xe7\\xb4\\xe0>+\\xb0xm\\x18\\xd5\\xaa9c\\xda,.*\\x9e\\xe6\\xf0op\\x08\\x19^q\\xc6=0\\xe7\\x18+\\xbf\\xc9o\\xae\\xbf\\x10\\x8f\\xbd^\\x19\\xbd\\xf9"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3;\\xc7d\\xf9\\x14v\\xdf!\\xf7\\xbd\\xc8i\\x97\\x14i.=\\xb93\\xa0\\x0c\\xc6\\xf7\\xb6\\xa8\\x14\\xc3\\xa3\\xd7\\x84\\xd1oq\\x93\\xebl\\xa3\\x95$\\x8b \\xdc\\x90\\x85\\x044\\xbb\\xcb'v\\x1du\\xc8\\xe7y\\xc3\\xbd,\\xeb%k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001u*\\xa1\\xa3\\xfe\\xcaw\\x11\\xbch\\xb4\\x0f\\xc4~\\x17\\x00\n\\xa7\\x05~44\\x83\\xef\\xe1\\x0cv\\xefq\\xc9\\xb6 \\x84\\x079\\x87\\xec\\xae\\x05\\x15\\x15\\xb7\\xb5\\xf6\\x99\\x98`"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xa8\\xe4\\x1c\\xca\\x07/\\xa4s\\x93\\xea\\xdb\\xf8\\xfe\\xa3d\\xa4\\x9d\\x83n\\xec\\xd3\\x86\\xa4\\xda \\x05\\xec\\x96n5\\xa2v\\x9a\\xaa\\x833\\xdd\\xcct\\xbf\t\\x93i\\xcdm\\x97\\x11\\xe2w\\xb0\\xd8\\xe6\\x83\t\\xe8\\x06hq\\xe4\\x158\n\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\xf0\\x91s\\xc8\\x1a\\x80\\x1b\\xdc\\xb1\\x16m\n\\xc8\\xf4i<u\\x1b\\x8ad\\x0e\\xb7\\xd0\\x1a\\x133\\x10g\\xc4\\xa9`\\xe8\\x94\\xc79\\xf4\\xa4\\x98\\x86'\\x87\\xa2\\x91$q\\x19\\xde"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6t\\x0c\\x8eo\\x8c\\xc2tnc\\xed\\x89\\xa0-\\xa0\\xd6\\xf0`\\x91\\xda\\xbb\\xd9\\x82k\\x95j\\x03\\xbf\\xfa*\\xd9\\xba`\\xa5\\xe4\\xce\\xcct##a!y\\xff\\x1ce\\xc0\\x91q\\xc1c\\x06o=\\xda\\x9f\\x81\\xc8\\xbd'\\xe4xf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xbf\\x1a\\xfb>y\\xf4\\xbf\\x0b_(\\xcc\\xe2\\xa0\\x94z\\xe2\\x01z\\x87\\x10\\x86\\x9a;o\\xea2\\xd37k\\xfb\\xa8\\x1d\\xedo\\x83\\xa0h\\xbc;\\xf3\\x18xdat&"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d\\x142\\xf7_\\xbbx\\x95cf\\x9bq\\x0b\\x05b\\x81\\x97&4s\\xfb\\xea\\xc6&\\xbf,\\xe8\\x9a3\\xaf\\x83\\x88\\x02\\xd5~\\xd8\\xfd\n\\xf1\\xbcqbr\\xb6\\x120@\\xff;\\x02\\xb8\\x9bd\\xa7\\xad\\x063\\xed3\\xa3\\xf2\\xd5o\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xe8m.4\\xb7\\x952\\xc2\\xb6d%\\xdb\\xe6r5\\xc3\\x15 +\\x8au^\\x84j\\x9f\\x17\\xbb\\xb8\\xa1t.\\x97\\x0f\\x01\t\\xa7\\xae\\xd9\\xf8\\xcc\\xfd\\x948gk\\xfb"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x9b\\xf4t=\\xd7\\xa87\\x95\\xfa\\xf8\\xa7\\x18p\\xf7\\xa7\\x17\\xb7\\xf2x\\x07\\x0e\\x8fa\\xcc\\x00yh\\xf4f\\x1b\\x93\\xe1\\x92\\xc2\\xd4\\xa6\n\\x12\\x1c\\x8e\\xcc\\x8e:\\xb1!\\xb8\\xe5\\xf7#h.\\x02\\x08yc\\xa5\\xdc\\xc2*\\x84\\xc9\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc%ez\n\\x96\\xb9\\xb9\\x9b\r\\xd0\\x89\\x98\\xbd<\\xf2\\x0b\\x82y\\x05\\xdb\\\\x10n\\xbd\\xea\\xf5:\\x1a\\x99|\\x96i(\\x1a\\x96\\xb39ju\\xd2\\xa4z\\x87\\xa9\\x98;"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9r\\x05\\x145=\\x8c\\x8d;g\\x8al\\xd3\\xde\\x07lg\\xf8a6c\\x8e\\x00\\xa0\\xa9ipx\\xd5\\xc4e\\x1b\\xb7\\xc0\\\\\\xbd\\xee\rg\\x88\\xe1\\xce\\xae\\x15\\xb0\\x8c9\\xf9\\xc5i\\xbb\\x12\\x03\\x8c\"v\\x1cik\\x12s\\xf5y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13p\\x9a\\x9b\\xd3\\x9a\\xe6\\xac\\x0c\\xbdm0=\\x87\\x18\\x87\\x9c\\xa0h>\\xc2)\tt\\x1c\\x11\\xe2\\x86\\x0f\\xf5\\xad\\x1e^j\\x0b\\x87`\\xffc\\xd7\\x9b!q\\xdd\\x11\\xbc-"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04he\\x84\\xbebq\\xd2\\xdb`\\x15*\\xa6_\\xcf\\x9eif33\\xebe-\\xb5\\xd8\\x00t\\xa6\\xb0=\\xd5\\xfc\\xbd\\x1a\\xa9\\x1b6\\xfbd\\x9d~\\xda\\xe5pg\\xecum\\x0e\\xe3\\xe7\\x95\\xaf\\x02\\xc1\\xac\\xa3x\\x8c\\xa3\\xa5\\xfbob\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xc2o\\x86\\x83\\x02\\xc1v\\xff4\\x8b.\\xe5\\x96%\\xc2&;\\xdf5\\xf7\\x122\\xb8\\x86\\xae\\xa3\\xec\\xfd\\x82\\xfb\\xa5\\x15\\xe9\\xba\\x9d\\xc1h\\xf9\\xae\\x85\\xb1\\xd16\\x85\\x8e\\xe8\\x04"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xac\\xb6\\xc2\\x98\\xaa\\x06~\\x9c\\xbb\\xf1r\\xb9\\xbb\\xc5\\x98\\xbc/\\xe4 \\x04f\\x0b\\xf8\\x18\\x9d\\xc0\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!\\xa9\\xf1\\xc5\\xb9\\xc5\\x1b\\xa1\\xe2r\\xf7a\\xeb\\xdbz\\xa24\\xd8\\xb9\\xa1\\xde\\xe0\\x1a\\xc7b.14c\\xd7\\xed\\x1e\\xbd\\xf0h\\x80y*\\xc5\\xaf\\xe1\\x0bps\\x00ca\\xac\\xc25\\x93\\xd56\\xa1\\xc7vr\\xdb\\xec,\\xc1f\\x91\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\xce\\x03\\x12\\xd0\\x83\\xbe\\xc5\\xc1\\xab\\x7f7y%.\t;\\xf5\\xd2\\xae)\\x00\\xef\\x8f\\xaf\\x94-\\xd38\\x00\\xbdad\\xc2\\xde?\\x01w$\\x03\\x81\\xcb\\x93<\\xe4\\xb3"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\xa2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xf0\\x84\\x98g8\\x9do\\xf1\\x836*\\xa6\\xd6w\\xa7\\x084\\x8bp\\xa1\\x19\\x104x\\xb4\\xf8\\x9d,_:\\x8f\\xd8\\xb6\\x91\r\\x9d\\xc83\\xc3\\xf9\\xb1\\xed\\xd6\\xea\\xb5\\xab\\x18\\xea\\xf0\\x86\\xb9)m<\\x136\ta+\\xd5\\xff\\xfcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>b\\xcb\\xa5\\x84\\xec\\x82\\x8e3\\xd2\\x99\\x9f\\xec2\\xcfjbom\\xa0v@\\x14\\x88\\x14\\x02\\xd3\\x8d.(\\xf3l@+\\x89\\xb624f\\x17\\x80rg\\x9f\\xb24\\x01\\xfb"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x03\\xa0\\x1ct\\x1d\\xf9\\xbf:\\x9a%\\xb0\\xd5\\x80e/\\xc1i\\xb6\\xef@\\xf3\\x97d\\xcd\\xc9\\xe1\\x8b&\\x10u\\xad\\x137y\\x14;\\xb1\\x96\\x8c)|'\\x1b\\xe1n\\xd5+\\x0e\\xcc\\xb6\\x01\\xe8\\x9b\\x83\\xdace\\x13\\x11\\xac<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\xcb<\\xb4p\\xdf\\x02\\xe1\\xder\\xf3\\xe2i&8\\xa3\\xfd\\xeb\\x85\\x0cco\\xf6&4\\xc5\\x97\\x1a\\x0e\\xe9i\\x8d\\xb8h\\x87)\\xc1i5\\xa4\\x85pq2\\xc5i\\xb8\\x99"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xa52\\xe1\\xbf\\xeb\\xf8\\xa9\\xbe\\x872^4r\\xe6\\xdc\\xdch5.\\xc8\\xd7\\x93m\\x0b\\xe2\\xfe`\\xbb\\xfb\n\\xff\\x02\\x1e\\xef:\\x98\\xeelm6%,\\xf6_\\xc9^\\x87\\x10\\xb7\\xe2kqq~?\\xbai&f\\x17\\x80e\\xd9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdc\\xdb\\xf0*\\x90 \\x8b\\x8f\\xe7\\xbd\\xcdc\\x06\\xe3\\x95n=\\xbbq\\xb3;\\xd7\t\\xb5b\\x1a\\xe9x\\x8e\\xbb\\xb9a\\xe39\\x8a\\xfc\\xfa\\x99\\x84\\xc5m\\x80k\\xbeo\\xec\\x1c"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\xae\\xe7\\xaa\\x81\\x18\\xe8\\xf2.\\xa8\\xa3oi&&t\\xf4 \\xe2~\\xe5z\\x00>\\x01+\\x15\\xc9_\\xe9\\xcf\\xfb\\x01\\x8b\\xc9\\x04oe\\x02\\x8e\\x82\\xb5!\\xf9\\x80\\x8d-s\\xd5n\\xc9&\\x02y\\xe0g\\x03\\xd2\\xaclp4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\xc0\\xe2'w\\xfa\\x06\\xdc'\\x9eo_\\xf8\\x0f\\xcc\\x07s\\xa7`\\xfd\\xbc8\\xdfj\\x92\\x02\\x08n\\xb1?\\x7f\\xdd$\\xc1\\xc3\\xd1\\x86\\x1a>\\xbdz\\xe9\\x83\\x1a\\xb3n\\x1f\\xd5"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xb1\\x98\\x9a\\xb1\\xef\\xa0\\x1bpy\\xe6\\x9ew\\xe9\\xf2\\xe1\\x81\\xefo\\xb6\\x95\\x1c27\\x9c05\\x06\\xc4d\\xfa\\x14\\xd5lw\\xa7\\xa3@\\x9dq\\xf5\\x8do\\x1c\\x01\\x81\\x9e\\xc9!o#\\xeb`\t=\\xa4p\\x11\\x00=\\xa2\\x7f\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\xe3\\x0b\\xbbe\\xd0y\\xa9%m\\x16\\xfa\\xeffc:\\xcb\\xc0pj\\xa4\\xcb\\x8d\\x0b\\xe1\\x06\\xd3\\x0fu\\x0b\\xcf\\x80\\xd1\\x8c\\xcf\\xbb\\x9e\\x08#\\xee\\xb2:d\\xed\\xa3\\xfdr\\x84"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb8k\\x15\\x0b\\x13\\xf3\\xd6\\x99j'\\xfe\\x93\\x94>\\xfd\\x13~g;\\x02\\x0f\\x19\\xdal\\xc2+\\x85qb\\xd6\\x82\\xf3\\xba\\xabq\\xc8pg\\x0f\\x8f\\xea:\\xb7!\\xd0 \\xe4\\xe4\\x08\\xa77\\x05\\x98\\x0b'\\xdesaq\\xbd0=\\xc9l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\xd4\\xe5\\xba\\x19\\x97 \\x02m\\x87\\xd6\\x88\"\\xa0\\xcf\\xdd\\x86\\xc8\\xc4\\xe6h^z\"\\xdf/d^\\x82ei\\x1a\\x124\\x8d5\\xb1\\x7f*\\xd8'\\xac\\xcal\\x08\\xb2v"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*q\\xe6\\x8c\\x04\\xef\\x7f\\xb3k\\xcd\\x125<\\xb1\\xe6\\x04=\\xed\\xfau\\x82\\x8a\\xf9\\xff0\"<\\x9a\\x1c\\x9b\\xae\\x08\\xb1u\\xe0|\\xaa3\\x11w\\xef\\x16\\xadp|\\x9b6m\\xc7\\xff\\x96\\xf6\\x9f\\x050hj\\x13\\xee\\xa5\\xec\\x93q\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4t;s\\x96\\x0c>-\\xe7\\xa5d\\xd2\\xf4\\xce\\x19\\xea\\x01k\\xa9`\\xb5\\xb1\\xfa\\xc8;\\xff\\xddbn-\\xf5\\x9c\\x11k\\x8b|\\x97.\\x8f\\x02\\x1c\\xcd\\xbe:\\x84u\\xef"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\xf30\\xf7\\xcf\\x005.,d\\xc5\\x1e\n\\xee\\xe5k\\xaa\\xbd)\\xd3\\x95\\xb6\\xae\\xbe=q\\xd4\\x8es\\xb5-\\xe7)d\\xbd\\xd3~j\\xbajd\\xa2\\xbc\\xac\\x10'\\xf6evd$9\\xef\\x87\\x92\\xca\\xa4\\x1ci\\xfb\\xa4\tn\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\nc\\x19\\xdd\\x18\\xf7\\xeb\\xb4\\x8b\\xf22\\xf5z\\x04o\\x84\\x92\\xaa\\xc3\\xd0\\x0cx\\x9b\\xf1@`\\x94\\xc3\\x81\\xe8s\\xd6kq\\xb9n%^\\x1a\\xf6\\x8c=\\xad\\xf7\\xd7r\\x96\\x8a"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7\\xd6\\xae\\xf1v\\xe8wc\\x8c\tx\\x03\\x95\\xe3\\x1f\\xb5\\xb4h\\x12@\\xb3\\x1c\r\\xad\\xe6g\\xe9j\\xff\\\\xbaa\\xf0\\x7f\\xa5\\x05\\x9b\\xecw\\xd2\\xf6bngh\\x0f\\x05\\xdf\\xf8\\xdf\\xfe\\xe7\\x1fc0\\xe1\\xa4\\xb8u\\xf1\\x08'#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x97,\\x85\\x08\\x81>\\xa9\\xa5e\\x99\\xb5\\xea\\xcb~\\x97\\xd5\\xd6g\\xb2\\x1d\\x04\\x19_\\xeb\\xb0\\xc9\\x9b\\xc3g\\xdc!y\\x97\\xce\\xbf\\xb9\\xc8\\xe3\\x1b_\\x7f\\x93|t3%\\xca"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\xaf\n\\xc6\\xfflq7:r\\x1c\\x1e \\x06\\x063\t\\xb1 \\x05\\x8c\\x860\\xfc\\x98\\x13\\xa9^\\x90\\xc6\\xa4\\xec\\x81\\xbd\\xb7\\x82d\n\\x97\\xe3n>\\x804z*\\xd0\\xfaf\\xe7u\\xc0\\xfa\\x93.\\xd8w\\xe0\\x802\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06iy@\\x1c\\xb02\\xdd\\xc2m\\x8e2o\r|\\xbe\\xb3~\\x97a\\xf7e\\xf3\\xd7keo\\x0e\\x85@\\x06\\xc9\\x98=\\xd4\\xc9|\\x06\\xfc\\x98\\xe6\\xc1*\\x95\\x00\\xcb\\x83\\xf0"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8\\xef/\\xd49\\x9e3)\\x7f\\xa1\\x03\"\\xed\\x89\\x0f\\xee\\x93fm\\x07y\\xb1\\xbe\\x9b\\xe3\\x08\\xea\\xda\\x8cot\\xa6\\xea\\xe3\\xd0\\x0e\\x19s\\x1baov\\xe4\\x93\\xec%\\xb1\\xf1\\xfefi\\xcd\\x8e\\xc0\\xd4\\xbai0n\\xb0\\xba\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xf3\\x05\\xe3l\\xea\\xd0h\\x1b$\\xbbc\\xacxv6\\x13!fb\\xd2*eay\\x96\\xd6\\xd80\\x1a\\x12vi\\xbf\\x11w\\x170\\xee\\xd7\\xab\\xf5?\\x94\\xfa\\xc9"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfbh\\xcd\\x01\\x1e@v\\xa6\\x0c\\x04-\\xf1\\x03e \\xf38\\xe0\\xbc\\x98a\\xb3\\xbf\\xd4\\xe9c\\x90b\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\x9f\\xe2ex9\\xf8\\x92\\xb3%\\xb7\\xf9k\\x1bl\\x8e\\xba\\xc8\\xaa\\xbad\\xcdb\\xb6\\xcd\\x96\\x9d.\\xe7\\x00\\xc8\t&l\\xaflk\\x80\\x87\\xcau\\x12;g\\xa0i\\xfd\\xb8,.\\xdd\\x7f\\x91b\\xc3j\\x15\\x8a\\xb4\\xab\\xa4\\xdc.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+st\\x90r\\xd86\\xbe6\\xaa\\xfc(\\x06d\\xbc\\xb0\\xcf\\x8c\\xc0\\xb4\\x0c\\x02\\xbf\\xc5\\x97\\xe9\\xa0j\\x9bg_\\xb8xfq\\x10\\x85\\xed\\x0b\\xfc\\x89\\\\xe6s<"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xd8\\xa2\\x90\\xf1\\xc1\\x81\\xdc\\x95\\xd9#1hlem\\x8f\\x8d\\x87\\x8d\\x90\\xca\\xb4h\\xcb*\\x15\\xb9$\\x01\\xa7\\xb3\\xfdq\\x0f\\xea/=\\xb5\\x815\\xf0\\xcaym&x\\x18\\xe3\\xc8\\x9b7\\x9d\t\\xb7\\xb2\\xd1c\\x9d\\x02%\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\xc5\\xe5\\xd3y\\xbfg\\xbc\\x1au\\x96\\xe91\\xe1\\x8ei\\xf8\\xfdv\\xadx>o\\xee(&\t\\xe2\\xd3\\xad\\xdb\\x02x\\x8d#\\x9c\\x89\\x97xg\\x07\\xaf\\xb7\\x84\\xa3\\xb7\\x84"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\xa2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\xc0\\x176d-\\xb7*atb\\xa0\\xa9%\\x850\\x12oq\\xbf\\xb0\\x96.?\\x9f\\xa6\\xb0e\\xec\\x87a\\x8a:\\x12\\xb2\\xcfj\\xea\\xd8)\\x93\\x86*\\xfb\\xb9>\\x85\\xc9\\xc5\\x9c\\xae9*s\\x18\\x9c\\xbd\\xa3g\\xd6f<\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\x0f\\x82agk\\x0f?r\\xfcq\\x11\\xb8\\x85\\x1b\\xecih\\xa4\\xa6g\\x9f\\xa9rh\\xc0\\xec\t'\\xc4\\xd57f\\xa9\\xa5\n\\xe1r4\\xa5\\xf8\\xf1\\x91'\\xec!pt"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\xc8\\x1b>\\xc9\\xb2\\xdd\\xaa\\xc2j\\xe5\\xca\\x1b\\xaa\\xfa6\\x98\\x89\\xf7\\x8e-,\\xe8\\xc6 a\\x10\\xb1kx\\xe7\\xf5\\x0f\\x18+\\x88\\x10\\xd1\\x162\\x8c\\xf5c\\xe1\\x8a\np\\x03e\\xce\\xdc\\xfb\\x01w\\xe5!\rs\\xa6c\\x89\\xcd\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x9a\\xfdk\\x84\\xcd\\x95\\xd7\\xf7\\x11u\\xf0^0\\xfd\\xc1\\xafr\\xd5\\x8evji\\xadvm^\\xbb\\x03\\x86\\xe6z)\\x8b\\x12y/\\xa3\\xaf\\xc1\\xda\\\\xdc\\xf3\\x02s\\x1e\\xf1"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\x1f\\x94\\xe67*zox:>\\x19y\\xe4b\\xdbd\\xf5j\\xa9\\xf6\\xe8\\x0f\\xc3\\xc1\\xc0\\xba\\x9f\\x14\\xd3\\>y\\x02\\xa8\\xadih\\x010w\\xb15w9\\x04\\xc17;\\xa6\\xdb`q\\xdfn\\x04\\xa20\\x8c5p\\x1cf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4\n\\x0c \\xf4\\xc9j\\xcd\\x07\\xa0\\xe0\\x82nh(\\x1cj\\xc6\\xb6\\xc4\\xbe\\x94\\x7f:\\xb8j!\\xd2\\xb5z\\xb1k\\xf3\\xa8$\\x8e\\xe0\\x12\\xea#/\\xfbi\\x1c\\xb1u"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\xdc\\x08q\\x0fs&\\x91\\xda_e'\\x93\\xc9ogl\\x8ete\\x1c$\\xe8<o&.d@\\xbb\\xd8w!\\x86\\xe7\\xd3|/&/\\xbd\\xc5;,k d\\xb61e`\\x13\\x01ep\\xa9\\x0c\\xbe\\x82w\\x125\\xc8\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd3q\\x9fu\\x8f\\xb2f+t\\x95\\xd9.7\\x14\\xcf\\xa6\\xd8k\\xd1\\x8d\\x941\\x95\\xf1\\xc0\\xbf\\x7f\\xac\\x94\\x85xgrc\\x02\\xe1\\xe7k\\x94<y\\x84\\xde\\x0f\\xd72"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\xa2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\\\xd9\\xc1:\\x16\\xfa\\x97\\xb4\\xc5t\\x87\\x8f\\x03\\xbe\\xf3\\x86\\xf7:\\x8b\\x89y\\x8b\\x08\\xe1)p@l\\xe5\\xf0\\xcb\\x8a4\\x9b\\xb5v\\xd6\\xd2&\\xfby\\x0b\\x06\\xf3\\x06\\x1e\\xe7\\xebb\\x87^\\x17\\xf5\\x16\\x13r\\x15\\xfe\\x964\\x086k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xcf\\xc9\\x9d\\xa4\\xf8\\xfbd\\x81\\x03\\xb0\\xd7\\xb6-\\xdf\\x90\\x86\\xbd\\x90\\x7f\\x8d5\\xf5\\x194#\\xe4l\\x94u\\xda\\x1a\\x82\\xf5\\xf9\\x01xc\\xf0!\\xf2\\xb3\\xee_p,\\xd0u"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\x1e\\x8d\\x11%^+\\xab\\g5\\xec\\xf8\\x1d\\xdd5\\xd7\\xbe\\xbdy\\xe4m.\\xb6\\x03\\xc0\\x02\\x1b\\xd0iu/\\xa58\\xb5\\xa0m\\x1b\\xe6m\\xb0\\xd5\\xb4\\x00\\x1bj\\x87:\\xfe\\x9f\\x84\tjoj\n\\x13\\xb6\\xbf|u?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000xs\\xa9\\xd5\\x14$>\\x06\\x8ec\\xc7\\x8e\\xad\\xacj\\xd3o\\x1b\\xf2-\\xe9\\x18\\xb0,\\xff1\\xbf+l\\x7f\\x9f&\\xd6\\x98\\x07me\\x1c\\xa09\\x18?\\xb3\\xbf\\xec\\xa9i"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xe4q\\xc9\\xaa\\xf5\\xc9\\x0boa\\x04l\\xefp\\xf0\\x14\\xe4 u\\xcf\\x8d\\x9aoz<\\x0b\\xb3\rfomlr\\xaa\\x8a\\xc3s\\xf4\\xa4uc\\xf4\\xe8p6&\\xe8t6\\xbasx+\\xbc\\xc6\\xc6\\xd2\\xe2&\\xf1i\\x80\\xbc\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xe5\\xb4\\xfbln\\x0ef\\xbe\\x9c\\xc1\\xf6\\xc6e\\x1c\\x8cel\\xb9\\xe4\\xa8\\xf7\\xfd\\xaf.\\xc3e\\x95\t\\x06\\xd0\\xd3\\xab\\xd3\\x90\\xfe<u\\xc6\\x15lt8\\x92zx\\xe8\\xbc"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h%\\x9a$\\x12\\xd78\\x9c\\xe7\\xbf\\xb3\\xf3\\x9b(r\\xc4\\x88\\xb96\\xf5\\x85\\x13\n\\xd5\\x84\\x977x\\x835\\x9el\\xb2\\xdf\\x839fq\\xae\\xe9_\\xc5\\xd5?\\xa0\\xffsl\\xc0\\x08\"\\xa2>d\\x8c\\xeb\\xe4*\\x15\ne\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\xfa7\\xb0\\xe9\\xa5\\xde\\x05\tk\\xa6\\xd4f\\x9a\\xab\\x8a\\xb9\\xf9h\\xe5\\xb7\\xc5\\xda\\xfd\\xc75\\x068\\xf9zij\\x86\\x154s\\xa4\\x84e;>\\xaa\\xca\\x848\\x93"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xe8\\xc63\\x84a\\xb8b?\\xdf\\xcax\\xeai\\x1cn\\xf4\\x99!\\x95\\x97z\\xdc\t74\\x9c\\xf3\\x83\\xdb*f\\\\x80dya\\x15\\x05\\xa8\\x85\\xb4\\x95\\x97\\x98\\x7f\"\\xbb\\x1a\\xab\\xf4\\xce\\xfd\\x90\\x84+\\x13f\\xf9\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008p\\x14\\x13\\x9bl\\xf3\\x08\\xc3c\\xea\\xcf\\x9dx\\xffx\\xbdg|\\x96%3;\\x03?\\x01n\\xdf\\x00\\xa1to\\x0f\\xa6rh\\xa1b\\x1e\\xfc\\xd2\\x9e\\x1e\\xb3n\\x9d\\xf6"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\xe5\\xf2\\xa3'+k\\x85n\\xdf,\\x05\\x0e\\xb0\\xd3#f\\xedq\\xea\\xd9\\x95\\x05vd\\xd7\\xe7nc\\xfa_g\\x1ae7\\xd4<\r\\x9f?\\xb5a\\xb0/\\xaf\\x9b\\x90/\\xff\\x0c'\\xaf\\xd7\\xa5\\xe1g\\xbb\\xf3\\x82x;\\xae\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ck\\xa9l\\xff\\xbc\\xbc$\t1\\xafe\\xad\\xf8\\xe0\\xf8\\x97?\\xf3\\x1e\\xa036\\xc8\\xcb\\x86\\xbdw\\xaa!yieu\\x1e\\xf6\\xef\\x92w\\x91\"\\xa0\\xac2\\xe9"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04rl\\x8a\\x05\\xd0w\\xed\\x03\\x7f\\x80h\\xea\\x96\\xa9\\xb5\\xf3+ri\\xc2\\x8d\\x900k\\xf4=\\xbd4\\xfb\\x8a|\\xc6$-j\\xc7\\xbf\\xd9c\\xf9\\xea\\x86\\xb8u\\xec\\xf8\\xe62=\\xb8\\xf90\\xf7#j\\xdc\\x9f\\xb7\\xb1\\xd3\\xed\\xb0\\xb4y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5\\xa9a\\xf9\\x92\\x80\\xab\\x89\\xde\\xd54\\x91;\\x1c cn\\xeb\\xb56\\xa9\\x1b\\xb6\\x1cme~\\xfa\\x0f\\x8bku\\xc7\\xd0\\xf7\\x93\\xbf!\\xfc\\x97\\xdb/!\\xba\\xe4e\\x05"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16l\\x1fm\\xc7\\x8au\\xd7r\\xccf|\\x8a\\xbb\\xe3\\xe1\\x17=\\xd3\\xb9\\x92z\\xa4\\x8a\\xd7\\x9fo\\x19\\x94/\\xb4\\xcd\\xf1@1\\x1e\\x9c\\xd5-\\x8fo5\\xeb\\x83\\x9a!n\\xfbn\\x0e\\xf8\\xf4\\xb9\\x92\\x01\\xb7$\\xa7\\x1f~l\\x97\\x85|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c*h\\xd1\\xbe\\xdc\\x84\\xef\r\\x94\\xeb\\x10\\xc7\\xedt\\xef`\\x1e_\\xd8\\x18f1\\x81\\x03\\x0exj\\xb5\\x1b\\xf3\\x86\\xec%\\x11\\xea\\xbdf7\\x92c\\xae\\x82kn\\xac\\xd8"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd*v\\xfd\\x06\\x86aw\\xd0\\xaf\\xca\\x86\\xba\\xd2o\n\\x8a\\xadk\n\\x96\\xa3g\\x0b\\xfe\\x1e\\xdd\\x1fo@)/\\xef@ms\\x815\\xc9\\x98\\xae\\xad\\xdbiu\\x9d\\x03\\xb8/`7\\xe1\\xd6f\\xe7\\xd1(:\\x19\\x0b%$\\x9e!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcdh\\xaa\\x06\\x0c\\x1am\\x9a\\xc1z\\xffbs\\x13m\\x02\\xcd\\x06h\ny\\xc5\\xaf\\xcetu?\\x9be\\xa6\\x97\\xd4c.\\xda\\xc3\\x92*8\"\\xa9\\x96\\xdb\\xcc\\x96\\x13\\xd0 "
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\xa2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9sanc\\xdf\\xeb,\\x16\\xd5o\\x1d:o9\\x7feglx\\xaf\\x00<\\x9c\\xe8\\x1b\\xdd\\x01r\\xab\\xc4\\xaeo\\xb0#ht\\xc4u\\xe7\\x9b\\x94\\xd0\\x19x\\xbf\\xc2z\\xcc\\x80\\x9c\\xa2nb\\xf0\\xd0f\\xd9\\x1e\\x1e\\x86\\xfdy\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|\\x99\\x01\\x1d\\xce\\xbcw\\xb0\\xce\t!%\\x8d\\xfa\\xe6\\x8c\\xe5\\x82\\x0b\\x8c\\xe0\\x16\\xc7c\\x9cg\\xc5\\xd6\\x1fepm\\xa0\\xb1\\xe6\\x10\\xa8\\xd1k\\x0c\\xd2\\x18\\x8e\\xa4w\\x12"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r$\\xe9o>\\x86wy\\xe0\t\\xda\\xc9v,\\xff\\x0c\\x1a\\xe4\\x81\\xb1&r\\x15\\x84\\x9c\\x83\\xb9\\xcb\">o\\x18\\x8f@\\x95\\xc12\\xa9\\xf7\\xd9?\\x01\"4'\\xd1q;\\x91\\xa6\\xd3\\x148\\xacf~\r\\xc6q\\xeee+\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x97\\x9f\\xffc\\x02\\x93)(\\x91#o\\xcdyu#\\xc1q\\xd1)\\x9f\\x02\\xd3 -\\xf5\\x0b\\xce\\x90\\xb0\\x95\\x83\\xf4\\xc8\\xfb\\xd8\\xfa8\\x05\\xb3\\xf4\\xf0\\xd9?\\x0c\\x9c\\x11\\xa8"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e)-c\\x82\\xff\\xa1\\xdead\\x1bp7\\x96i_mm\\xe7\\xed\\x02xl\\xe3\\xf9\\xe0\\xa7\\xd4\\xa9\\x1c\\xb9\\x1d\\xc2\\xb0z\\xf85\\xfe\\xea\\xc3-\n\\\\x1f\\xbdl\\x91\\xbe\\xd7s\\xd2r\\xc3\\xfc\\xc1=\\x07.\\xb1\\xc8i?;k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\x86\\xea\\x9b<o\\x85fh\\xce\\xfa\\xaf\\xe3:m&\\xad\\xc10\\x0c\\xa6\\xb0i.\\xaf\\xd7\\xf6l\\x7f\\xf6)\\xaa|\\x01\\x8b\\xe1\\x02_\\x90pai4\\xdc\\x182a"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xa7\\xaf\\x89\\x8f\\xb0\\xce'\\x95:\\x88c\\xbb\\xc1x\\x14\\xc8\\xe9f\\x17\\xf3\\x80\\xc20~\\x80~\\xb8\\xaa\\x1b\\xa5\\x9cy\\x001+\\xf37\\x82\\xc6\\x97\\xdc\\xf1\\xb9q\\xbc\\xeb0\"h\\xbe8\\x90\\xba\\x8a\\xbdw\\xd0\\xc6\\x06\\x11\\xe3w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\x9a;\\x91\\x96\\xef^\\xff\\xe3+\\x1f\\xfa\\x85#!\\xc9o\\x8fo\\xf9\\xd6v\\xc2\\xd0\\x01\\xcd\\x13\\x18d!\\xb9(\\xbe\\2\\xe4\\xb9\\x96\\xa3\\x00\\xb5\\x9c\\xc7\\x85r\\xbf"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xcd\\xab\\x82\\xad\\xbe\\xe6\\x0c\\x1d\\x9b\\xe4ir;m\\x02\\x12\\x81l\\x14\\xdbc\\xcdc\\xa3\\xa7=$\\x10\\xd6\\x08\\xce\\\\xb6\\xd6-\\x8fh\\xf6\\xe0p\\xf3\\x91\\xf7\\xf8\\xd0*\\x02\\x1an\\x19es\\xfcwri\\xff\\x90t\\x8d\\x07\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c!z;2\\x8d\\xa9\\xed\\xe7\\x0ft\\xf8\\x00\\xdc\\xa7x\\xc4o/\\xedp\\xd3\\x9e\\xc6\\x05\\x9f\\xb6\\xa1l\\xef\tx?\\xff\\x0f\\x17\\xab/\\x96\\xfe\\x87\\x06\\xbe\\x93\\x94\\xf4<\r"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\xcd\\xcc\\x9b\\xda\\x7fu\\xf17\\xee\\xfbeze\\x9f:\\x1b>\\x11,\\xf3\\x99\\xe6r.\\xeec\\xc2v\\xb3\\xd9\\xa1m\\xd7\\xce\\x94\\xeb\\x14\\xeaf\\xa1\\x01\\x01\\x14xry\\xd5\\x01\r?\\xc5o\\x90\\x8a3\\xe1\\x00\\xde\\x8fl=\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06 \\xfdm\\x92\\xd5\\xed\\xeb\\x90q\\xf6#\\x9b\\x95\\x12o\\xfe\\x9d\\xbc\\x08\\xb6\\xfc#\\x9b\\x93\\xd0\\xcc\\xb1\\xd2\\xd9^\\x9f\\x84\\x88\\xd6\\xc8\\xdb\\x85\\x9b8\\x04#\\x8a\\xfd\\xc1z"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?\\x7f\\x83\\xa8\\x07&\\xaf\\xdc\\xabj\\xc8s+\\x87w\\xd5ga\\xf3\\x95\\xab\\xd1\\xb0\\x11b\\x8e\\xd3\\x8cw\\xc3\\x91\\xd3\\xfe\n\\xa6;\\x14\\xc7\\x9f\\xffl$\\x0c\\xdb\\x0e\\xded\\xc1\\xec\\xab\\x9dlen\r\\xfa:\\x80\\xf9\\xce-\\xee\\x08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\xec\\x9d\\x13\\x0f\\x1dm$fu\\xa8\\xef\\xdd\\x94\\xb1\\xc9v)\\xe9\\xdf\\x88d\\xf6\\xee;z\\xa2g\\x1a\\xf8\\x9b*\\xaa\\x9d\\xbcj\\xcc\\xc0\\x1al\\xbdf8\\xa3eck\\x12"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/^\\x07\\xd2^\\x0c\\xdf\\x04\\xa8a\\xd1\\xd7kub\\xea\\x1b\\xf5\\xb6n\\x87\\xad5\\x14m\\xb7\\xb9\\xd1\\xa2vuh\\xdb@r\\xdb\\x966t\\xc4\\x02`\\xc232\\xc2vw\\x90p\\xb2:\\x8e\\xb4k\\x1b\\xeban\\x02$x\\x199\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\xa6\\xfe/g\\x1c7@y\\xd8t\\x16\\xd9\\xfa\\xe1\ru)\\x8ebf\\xb4\\xba\\xd4\\x8c\\x95\\xb8@\\xf5\\x1b\\x95\\xbby+\\xddk\\xfd\\xaat>xo\\x8doa\\x846"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xac\\x94\\xf1\\xad\\xde\\xb0\\xb7\\xe1%k\\xe3\\x00\\xb7z\\x95\\x11\\xc2\\x9e<v<\\x98\\xf4\\xdd\\x97u\\xb2\\xa4\\xb6\\x8a\\x85^>d\\x07q!\\x9b~\\xef\\xfc\\x8ei\\xce\\xc5\"\\xe4\\x1c\\xa4lxpt\\x95)\\x01p0\\xc2b\\x0c\\x1e.z\\x9cr?o\\x82o\\xcdc\\xbf\\xe6^\tr\\x84\\x86z\\x82\\x88\\x1d\\x8d9\\xfe\\xe9\\x80wz\\x8b\"\\xc64\\x99\\x00*g\\x85\\x8d-\\x9d\\xa3cu\\x83\\xdf\\xe7`\"\\x8a\\xac\\xbff\\xb6\\x7f\\xdfn\\xa9n\\x12\\x19\\x91\\x16\\xabi\"\\x82\\xb3v\\x87\\x08\\xf1\\x1a\\x90\\xdbi\\xa6f&\\\\xfd\\xbb\\x15,qv\\x97\\xdfy\n\\xce\\xdc\\x91\\xca\\xb7\\x99\\xe4_;\\xa1\\x8e\\xe21\\xc6\\xd5\\x9ag\\xe9t|\\x87`\\x96\\xca\\xed\\xe3\"k(\\xe1\\xcc)\\xab9\\xc5x\\xb3_\\xb0<\\xb3@7\\xe4\\xb9\\x1fi0\\xa8\\xf0l.\\x86\\xdfi\\x03\\xb6\\x8azz\\xa6\\xb8\\xc3/~\\xce\\xb0\\xa0\\x9b\\xd8\\xa7\\xf8|m6\\x91\\xce%\\x12\\x0e\\xecx\\xc1\\x0ei\\x02\\xbe\\xcb\\xee\\xd8"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xceze\\xfav~\\x1e\\xddi!\\xf5\\x02x\\x93|c*\\x90\\xdb\nv\\x9cvu\\x8f\\x1ft\\xfd\\x89\\xdd\\x90\\xb6\\x8cz\\x14\\xa3\\x0bq\\x97h\\x12\\xcb\\x1a\\xca\\x98\\x0e\\xae\\xbc\\xbd\\xe5\\x90\\x80\\xc0\\xa2\\x19^\\xaa\\xe6ma\\xf7\\xb2\\xdc\\xfd'wh\\xf4\\xc4\\xd1_\\xda,\\xaf\\x81'l\\xa1<\\xb3\\xc1\\xb8\\x94a\\x92w\\x9b\\xcd\\xcdh\\xb3\\xe3\\xc2^m:\\xde<\\x9a\\xd0\\x9b\\xc5\\xf4t\\x8b\\x8ac\\xa1\\xf4\\x94\\xe4gtwz\\x89\\xa9t$i\\xc0\\xe4i\\xb6&\\x9efi\\x97\"\\xa3h\\xd0\\xd3\\x9e\\x98q\\xa3k/\t\\xeb\\x03\\xba ed\\xb3l\\\"\n\\x1a\\x04\\xa4\\x8b\\xcd\\xb7\\xb4,l\rkv,\\x10\\xdd\\xc3\\x19\\x03\\x17\\xb5\\xff\\xa4\\x08\\x02ug\\x88t\\xffq\\xa9\\x86\\xe8^\\xe1\\xa8`\\x1f\\x19\\x9c\\xcd\\x1es\\xa0=\\x9el\\x08\\x96\\x87ze\\xeb\\xce\\xa6\\xee\\x8d\\x0c\\xf56wpj\\x993\\x87\\xb6\\xc4%\\x86 \\xfa/\\x9ec\\xb7\\xe4\\x9a\\x14<\\xe5\\xef\\x00\\xe4e\\xd1v\\xa6y\\xfe\\xda\\xd0\\x8b\\xe8\\xcf\\xae"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\xa2\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\xbb\\xbe\\xe1\\xf0e+`k\\x1b\\xb2\\xb6\\xd7\\xa9\\xf1e\\xb6,on\\x93\\xf71\\xe0@\\xf2ki\\xf2\\xfcl\\xf4\\x90\\xa4\\xa6\\xfc\\x9d\\x9co\\x92\\x00\\x0el\\x8b\\x96p\\xc4\\x1a\\x94.\\xd6\\x85r\\x16\\xfb\\x9cwt\\xdd\\x91\\xbf\\x93q\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbdow%y\\xe30\\x8e(\\x95\\xf0\\x07b\\x94\\xfa2z\\x1c\\x04\\xb05\\xc5z\\x8b\\xa2o\\xc9l(\\xf7\\x86\\xc2\\xc3\\xa0f\\x8fa\\xc2;hz\\xb4b\\x1a\\xf4\\xeb"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\xb9\\xe9\\xb2a\\xca\\xc5z\\xa9\\\\xfb*j\\x89\\xbd/pc\\xb8c\\xad\\xc8s\\xab\\xa1\\xea\\x7fe\\xf2\\xa2\\x93v&\\x11\\x80\\x06\\xbb\\x1a\\xd7\\xa1|\\x9c\\x86\\xff`\\x90m\\xf4?\\xd9\\xe1v\\x926\\x7f\\xfc\\xf3\\x94\\x826\\x0c@\\x9a\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4\\xe4\\xcar\\x15\\xd3qb\\xae3\\xe1n\\xe2k\\xb8\\x08\\xfd\\x13h\\xb1\\xa30\\xf0p\\xd9g1\\x97\\xc7\\xf7\\xe2\\xf8\\x16j\\xae\\\\xd6\\xaa\\xe4\\x1e\\xe12z\\xbb0\\xdc\\xdc\\x1f"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m<8:p\\xa2\\xaa\\xa4:\\xd7\\x85p//\\xf3\\xc1/?'\\xeb@h\\x1a\\xe3td\\xde\\x9f\\xcff\\xee\\xbb!=-\\x16^\\xaf\\x1f\\x8f?\\x06\\xe4\\x05\\xae\\xb4\\x91\\xd5\\xb5\\x8ee\t\\xec|\\xd4\\xd7x\\xd9\\xb7\\xbf\\xbc\\xca\\x16\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\x08\t\\xa7\\x8f\\xed\\x01\\xc1\\xe1\\x18\\x8cm\\x9ff\\xb8\\xed\\xa2\\xcd\\xb0\\xc200\\xb5%\\xcb\\xc4\\xfb\\xd4\\i\\xb5\\xf6l\\x88\\x8a\r\\x07\\x89\\xb9>\\xefl\\x92\\xa8p\\x05\\xfdz"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xbc\\x96\\x9f\\xe6\\x0bx\\xad\\x14\\xb7\\xdb\"\n\\xd43\\xdb\\x0c\\x9b\\x91>(\\x8b$\\xa2\\x00\\x95\\xc7s\\x02\\xe8\\x9blhg0szvj\\xa3h\\x1a\\x14\\xad'y\\x8ed\\x80\\x8e\\xa3)\\xd5\\xc6\\xda6\\xae\\xe7@4^\\x9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ii^\\x03\\x1b\\xba>:q^\\xf0\\xcd\\x99\\\\xa1\\xc8\\xcc\\x17f\\xb53jl\\xbe\\xfa\\x80\\xa1g\\xcb\\xed\\x1ak\\xd1%\\xf9\\xa5\\x10\\xfc\\x99:$xk\\xd2\\x056\\x94\\x05"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010nu\\xc3\\xd78r\\xb1\\x0c\\x99\\x9d\\xb3fo\\xc9_\\xe0ocp\\xb1p\\xec\\xa6j\\x84\\xe9\\xa7_\\xba\\x84o_\\xf2\\x8e\\xaf\\xbb\\x198\\xb2\\xc8\\xc7\\x13|\\xb9\\xf6\\x06!\\x99~l\\xd5\\x155\\xf0x\\x81?\\xa7\\x06\\x81\\x1c\\x1b\\xfd;^\\x82\\xbc\\xc5\\xc1wh\\xba\\x1f1'\\x95^ed\\xc4\\x99\\xfc\\x83\\x02'zekc\\x9d`8\\xb4i\\xadf\\xd0\\x98s\\x04\\x14\\x9f\\x86fdl\\x8e\\xb2\\xbf_\\xbf\\xd8\\xf2-\\x12\\x19\\xaf\\\\xe3g \\xd0x\\xb2b>\\x1fstd\\xba\\xd3m)\\xdd` \\xe2\\xf4\\x9a\\x8b-f4n\\xbf\\x90\\x1b\\x1c\r\\xb0\\x8bb\\xe7\\xf9\\xcc\\xc9\\x8f\\xee\\x87\\xa8)\\xf6p\\xef\\xe9\\x0c\\xf3\\x84<\\x16v\\x1af\\xe8\\x98\\x01-\\x83\\x87\\xcei\\x94\\x83\\x96\\x966\\xf5dbq\\xa3t\\xad\\x12a\\xdfv\\xfb\\xa7\\xaa\\xb9\\x8c\\xb4\\xd9\\x84\\x11f\\x7f\\x15\\xd7w\\xfb\\xa7\\xd7v\\xc0\\xc2\\xc5\\x94\\xa2\\xcb'\\xcb\\x81\\xc3\\x027\\xd4\\xf5sae\\xd3,\\\\xa8\\xc3\\xfe\\x8bc\t"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&\\xcc4yp7\\x96\\x90\\xc6\\xb8vka\\x92:pl\\xb2\\xc6@\\xcc#\\x1fyu\\x91\\xa4\\xa1\\xbb\\xfa\\x04f\\xbbks\\x8d6\\xcf\\x84\\x9c\\x7f\\xc2l\\xd0\\x11n\\x1f\\xcb\\xe8\\xf9\\xad\\xd5\\xb4\\x17\\x9d4\\xbeu\\x12\\xce\\xb9\\xb9\\x07\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0j\\x04!>i\\xd4\\xb8\\x90\n\\xab\\x95'\\xf9\\x10d\r\\xe3\\x01n&<dt\\xc5\\x16\\xfb(\\xa3\\xaa\\xb1f27\\xf5\\xe2\\x15y\\xd6c\\xfc\\xca,\\xac\\x19s@"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18-\\xfeu|\\xff\\xe5\\xee\\xef1\\xa5u\\xe3\\x07|\\xb1\\xcc\\x8d\\x7f\\x1a\\xef2f\\xd5\\xd8=\\xfd\\xd8\\xd4w\\xd5\\xb8g\\xe3\\x81\\x11\\xf3l\\x9d\\xeb\\x11;\\x9fym\\xb1\\xb8\\xdciah\\xa8\\xfc\\x8e\\xe7\\x1c\\x1a\\x13\\x05-\\xfc\\x11\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\xa7\\x9ch\\xde\\xed\\xe9l\\xf3\\x91\\x07\\xbe\\xde\\xa6xi\\x97`n^\\xf4\\xbb\\xf4j:\\xfe\\x8cb^\\xacz\\xf6l\\xear\\xa9)v\\xbbc>\\xf9\\x87\\xee8\\x1f\\x97"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\xa3\\xfb\\xdb\\xb8\\x9ag\\xfa\\xb9d\\xb4\\xca\\x85\\xe3\\x06\\x94vj\\xb0q\\x96\\xa4b4\\xa7\\x0c\\xff\\xb0y\\xbc\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\\xee\\xe1\\xe1\\xc0\\xa4\\x7f\\x14\\xba\\x08i\\xa4\\x8f\\x9d\\xba\\x1e\\x8a\\x87\\xa9w\\xc1\\x8e\\xe7\\xb5\\x84t\\x069h\\x00\\xff\\xfe\\x9e\\xd5g\\xc91\\xf0?\\x9fl\\x7fi\\xa0\\xce\\xbb\\xb6\\xf9w&\\x19\\xb3\\xbb\\xeb=\\xa1,\\xb6v\\xa9\\xf6\"q\\x1a:\\xdc(\\xc8k\\xdc\\x0b\\x04\\x97\\x18\\xa1ym\\xefo\\x85\\xdfx\\x98\\xa7\\xa0\\x11u9*\\x1b!\\x86\\xe7\\xe9\\xf4\\xd6d\\x17\\x19\\xb33pzb!\\x96\\xe8o\\x14e\\xa4\\x11\\xf00\\xad\\xd4\\xae\"=,\\x1e\t\\xb0\\x06\\x80qh1\\xde\\xbc\\x0c\\x94\\x828\\x9d\\x9c\\xd3\\xc8fy\\x04\\x0b\\xf9\\x84\\xc4\\x8f\\x1cfw\\x0f\\xd5\\xe7\\xf3dn\\xa3\\x80by\\xef\\xa6\"\\x10\\x87onei\t<\\xa4\\xf8\\xb9\\xd1\\xec\\xbcv\\xec\\x0ca\\x18nl7\\xf8\\xe2\\xc6a\\xbb\\x18s\\xfa\\x84\\xf2\\x07*\\x82\\xd51\\xe0\\xdd\\x88\\x87\\xea\\xecqeox\\x19\\x1e\\xe5a'\\x89\\x96u^dp\\x03\\xb0\\xab\\xc1`$@\\x84\\xa2\\x12\\xa1\\x11lm\\x97\\xb7\\xcb\\xfb\\xd2\\xea\\xe1\"\\xd68r\\xddl\\xc5t\\x9a"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfa\\xfc\\x99c\\x89w\\x1f\\xe5\\x9b\\xafi\\xa0\\xea\\xd9\\xd7\"z1!\\xb1\\x8b\\x1f\\xbcd6\\xb2\\x05\\x8f\\x9anx\\x0e|\\xa5:\\xdb\\x99\\xbb+`\\x1e'\\xe5\\xbewm\\xb1\\xaef\\xe0$\\xa9\\x90\\xf7\\xe0\\xaa\"d\\xfc\\xe1hr!b\\xda\\xd0\\xfa\\xfboo\\xbb\\x94\\xe8\\x92b\\xaf\\x165\nae\\x1d2352\\\\xee\\xbb\\xd7 \\x0f\\x92\\xe5\\x0f\\xa1hq\\xffz`\\xca\\xab\\x1e\\x02\\xbd#6g\\x1f\\xfb\\x16\\xbcj\\xef\\x97\\xcb\\xe5\\xc5\\xb0\\x1d3g\\x90\\x9a\\x19r\\x95p\\xba\\xdft\\xf5\\xc9\\xd0u\\x88_\\xb1\\x05\\xf3\\x90\\xd5\\xe4\\x92\\xabl\\xeb1\\xb1j\\xfb\\xad\\xe2d\\x82\\x0b\\xfb\\x15y\\x19\\x0e\\x81\\xd7\\x966+\\xd1\\x95\\x84\\xc1\\x90\\xc3\\xc3\\xbb\\xcc\\x8c\\xfa\\xe1\\x92\\xa9\\xd5\\xbb\\xc9!\\xa0_\\xd2\\xaax\\xded\\xc2\\x91\\xdc\\x8f\\x18\\xc2p\\xb12\\x06\\x07c\\x83\\x86\\x1f\\x89\\x91\\xebs\\x8cug\\xa3_g\\x01\\xab\\x1d\\xcf\\x96\\xb0&%*\\x84\\x9a\\x8f\\xc9\\xc37\\x06\\x8ap\\xad\\x97\\xad\\x0b\\xc3\\xcf\\xda\\xe9\\xadx%\\x9dp\\xf6"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xaco\\xfa\\xb2\\xd6z\\xa6\\xf1q\\_\\x05d\\x9f\\x84\\xc0\\xde\\x0e\\xcf\\x8a\\xa0\\x8d?\\xe0`\\x9fos\r\\x19\\xdb/\\x8d5\\x8f\\x9c\\xcbv\\xf1\\xa0\\x08\\xc0tgh\\x17op3\\xcd\\x81pi\\x1b\\x18\\x14\\xb5\\xd9\\x87\\x1d\\xd3\\x96\\xb31\\x17\\xd2\\xd1a*\\xf8\\x95\\xfa\\xfa\\x942\\xc1\\xcf\\x12\\x9a\\x86?u\n\\x0c\\xbfs\\x12\\xea9i\\xc7\\x8a\\x12\\xe49w\\x9a \\x91\\xff\\xf7\\x9b\\xed:\\xafgjx\\x0ce\\xc4\\xb5x\\xc8\\x01!\\xafz\\xfb,\\xf6\\x17\\xc8p\\x0f\\xd8\\xb8hh\\xb0\\x88|\\x02\\x07\\x99\\xf4\\x9ec\\x89\\x12oq\\xb4?\\xac&\\x95\\xb1\\xc3\\xc9 \"\\x18\\x13\\x17b\\xb3\\\\x11\\xfe\\xe8tl/!\\xfdqx\\xf7i\\x89\\xd3\\xd3n\\xe7\\x17\\xcc$\\x05\\xd2\\x04h*\\xc3l9\\xabptuy\"\\xd7\\\\x07\\xd7e\\xac0\\xc6(\\xb1\\xbbf\\x84\\xfc\\x95\\x87\\xb0\\xc4h&/\\xb9\\x11\\x0by\\xc9\\xaco\\x94\\xa8\\xf9\\xfff\\xfd|>=tb\\xe7\\xf4^a\\xd3r\\x02\\xb1\\xfdw(\\xc8\\xe4t"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc2\\x8b\\xcb\\x80\\xb4\\x9dp);\\xc4yp\\x18\\x04\\xca\\xb5\\xec\\x00\\xcf\\x96\\x04e\\xd7\\xba\\xd8o(\\xfb;\\x908\\xdb`\\xef\\xbd\\xdf\\x88f\\xd9\\xdb\\xe6#*e\\xd0yp\\x00\\xd9\\xda.\\xb0\\x98\\xcb\\xe2\\xeck\\xac\\xa4\\xa9\\x1b\\xb9\\xd6\\d5\\xa2\\xb2\\xc2%j\\xd3\\x87\\xd9r\\xd7\\x9c\\x9d\\xbeg|kr\\xf4\\x98j\\xb6f\\xc5s \\xc9\\x9ev\\x8e\\xfd\\x1f\\xf8\\xe8,\tf1\\x19\\xb7\\x98\\xbd\\xcd\\xbb\\x89.0\\xba-\\xa0fo\\xc4\\xf4\\x9f\\xaa\\xf8\r\\x18\\x1e\t|\\x9f\\xd7\\xf3hlq\\x992\\xc1\\xda~\\x91\\xcc^\\xb64\\xb1\\x877&\\xfc\\xf0\\x14\\xdc^(\\xee\\xa7\\x07\\x85\\xc2\\x80g6\\x05\\xc9\\xf2\\xf3\\x19#\\xc2u\\xb0\\x1a\\x80\\x04\\xc3\\x86\\x88\\xbb\\x97b\\xe2(\\x8c\\x87\\x84zd\\xba\\xa6\\xbe\\xe5\\xe2\\xd9\r\\xee\\x13v\\xe9\\xb5\\xc1\\xbe\\xa5\\x159pae\\x97i\r\\x8e\\x1bqtz8sz\\xf1xb\\xbe\\xa2\\xa3qqh\\xaamy/\\xbd\\xef\\x0f\\xd2\\x08\\x8e\\xda$c\\xdb\\xd5\\x15k2\\xeb\\xd7\\xfb"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x84\\xbd\\xb4\\xab\\x80\\x85<\\x0e\\x08\\xe4g\\xdf\\xe0\\xaa\\xda\\xff\\xa5\\x07\\x1d!\"\\xf7ui\\xc4&\\x0cw\\x98\\x8d\\xfb\\xf5\\xb99lj\\x0f\\xe0\\xff\\x86\\xe1/\\xa3\\xba\\xb1>-\\xb0p /\\x95\\xb7\\xd9\\x90`\\x0bm\\xf3\\xec\\x1c\\x96dy^q\\xb9\\x12\\x92g\\xff\\xfb\\xf30\\x0b\\xbb\\xf69~\\xeczm\\xda\\xc0\\xd2\\xbf_l\\x82u'\\x82\\xdb\\xc6\\x05\\xfcx\\x03k\\xe9\\xbe`\\xf4e\\xd9\\xe2\\xcds\\xcc\\x84\\x1a\\xc89\\x83\\x152b\\xc3\\xb9\\x1df\\x0ex\\x89\\x8a\\x7f\\x06mw\\xbe\\xac\\xd8<\\x1f\\x8a\\xe4\\x08\\xe6x\\x1d\\xb9u\\xf9\\x04\\xeb\\xf6\\xd0\\xbd\\xe3\\xc5\\xe9\\x10\\xffy^\\xa7~\\xb0b\\xd2\\xbc_\\xa9\\xbdl\\xfb\\x07\\xbff\\xd0\\x08\\xa1\\xb0\\x80\\x97\\xc4q\\x99s\\x02@\\xa6geomss\\xef\\x7f+g\\xfdm\\x89\\xfc3\\x92\\xc3\\x91\\xf8%o\\x02\\xb9\\x7f\\x1d\r\\xd1\\x93\\x81\"\\x04\\xd8m\\x89\\xfa3fn\\xf2'\\xa6\\xb7\\xbfh\\xee\\xb4k\\xf4\\x967\\x83\\x9c=\\x83ng\\x16\\xc5\\xed\\x94\\xa5|a\\xbd*d\\xab\\xf7\\xc4"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2\\xfc|4eq\\x12\\xf2n\\xb6thv\\xcf\\x17a\\xd9\\x00\\x03r\\x89\\xc2pt'^\\xda\\xbau\\xd8\\xff1\\xf8\\x83\\xf5v\\x9at\\x92t\\x87\\xb7\\xf7\\xc3\\xf4\\xdd\\xae\\xd2\\x01<o\\xb1\\xcd\\x18\\xd6\\xe91u\\xdc9\\xa4du\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9d=\\x03 \n\\x83\\x13\\x90\\xf1\\xc4\\xc7\\x8c\\xba\\xfcwi\\x1f\\x9e\\xc0u\\xdc\\xc1bo\\\\xdd\\xa0\\xaf\\xd5m\\xf1\\xe0\\xc93\\x10\\x05a\\x00\\xc1=\\xe3n\\xb9\\xf9.\\xc5w"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\xa2r\\xd4\\xc0?\\xfdw<|\\x13>\\x18\\xcd\\xf7,;\\xbf\\xc9a\\xe8\\xb0\\xaa\\xf4\\xd1\\xd4\\xc7$\\xccogs\\x99\\x1f\\xed\\x86\n\\xc79u\\xe7\\x0b\\xb6\\xe1\\xc7+@\\x84\\xe1\\xbam\r\\xa6w\\xe4\\x7f@\\x9ak\\x055<l*'\\xf5&\\xd9\\xaf\\x96\\xaf\\xbb\\xa8\\x7f\\or\"x\\xb9ty\\x97\\xf7v\\xf8y\\xfalq\\xe4\\xc3\\xf6\\x82;+\\xf6\\x8b\\x16\\xd4\\x9b\\xa5j\\xd7\\xeb\\xc50\\xb1\\x81qr\\x90\\xcb\\x91\\x93c\\xb8\\xa3\\xb0\\xa1\\x1c\\x0e\\xa6vl\\xaa\\x00\\x9f\\xb1\\xfb\\xfe\\xb9\\x00\\xf3r\\xea\\xfd$\\xcc7z\\x08\\xf0\\xb6 \\xd2\\xe6e\\x94\\xd2\\xe3\\xd3\\x84\r\\x92\\x1c\r\\xb9\\x18\\x1d\\xce\\xa0\\xbe\\xf6g\\xd0\\xdc\\x96qzm+\\x0fa\\xe901\\xffv\\x1cn\\xe8$\\xc9\\xb8\\x9fh\\x9e\\xa6\\xfc\\x87 \\x93\\x12\\x14\\xf0\\xd7\\x80pr\\xb2n\\x11\\xb1p>j!k\n\\xb97c\\xfe\\x05\\xb1\\xf2\\x8a\\x84\\xc4\\xcdf|\\xe6\\xf6v\\x95\\xcf\\xaa&|\\xd3\\xd9\\x02\\xac1d\\xe7\\x98\\x1d\\xcd\\xa3\\xa8\\xdd\\xc2\\x1er\\x01"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03\\xce\\x1c4\\x10\\xb7\\x8ao\\xb7\\x8f\\xae\\xb1_\\xd9\\x199u\\xfb\\x8c\\xc9~\\xe8\\xfc3\\x90k\\x97\\x1b\\xf3k\\x0cp\\xbfqi\\xcaj\\x0c\\xbd\\xba\\x0fv\\xa8\\x02t\\xad\t\\xeel\\x90\\xa4\\xa6\\x19\\x84\\x1ev\\xb0\\xb2\\xbf\\x02\\xbf\\x84\\xc9j\\x82\\xdf\\xd6\\xf5<\\x01\\x9a\\xda0q\\xd02\\xed1?w\\xe4\\xb9\\x02\\xd5\\xa9of\\x83a2#\\x1d\\xb8\\x84\\x90m3b<\\x9d\\xaa\\xaa\\xe64\\x1d*.\\x19r\\xd3\\x94\\xa5\\x9cn\\x1c'\\xcbr.\\x8b\\x1e\\xda\\x7f\\xc5\\x8e\\xa9\\xaf\\xe7&\\x04 \\xb0\\xafiugt\\xe0wx\"\\xd6j\\x86\\x9e\\x97\\xc8\\x83p%\\xd9\\xb5\\xad\\xa4%ndm\\xe2%\\x8cs\\xc9\\xc8\\xaf\\xdav\\x7f\\xfac\\xd3\\xbe\\x1c\\xd5\\xfcn\\xd0\\xb4mz\\x19~\\x02x;\\x0b+ya\\xfd\\x97\\xcd\\xef@e/\\xd1\\x14g=\\xf2\\x1d\\xa8/\\x0f\\xa1m\\xca\\xd7k\\xf9x\\x0c\\x8d3(\\x8c\\xbb+\\x9fv\\x81\\xbc:\\xb0\\xde\\xa0w\\x8f\\xc8v\\x12v\ti2\\xc5\\xfd\\x8f\\xee\\x175\\xe3\\xf6\\xf3"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbbz\tw\\x11\\xfe\\xfa(\\xa2\\x1a\\xba\\x93^u\\xb3xx\\xd5\\xaa\\x1c$\\xc8\\x08\\xf8\\x8c$\\xf3\\x12p\\xd4\\x94f-\\xf4\\x8bpoa\"\\xbe\\xb2a\\xfe?\\x924\\xfa\\x86\\x04b\\xe2q\\xeeg\\x0f/7\\xf7\\xc6j\\x86r6g\\x06|g>\\x87ji\\xc5\\xf1\\x04\\xa6y\\x99\\xc7_\\x13 \\x00\\xea\\xa8\t\r\\xee\\x8b\\xcdm\\x1d\\x18^myhr\\xb9\\x9f\\xdd\\x91\\x87\\xafvm\\xb9\\xf6\\xa7\\x00\\x81\\xb4tp\\x0b\\xddk\\xd9\\xac\\xf0,fr\\xf6w\\xfc\\xcd\t\\xfc\\xb3\\xf3m\na\th1\\xf14\\x1d\\x86\\xcc\\xa2\\xbau\\xf4\\xe5\\xd0i\\xe8`\\xd8\\x07_\\x92\\xe7\\xcf\\x85+z\\xe4s#\\x925\\x89\\x8b\\xbb\\x96<\\xf0\\xb2\\xa0\\x9c_l\\x06\\x84\\xd8\\xe2q,\\x10\\x888\\xe9\\xd3`>~\\xab9\\xde\\x96\\x00\\xf5b1m^\\x1a\\x8c\\xcb\\xb3\\x10\"\\\\x9f\\xc0\\xb1\\xdbe\\xcb\\x9e\\x18\\xf4\\xbd\\xa1\\xea>8\\xe1\\x0b\\xc5c\\x19x\\xce^\\x92\\xf4\\xfb\\x89\\x8e*\\x9ec\\x1c)ma\\xf1e\\x04\\xac\t"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<bx\\xfcj\\xb9w\"\\x8am\\x08\\x14#\\x14\\xd4\\xd4\\xd3uwb\\xd9?9\\x918\\xa8\\xb5v\\x1e\\xf7$\\xe5\\xac\\xd6o\\xab\\xafn2\\x91d3\\xeee\\xf0\\xa1\\xc4 \\xd8`\\xc2\\xad6\\xe9 \\x02\\xe4u\\xbd9\\xd4?\\x02\\xcc\\xe9\n\\x11\\xf8\\xf6tzviv\r\\xf2,a\\x94z$\\xd3\\xde$y!\\x1d\\xab\\xf2b\\xc8xgi\\xd2^`\\xefaymn\\xdd\\xf2b\\xfb\\xd2x\\xf2\\xc9\\xf7\\xaf\\xda\\xa8(\\xb4\\xf9\\x89\\x8d\n\\xee\\x83j\\xda-\\x93\\x99s\\xe3\\xdaq\\xcb\\xc9\\xce'\\x8e\\x0fiq_my\\xd8\"wv\\xac|\\x9btr\\xc0a\\xa7\\xbdf\\x93\\xe6\\xca\\x12\\xd1\\xf0\\x9c^\\x89\\xee\\x1a\\xbf\\x1a\\xf0\\xb9\\xbe\\xaa\\x1b5\\xb49\\x1b:\\x11\\xe1\\xca\\x82h\\xf4j8\\x1e\\x11owg\\xaea\\xb0\\x7f\\x89p9\\xec\\xa3\\xc8\\xa1.j\\xb9p)\\xc8\r\\xd2\\x8e\\xb2\\xa5\\xc3z\\xa7jaql\\xd4\\x01\\x17v\\xaed=\\x97c\\x7fwwi\\xa1\\x8a\\x93;\\x1bw\\xde,\\xe5\\xbb\\x86\t\\xdd\\x11\\xa7\\xf5"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)-a\\x0f\\xd1\\x93_\\x9cq\\x0cl\\xe9:\\xdb\\xd90\\x16\r\\x91\\xeff_\\x90\\xfa\\xd7\\xbea\\x13\\xdb\\xa9\r\\xf8\\xd3\\xa4\\xc7\\xab\\xf2k\\xfcz\\xdb\\xa9\\xcbk\\xe4h\\xe2x\\xc7\\x84\\xb3\\xb2~q\\xdc:2\\x8c\\xcfi\\xa9g\\xea\\x11\\xa6\\xb2\\xbd\\x8d\\xae9k:<\\xfb5\\x9d\\x10\\xfb\\x01\\x04\\xb8\\xd2\\xf6x\\x85\\xed\\xde\\x9aj\\x9d\\xe6\\xd99d^>\\xcf-\\xb4\\xa5\\x19\\xe7^\\xbb\\x8b|\\xd1\\x93\\xd9p\\x8dz\\x90@\\x02\\xc2\\x19\\xb34\\xc4\\x97\\xc9\\xd9f\\x1fe\\x82j\\xb7x\\xf9mv\\xde2e\\xd6\\xe5x\\xfak9\\xc3@\\xfa\\xc1\\xe5\\xcf2\\xd3@\\xd0\\xa43\\xc5\\x1aei\\xeb\\xa8)\\x89\\x16\\xea\\x81+\\xe4\\x18\\x08\\xdd_\n!h\\x01h~\\xaf\\xcf\\xaa/b\\xff\\xe73\\xd0\\xf0\\xf9\\xbc\\x83\\xcf\\x83\\x05u*\\xca\\xe0\\xe0m\\xa8\\xcf\\xcc\\xf4<t<\\xf7\\x1a\\xdd,\\xe1l6\\x12\\x0ef\\xa4\\xa9ci\\xfb\\xfa b\\x82$\\xedi\\xb9\\x8dbm\\x93\\xc2(m=\\xa5\\xea\\xad3ht"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f0c\\xc1\\xf4t1\\xa7\\xdcuc\\xc6-l\\x81\\xe6|\\xc6n\\xbd\"\\xe9\\xba\\xc5i\\xea\\xa37\\xc0j\\x9et\\xf5\\x84\\xba\\xbb\\xdcd\\xef\\x16\\x01\\x08\\xe3\\xeepc\\x00\\xa1\\xb5\\xc5\\x05\\x11\\x12\\xb6\\xd9\\xa4\\xdcr*\\xad\\xcb\\xady\\xda\\xa319\"\\x8f\\x8e\\xfct#\\x84\\xad\\x1c\\x9cp\\xa7\\xff\\x12\\xf1\\x91)'\\x9e\\xb6\\xd6\\xcb==\\xf6\\xfa\\x07\\xcc\\xa5\\xdc&\\xfd\\x9a\\xfe\\xce\\xbf\\xa4\\xaf\\xfan\\x80\\x88h\\x82\\x0e\\x19\\xb8\\x89\\xac\\xb9\\x9ex\\xcb\\x0c^\\x99\\x13\\\\xa0\\x8f\\x80\\x91\\xact\\x0f\\x90\n\\xcb\tvr\\xa7\\xb9\\xa685\\xac\\xc2\\x9d\\x9d>mze^\t\\xe8\\x81\\xf0\\xd8:'\\xc8\\xf4\\x93l\\xa8\\xed@*\\xc1n0\\xd6b\\xd8\\xd2d\\xf2;\\xdcm\\xe4\\x18:\\x0e\\x05vo\\x9e\\x1ar\\xf3\\xbdaz\\xe6>\\x0c\\x17$vi\\xc3%1i\\xcb\\x08*mb\\x8ef+\\x8b\\x1c\\xc8\\xd8m\\x1ae\\xc8\\x83x\\xad\\xf5\n!\\xf5\\xd7\\x94\\xaak\\x14\\xb7^a\\xdb\\xe3\\x9c\\x06\\xa8\\xa6\\xdd#\\xd4\\xc3\\xc8\\x80\\xcbv"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ykp\\xdc\\xbf\\x88os\\x0e.\\xb6\\x01\\xbf\\xa3l\\x95mz4\\x8d\\x086\\xfa\\xa9\\x91\\x11\\x9b|z\\x19)\\xb6/\\xf20\\xc6\\xb4\\xea&v\\xcb\\x99(\\xd0+\\x15a\\xe8\\x95\\xda\\x97\\xeb\\x99\\xdb\\xa2;\\xbfe\r\\x84\\x92\\x01\\x1e\\xdc\\xa2z\\xda#\\xa4\\x9b`\\x9e\\xda\\x82a6\\x9a\\xfe\\xd2\\x96\\xbb\\x1045\n\\x8a\\xcd!\\x1fz\\x14\\xa2=\\xbe\\x08\\xd6\\xa8\\x86,\\xc07\\x8d\\xe7\\x90\\xff\\x88\\x81\\x06b|\\xbbcj\\xc1\\xfd\\x11\\xdf\\x80\\x1a\\x9f^(\\xd7\\xed\\x95\\xde\\x91\\x14a\"n\\x07x(yh\\xf5&\\xf0\\x04\\xdcj/\\x1bnx\\xd8\\xb5\\xe2\\x04\\x16f#\\xaa\\xf9\\xff\\xd0\\xcds.\\x02\t\\x07\\xbb\t\\xd1\\xe5\\xb7e\\x9c\\x1a\\xf9\\xbf\\xfe\\xc53\\x01\\xde\\xe4a\\x8c\\x02\\xd1@\\xb33\\xd9?\\xcb\\x1bop\\xf4@\\xc57\\xf6\\xb8\\x9fr \\x15q\\xcb\\xc7\\x0e\\xe8\\x15\\x1e/\\x04rn\\xd3\\x8ed\\xe8\\x82\\xb9<\\xa1\\xd2\t\\xb3\\xfc\\xdc#\\x13\\x12\\x19*\\xd1\\x81k\\x88\\xa1\\x93\\xc7\\xc9\\x80\\x82\\xf5\\xecc\\xb1\\xa8\\xda\\x01"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107 ff\\xfc\\xdc\\xf2c\\x87'd\\x112\\xf5d5\\xe9\\xe9\\xf3\\x81\\xb6:\\x10\\xae\\xc4\\x0ct\\xc5e\\xb0j\\x82^\\xea\\xe0\\x81\\x8fg\\xb9\\x0f\\xea;\\xf7x\\x91\\xe8rk o\\xae\\x9d\\x8b\\xab\\x01\\x0f-x<\\xcdk\\xbdc\\xd1\\x02\\x95\\xda\r\\xce:\\xe2(\\xe3\\xbe\\x10\\xabt\\xfce/\\x03\\xae:f\\x8f\\xec\\xb1ir\\x15\\x9b%\\xe1\\xa2a\\xa9\\xd2,\\x01i\\xc9\\xfb\\xc7\\x83\\x82\\xb1\\x08\\xe6lx\\x97\\x1d\\xc0\\xc1e\\x95\\x196_\\xb9\\xf5\\xaa\\xc3h^:\\xc9\\x7f\\xff\\x147\\x01*\\x89;\\xfc\"\\x8f\\x84<l\\x04\\xb03+\\x84.\\x08z \\xff\\x87\\xd5\\x14\\x89\\x81\\x0c.f\\x0b+\\x0e>\\xba\\xce\\xdb!\\x06\\xe8)t\\xdb.m\\xf7\\xb4\\x83x\\xa0\\x95\\xc1\\xb7\\x7f \\x0c/\\x1e;\\xab\\x86s\\x88$\\xb5_dl\\xea0\\x81$\\xc5\\x7f\\x97\\xa9\\xa8\\xees\\xa0\\x83\\xa5\\xa6\"\\x19\\x17^kn\\x89a\\xed\\xc5\\xd4\\xfa\\x83\\x19\\xb8:;jnm,\\xc8\\xe1m\\xf9\\xbei\\xe2\\xa5\\xf6\\x1f"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\xef&p%m\\xaa\\xf3\\x88\\xff\\x82\\xbb\\xec\\x8f-2\\x0e\\xda\\xb6oz\\x97|\\x8dz\\x12\\xa0u~\\xd8wx\tk\\x18+;\\xd7k\\xbb\\x8fu\\xf3h;\\xfe\\x00\\xbb\\x1e\\xe5\\xa4\\xee\\xb6\\xba_\\x93r+\\xe4i\\xcd<o\\xc5#\\xc35\\xf5\\x8b>`bb\\x9f\\xa0(#\\xd5\\xdb+\\xb0q=ac\\xa6\\xad\\\\xae\\xd7\\xff\\xfax\\x19\\x97\\x84\\x8c\\xcb\\x9bo\\xb5\\xd7\\x86\\xec\\x01\\xed?e\\x96\\xa7r\\xc3\\xc2x\\x1eb\\x0ca\\x86\\x14y\\xb6z%\\x0e\\xc2\\xd88v\\x87cz7\\xd8\\xb9\\x0bj\\xb2;\\xeb\\xe2\\xf6f\\x8b,\\xa5\\xd8y\\xe5'\\xd4\\x9d9\\xbeqz\\xf1\\x89l\\xb6xrq\\x83)\\x9b\\xf6\\x1b\\xca\\x9dg\\xb9p\\xd9\\xcf8\\xa7?\\xdez\\xa0\\xa9\\x18\\x13\\x14\\xd9\\xf7\\x96\\x12\\x08\\xee\\xe9\\xfau)$\\x07\\xe3\\xff*h\\xb1\\x0e\\xe3\\x9ft\\xec\\xbf\\xbb!\\xf3<\\x90\\xbf\\xa0\\x8b\\xf4qi\\xe0\\x0f\\x85h\\xd0\\x12b\\x1a\\x9a\\x95\\xdab\\xee\\\\x9en\\xfc\\xa1\\xc8\\x1c%\\\\xc3@\\x8d\\xf7s\\xd6"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107.;\\x83\\xa5\\x86\\xd0\\x9e\\xd1\\x8b_\\x89u\\xdcid\\x7f\\xc0\"\t\\x95\\x06&\\x7fz\\xe1\\xc4\\xb0h\\xe5\\x99\\x98\\xb9\\xd1\\x94\\xd9\\xd2\n8\\x9c\\x90q,\\xfc3u\\x05\\xa2\\xdez\rj\\xa8zn\\x1c^9\\xd0\\x14x\\xba\\xdc~\\xca\\xa8#\\xae\\xd5n@\\xa9\\xe8m\\xd9z\\xb0\\xb3\\x0bo\\xd4\\xe8\\x155\\xe9\\xf3\\x06b\\xb2w\\xe5\\xfd\\x97\\x0f\\xceb~\\xac\\xd4`\\x880\\xb6m\\xcd\\x0e|2+\\xb8\\xd41\\xd49\\x7f\\xc9\\xd3\\xf4\\x8a*e\\xea\\x03~\\x16\\xc9\\xb1t%\\x86q<\\xa3\\x9d\\xf5\t\\x98\\xc3k\\x05\\xe3e\\xab\\x8f\t6\\xcdu\\x0c\\xaf\\xb2w\\xfb\\xbc!\\xe4:aj\\xe9\\x81\\x81\\x9b\\x1b\\xf0\\xc5n\\xb0\\xb6\\xde.\\xec\\x8a\\x86\\xe3\\xda)\\xf8n\\xd6\\x01\\xc3\\xcf/|q\\xb9d(\\xd6\\x9c\\x0e9\\xb8\\x87\\xbb\\x80$\\xe2%\\xe5\\x98\\xdeul\\x02\\xb1?\\x1d\\xec\\xc7\\xdfem\\x00\\xc1\\xb0\t\\xc9f-.^5i\\x13\\xd4or\\xc6\\xf1px\\xce\\xee\\xc8\">\\xa8p \\x15\\xeb\\x1a\\x85\\xd1\\x02\\xc7\\x0b\\x9f"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbdz\\x0b\\xd7\\x8d\\x9e\\xfa+\\xd3\\xe0\\x92\\x93\\x8c\\xd7\\xaa\\xa3\\xc2\\x14\\xa6hc2\\xdf\\xff\\xe8\\xb1\\xb4\\x90\\xcd\\\\xba\\xb0\\xcb\\xf4t'^2\\xe3#j\\xb3\\xac\\x80\\xfa\\xd1\\x8d\\xf1\\x12\\xc3\\xb9\\xb2us2\\x8cq\\xf5\\xdcs\\xc6\\x7f\\x9a\\x900\\x84\\x84>\\xa1\\xb7\\xbeq\\x91\\xe4\\x9a\\x1d\\xc9\\z\\xfao|\\xf3\\x1f\\\\x8e\\xc9\\xe0)\\xfb\\x8a\\xe4\\xd95m\\xfb\\x87\\xd7\\x92\\xfcp\\x8d\\x81\\x1b:q\\xc3\\xd3\\x9e\\x9d\\xb6\\x04o\\xcahiua\\x94\\x81\\xe5\\xeb\\xa6\\x8b?\\x12\\xcb?i\\x1e\\xe1\\xc2o\\x99'k\\xca\\x9b8\\xfd\\\\x1e\\xdba\\x90!\\xdc|\\xef\\x899\\x02\\x8dv\\xedr\\x98\\x9c\\xb0\\xfe0\\xdd\\xed\\xefkmx\\xb9\\xc4\\xc2\\xbd\\xc1\t\\x9f\\xdf\\xcac\\x12\\xa1\\x911vyq\\xda\\xe6\\xca\\xe5+j.\\x1a'\\xf2v\\xbcc\\xa2b\\x08x@\\x04\\xc9\\x06 t\\xc8\\x87\\xebnr\\xd9/k\\xd3\\xe3\\xc1\\x0e\\xd6\\xf9p\\xba\\xafy\\xe7 \\x03\\x8ct\\xa5\\x13ku\\x18\\xf8\\xc2\\x99\\xb1\\xab\\xab\\xb9j\\xb1"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3\\xbe\\x97\\xad\\x12\\xab\\x90\\xcd\\xeb\\xa7v\\xd6\\xf2\\x97`6pg\\xf2x\\xce#\\x1c-mncp3\\xeb\\x01\\xc0\\xd7\\x8bs\\xe8\\xd4\\x13v7\\x80\\xb7'\\x0c\\x0e\\xeb\\x81\\xcc\\x9d\\x1f^\\xf9\\x87iv6\\xa8\\xfb\\x8c\\xa2\\xb8~\\x82#mf\\x01\\xd4\\xa5\\xea$\\x9b\\xc0s\\x1bpp\\xab\\x02\\x0ehx*d\\xee\\xbc\\xa4/\\xb4\\x8b\r\\x98t\\xc8\\xddi\\xa8#\\x15\\x07u\\x88_a\\x9c\\x8f\"\\xea\\xfey\\xffh<g\\xde\\xeao\\xfc\\xc1\\xfab\\xc8/\\xd0\\xb3\\xfa\\xd7\\xbc\\xbc\\xb1\\x88tu\\x90\\xaf\\x16?\\x8c\\xd2\\x16\\xcb\\xdd\\x01\\xd1\\x17\\xe7q\\x17\\x16\\x08\\xe4\\xfel7\\x1a\\x88\\xcf!3\\xeds\\x15\\xcd>\\xe84\\xf7\\xc9o\\xebfv\\xbe\n\n\\x88\\x14\\x13\\xf5rw\\x90=\\xb8\\x97\\xf9oto\\x9fz\\x7f\\x9b\\x03\\xb9\\x83\\xd0\\xac\\xe1\\xd2\\x00\\xe8\\xe9\\xbf4|\\xd9w\\xae\\xf3\\x84j\\x89\\xcbo:\\x82\\xe8>\\xfbz\\x80f\rd9:sf\\x13>\\xf9\\xfc\\xad\\x08\\x08\\x8d\\x9b\\x8d_\\x1c\\xcbi\\xbd\\x97\\xdb\\xc5"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010sm\\xa8\\x89\\xa3d1\\xb7eq~\\xa8\\x8e\\xe7\\xcd\\xdedf\\xf9?v\\xfc\\x82\\x04\\xdf\\x94)\\xe2\\x81x\\xa3@gg\\x8aag\\xf9r\\xca>t\\xf2\\x11\\xfd\\x96#\\xab\\x91\\xe2\\xb2p\\xd0\r|\\xf9t\\xb7\\x11\\xa6\\x8b9\\xb0jb\\xaf\\xb7\\x9b\\xde\\x18d\\xae\\xe5\\xe7ub\\x89\\xafh\\x89v\\xc5\\xb9;\\xacg\\xe0r\\xf9&\\xc4\\xa5\\xb4&\\xc5\\xe4\\x86_.\\xf1&an\\x10\\xadb\\x18\r\\xc9\\x92\\x86 pj\\xce7\\xf6\\x03\\x91\\xfb\\x10oa\\x12f\\xb3f\\xc98\\x8f\\xado1\\x98\\x03yu\\xf2\\xb07\\xe5\\xf3\\xc4\\x08j\\xea\\xaa\\xa4\\x84\\xaf\\x88\\2r'\\xcb\\xdf\\xb0\\x91\\xba\\x08o\\x01\\xc9z\\xad'\\xd7\\xc9\\x00x\\xb8y\\xcf\\xb3\\xf9k,\\x8f\\xba\\xbb\\xc2\\x8a\\xe4\\xc6$4\\xee@\\x18\\xcb\\xb7@;.\\xa9,&\\xf6\\xc6y\\x14\\xc2c$)\\xcb\\xbb~u\\xeb\\xe0\\xa6\\xbf\\x16\\xad\\x89\\x0e\\x1f\\xbe\\x02j\\xf1n\\xdb=\\x05\\xe1\\xe4\\xe7\\xdau\\x8a\\xb5\\xa7b\\xe4\\x93j\r\\x9b\\xdd\\x82\\x1d\\xb7u\\x96"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85q*6f\\xb33\\x1el\\xf3+\\xdf\\x95\\xbbv7\\xe6yy\"z~\\xc8\\xe2\\x18`\\x0ccd\\x9a\\xc7\\x12\\xe8oa\\x87\\xaf\\xedi\\x9e\\xcc\\x12\\xf2\\x84t\\xea5\\xd1q\\x00m\\xe1\\xd4\\xd0m)\\x13|\n\\x11\\x94\\x00\\xa3)j\\x81`\\x9a\\x1a\\x8ex7\\x82\\xa68\\x83\\xefb\\xb9~n\\xee\\xd4\\x94\\xd6\\xe8\\xed\\x1b\\x83\\x9b\\xaa\\xd2\\xd6?\\xef\\x99`\"\\x98\\x93\\xbc\\x9cz\\xf0\\xd2\\x81tv\\xfdt\\x87\\xa1vs\\xc1\\xf0la\\xf8\\x8e\\xcb\\x80 2\\xfc\\xdc\\x8d\\x02+u\\xa1\\xca$ytc\\x03i\\xdc\\xed\\x8b\\xec\\x94(\\xfd\\x87\\xc5\\xe2\\xf3\\xc1!\\xd8@\\xfek+#\\xf5\\xc6'\\x1d\\xf7v=\\x96\\xfd\\x8a$\\xfd\\x921\\xdd\\x1e\\xad \\x97|y\\xefu\\xfb\\xb3\\x97\\xf4,\\xaf\\xecw\\xd1\\x1f\\xf2=c\\xe65\\xee$gp4\\x89s#\\xd3|\\xd73\\xe1-\\x99\\x89\\xe6\\xf2\\x95\\xd9\\xa4\\x7f\t\\xbc\\xddfb\\xfc\\x98\\xcf\\xc1cn!\\xad\\xf5i\\xbd\\xf6\\xbcc\\xfe\\xc7\\xa1g\\xea\\xf7>\\x8bt/\\xc9h"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\xa2,\\xa1\\xa0\\x81\\x11\\xcan%y9\\x95\\x0f\\x06z\\xf4\\xa6\\xe2\\x10\\xa4'wt\\xab\\xdbn\\x0e\\xbe\\xb4\\xf7\\xce\\xc3@\\x06\\xbf\\xf4\\xee\\x18\\x8c\\xe3\\x03\\x11\\xc8\\xca\\xc5bi\\x1d\\xd4\\xeb\\xbd\\xff\\x8a0\\xb4\\x91\\x80\\xeb?^ (\\xd1\\xa6\"\\x9d\\xfb\\xa65\\xf2)\\x14\\xc1\\x8f3/\\xd7v\\x05\\xc9\\xf8%>\\x9ac\\xf0g\\xd5e\\x05\\x19\\xa0\\xaa\\xb8\\x1e\\xdey\\x87\\x14t\\x8f\\xd3t\\xe5a\\xd46_dr\\xdax\\xb8\\xc9w\\xee\\x13\\xa4\\x99\\x8d\\x002\\xb8\\x17\\xbd\\x86\\xa7\\xff@z1e0\\xc9\\\\x19i\\xf8\\xbe\\xb6\\x99\\xf9\\x1ch\\xa3ma\\xf7\\xcb\\x98om\\xd4d\\x0e,w`h0h\\x83\\xd0\\xe6@r\\xf0e\\xf6\\xfc\\xb0\\xe7\\xe7\\x9d\\xed\\xdb\n\\xee@\\xa2\\xc1\\xeb\\x84-p\\x8a\\xfa:*k\\xac\\x16z\\x8d\\xa9b\\xfc\\xe7\\xe5<\\x9c/h^\\x17\\xda?f$\\x07\\xe9\\xf3e\\x1a\\xa2r\\xc9;\\x9ds\\xfa)\\xc4\\xcb\\xf0\\xf3c\\xce@\\xf3o\\xa1\\x95\\xdeqb\\x04\r\\x913\\xb0px\\xf5\\xd5\\xd3"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\xd1s\\xca\\xb9\\xb3tf\\xfd\\x0e\\xd4\\xfe\\xec\\x9d#e2e\\xd7.\\xedlw\\xead#\\xc6z\\xa9\\xb41n\\x9fb\\xd0\\xb3&\\xd9\\x1f\\x9b\\xa9\\x1ck\\xf1zz\\xb7\\xbd\\x99y)\\xe5\\xb3`>@%\\xe0v\\x9e\\xe9d\\x83\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\xdd\\x82<o\\xf9l\\xd4g/\\xc8f\\x92\\x8d@\\xb3wa\\xd5\\xf4\\xe9%\\xc8\\x8b\\xaad\\xf0\\x18a\\xf8\\x19il\\x12\\xf6uj\\xa3_\\xa8h+\\xd0\\x16\\xc6lsd"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xfe&\\x06\\xc6j\\x81<\\xacb')\\x06\\xf4\\xcc\\xf4;)\\x877\\x14\\xcc\\xde\\x19\\xa8)s6\\xc0k~\\xe2=;uue\\xf4\\x81\\xfdswix,\\xcc\\x00fz`\\x94\\x1e\\xeb\\xb3\\x04\\x17x\\xa78z\\x0ba\\xbd\\xd4\\x99\\xbf\\x02\\x9e\\xc6:\\xc7k\\xeeo\\x9a\\x03\\x15\\xa3/czjv\\xf0p\\x9e\\xc6\\xe93l\\xd9\\x7f\\xc19-\\xd3\\xb4\\x9a\\xc0g\\xf7?u\\xd5k\\xc6(),\\x1f\\xa8\\x01\\xe8\\xca\\xd2\\x94r\\xfe3\\x88\\xc7\\xda\\xc6*\\xd5\\x95w\\x15i\n\\xc2\\xf7:\\xea0\\xc8wj\\x01xu\\xef\\x04\\xd6\\x13\\x8a\\xe1\\xeap\\x7f!\\xb4f\\x97\\x14\\xfb\\x87\\xb9\\x1b\\xe7k\\x1c\\xd6\\xd1db\\xc71\\xc5\\x8f\\xbf\\x98\\xf3&\\x15\"\\x95?\\xf9\\x83v\\x94w9\\xb3^\\xce\\xf3\\xd57\\xe2j\\xa7\\xbd\\x19c\\x15,\\xd1*\\xa4\\x95q\\x0bo\\x0f\\xfeapw\\x01)\\xb6\\xa0^'\\xc4ec\\x92\\xe4\\xb8\\x83\\xe5\\x92\\x03(&;!0yjt\\x175\\xe3\\x84:,2v\\x13\\xdd w"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\x1cq\\xa2\\xbdv\r9\\xc6\\xcc\\x17v\\x94\\xf3/\\xce\\x84m\\xf5\\x8c\\xcar\\xc6\\xa6 \\xb4\\x9e\\x12y\\xeb\\x1f\\xe8b^\\xc7@\\x1e\\xca\\x8a\\xdd\\xab\\x18g\\x0czoo\\xf7\\xc1\\xd4\\xad\\x18\\xfc\\xf0_;\\x1d\\xf2j\\xc1\\x9ek\\xc4\\x95\\xc3\\xab\\xf1cc\\x0c\\x9en\\x05$\\xd4bgk\\x1a\\x19\\xce\\xe4\\xc8_\\x86\\xe6c\\xa1'x\\xe2'%\\xe1\\x8a\\x99e\\xa9\\x87+\\x91\\xb5x\\x1d\\x87\\xb6\\x08ybg\\x8e\\xd0w\\xd2\\x1c\\x95\\xbe\\xbf\\x84l\\xdfr\\xec\\x80\\xe5\\xb0e8\\xb1e4)\r\nj\\x96\\xf7\\xd8\\x7f^\\xa9`_<\\xba\\xc7xa\\x97w\\x89\\xb8\\xc8jj9\\xb1l\\xbd\\x14v\\x7f\\x07\\xf8p\\x03\\x85\\xecl\\xfa\\x7f\\xbef\\xc2\\x18\\xec\\xa8\\x8bt\\x92v8\\x99\\xff:\\x14x\\xf2\\xcb&\\xeci=j\\xa2\\xe3a\\x06\\xae\\xf8\\xe1\\x13\\xebv\\x17$%\\x8c\\xa1\\xdc\\xf5\\xd8\\x85a\\x88.\\xe8\\xcd\\x15p\\xa1\n\\x1c\\xf4\\xa48\\x96e\ro#\\xee|\\xa0\\xb8#\\x9d\\xe5\\x03\\x18\\x84\\xa1\\xdc\\xda\\xb7\\x82"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x1d\\x1b\\xde\\xa4t\\xa5f\\xb6w\\xe1;\\xeb4m\\xc7\\xbaq\\x91f\\xcc\\xa5\\x1d\\x8f\\xe4d\\xaf\\xfe\\xa7\\xaf\\xa2y\\x17\\x9f\\xfb\\xd9\\xfb.k\\x80\\x8fx\tmg\\xecmo7\\xd5\\xabngv\\xfcp)\\xbd\\xd2\n\\xaa\\xd4\\xbdn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01^\\x90\\x1c\\xb3+\\x00\\xd7^\\xe5\\xab\\x8b\\xb1r\\x04e\\xe3\\xb4x\\x8a\\xaebae\\xe9\\xf3~\\x1d\\x81\\xe7\\xff\\x16\\xa8\\xfa\\xb5\\x80c\\xc23(2\\xce\\xace:\\x1b\\xb9"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04!\t\\x17\\x91\\x80\\xa3\\xe3\\xe9\\xb7\\xf8k\\x9bi\\xea- `@\\xf1z\\x9ad\\xa8;\\xbc\\xf5.\\xfbo\\xfd\\xd73k\\x80\\xa1\\xb0b\\x84\\xb3\\x93\\xf5\"\\x1asu\\x90\\xb7\\x1f\\xc6(i\\xdb\\x1a\\x12\\xdb^=\\xf6s\\x18\\xcd\\x94`.n\\x01r\\x06\\x9ax\\x174\\x14\\xfd\\x0f\\x01\\xdb\\xc6\\x8d\\x1d\\xa4\\xc7\\x90\\xddl_\\x91g\\xc4\\xb9\\xa3\\xd17\\xf2\\xa7\\x14\\xd9\\xb3\\xa0\\xe8\\x91u\\xf75j\\x92\\xd7\\xcd\\x1b\\xcc8\\x08\\xbaf&c\\x9a\\x03#\\x8c\\xd7\\xdd\\xbdt\\xc6c\\u\\x98\r>\\xae\\xe8\\x99\\xd8\\xf6b\\x85\\x94\\xbb.\\x03a\\xbdfy\\xa51\\x9bm\\x80\\xc1\\xe6\\x9f\\x10\\xaa\\xcf\\xf93\\x04\\x89\\xdfk\\x93hf\\xb2\\x8e\\x0cdt\\xdfa\\x04\\xb0\\xf3\\x1b\\xb8\\xd5k@\\xc0da\\x8d\\xb93\\xc1\\x01:h\\xa5\\x10\\x0e\\xd0,\\\\xf5\\xa5\\xc9j\\x1b\\xd3c7\\x1dx\\xda\\xd6l\\x05\\x7f\\xfc\\xa5\\xd0\\x18\\xd1\\x9f\\xd3\\xc7\\x1cf\\xcf\\x18\\x97\\x12\\xbf\\x8a\"\\x94sn<\\x00\\x91\\x17_hql\\x87\\xe1\\xfe\\xa1\\xe3\\xaf"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\x94h>\\xc5\\xc1\\x07vd;\\xdf\\xa5\\xdeu\\xd7\\xef\\xab\\x0e\\xffd\\x84\\xfb|g|\\x7fpy\\xe8\\xa9m\\xd8\\x01\\xe5\\xf5\\x81au\\xa5\\xeba),l\\x94\\x12\\xe39\\xf0\\xb8\\x90\\xae\\xfc>\\x16\\xd0\\xbd3\\xc3w\n\\xc9\\xbd\\x04$&cn\\x85<\\xf4*\\x7fx\\xcdm\nby\\xfb\\xa6\\x9dl\\xed\\x1a$\\xf0\\xd4c\\x83\\xd7~\\xb9\\xbaku\\xeez\\xc7\\xf7gt#\\xfb\\xe6\\xdc\\x88\\xf4|r\\x82\\x14*\\x8b)\\x1c\\x94<m\\xe7>\\x8d0\\xe6\\xd2\\x16\\xe9hk\\xa9f;\\x1f\\xfa\\xdb0\\xfc)\\xaf\\xa8y\\x1f\\xcdk\\xb7\"9\\x9e\\xc39\\x9e.\\x97+\\x91.\\xcck \\x92\\x98\\xc6\\xfd\\x9d\\xc88\\xb3\\x195\\x90j \\xd9f\\xda_\\x9as/\\xf6\\xe5\\xa3\\x92\\xb3d\\xd0*\\x91\\x8ff\\xb0\\x05\\xde^\\xc4o\\xa6\\x14\\x02\\x10\\xaaj\\\\xcc\\xef(:\\xc28\\xcb\\x80\\x07\\x13\\xad\\x10z\\xa9!\\xc71\\x0bff\\x7f\\xd9\\xe9\\xe6\\x0c\\xf1\\xc9\\xff\\xf1\\xb3\\xda\\x8f\"\\xeae\\xbd\\xa7q\\xb6-bo\\x82"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010wi.\\x8e\\xa9\\xcbx2cv3\\xdf\\x0f\\xa8\\x98\n\\xb1\\x06\\xb76\\x02\\x93\\xb2\\xee\\x9d\\x95\\xd4\\x07\\xfa%b\"z\\x99\\x142\\xed\\x87=f.\tf\rf\\x9e\\xbf\\x1b\\xec\\x1d\\xc9\\xa2\\xe6\\xe9\\xaa\\x0e\\x98\\x92\\x83?:\\x1b\\xea\\xaa$\\xbe\\x05\\x01\\x08mb\\x061\\\\xe8\\xf5\\xe2\\xd1\\xf1\\xb66\\xf1\\x82v!\\xdf\\x94\\xfa\\xe5\\xda\\x8fh\\x85\\x9f5\\xdb\\x02\\xa4\\xcb|\\x18\\x15\\xe7\\xc9*/\\xe8\\xd5\\xe2t\\xacs\\xd7~\\x92\\xcf\\xf1\\x92w'1\"\\xe0\\xa8p\\x9a\\x15d\\xc9\\xae\\x8a\\x10.fl6\\x13\\x808\\xa2\\x8a/\\xd6\\x1aq\\x15\\xd2\\xd3\\x0ex\\xbd\\xff^\\xb0\\xa1\\x0e7\\xe0\\x1dc\\x1ef!\\x94&yef\\x9a\\xccdq\\x8bv\\xef\\xcc\r\\xb5\\xa1\\xcag\\xc1\\xcf:=\\x8a\\xe5z\\x85\\xab\\xd4=\\xdf\\x07\\xf9?k_\\x06\\xab\\xea\\x1etjar\n\\x9eq\\xbbi\\xa4\"\\xa3\\xd3\\xa6\\xef)\\x94\\xda\\x9f\\xf5jz\\x04y\\x97r\\x015\\xaal\\xe6\\x88\\xaa\\x9e8\\xa0\\x05\\x80\\x0e\\x08\\xce\\x11 \\x1cc\\x88"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\xbbn\\xede\\xbf\\xae,\\xbbgb1\\xefidr\\xc3\\xa9\\x13l\\xd8n\\xa0\\xab8\\x81\\xc5\\x8e\\xfc \\xcf\\x96~\\xf1c\t\\x80z\\xd4\\xe5\\x928\\xda\\x16\\xff>\\xed\\xa2\\xec\\x96\\xb5\\xe6\\xe2\\xebf\\xef\\x06qry\\x81c\\xde\\xeb\\xfb*4qf\\x82\\xea\\x10g\\x1c\\xf6'y\\xb8o\\xfc\\xd3z3\\xb5s\\xe6\\x01\\xf5y|97\\x89@n\\x13\\xf7\\x9ar\\xd1_\\xf7b\\x07\\xbb\\x13\\x94\\x88?\\x84\\x84h\\xf9\\xeck\\x9f2\\xfci\\xd7t\\xe1b\\xf6\\x98\\xad@%?\\xdc3=\\x19\\xa3ykb\\xf2\\xcbw\\xa6\\xad\\x9d\\x0b\\xb1\\xc4\\x8e\\xc8\\x12\\xed1\\xfc\\xe2\\x92\\xf2a\\xa1w\\x89h\\x8f\\xaf\\x95\\x82\\x1a\\xba\\xe6\\xc52u\\xb7b\\xafv\\x01\\x06w\\xf9g\\x8d@b\\xa6-\\xda*\\xd5\\xbc\r\\x1b7\\xbe\\xb5\\xc3\\x83na\\xbf\\x0b\\xfa\\xae<\\xbf:\\x8d'\\x9d\\xbej\\xb4\\x1a\\x92sw\\x87\\x8f\\xe18+\\x0b\\xfei\\x0b\\xb2\\xd5\\xb6\\xa3\\x02\\xee\\x18\\xe1v\\xaan\\x07\\xc4\\x80\\xbc\\x85\rmb\\x1a\\xb6\\xe4%\\xba\\xbf"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xa4\\x94\\xc5x\\xb7o\\xa6\\x8c\\xdd\\xe1\\x08\\x15\\x149_\\x88k\\x9aarq\\x9c\\1\\xc4\\x88\\xe7\\x17\\xfd\\x01\\x10gp\\xa1\\xde\\x97\\xfd&\\x11y\\x92p\\x14\\x1e\\xa1\\x0b\\x01;\\xb8\\x00\\xf3\\xf4\\x90\\x1ax\\xda\\x96-\\xc4~\\x8f'\\xd8e7\\x93\\xdf\\x06y-\\xf3i\\xaf3`\\xb0\"\\x93\\x1b\\xdc)\\xf9\\x8bb\\xcd\\xe58h\\xdc\\xbd\\x1f7\\xa8\\xeb\\xa8\\xb3\\x18\\x95/j\\x12\\xdb1ej\\x10\\x96!\\xc0\\x87o\\xce%5\\xe6\\xd4\\x90\\xfe\\x06\\xf8\\xa7\\xf4\\x10f\\xa6k7\\xf1\\xd4o\\xf9\\x1d\\xfe\\x82gf\r\\x0cty\\xc8\\xa6\\x10#\\xcc\\xe54\\xfcs\\xa5)\\xbf\\xd2s\\xe9\\xdf\\xee\\x97\\xb6k\\x9b@\\x9b;j\n-\\xfb\\x95\\xf5\\xc0k\\xdb\\x87\\xcch\\xde\\x05v7x\\xed\\x98\\x88\\xa1l\\x86\\x83w\\xfc\\xe8f\\xd6\\x05\\x12\\x1b\\xd2v\\x93\\x8d|h\\x8b\\x8f\\xeb\\xd0d\\x1c\\xa7\\xdb\\xaf\\xd6yd\\xdbt\\xd7\\x8b9\\xd5e\\xa7\\x9f8\\x94\\xb3)c\\xab\\xd7\\xaf\\xf5\\xf7\\xc7\\xd6nt\\xa8t\\x9d\\x10)\\xbd\\xdb\\x1d)"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\x8c\\xf1oqlax\\xf1\\x1a\\xb2\\x90\\x8avi\\x8e\\x9e\\x19\\x18\\xb76^\\x922\\xa1\\xc7\\xfas\\x8d\\xf5\\x10\\xd4\\x12\tyj5r\\xde\\xae\\x18\\xd2v\\xad\\xa9\\xdf\\xac&\\xbf\\xc6\\xd6\\xa5\\x8c\\xc1q\t1\\xdd\\xf9\\xb0\\xae+\\xb9\\xe7_\\xca\\x8at\\xe2^\\xfb\\xdb\\xe0\\x07\\xf0!\\x99\\x13j:\\xca\\x1d\\xaa\\xabmbvs4\\xbe\\xf7g'\\x11\\xed\\xdf\\xeb\\xa7\\x9c\\x82\\xffxo\\xdce\\xf0\\x9d\\xbd\\xe6\\x16\\xcaea\\xecm\\xc3\\x8a\\xb1-\\x1c\\xb2\\xa3<\\xc1x\\xd0\\xa5d\\xc3d\\x81b\\xad\\xc8i\\x8a\\xa6\\xc1\\xc6\\xff|\\xe8\\x94\\x05\\xbe2u&\\se\\xf6f\\xd5\\xa0\\x1a1=4\\x90\\xcfs\r\\xdc\\xb6\\xd7\t\\x80\\x83\\x89\\xd9\\x1b\\x04\\xc1\\xb9\\xa8\\xba\\x1f\\xdbx4\\x80\\x8b?\\x99>\\x05;\\xb2\\xec\\x0e\\xdc\\xf8oi\\x10\\xe3$\\xf7\\xf5\\xfa\\xc7\\x96\\xf8\\xec\\xa5\\xb7\\x84\\x0f2i'\\xe8o9<i;\\xc7\\x1b+\\xef2\\x87ze\\x1a\\xad\\x1fw\\xcd\n6=\\x11vn\\xc4\\xa2\\xc8xn\\x83\\xa1\\xc1\\xb8d"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfes\\x11n\\x0bj>\\x14e%1fq\\xe5\\xd9e_\\xaej\\x19\\xeb\\xcf\\xa1\\x96c\\x1d\\xc6\\xe7\\xa5\\x0c\\xfa\\x13\\x86\\x9a\\xe0\\xc6\\xe1\\xb5g\\xeagy\\x19(va\\xcf\\x03 y\\xe1\\xcf\\xcf8\\x93\\x1c.\\x12\\xca6\\x7f\\xee\\x10?\\xb4z\\x8a\\xd8\\xedc\\x92\\xccy,\\xeai\\xb2j\\xaf\\x8ax\\xbf\\xc2d\\x11\\x9c@v\\xf3\\xd56:\\xf4\\x01\\xd9o\\xc1\\xa2m\\xca\\xdf\\xf7\\x0fj\\xda\\x17aa\\x15\\x15\\x11\\x12\r=?\\xc6\\xfb\\xea\t\\xb8\t\\x99\\x9dw\\xddl\\x82\\xc6\\xec\\xca\\xd1<\\xddd\t\\xd0\\x87\\xe5\\x06y\\xd1\\xaa9\\xac\\xbc\\x11\\xfa\\x97o\\xa9\\xc1\\a\\xcd\\x8e\\x9b\\xf1\\xbcb\\x06\\x81\\xfc\\xad\\x1e: \\x0c\\x13^l\\xa0u\\x80j^\\xce\\x96p^\\xfe5\\xa7\\x87s\\x0e\\xc0&\\x94\\xe0\\x80\\xda\\x1a~?\\xcf\\x9a\\xd4\\xb3\\x1c\\x8d\\xe0\\xed@\\x89\\x06\\xf2\\xa4'\\x06\\xf4\\xd4#\\x1b:\\xe6\\x94\\xb2\\x8f\\xa0st,+y\\xfb^`9s\\xbc\\x04\\x9d\\xa4\\xe3(j\\x90$\\xd05\\xc4\"\\xca\\xb4\\x9d\\x8d\\xa2n\\xb09\\x02"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe4t\\xf6\\xea\\x8c&1l'e&\\xcf\\x01\\xd4\\xda/ow\\x9c\\x0b\\x81m\\x86\\xd9\\xde\\xd3_e\\xf4\\x99\\x8b\\xc1f!\\xd84\\xed<\\xc0\\x99\\xfe\\x00sym\\x8d\\xc3\\x0b\\xfc/\\x8e'\\xf1\\xf9\\xc3@t\\xde\\xc5\\xfe,^\\xb0\\xd3)\\xc3\\x90\\x08\\xdd\\xcec\\x8f\\xb50\\xeb\\xae\\x9aiz\\xe4x\\xbakx\\xb2\\x0e\\xe1\\xc4\\xae\\x88\\xa0r#\\x11\\x03j\\xd0\\xcev\\xca\\xc5\\xd1<\\xbc\\xa1\\x03q\\xfea\\x83\\xca\\xa4_\\x94\\x05 f\\xa9q\\xa6r\\xac\\xdb(\\xbe\\x8a\\xa7g\\x93\\xef\r\\xac@0\ne+\\x9e \\x90n\\x9c\\x7f\\xafy(\\xb1\\xac\\x8d:\\x05<(\\xce\\xfc\\xa4\\x9f\\xda\\xbbpm\\x8e\\x15\\x9c\\x13\\xee\\xcc\\xf0\\xf6\\xd0\\xec$d\\x9c\\xfa^^\\xdaa\\xe4\\x10\\x93\\xa9\\x03l\\x9e \\x84\\xa9l h:\\x01\\xb0\\x91\\xf4\\xd6\"=f\\xb4\\xa6dm\\xd0,\\xbb1#\\xf9+q\\xa6o\\x13\\xad\\xe5\\x1fe\\xadi\\xcaapk)1j\\xa1\\xb4\\xdcyl\\x97y\\xc6\\xbe\\x81\\xf3\\xd5\\x0c\\x16s\\x06\\xd2"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|\\x18\\x13j\n\\xff\\xbfu\\x072<*\\x10\\xa9<$\t3p\\xa3\\x1ds\\xcaq\\xaaga\\x04\\xb0\\xec\\x02\\xfa'\\xe1\\xaa\\xe0\\xdf\\x11mj\\xfa\\x82\\x17\\xc5\\x98o\\x11\\x17\\xc1\\x1d\\xa7\\x11\\xb2\\xa6`\n\\xabn\\x94\\x84\\xbb\\x1b\\x9f\r\\x88\\xd1\" \\x7f\\x1a\\xc0\\xb2mf==@(\\xbf-\\x0bs\\x848\\xdft\r\\xc10h\\x875\\xd60\\x15\\xdde*\\x06\\x9b2\\xcdeq\\x91\\xe5u\\xf2\\xd7\\xac\\x97\\xea\\xfd\\xd4j\\x86\\x98\\xbf\\x06\\xce\\x99\\xdd\\xec`|'\\x94\\xdc\\xdb\\x85ox\\x8c\\x9ep\\x0b\\x06k\\x9a\\xbc\\x88#gd\\xe7\\\\x81\\xd1\\xd0k\\x84z\\x03y~\\xb1\\xfbv\\xfb\\xb3q\\xae\\x03\\xa9\\xd9\\xa3\\xf8\\xfdy\\x13\\xfd\\xe1\\xa7\\xfbfa\\x07\\xc7\\xdf|w\\xaf\\xe9\\xb7\\x9d2\\x8dr\\\\x00.@\\xd0`b1\\xa9,\\xc4\\xed\\xde\\xa0@\\xb0\\xa9q\\xd0\\xff$\\xf4\\xcc\\x8d\\x948\\xb4\\xd8\\xea/-0\\xd7\\xa7%\\x97\\xb7\\x9e\\xe87\\xe1\\xfa:\\xa4\\xac6\\x0bqy\\xce\\x1e\\xfda>\\xa1\\x86\\x99h\\xc3\\xf8p"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\xe1\\xff\\x94\\x08\\xe6:3\\xa0\\xb5\\x96\\x07\\x7fp\\xbc7z\\xc8p\\x1d\\x86\\x95\\xf5\\x86rt\\x14p\\x19#\\xbaun\\xbf\\x1a\\xcb\\xc1\\xb6#\\x91\\xfae\\xb2\\xe9\\xbc\\x9ao@\\x10\\x07r\\xd9ft\\xfa\\xc5\\x82\\xa4\\x10\\x01\\x84\\x17\\x85n\\x08\\xa5\\xb7\\x10\\xfem\\xb1m2&\\xbb\\xd4f\"\\x82\\x91(\\xc8>e\\xa7\\xec\\x91\\xfe\\xd4\\xd3\\x996\\xc5\\xf2\\x90n\\xb6\\xc7_\\xe03g\\x8b\\x87\\x1c\\xcb\\x91\\xbe\\x7f=\\xb1w@\r\\xdb\\xb6\\xbb,py\\x8b\\xeb\\xf2\\xc7\\x1d\\xbar\\xec\\x1bs\\xb6t,\\x8f\\x95e*w\\xb7m\\x85\\xb6\\x1b\\xe1dl\\x9b\\xca\\x04y;)\\xc9\\x9f\\xe5\\xcf\\xea\\xe9\\x0ccx\\xf7\\xe4|\\x88\\x10\\xf2\\xdf\\x0f\\xd5\\xeb*rr\\xa9a\\xdc\\xb3\\xc8\\xc2d\\x8cn\\xa0/+ap\\x0c\\xbal\\xa1\\x9e\\xbeof\\xcd\\xc3v7\\x81q\\xf9\\xce\\xfc\\xda\\xf2p\\xc7\\xa6z\r5\\x12t\\xf9\\xc4\\xbc\\xc1\\xdc5\\x93\\xc6i\\xae\\xbf\\x06e\\x15q*\\x8e~<\\x04\\xff\\x9c\\x85\\xf1\\x13/\\xf9lp\\xb62\\xbc\\xdf\\x11"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99w\\x9a\\x11<j\\x8e\\xa63\\xf2\\xe7\\xff\\x1dq\\xfc\\x8f0sv\\xae\\xf2\\x8c\\xf5\r\\xd3p\\x96\\xc0fp*\\xd5\\xdcnj\\xe0\\xf1\\xbf\\x0f5\\x1f9'\\xfdd\\xac\\x87\\xa5\\x10\\xc22\\xac\\x9d\\x98\\xeav\\x8c\\xc0\\x81\\xa8\\xb6+\\xf7-\\x1a\\xf7\\xa0v\\xa6k\\x84ga\\xb8,\\xc4\\xc2\\xbe\\x1ev\\x88\\x9c\\xb6\\x03\\xce|\\xbced`\\xe1s&*\\xa6\\x94\\x07\\x07\\x9b\\x87\\xed\\x1e\\x7f\\x1c\"fgc#\\xd1z\\xaf+8j\\x86u\\xd2o\\xdd\\xba|\\x82o\\x82\\x97\\xa83w\\x93>\\x9b\\xf1\\x8d\\x93(o\\xe05\\xe0\\x85%\\x99\\xf5\\x0b\\xea\\xb7\\xd0\\x10\\xf4$/\\x1d\\xba8\\xb8\\xb8\\xaby\\xee\\x06\\xeb\\xa8\\x0c\\x1e\\xf3\\xddn\n\\xb6\\xd2%\\x10\\x01\\x11|o*\\xce\\x18\\xef\\xb2$q\\xbe)\\xf5\\x1d_\\xe9g\\x00\\x94\\x01\\xfd\\xaa\\xa5>d\\xed\n\\xb0h\\x93\\xcd\\xe1\\x88\\x0b~v\\x02\\x8c\\xfa\\xac\\xd6\\xf1c\\xfe\\x9e\\x8e\\xce\\x13\\xf2:\\xe9\\x1f\\xcah\\xd8a\\xdd|a\\x89\\xd7\\xb1g\\x16\\x8da0\\xe4\\xfc\\xdb\\xd1\\xb6\\xf0\\xfe\\xc1"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\xa0\\x93\\xe5x~\\x13sg\\xb4\\x07a\\xb0\\xb1\\x8d\\xa0x\\x92\\xf9\\x02\\x83\\xba\\xe2\\xccv\\x8co\\xe7\\xe2\\xff\\xa7\\xd6|\t\\xec\\xe9\\x12\\xf9\\x88\\x1a\\xcds\\x9c,\\x92\"\\x96\\x19\\x9f\\xfb\\xdc\\xba\\x06\\xe5k\\xa4.\\xf4a\\x1f8\\x9b\\xa2p\\xabh\\x989\\xd2\\x19'>q_\\xb182\\xb3\\xf3\\xb8vwta\\xc8v\\x85\\xe9\\xefu\\x80y\\x94b\\xb7\\x16\\xe6\\x85%\\xe2\\x9e`8\\x01w>\\xbd\\x16g<\\xbb\\xad\\xb5\\xaf\\x03~\\xdd\\xbf=\\xed\\x05\\xcew:y\\x04(b\\xaf\\x85\\x04nx\\xa3\\xa7\\x86\\xaaq\\x04y\\x94\\xe9\\xfa\\x15\\xcdwx\\x96\ry\\xbc\\xcc\\xb6\\xbd\\xdb\\xbd\\xc5\\x8e\\xcd\\xe3\\x1e\\x12p\\xad\\x8e\\xe0+#r-\n\\x97\\xd7\\xf95x\\xb4\\xda1p:\\x9f,\\xb6j\\x16z@\\xf5\\xa1,w\\xfb^\\xfc@\\x1c\\x8bp\\xfaw\\xc8\\xc8\\x0c'#(\\x0f\\x99!\\xd7.-\\x0f\\x88\\x10\\xad\\x0c\\xb2\\xa60z*-5\\xef\\xe5p*\\xbc\\x06i\\x87<\\x87\\xb1\\xa8i\\xfa\\xba+\\xad\\xef\\xdf\\xc9\\xb0\\x16"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\xef\\xf2u\\xee\\x92\\x0b\\xf8\\xc3(l\\xecm\\x85\\x14\\xa4y\\x89`u\\x96\"r\\xb9\\xbf\\xeb\\x00$\\x97*\\xfd\\xb0\\x05\\xaee\\xa0\\x9d\\xf2\\xc1\\xcd\\xb2\\xb5\\x84\\x9d\\xbe\\x0b\\x01\\xbc\\x0e\\xfdo\\x18\\xa0d\\x8b\\xb7\\xc5m/+\\x81\\x18\\x80'n\\xd6\\xd5\\xc4g8&l\\xaf\\xb2\\xab\\xa7\\xe6(ag`\\x1c\\xce\\xe2\\\\xc7\\xe2k\\x813@7\\x87\\xdb\\xe0\\xe9\\xf2\\x03$\\xb7\\x8fs^;$\\x0e\\xae\\xa3&\\xcfp\\x90\\xb8\\xe0\\x01\\xa4\\xd5\\xe7\\x91&\\x9a^\\xe3q?r\\xc6\\xaa\\x9f\\xee\\xa5\\xeblz\\x96\\x99\\xa5\\x9c\\x9d\\x95e\\x07\\xb6\\xd3\\x0ctg\\x8f\\x1a\\xdc\\xcc?\\xc9\\x88\\xa7\\x11gb\\xb2\\xc1\\xbd\\xdb\n;y\\xe1\\xaa!n\\xc5j\\x05\\x96|\\x1fy\\xc3\\xadf\\xd2\\xa2\\x87\\x0e\\xaf\\x8c0\\x97ca\\x11\\x07\\xe2h\\x84\\xc6\\xed\\x88\"\\xa4\\xd6\\xa1\\xb0#\\x01\\xea\\x99d,\\xf3\\x06\\xa89\\xae\\xa1\\xf7\\xd5d\\xe3\\xad:\\x81w\\x9b>\\x0e\\x8b\\x90\\xef3\\x9a\\xc4\\x8e\"\\x9d\r\\x9e\\xf2\\x94x\\xce\\x03\\xce\\xad\\xff\\xad\\xf9\\xa3"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xa30\\xbf\\x9a\\xbe\\xa2\\xd9\\x82\\xcf#\\x86(\\x8d\\xcd\\x92\\x05\\xf2\\xe4\\xbek\\xc5\\xfe\\x87\\\\xb91\\x8dua\\xd7\\xd5\\xd7\\x06\\xb1z\\xa8\\x9f34wvy\\xb6\\x07a\\x89\\x85k\\xb4\\x91\\x17\\xabh\\x10\\x97\\x83\\xbb\\xa4\\x82\\xb2\\x03\\xf6\\x140\\xe1\\x06\\xf9\\x92s\\x18\\xceq.\\x9d\\xa9\\x13ed\\x8e\\x97\\x8d\\xc7\\xd8\\xd8\\xe3\\x8f\\x8f\\xea\\xact\"\\xbe\\x8a\r\\x9b\\x03\\x1f-\\x89\n\\xd3\\xd9\\x1e\\xb0\\x12\n\\xf4\\xa34\\xad\\x96\\xccb\\x13\\xfc\\x18\\x99\\xf0\\xef\\xe1\\x8a\\xcek\\xe7epkz\\x8c\\xf3,<\\xddb\\xd9)+\\xc5\\xc9\\xf7\\xa4pq\\xcb\\x1d\\xc4\\x95\\x10>l\\xc8\\xab\\xde\\xde\\xf7\\xb7\\x81\\xfe\\xc9\\xfd\\xa5t\\xa8\\x16\\x0c\\x03\\x87+\\xeaf\\xc9\\x89w\\xe9e\\xd5b\\xf7@\\xc0mn\\xee7\\x10\\x1c\\x19\\xf7%7h\\xbc\\xc7\\xdd'\\xe5\\xab9\\x02k\\xac\\xb7\\x08\\xa8\\x99\\xd1n\\xb5\\xde\\xdd\\xf7\\xe65\\xdf\\xdb\\xad\\xf7\\x03\\xb6\\\\xb6\\xca\\xc2\\xb687\\xc5\\xd7\\x08\\x14@2\\x8eqku\\xf8\\xd5\\xadu\\xbd\\xfex_r\\xf1l\\xae"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfea\\x06\\x07\\x02\\xa1\\xc9)\\xd1\\x9e\\xe2\\xefpp\\xdf\\xa7\\xea\\xf2\\x80_\\b \\xab\\x12\\xc3b\\xc3f\\xfc\\x1e\\x96y\\x0c#\\xd6\\xfb\\xf4\\xa9\\xe6\\x91\\xf4\\x85\\xb6\\x910v\\xbdl*9)\\xdd\\x0f3\\xdc0\\x0c\\xd3dkdwf;\\xfb\\xd0\\xb3k\\x8b\\xeb\\xd5x\\xebpwhhz\\xcff\\x08\\x0ef\\xa3\\x9b\\xb6t\\xaew?\\x9a\\x86\\xc2\\x86a\\xfa`\\xd9d\\x83i`\\xf1 \nl\\x08\t.\\xa6g\\x88\\xd5z\\xb6<\\xbek9\\xb0\\xad@\\x03\\x9b\\xff\\xdb\\xb7\\x85\\xd5\\x9e\\x00f\\x01\\xec\\x99u\\xf9y?\\x8b\\xbe\\x9d\\x8b\\xfe\\xea\\xd8:\\x89\\xec\\xec\\x80\\xd7\\xc4\\xb2\\x86\np\\x82\\xe9cx\\x04i0\\xfb\\xcdg=\\xcc\\xd1ws_\\xec#$v\\xf7\\x9a9\\xb6s\\xa7s\\x0fi\\xeedy\\x9b\\xd8rz\\x95\\x14\\xd8!\\x01\\x0e\\xfb\\xb0\\xf4\\xf6j\\x10\\x8a|nm\\xcfp\\xf4w\\xfd\\;\\xa9\\x8aa\\x86\\xfa\\xda\\x99\\x00\\xb5\\x88c\\xbe\\xde\\xc6z\\x00\\xd6k\\xfd\\xf9\\xa9.\\xb02\\xa7\\xad\\x0c\\xeb^\\xfd"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xc9\\xdc\\xe0\\xcbq\\xea\\xb2x\\x059\\x9c\\x98\\xe4xc\\xb7\\xff;\\xc0\\xd6\\xd5\\xe0\\xfb\\xbc\\xe5\\xc3m\\xec\\x0b\\xfa\\x8ax\\x15v&\\x8e\\x00\\xe2\t\\xdd\\xfe*\\x99\\x9b\\x82\\xbf\\x18h\\x1b@\\x95\\xd9u\\x03\\xc3+j\\xa6 m7m\\xca\t\\xfa\\x80q\\xc0=\\xde\\xaa`\\xac\\xe4|\\xffu\\x95\\xe7\\x02k\\xb3\\xf9\\xe0\"v\\xaf\\xae~@\\xa3d\\xbby:,\\xb0\\xef\\xfc\\x0b\\x89\\x1aln\\xe1\\xf25t\\xec\\xe4\\xa1\\xe1\\xd9\\x82\\xf6\\xf5\\xa3v\\xe1\\xd8\\x8c\\x0e\\xd3\\x01\\xc6@g\\x81\\xd5\\x1arr^\\xa7ymf\\xaa\\x0e\\x14u\\x97\\x8few\\x9a\\xbe\\xa4k\\x02\\xe2\\x93.v\\x9e\\x1ar\\xf1\\xe0\\xc7`\\x98!\"l\t\\x11y\\xbf\\xb5w\\xfd\\xed\\xca)\\x0e\\xda\\x9ad\\x15\\xcc\\xc5-c=\\xeb\\xa9\\xba+\\x84l\\xd1\\x8b\\x17\\xc9+n\\x94\\xe8yb&\\x84\\x10i\\x12\\xb9b\\x97v\n\\xce\\xc0j\\xb9q\\x96y@\\xf0\\xef\\xfck\\xd6w\\xca|\\x9cj\\x05\\xe7'mon\\xc1\\xbdn\\x83\\xac(\\x08b\\x94"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3\\x0bj\\xd3\\x0ci\\x00w\t\\x98\\xf0\\xf8\\xcf\\xdf4it\\x15\\x0cb^d\\x17\\x8f\\xe2\\x90\\xd64\\xca\\xccv\\xc7\\x80\\x89\\xdc,\\xd5\\xb4\\xaay\\xcd\\x89\\x14\\x95\\x0e\\xb5\\xca\\xf2c\\xf67\\\\x19?\\xb5\\xea(\\xc0d6\\xb0\\xc8\\\\xa8-l\\xe4\\x9c$ml\\xa0\\xa0\\xe5\\xb7\\x16\\xca\\xf6\\xc0\\xdf)q\\x0c\\x9e\\xac\\xb1\\xa0\\xa1j\\xadmoc;\\x9e\\x97\\xc5\\xd2\\x1a\\xfcw\\xb6\\xb2\\x7fj\\x9a\\xe9\\xdf\\x8c\"\\x03\\x7fs\\x13\\x8abj\\x07\\xb75;\\\\xd9cn\\xa2`\\x93,yv\\xbe\\x00\\x0cd\\xe8\\xfc\\xfb\\xb4\\x90%\\x0f\\xf2\\x06\\xd9vl?\\xd1\\xc6\\x06c\\xfc\\x03\\xa8`\\x1e\\xd6\\xb7\\x1b\\x9c\\x80\\x15\\xf7ve\\\\xecy\\xd3\\xfb\\x95\\x9fc\\xe5\\x96\\xb8\\x87\\xdc\\xe1\\xbb\\x1f&\\x8b\\xd6\\x9e\\xef\\x8c\\xcd\\xdf\\xd7\\xea\\xae4\\xbd\\xe3\\x95\\xe3\\x19\\xec\\xf9\\x1a(\\x8c\\x83\\x96\\x89n\\xf3\\xe6\\x10\\xad\\xb5\\x86*g?\\xc0.\\xce0\\x96dj\r\\xa8\\x99\\xa5\\xc2\\x83lvq\\x96\\x9a\\x96\\xc2\\xf4b<\\xf8\\x0f\\x8d\\xd2\\x0b1g\\x10"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16'\\xde\\x168\\x95a\\xe5\\xf5\\xa9\\xbe\\xd0\\x03,m\\xc8!\\xa3y\\xfe\\xd4\\x81~\\xfat)\\x16(\\x18\\xb92\\xb9y'j\\x14r\\x13a\\x02qq\\xd6'\\x08\\xfc`\\xc7\\xfc\\x1a\\x0bj;\\xeb\\xa1\\xd1\\xfe\\xce\\x03\\x08.\\xa9\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xad\\x9b\\x89\\xf0\\x15\\x1e\\xef;\\xe4\\xe2\\xadc\\x89\\x9c\\xfd\\xeb\\xba~c\\xfb\\xb5\\x93yk'\\xab\\xea0gx\\xce\\x92\\xd2*\\xb2\\xaff\\x87\\x19!\\x81\\xb2\\xd2\\x1eu\\xf7\\x06"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x91\"\\xb5\\xae\\x14\\xb9k\\xa4\\xf1\\xac\\x94\\xa7\\xb9<\\x0c^h\"\\xff\\x9c,\\xdfv\\xde\\x1a\\xda\"\\xd65\\xd9\\xeb\"x\\xf4`~\\x9c\\xe8\\xc5\\x9ejj7*\\xae\\x08y\\xd6\\xdb\\xdf\\xe9\\xf8xx0+\\xf4\\xf3!3a?\\x046ez\\xc86\\xed\\x00:dq\"\\x88<\\x8e\\xd3\\xe0\\xfces\\x80=\\xde:\\xb5m\\xdd!\\xdc\\xb1\\xb5\\x14&4^n$\\x8d\\xf6\\x9b\\xdf\\x95v\\xd6\\x0b\\xc2jvr\\x9c\\xc9\\xc0b\\xf0_&l\\xed\\x1eh\\x08\\xc3)\\xa1\\xfc\\xfb'scu\\xf2q\\x81\\xc1\\x02\\x0fsizd\\xf7\\xd9q\\xcb\\xb9\\xf6\\x80\\x98qt\r\\xdb\\xd3\\x0c\\xfa\\x08\\xe9v5|?\\xd0\\xc3\\x85$\\x84\\x9c6\\xcfiw^\\xebv\\x07\n\\xa9k=\\xdb \\xf2\\xc2|\\xcfp a\\x12l\\x81\\xd9h\\xf57\\x91\\x90\\x8dt\\xc5\\x89u5\\xf8\\xf2ut7\\xf6\\x15\\xb1\\x1c\\xe9^\\xb5\\x10\\x97\\x98h\\xc2!a&\\xb5<z\\x85\\x99n\\xe1\\x97&\\xb1%q\\xf88)\\xa1;"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80s'\\xfa\\x1a_\\xd6\\xf1\\xc5\\x12\\xfb\\xdd>|\\xaat&\\x1f\\xfb\\xdcd\\xc6\\xfe\\xd9c\\x99.'\\x96\\x16\\x149\\xbe\\xe9\\xd1>\\xc5\\xdf\\x97\n!\\xd5-\\xf0y\\xc1\\xa1\\xe6el'\\x95\timr\\x1f\\xc1\\xfd\\xa2\\x07(s\\xa2m\\x84 k\\x9edb\\xbf\\xb8\\xa3\\x84\\xa4o\\xc5\\x14\\xccx\\xec\\x93\\xc9\\x1b=m\\xbe\\xf5\\x11\\x0e\\x13rw\\xc6\\xe8\\xb7h\\x9ap\\x12\\x87\\xffyg\\x16\\x02\\x93\\xa0\\x85:sh\\xcfhzu\\xc3\\x93\\xfc-&?\\xe9m\\x11\\xbe\\x86\\xf8\\xcd\\x05r\\xddf%\\xae\\xd7\\xad6\\xa1\\xb0\\x84~\\xb2q\\xbb\\xa7\\x99\\xa4!\\xf9p\\x0c\\xaee\\xc7l\\x03\\xc2+m\\xbf\\xccg\\xde\\xb0\\x90\\xa4t\\xea\\xf3\\xe5\\xc2\\xc6\\xd9c1l\\xef\\xae\\x94\\xdafk\\x9b\\xc7\\xaah+\\\\xe6\\x0b\\xa4\\xa4\\xe1kuj\\xb4\\xd3<\\xa9\\x8a\\xc5\\x0f\\xb3\r\\xb1)\\x0c\\xed\\xaf\\x01\\x98\\x05\\xd7\\x95\\x8e\\xd2|\\xd4\\xf1\\x14\\x03\\xf7\\x98?\\\\xf1s\\xae\\x8cd\\xc6.i\\xf1\\x1ckv\\xe2\\xe31\\xbc\\x0b\\x9a"
  599.  
  600.  
  601.  
  602.  
  603.  
  604. * Started Service:
  605. "osppsvc"
  606.  
  607.  
  608. * Mutexes:
  609. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  610. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  611. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  612. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  613. "CicLoadWinStaWinSta0",
  614. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  615. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  616. "Global\\552FFA80-3393-423d-8671-7BA046BB5906"
  617.  
  618.  
  619. * Modified Files:
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_2c8484635e2f145526169e04f069fc53.doc",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_2c8484635e2f145526169e04f069fc53.doc",
  622. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFC5AC14E5-8851-48A8-AE91-2703B85AF8CA.tmp",
  623. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE9EDFFFB-E439-4023-9774-B351C809AADA.tmp",
  624. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS71430FB5-E886-43BE-8E81-8B9753801F96.tmp",
  625. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF99AFA3C072F0DA66.TMP",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  628. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  629. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF37AFF7AB4E644A79.TMP",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFF8979003C783E7B.TMP",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB3D854674E20B89D.TMP",
  633. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\4901F40.jpeg",
  634. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  635. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7432.tmp",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7433.tmp",
  638. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\cab945F.tmp",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949E.tmp",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94AF.tmp"
  642.  
  643.  
  644. * Deleted Files:
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\tst6623.tmp",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\tst6643.tmp",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\tst6663.tmp",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\tst6674.tmp",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\tst66E2.tmp",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\tst6702.tmp",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFF8979003C783E7B.TMP",
  652. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\4901F40.jpeg",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7432.tmp",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7433.tmp",
  655. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\"
  656.  
  657.  
  658. * Modified Registry Keys:
  659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\8+:",
  660. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  661. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\TCWP5FilesIntl_1033",
  662. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\TCWP6FilesIntl_1033",
  663. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  664. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import",
  665. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Name",
  666. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Path",
  667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Office\\15.0\\Word\\Text Converters\\Import\\Extensions",
  668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\20F0D16",
  686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\20F0D16\\20F0D16",
  687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  862. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922",
  863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  864. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0",
  865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  867. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\(Default)",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  869. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\FLAGS",
  870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  871. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\FLAGS\\(Default)",
  872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  875. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0",
  876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  877. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0\\win32",
  878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  879. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0\\win32\\(Default)",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  883. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\HELPDIR",
  884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  885. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\HELPDIR\\(Default)",
  886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  887. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  890. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0",
  891. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\(Default)",
  892. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\FLAGS",
  893. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\FLAGS\\(Default)",
  894. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0",
  895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  896. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0\\win32",
  897. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\0\\win32\\(Default)",
  898. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\HELPDIR",
  899. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\DD1DF464-4C64-4E91-81C6-76F805F91922\\2.0\\HELPDIR\\(Default)",
  900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  901. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  902. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  904. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  905. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  907. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  908. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  910. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  911. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  914. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  916. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  917. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  918. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  920. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  921. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  923. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  925. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  927. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  928. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  930. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  932. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  934. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  935. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  937. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  938. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  939. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  940. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  942. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  943. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  945. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  946. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  948. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  950. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  952. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  954. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  957. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  958. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  960. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  961. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  963. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  964. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  967. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  969. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  971. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  972. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  973. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  974. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  975. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  976. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  977. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  978. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  979. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  980. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  981. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  982. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  983. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  984. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  985. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  986. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  989. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  990. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  993. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  994. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  996. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  997. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  999. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1001. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1003. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  1004. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1006. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1007. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1009. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  1010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1011. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1013. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1014. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1017. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  1018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1019. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1023. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1024. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1026. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  1027. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1028. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1029. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1030. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  1031. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1032. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1033. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1034. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  1035. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1036. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1037. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1038. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  1039. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1040. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1041. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1042. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  1043. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  1044. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1045. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1046. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  1047. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  1048. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1049. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1050. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  1051. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1052. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1053. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1054. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  1055. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1056. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1057. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1058. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  1059. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  1060. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1061. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1062. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  1063. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1064. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1065. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1066. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  1067. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1068. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1069. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1070. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  1071. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1072. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1073. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1074. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  1075. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1076. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1077. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1078. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  1079. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1080. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1081. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1082. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  1083. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1084. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1085. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1086. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  1087. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1088. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1089. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1090. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  1091. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1092. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1093. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1094. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  1095. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1096. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1097. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1098. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  1099. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  1100. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1101. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1102. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  1103. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  1104. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1105. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1106. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  1107. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1108. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1109. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1110. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  1111. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1112. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1113. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1114. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  1115. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1116. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1117. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1118. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  1119. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1120. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1121. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1122. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  1123. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1124. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1125. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1126. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  1127. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1128. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1129. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1130. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  1131. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  1132. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1133. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1134. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  1135. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1136. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1137. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1138. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  1139. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1140. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1141. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1142. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  1143. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  1144. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1145. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1146. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  1147. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  1148. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1149. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1150. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  1151. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  1152. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1153. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1154. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  1155. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1156. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1157. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1158. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  1159. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1160. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1161. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1162. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  1163. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1164. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1165. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1166. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  1167. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1168. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1169. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1170. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  1171. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1172. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1173. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1174. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  1175. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1176. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1177. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1178. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  1179. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1180. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1181. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1182. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  1183. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1184. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1185. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1186. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  1187. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  1188. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1189. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1190. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  1191. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  1192. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1193. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1194. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  1195. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  1196. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1197. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1198. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  1199. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  1200. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1201. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1202. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  1203. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  1204. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1205. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1209. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1210. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1211. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905"
  1270.  
  1271.  
  1272. * Deleted Registry Keys:
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\8+:",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\\x7fo8"
  1279.  
  1280.  
  1281. * DNS Communications:
  1282.  
  1283. * Domains:
  1284.  
  1285. * Network Communication - ICMP:
  1286.  
  1287. * Network Communication - HTTP:
  1288.  
  1289. "count": 1,
  1290. "body": "",
  1291. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1292. "user-agent": "Microsoft-CryptoAPI/6.1",
  1293. "method": "GET",
  1294. "host": "ocsp.digicert.com",
  1295. "version": "1.1",
  1296. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1297. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1298. "port": 80
  1299.  
  1300.  
  1301. "count": 1,
  1302. "body": "",
  1303. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1304. "user-agent": "Microsoft-CryptoAPI/6.1",
  1305. "method": "GET",
  1306. "host": "ocsp.msocsp.com",
  1307. "version": "1.1",
  1308. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1309. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1310. "port": 80
  1311.  
  1312.  
  1313.  
  1314. * Network Communication - SMTP:
  1315.  
  1316. * Network Communication - Hosts:
  1317.  
  1318. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!