API tools faq
paste
paladin316

Docs_554ae0b60388ba9b40ec29f74b84363a_doc_2019-07-11_02_30.txt

paladin316
Jul 10th, 2019
2,199
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 236.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "RTF.CVE-2017-11882"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_554ae0b60388ba9b40ec29f74b84363a.doc"
  7. * File Size: 267448
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "32423869bcc4023c1f7af8b735807da61cdc496d42563e6882a6a8f156372cc6"
  10. * MD5: "554ae0b60388ba9b40ec29f74b84363a"
  11. * SHA1: "6b468d95f22fb9ce40ca55f06c4d4ba32035fd6a"
  12. * SHA512: "5191f694cb38a2d6e2391eefa1e7cf53d4bd1cb39068f74dba7136929878b3eefb17e86f58c146b8ae369dbaca8cdcb3190c3db475831629796b6a903843efce"
  13. * CRC32: "D6FECA5B"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLeo8yBt/ii2mJ6ju55tqcBcj2RuDdKe3FJNC7Ds:sxxQW3yK17J4Fp98D3RjGrZYZPLBEl7"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 1756"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  33. "Details":
  34.  
  35. "IP": "69.192.108.32:443"
  36.  
  37.  
  38. "IP": "52.109.6.40:443"
  39.  
  40.  
  41. "IP": "65.52.98.231:443"
  42.  
  43.  
  44. "IP": "104.18.24.243:80"
  45.  
  46.  
  47. "IP": "23.15.4.26:80"
  48.  
  49.  
  50. "IP": "52.109.6.6:443"
  51.  
  52.  
  53. "IP": "72.21.91.29:80"
  54.  
  55.  
  56. "IP": "104.108.134.145:443"
  57.  
  58.  
  59. "IP": "23.15.4.32:80"
  60.  
  61.  
  62.  
  63.  
  64. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  65. "Details":
  66.  
  67. "ioc": "quations.dotx"
  68.  
  69.  
  70. "ioc": "ontent.inf"
  71.  
  72.  
  73. "ioc": "gosttitle.xsl"
  74.  
  75.  
  76. "ioc": "ist.glox"
  77.  
  78.  
  79. "ioc": "harvardanglia2008officeonline.xsl"
  80.  
  81.  
  82. "ioc": "pictureorgchart.glox"
  83.  
  84.  
  85. "ioc": "mlaseventheditionofficeonline.xsl"
  86.  
  87.  
  88. "ioc": "sist02.xsl"
  89.  
  90.  
  91. "ioc": "gostname.xsl"
  92.  
  93.  
  94. "ioc": "set.dotx"
  95.  
  96.  
  97. "ioc": "rings.glox"
  98.  
  99.  
  100. "ioc": "gb.xsl"
  101.  
  102.  
  103. "ioc": "ieee2006officeonline.xsl"
  104.  
  105.  
  106. "ioc": "e.gu"
  107.  
  108.  
  109. "ioc": "turabian.xsl"
  110.  
  111.  
  112. "ioc": "ccent.glox"
  113.  
  114.  
  115. "ioc": "rame.glox"
  116.  
  117.  
  118. "ioc": "rc.glox"
  119.  
  120.  
  121. "ioc": "nline.xsl"
  122.  
  123.  
  124. "ioc": "iso690nmerical.xsl"
  125.  
  126.  
  127. "ioc": "asis.thmx"
  128.  
  129.  
  130. "ioc": "content.inf"
  131.  
  132.  
  133. "ioc": "rop.thmx"
  134.  
  135.  
  136. "ioc": "avon.thmx"
  137.  
  138.  
  139. "ioc": "eathered.thmx"
  140.  
  141.  
  142. "ioc": "late.thmx"
  143.  
  144.  
  145. "ioc": "eadlines.thmx"
  146.  
  147.  
  148.  
  149.  
  150. "Description": "Performs some HTTP requests",
  151. "Details":
  152.  
  153. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  154.  
  155.  
  156. "url": "http://thecoverstudio.com/modules/jmsslider/views/img/layers/app/gorwxf.msi"
  157.  
  158.  
  159. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  160.  
  161.  
  162.  
  163.  
  164. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  165. "Details":
  166.  
  167. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01&\\x96\\x84\\xde\\xfa\\x1e\\x95x\\x07\\xbak,\\xd0\\xf7\\x86di\\x84\\x07h\\x08\\x99b\\xeai\\xa0\\xfe\\xf6c\\x95\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  168.  
  169.  
  170. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\x0b\\x83.\\xf1gvx\\xfaj\\x9b\\x05s\\xe0i\\x983\\xcb=0\\x89\\xbbm\\xfa\\x84\\x96vw\\x93`\\xf1\\xe9\\xb57-\\xc6\\xcc.z\\x9ft\\xbe:\\xb9\\xbf\\xb7z\\x19\\xde\r\\xb9\\x16.kr\\xb4\\xb1\\xe2\\xa9\\xba\\xd0dn\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xd4m\\xa8\\xaf5\\x98\\x82\\xdd\\xbb=h\\x19^\\xa6\\x07\\xc7\\x0f\\x8b\\xffv\\x04\\xe9j\\x98o\\x82\\x8e\n\\xd5\\x91\\xd1\\xb7zw \\x95\\xb0(\\x81q\\xd38*\\xd1r\\xdf0"
  171.  
  172.  
  173. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  174.  
  175.  
  176. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  177.  
  178.  
  179. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb5\\x18\\xe0\\xb8)\\x0e?\\xd9\\xd5f<w\\xbcu\\x8bm:\\xeaj1e\\xee\\xe9tx\\x02(\\x80\\xf8\\xc3\\x12\\xcc:c\\x8c.\\x8eh\\x81\\xb2\\x99^\\xf3\\xc7\\x8b\\xba1\\xb3\\xf8red3\\xe7\\xefa'\\x96\\x9b\\xe8s\\x99\\xaaefn\\xdf\\x88qc\\xda\\x86n\\x8c\\x0e\\x82\\xc0w\\xd8q7\\x91\\xa5`\\xd8\\xdb\\xb6`/\\xae\\xef45\\x9cx\\x05\\xecz\\x1e\\x8d\\x0f\\xb9h\\xce\\x9f\\xf1\\x8c\\xb1ok\\xff\\xf6\\xd3\\x9dme\\x15\\xe7\\xd3\\xd4\\xf0^\\x7fq\\x92\\xc5z\\xc1\\x19\\xc9\\xb26\\xba\\x8ec\\xc6\\xe1\\x10\\xbf\\x14\\x1c\\x9d@\\xc9\\xcf\\x14\\x8b\\x99\\x19\\xad\\x01\\xdb\\xfc\\x84\\xaeb\\xbf5\\xa6\\xa4(\\xb4\\\\x88\\xb7\\xdf\\x01c\\x9b\\xce\\xe0\\x17\\x80@\\x8as,\\x0b\\xc0\\xb8y\\xe9\\x00\\xc6\\xea\\xe6c\\x94\\xe3q= \\xd8\\x02\\x82hov0q\\xab\\xb7#+\\xb95\\xd3\\x03\\xd6:\\xd7\\xf5\\xb2\\xd3\\x98\\x18\\xd0%5\\xc7g\\x16g,\\xa4\\xf1\\x10\\xbfo\\x87\\xff\\x9d\\xe8\\x05\\xec1q\\xbe\\xc6\\x03\\x837\\xb5-v\\x88\\xa5\\x0f\\xd6t/"
  180.  
  181.  
  182. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x10$*\\xbb/\\xb7\\x10!\\xee\\x9b\\xa6\\xa5\\xb1\\xe2\\x95\\xa8\\x80\\xb6\\xb4\\xe9\\xe9\\xe8w\\xad\\xfc\\x91\\xdb\\x0c\\xa0\\xd1\\xe8\\xd4\\xdd\\xecw8\\xc7x\\xf6\\xc4\\x84'\\x9e\\xe2\\xef+\\xcd\\xee\\xb8u\\xb3ok\\x1f\\xca\\xd3\\x82\\x19~xs|\\x96\\x8d\\xbce\\x0bv\\xb9\\x1d\\x9e\\xa8r\\xe8\\xac\\xf5\\xe1v\\xdf\\xb1\\xea\\xb9u\\x91\\xa1\\xe6\\x89\\xc7f\\xf4\\x0e\\xa4\\x9c\\xc1\\xa5\\x92\\xae\\x9cgf\\xbav\\xfe(>wi\\xb4<1\\xe1!\\x8d&\\xfb\\x0cv|.\\x93\\xf7i\\x1a\\xa0\\x04\\x07\\xa6\\xab\\xd6?\\xab\\xc3\\x1d\\x8d\"\\x90\\xab\r\\xc5g\\x9f`\\x99\\x97\\x0e\\xe7\"\\xd2f= :\\x08\\x84,l\\x90d\\x8e\\x94\\xd5\\xa6\\x14v\\xea\\xcc\\xccd\\x90\\xb2\\xc7\\xf7%yo\\x0b\\x8az..c\\xe1!\\xaa\\xc7ez4\\xf00\\xa1eu\\xaf\\x0f\\x01\\x89\\xc8\\xc9\\xff\\x84\\xd54w\\xc6\\xc5:\\xdd\\xb8\\xde?\\x83\\xd8\\xebm\\xeb\\xfb\\xe9\\x96s=w\\xad\\xe2\\xd6\\xce\\xc4s#\\x9d\\xc92\\xed\\xa6(\\xe2\\xeb\\xfa\\xa8\\xbf\\xda\\xee~\\x8c\\"
  183.  
  184.  
  185. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01&\\x96\\x860\\xb2\\xb9-^\\xca q\\xf2\\x99\\xdc\\\\xcbb\\xdb\\xd0a\\xb0=_\\xed\\x05\\x94.s\\x07\\xb0\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  186.  
  187.  
  188. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xd1\\x19_r\\xd8;#\\xc1\\xa1\\xf5\\xd25\\xc2q6\\xd7\\xfb\\xa6\\xc6\\xd1#\\xda\\xbah~r\\xf3@x\\xd8e\\xaf\\xcd\\xf2\\xf4\\xc3\\x8b\\xc6q\\x00\\xf0\\xa0\\xfee\\x9f\\xe5s\\xbc\\x83\\xeb\n\\xae\\xae\\x12\\xbe.\\x9a\\xbbe\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xfb\\xfb\\xa6\\xe67\\xcd>\\xc9\\x1e\\xb9f?f\t\\x8e\\x9b \\xd0q\\xea\\xe6\\xb1\\x87\\xc4j%\\xd4\\xfff\\x85z\\xa6;\t\\xe1\\xad6\\xc82\\xde\\xb0\\xbb\\xe8\\xc0\\xe5\\xc4a"
  189.  
  190.  
  191. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x08\\xaf#pu\\x880\\x11\\xc1\\xf2\\xd1e\\xf0q\\xbf\\x1f7w\\x97\\xce\\xc44z`\\x1cc2r\\x1c\\xa5\\xa5g\\xc1\\x90p\\xd7\\xb4\t\\xea\\xd2y\\x9b\\xb0\\xcb\\xfc\\xcb\\xfd<i\\x9e\\xb86\\x9da_j\\xea\\x05\\x8f\\x0f\\xbc\\xb6%\\x7f\\xe3@o\\x0by\\x0b\\xeds\r\\x80\\x1c\\xdf)\\xc8#\\x99\\xd1p\\x0b\\x9b=\\xc84\\x01d\\x13:re\\xdc\\xb7\\xde\\x97q\\xfd\\x17\\x0c\\xe59+\\xeb\\xd0\njv5\\xa2\\x01\\xb3\\xe4z\\xae\\x18\\xc2\\x88\\x9e\\xbd\\xc7\\zr\\xc6\\xf8\\x05\\xb5\\x82\\xa0@@\\x8avtw\\xf5\\x92\\xd0\\x17\\x84s\\x0f\\xbd\n\\x8e\\xd3c\\xe1\\xd3\\x12\\xd3\\x04e\\xe6\\xedu\\x14\\xa3\\xfcc\\x8b\\xa4)\\xf6p\n\\x94e\\xa9\\x14\\xd8\\xdd8\\xacb\\xfd\\x02^\\x89\\x18\\xb1\\xa1\\xdc\\x1bz\\xa0o\\xbc\\x0fbb\\x87\\x9ac\\x04`~\\x18t\\x81\\xe9\\xc0\\xc3\\x9d\\xa3\\xd7\\x9c\\xcc\\xad\\xc9\\xb2\\xc9w\\xe9\\x8a\\x92\\xd6\\x05\\xb6yp\\xdb\\xc9\\xd9\\x17f\\xed>2\\xd90z\\x96\\x9f\\x8a\\xa8\\xf1\\x0c\\x9du\\x15\\xe1\\xa6\\xfc"
  192.  
  193.  
  194. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01&\\x96\\x88\\x80\\xb0\\xc2\\x99\\xe0\t\\xb1\"\\xbc\\x8f\\xde\\xb96v\\x19\\xd1\\xce\\xac\\xdbx\\xba\\x08$\\xf0\\xa6\\x80\\x81\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  195.  
  196.  
  197. "http_request": "winword.exe_WSASend_\\xd6\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05\\x18\\xc10d\\xe0\\xb5\\x1c:w\\xe2\\x90e$\\xcbg\\x19\\x90\\x9d>o\\xca\\xa2\\xfe\\xac\\xe2\\x86\\xd9\\x0b\\x83\\xd98\\xea\\xff\\xb3<\\xfc\\x89rnp\\x05=b'\\xba\\xd3\\xc0k\\xb8\\x08\\x8bn\\xf6\\xf1\\xec\\x80\\x97\\xa9\\xe6\\x05\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85u\\x18+\\xc1\\xdf*\\xa3!\\xa6\\xd5;t\\xa1\\xa3\\xb3\\x89!\\x84\\xca\\x8ei,\\x03\\x9d\\x124\\x17>\\x87+\\x7f\\xb1\\xb5\\xf9j\\xc3\\x1b\\xcal\\xde\\xb6\\xbc\\xda\\xbd\\xf8\\x9f"
  198.  
  199.  
  200. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pp\\x91\\x99dw\\xf2\\xd7\\xca\\x85d\\x81\\xac\\x95\\xc3\\xdd\\xd3\\x8ak\\xb6\\x9b\\x19l\\x92w\\x07\\x16\\xfa\\xe2\\xc5\\x1e\\x06an\\x92\\xf76\\xaeg\\xca\\x89\\x9f\\x9b\\xf9\\xfc\\x19\\xa3\\xfb\\x19\\xbaa\\xb9\\xdd ;\\x03\\xefe\\xef\\x0c\\x83\\x01d\\xd8\\xdd4\\x04\\x98\\xbd\\x8do\\xefzfa\\xb6\\x063\\x8f\\xb2\\xb9\\x91\\xaa\\xe2 r)kj\\xf4g\\xb6\\xbc\\x91\\x80\\xbf\\xd0\\xef?^\\xd9\\xf2\\xc0\\x92\\x85\\xaf!\\xc10\\xb4j$fi\\xa7\\xdct\\xe9y\\xa2r\\x08a\\x9cc\\xd1$w\\x02\\x1be\\xce\\x9f\n$\\x08\\x99\\xf7\\xd1.\\x04b\\x06\\xc3r8'\\xeb= \\xcb\\x1c\\xf6\\xb8\\xef\\x01\\xdd\\xa1\\xf3`\\xee\\xa6z;\\x1ei\\x0ew\\xc5\\xe9s@;\\xb6\\xb4n\\xe8\\xd4\\xa9\\x9d\\xa7\\x04\\x9f\\x89\\xf4\\xe1o\\x08\\xb1\\xae\\xc5\\x06\\xd5w\\xb3j\\xb7zan\\xb4\\xc6\\x9d\\x91\\xbe\\xac\\x13\t\\xf9\t\\xf9s\\x9c\\xd1\\xff0'\\xd6g&\\x15\\x86\\xff\\xcd\\x9e\\x97d\\x9a\\xad\\xbc_\\x93et\\xf4ds\\x83\\x87\\xe2\\x90\\xb8"
  201.  
  202.  
  203. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89>\\xe3\\xf3\\xf6\\xf9^\\xc3h\\x88\\xf3\\xb4\\x94\\x10\\xca\\x03\\xf1 pt\\xaf\\xdf\\x1b\\'n\\xdfrf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  204.  
  205.  
  206. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89hh\\xe6-\\xa2\\x13\\xe1\\x9a<\\x18\\xcb\\xeb9y\\xf4\\xab?ew\\x11\\x9b\\x00\\xa2/\\xad\\xccb9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  207.  
  208.  
  209. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89c\\xbcest\\x81\\xf5\\xfe\\xdb\\x9b\\x08\\x03a|\\x1c\\xe0\\xbb\\xdf\\x8e\\xe4\\x93\\x1b\\xc7\"\\xef\\xc5q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  210.  
  211.  
  212. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x16,\\xa9\\xdcu\\x8d\\x0b\\xc9\\xd2\\xa0\\xa50 \\x1f\\xf7\\xf0\\x0b\\xc2s\\xa9\\xb9\\xc0\\xd5\\xfe\\xfc0y\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  213.  
  214.  
  215. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xe7\\xc1m@\\xab\\x88=2d^d\\xd6\\x95\\xb2'\\xf2\\x93pd7\\xef\\xbd\\xb0\\xf1\\xf8\\x93\\xed\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  216.  
  217.  
  218. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89>\\xb7\\xd7\\x90\\x83\\xfe\\xb2\\xaf\\xa6m.\\x04\\xbb)\\xa9s\\x84\\x10k\\x96\\xef\\x99\\xf1\\xb5\\xad\\x1e6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  219.  
  220.  
  221. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xdc\\x02d\\x19\\x81*3\\x87\\x06\\xfa\\x85wrj\\.x\\x1dh~\\x1f\\xa4\\x96c\\xaad\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  222.  
  223.  
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9f\\xd2\\xa0\\x08\\xaa\\x99\\xfc\\xea`\\xddy\\xbc\\x83\\xe5a\\x93\\xdd\\x80\\xa1l\\x84\\x00\\xc1\\x02\\xfe\\xd2(/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  225.  
  226.  
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\"\\xda\\x8b,\\xe9r\\xa3\\x91\\x0e+\\x06\\\\x92\\xf08\\xf5d\\xdf\\xdd\\x01'\\xd1\\xdd\\xe1;\\x8c\\x96\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  228.  
  229.  
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xf0\\x9e\\xa2\\xac\\x1c\\x97\\x8a\\x90\\xc3\\xd5fx=\\xa1\\xa37\\x9c\t\\xec_\\xe6\\xdf&\\x80o\\xc2\\x1f\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231.  
  232.  
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xb8\\xcd\\x95\\xbefeh\\xf3\\xc9#\\x90\\xdfw2\\xd6\\xf1a\\x1f\\xd5\\x15\\xddv\\xc34\\xcd\\xf8\\xc09\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234.  
  235.  
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xa0g\\xf3rt\n\\x98\\xc5l\\x94\\xb3,t\\xf5n\\xb0\\x14\\xf5j,vr\\x9eser7b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  237.  
  238.  
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x892\\xa2e\\xc2\\x18\\xaf\\x18\\x19y\\xf5ga\\x00h5\\x9e\\x08\\\\x07\\xdcz\\x99sg>y\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  240.  
  241.  
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89d*\\x02g\\xc1\\x815:\\x9c\\xd5\\xebcm\\xe7c\\x80s\\xa9a\\x01\\xd5\\xc6:\\x8a\\xd8\\x9f0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243.  
  244.  
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\tz\\x98\\x07un!ez\\x17mb\\xb6\\x95\\x1c8\\xd3=\\x83s\\xe7\\xec\\xf1\\xe4\\xb6d\\x91\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  246.  
  247.  
  248. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xbb\\xb4f\"\\xfe\\xea\\\\xac\\x10:h\\x0c\\xdb\\xd8f\\xaeq4\\x05\\x94\\xefa\\xd9\\x95\\xa4\\xd1\\b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  249.  
  250.  
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xb1\\xc3\\x88\\xa7\\xa6\\x00~\\xc4:\\xb1\\xd7\\xca \\xc0f\\xd2\\xcd&\\xfdc\\xd7\\xdf`g\\xb7\\xaf\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252.  
  253.  
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xff\\xe6\\x1d\\xc0i\\xc4\\x13\\x8a\\x12\\x11\\xc7\\xa8\\x9a\\x91o\\x105\\x0e;b\\xfb\\xc6\\xd5d\\xba\\x94\\xbb_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  255.  
  256.  
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x0b\\xd4\\x85e*\\x1dom<\\xd8\\xdc.\\x97\\xe6\\x80o\\xdf\\x1b\\xb5\\xc1\\xe6\\xb2\\xccm\\x126\\xb1^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  258.  
  259.  
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x93\\xb6\\x82\\xd6~\\xe9\\xd9\\xc0\\xacd\r\\xc5\\x87\\xfd\\xfd1\\xb8\\xd6\\x013\\x94;/<\\x11h\\xa4\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  261.  
  262.  
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x1d\\x8ex\\x9a\\xd3\\x0f\\xf2\\xfb\\xa3\\x99)@\\x9a\\x969\\x8c\\xd6\\x93\\xb2\\xdc\\xb9\\xb1\\x9a\\xd0\\xa5z\\xca@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264.  
  265.  
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9b\\xa6\n\\xaa\\xe9\\x05\\xa5\\xadhg\\xdd\\xea\\x0b\\.\"\\xa6\\x96\\x89_\\x14a\\xfcr#p'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  267.  
  268.  
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9a\\x07\\x17\\x1a\\xcc(\\xd6%\\x80\\xee\\xcc\\xa3\\xe9y-\\xe8\\xe8\\xad\\x8a\\xca\\x8c\\x08\\xbfl\\xb9\\xe6\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270.  
  271.  
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x19;veo\\xb2\\x17z1\\x9a@\\xf1v\\x96j?\\x8f\\xe7\\x85yy\\x8eb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  273.  
  274.  
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xb9\\x9de\\x89\\x856\\xa4\\x84\\x83\\xf2\\xa9\\x05\\x1f\\xaaw\\xb3j@\\xa8\\x10k\\xd8\\xff\\xf2\\xb7\\xfa\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276.  
  277.  
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9e\\xf2\\xb0bm\\x9e\\xe4\")\\x9d\\xd7\\x84\\xd8\\xb5\\xd5\\xea\\xc3\\xea.\t\\xb7\\xf6p\\xfb\\x10\\xb6\\x00\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279.  
  280.  
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89y\\xae%h\\xb6\\xac5l\\xcd\\xa6\\xbf8\\x17\\xf1)\\xf0\\x1du\\x00z\\xe7>\\x0f\\xff=b\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  282.  
  283.  
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89f\t6\\xa2\\xd5ots\\xd7\\xe5\\xe3\\xa3\\x16^\\x15\\xef\\x07\\x7f\\x1f\\xd0\\xe4\\xf5\\x08a\\x8c\\x0fd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285.  
  286.  
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x99q\\x89\\x97\\x17^\\xc7n-\\xd2\\xd5\\xf1\\xeda\\x007js\\x82\\xa39\\x87\\xf2\\x1f-\\x8d\\xcf=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288.  
  289.  
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xce\\x91\\x8e\\xb1\\x9e\\xf0q\\xc2\\z\\x82\\xd5\\xfe\\x13\\x1d\\x15\\xa2\\x0e\\x163\\xf6\\xa4\\x05\\x99\\xad_\\x82o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291.  
  292.  
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89a\\x94/u\\x8f#0\\xdc\\x8d\\xe2x\\x1e\\x88\\x16s\\xe6\\xb5va\\xe2\\xf7\\xc3f\\x95\\xce\\x19xg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294.  
  295.  
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89an9-\\x9d<z\\x15\\xd1\\xfda\\xf8r\\xa1\\xc9\\x87$\\xe5\\x9bo\\x14\\xe8\\xaf\\x04\\xfe\\x87\\xeew\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297.  
  298.  
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xdc\\xfaj\\xa3x~\\xfc.n\\xec\\x9d\\xfc\\xd3n\\xc4e\\x9c\\xb5%\\x1c\\xa7@\\xb9\\xefm\\xa1\\xca\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300.  
  301.  
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ri\\xbb\\xf0\\xf4k\\xc4\\xfe\\x00\\x81\\x82\\xb8r\\x87m\\x12\\xed\\x14j\\xd8\\x838\\x14\\xa6\\x9a\\xd1\\x98\\x95/\\xdf\\x8e\\xe9\\xb9\\x18\\x89\\xc6\\x1dxx@\\x07\\x00\\xd5/q\\xdbj|\\xaa\\x97z\\x08\\xd4\\xf70\\xd4>\\x88k\\x83v\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18p-4\\xb76<\\xc5=\\x80\\x8e\\x8b\\xe3\\x88\\x0f\\x89~\\xd7;o,?\\x117t\\xf4\\xbb\\xb1\\x12\\x18h\\xb8\\xd8\\x109\\xaa\\x1e_\\xad\\x18\\x0ft\\x8b\\xba\\x89\\x0b\\x06"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89s\\xa3\\xb1$e\\xbb\\xf7o\\xa6@\\xad\\xaap\\xd6\\xec\\xf4\\x8d\\x7fy\\xc0\\xc4\\x05|\\xfbw_\\xae\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89u.y\\xe8\\xc20\\xf0\\xd9z\\x92l\\xbe\\xc3\\x96\\xd18\\xae\\xb0t\\x19e\\xe0\\xf1\\xe5\\xde\\x82u\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xc3\\xc8\\xa7\\x1cg\\xe1\\xee\\x10\\xe9\\xdd$\\x9a\\xd4\\xc5\\xa8ac9\\x0e\\xc4\\x83d\\xcb=\\xb0-\\x82w!\\x9dfk\\xa8z&3\\x1f \\xce\\x88\\xd6\\xb9\\xef\\xd6p\\xd8\\xed\\xbe\\x98\\xf4\\x84\\xcf\\xe2\\xf0>\\xe9w\\xa5\\xe3\\x7f\\xb1\\x0e\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xbb\\xc3\\xc3w!\\xdb\\xeb\\xb5*\\x12\\xc9\\xa5~\\x16\\x8c\\x1b^\\xaa\\x00\\x936\\x0bw\\xd9wn,\\xf5h\\xafh\\xe6|\\x01\\x0f\\xd1\\xab\\xa6\\xf9\\x8ep\\x8f\\xa3\\xd8i"
  312.  
  313.  
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\x061\\xd3\\xbb_\\xc1\\xb8\\xdb\\x00rk\\xcb\\xc3\\x06\\xcb\\xdd\\x95j\\xae_\\xaf\\x9aj$\\xd7n\\xe1\\x85\\xbfgu\\xd0\\x8bi\\x99\\xb9\\xd0cl\\x81\\xec\\x05ob\\xc6\\x1c):'\\xe8\\xb9\\x06\\x15#4\\x9ec\\xa9\\x91:k\\x9d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa96d\\xcf\\xfa\\xea\\x16\\x1d\\xe0\\x96\\xb8\\x89\\xc4\\xd1\\xe9\\xad\\x16\\xb2~\\x9c\\x9e4ed8 o\t\\xafrb9\\x9b\\xf7\\xfc.h\\x08\\xca~:\\xcf\\xf3m\\xc2"
  315.  
  316.  
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7v\\xa5\\xbcb\\x10\\xe9\\x93\r\\xf8!\\x04\\x18c*\\xfb\\x0f8\\xaf9\\x03\\xf8\\x8b\\xa1\\xf9\\xbc,\\xd8\\xcf\\xc1jx\\xd4\\x1b\\xd2\\xaev\\x9d^\\xb0yo\\xbf\\x05\\x83\\x19\\xc88\\xddt\\x18\\xa0i\\x0c\\x82\\xf7\\x80\\xb6\\xaf\\xdf\\xa2\\xa4|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=_0\\xc2\\x19\\xd0\\x9a\\xbc\"\\xe3\\xab\\x1f\\x9a:\\x85\\x06\\x1a\\xe4\\xdb\\xb7\\x97\\x96\\x0fgx\\xfe\\x0fv\\xa7.\\xaf\\x92\\x97\\xe4\\xbaa\\x14\\x1ek4\\xba\\x07\\x9d\\xec`\\xab"
  318.  
  319.  
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\x82(\\xfd@\\x88\\xb0q\\x97\\xc62\\x05\\xee\\x19\\xfct\\xd1`|m\\x8d(lv\\xebi\\xda\\xf1\\x02v\\xabr\\xccl\\xa7k$y\\xec\\x87\\xa9\\xab\\xbf\\xd1\\xefs)\\xca?\\xe4\\xab\\xddl\\xf1c$u\\xa1xd\\xfd\\xcd\\x8f\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7 \\xce$\\xd1\\x15\\xa8m\\x93\\xf2\\xdbu\\xf3g=e\\xe8\\xab\\xea\\xcb\\x8af;\\xb7o\\x05\\x15\\x99\\xfa\\xc9\\x15\\x8f\\xb7h\\xddlp\\x0c\\xd5\\xef*_\\xbb\\x03\\x07"
  321.  
  322.  
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048q\\xb4_sd\\xaam\\x8b`\\xc8o_$\\x19\\x99\\xfb\\x96\\xdf\\x03\\xd7\\x99=\\xb9\\x90;\\xd8\r\\xbf\\x14\\x9f\\xa7\\xd8@n\\x83\\xca\\x0b\\x10\\xa6)_8\\xcf\\xaf\\x14\\xb9$*\\xe5\\x9e\\xde\\x17\\xdd\\x00\\xc4\\xae`yf\\x99\\xfb\\x0b\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001\\xee\\xd3\\x9b\\xad\\xc2\\xbat\\xf8\\x9aa\\xe6\\xbfn \\x07\\x05.\\xdf\\xd6\\x9a\\xfd\\xa6+p\\xe5\\x1eni\\x11\\xfdm\\x9ad\\x80*\\xfa&\\x06%l\\xa8\\xed!\\xe8\\xa8\\xe7\\xd7"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\x92\\xb858\\xb78\n\\x89\\xdf\\xe2\\xca\\x98utcim\\x7fk@\\x8e\\xd1\\x98\\x1b-\\xf5\\xdf<\\x9b\\xc3\\x0ba\\x07\\x99\\xea\\xd2\\x9cu\\xf3\\x82g\\xb0\\xa6\\x84\\xfd\\x88\\xe2\\x8a=gh\\x00\\x9b'\\xb9j!\\x82\\xb2ki\\xb4\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(o \\xc2%_\\x87\\xf9\\xb7\\x9c\\xe2g\\xc24\\xaf\\x85\\x90\\xa0o\\x9df\\x91\\x1f\\x7f~\\xda\\x81\\xb2p\\xa4l\\xf6s\\xa2r\\xdf\\xf0\\xbd\\xba5|\\x18h1\\xd4\\xe1\\xe1"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x1cd\"\\x8e^\\x04\\xcf\\xbc\\xdelb\\xcd\\x95\\x06\\x9b\\xa6+xz\\xe5\\xec!.\\xc7\\x16b\\x97e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xbd\\x0f\\x032\\xd9$\\xe4#b\\x87\\xcc=\\xcd$\\xad\\xf2d *\\x10\\xdb8\\xd4j\\x8f\\x10bp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x1f\\xa9g\\x97\\\\xad\\xe3r\\x1c\\xa8\\x83\\x13\\x02qy#\\xce$(\\x9f\\xe2\\xdfp\\xb9\\x8e\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xb5ku\\xe5\\x8c\\x9d\\x94\\xb8v\\x89\\x97r1\\xc7n\\xe1bd\\x18w(z\\xa06\"\\xa6\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x1f\\x13\\xd3\\xf4\\xb976f\\xf8>\\xa4<\\xea\\xf5g\\xfe\\xe9l;|b\\xa9\t\\xf6\\x0fgi\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xf1\\xb8\\x85\\xe8\\x89\\x96z\\x84\\xe73\\xb8\\xc3\\xf5\\x95\\xdc6\\xb0\\xac@\\x92\\xaa\nv\\xd2\\xe7d\\x91g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x80p\\x1ei\\xb5\\xad<\\x8a\\x93\\xb8\\x97^\\xeb\\x18\t/<\\xab.\\xbf\\xa4\\xa6\\xaa\\x82\\xea\\xa7\\xf7i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9f\\x94\\xfc~\\x9b\\x1d*`\\x9fd\\xc6vd\\x0e\\xee\\xa0~=\\xfd\\xd5\\xda\\xfc\\xf6\\xbe\\xee\\xe0\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x8cp(<\\x89z\\xe7a\\x1b\\xbaex\\xb8\\x81k\\x03j\\x15q\\xbd\nu\\xf3w\\xfa~\\xd38\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89f\\x9d\\xad\\x9a0npc<\\x93\\xf7(\\x11=~\\xd5\\x07\\xd5\\xe1\\xaf\t@w=\\xe3$;\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x89\\xec\\xa9\\x89\\xf6\\xe3\\x10\\x8dz\\xe5\\xb5b\\x1a\\x9c\\x89\\x8f\\x87\\x94\\x16\\xe0x\\x11\\xf7\\xd75\\x1ek\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\xbe\\xe4c\\x87\\xd7r\\xc1\\x0b8\\xc5lil2\\xaf\\xdcwn\\xfc%\\x00\\xd5\\x0e\\xe1\\x9b\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x9c|\\x15\\xed\\x15~v\\x8c2\\x9e\\xden\\x85a\\x9f\\xe1,\\xdc\\xdc\r\\xbb\\xa9\\xb0\\x9f6\\xa6t\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89\\x8fu\\x8a\\x95\\xcc\\x8a\\x0b\\xe9\"\\x97a\\xbe\\xfb\\xa6\\x16\\$ \\x9f\\\\xbc\\xf1\\xf2\\x87r\\xe6g\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89d%;\\xde\\xfb\\xe7?\\xde\\xc66\\xe6h\\xdcej4\\x8b\\xf7\\xf6rjn\\x9fd\\xfd\\xa57\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x89me\\x1d\\xda\\x8a\\xf1\\xbfb\\xe4z>k\\xb7yy\\x0c\\x19\\xaem\\x91f\\xa0\\x82\\xeb\\x0c\t\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bz\t\\x8e1\\x19.\\xa4\\x8f\\x82\\xd0\\xeb\\xf7\\xac \\xceh\\x0fa\\xe9\\\\xe9\\x7f\\xc0\\xa4\\xdb\\xe8\rv\\x19\\xed\\x9e\\xbf~\\xb9\\x1f'1\r\\x9d\\xe7\\xa5#\\x13t\\xbf\\xc3\\xb9\\xf3r\\x1bm\\x9f\"\\xb6_\\xe5\\xcbd\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xaet\\xd2\\xf2f\\xd8m\\xe3\\x8a\\x87%/\\x16\\xfc\\xa5\\xb1fiy\\x03\t\rw\\xfd\\xc9\\xb5\\xa1\\x11'^v\\xf1!g\\xaa\\xfc\\xa4\\xf0\\x8e\\x95\\xe2\\x8b\\x82\\xd4\\xd8\\xc4\\x03"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\xe3\\x11\\xb6\\xf8@\\xa1\\xa5n\\x18',\\xe5\\xac\\x13\\xc7a\\xc8\\x9d\\xde\\x81\\x11\\xf3\\xb2\\xf2x\\xf0w\\xaeplr?\\xa07o`\\xd2\\xf1\\xad\\xdb/h\\xeau\\x9df\\x04\\x11\\xf0\\xd7\\xe2k\\xfc)\\xd4\\x9e\\x86\\x13\\xa6\\xc7\\xfad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\xb7\\xe7\\x84\\xc0n\\xab:\\xf2q\\x9d\\x87\\xd9\\xa7n\\x18\\xe9\"\\xce\\x9b\\xed\\x8d\\x80\\xe4\\xa5\\xa2\\xc4\\x8c\\xe8'w\\xb3\\xd9\\xbd?\\xa0\\xfbq\\xed\\xd5\\xe2'\\xce\\x91\\xa1"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x8a\\xdf\\x93-p\\xbes*h/:\\xd9\\xe9\\xfa\\xb2\\x9b\\xdbg\\xb3\\xee%a\\xa1\\x8cps\\xc0\\xfc~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xd2%\\xff\\xdc\\x88\\x8a\\x8a<tq\\xb6\\x15\\x91:\\x923\\xe3c\\xd59\\xc2\\x1b28\\xf9vn\\xf1\\x03\\xbe:\\xdc\\x97\\xe9\\x8c\\x13o\\x80\\x95\\xc7\\xb8b\\x01\\x1e\\xe5h\\x8e\\xa7@\\x81\\x98\\xfb\\xd2\\x12\\x82s0\\xd8o>\\xc3k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\xbf8\\x95\\x95k\\xacj<yj\\xca\\xed\\xcdo\\xb8\\xc5\\x1a\\xc7|3\\xed\\x15m\\xb5:\\x7f\\xa2pp\\x01\\xf8\\x90\\xb6\\xe6\\x9du\\xb3\\x80j\\xe1\\x94\\-@\\x0e\\x07"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xe8\\x00\\xb1\\x98\\xe8\\x0c\\xeeec\\xdf\\xbe\\xc3\\x04-v\\xab?\\xa2>\\x84\\x89^\\x87%\\x00\\x03\\xcc\\x97\\x92\\xfb\\xb2\\x9a=\\xacbc\\x88k9\\xf0\\x02\\x1c+j\\xf3v\\x10ehlso\\x15\\x12qe\\x17\\xc6\\x93\\x9e\\xc7(\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\x8a7\\x04%,\\x9b\\xe0\\x7fr\\xac\\xcc\\xb8\\xc4\\xaf\\xbf@\\xf2\\xc1\\xe7a\\x15\\xbe\\x9bd\\xe9\\x16\tk\\x0b\\xbej\\x14w\\x91\\xa6\\x0c\\xb1\\xe5\\xd3\\xf8<1\\xcb`a\\xda"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xf4\\xf8\\xe1\\xd3\\xf6\\xcc`\\x08\\xf4\\xb3\\xa8\\x95)\\x0e\\xc4\\xd9\\x9fk\\x80\\xebdm \"\\xaa\\xf0\\x1c*\\xd5\\xa04\\x86\\x86\\xaf\\xf5\\xce\\xcaage|\\xf3\\x91\"\\xed\\xd4\\x8f+\\x1f\\xbd\\xa2\\x84\\xeb##s\\xf3\\xde\\xe0\\xc6^\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14\\xeb\\x9a\\xb8\\x15\\xe4h\\xf3\\x91\\xe8&\\xa5\\\\xc00\\\\xe18\\x05\\xa2\\x02\\xc4\\xea\\x98em\\x94\\x99* h\\x00\\xad\\xc0\\xa5\\x1e\\x8a\\xaa\\xa6\\xaf'\\x82!\\x7f"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7^lid\\xda\\x98\\xde.2\\xf0\\x149\\xa2\\xae\\x84\\x98\\xf1\\xb9\\xf7w\\xf1dv\\xf1\\xc3mfi;,$\\xab\\xddhy\\xf0@\\x00b\\x06\t\\xba\\x0b\\xd8\\xcb\\xeab9\\@a\\xae$ \\xb6\\x0e^\\xde\\x14;\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xfa`\\x8b\\xaf\\x02\\x92\\xe3\\xc2#\\x15\\xd7\\xde\\xf2`\\x02\\x05m\\xc1\\xdb\\xe8s\\xac\\xdep\\xe2\\xdd\r\\xc9\\xcb\\x8fd\\x99\\xebm\\xe3y\\xfa\\x88a\\xfe:\\xea\\xf3!uh"
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\xa3\\x84\\xad\\xed\\x98\\x89\\x18?:m9q\\xc3\\xd1ec\\xd2\\x83\\xae\\x03t\\xed\\xfe#\\xc5\\xdee\\xf5\\xb3\\xb1\\xb0\\x9b\\x08\\xfd0\\xaf\\x99\\x90-\\x8a\\xdd\\x10\\x1ax\\x98\\xc2sb\\x85\\x19\\xc9\\x1f\\x9a\\xc5\\x9c\\xc5\\xa4\\xd4\\\\x12\\xa2\\xad\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x94w\\xb0\\x0bp\\xd8u\\x1a\\xdf\\x86k\n\\xa5b=\\xfe8\\x01\\x96\t\\x86m\\xb6\\xe0 \\xa0\\x16\\xaf\\xb0\\xbc\\x1d\\xbfa\\xb1\\xe3@\\x9a\\xd9\\xf6\\x8f_\\xe6)\n4\\x93\\xd5"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04xnx\\xab9\\xb7\\x12\\xae\\xd4\\xb9t\\xfa0t\\x1a\\xe0\\xbd\\xc9\\xef0\\xe2\\x96f\\xf6\\xd7\\xe4\\xab\\x05\\x7f\\xe0+\\xfc\\x13\\xf4\\xee\\x02\\xbd\\xdb\\xcd\\xd5\\xc9\\xa8s\\xebe\\xcfy\\xe4\\x13\\xa3c\\xbb\\xeap\\x05\\xa0\\xd2r1fs=\\xe5\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\x0f\\xa8\\xa4\\x82\\x84pv\\x1d\\xde\\xa5\\xe3`r+0\\xd7+\\xads\\x8d%\\x1d\\x81\r\\xd5\\x12\\x1ew,9e\\xad\\xa1bq\\xfe\\x92\\xbcc%\\x97i\\x88=e"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048$\\xbbt\\x16\\x88\\xfbb\\xfd\\x9a_b\\x17\\x95f\\xe7\\xd0!en\\xe6j\\xbbm1j\\x87\\x994.\\xa9\\x90\\xd9\\xa2\\xbf\\xf1\\xc93\\x9a\\xb2\\xb0\\xbbe\\x10a\\xf0y\\xe7g\r\\xe3\\x9c\\x9ct\\x80\\xd6:|\\x94\\xb0x\\xf6\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\x0f'\\xe1\\xa3yb\\x01c\\x99*\\xfb\\xdc\\xa9\\xa1\\x95\\xbdmqz\\xc6\\x0f\\x88\\xc4\\xd3\\xcd\\xb4\\x9c\\xd0\\xc9$?\\xfb\\x97\\xc8\\x18\\xcc\\x82\\x9b\\xe0\\xa4\\xb8xf"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2e\\x96q\\xda&\\x87\\xef\\xc07\\xad\\xc0i\\xfd\\x18\\x00&\\x9bx\\xee\\x9b\\x0b\\xe7\\xece\\x97*g\\xd9\\xef\\x94id\\x7f\\xa0\\x94z\\xf6\\x03\\xa0\\xffo\\x0e/\\xe8\\xe8\\x11h\\x98\\xc0c_\\x14\\xb7\\x1e\\xce\\xd7\\xc2g:/\\x07g\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000fh\\xed\\xf2\\x17\\xd5\\xe0\\x87\\\\xd5m\\xb4\\x0e>\\x9da\\xd5\\xd8\\xe7\\xd1\n\\xd2\\x98\\x19\\xd7\\xc7\\xea\\x8a\\x88\\x12>\\xd6\\xeczp\r\\x15e\\x15i\\xd0\\xad\\xa8\\xcb\\xba\\xec\\x91"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c=\\x80i\\xb8\\x1f\\xd4\\xe1\\x13\\xf3l4\\xf6&xz\\xe9/\\xaa\\xe4\\xf7\\x91\\xf0>\\xc2p\\x86x\\xac\\x1d\\x93\\x1fq\\x1fx\\xef\\xdb<bx1\\x1a\\xbd\\x81\\xfb\\x0co\\x03\\x935|\\x95\\xd7\\xcew\\xc8`\\x06\\xf0\\x8b\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"\\x85\\xb4#\\xdc\\xe27,\\x94=\\x02\\x07l\\xb56p\\x1b\\xf3\\xbf\\xa0\\xc4_\\xf9x\\xb8\\xb9i\\xd2\\x89\\xae\\xb5vr\\xc4\\xb8s\\xfc\\xfbc\\xda\\xd0f\\xbc<<i"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xacs=\\x164<\\xe2\\x19\\x1f \\x1c\\xc2\\x01\\xd6\\xe7\\x8b\\xcf\\xe0\\x84,f\\xef\\xf1\\xa4\\x88\\xb2$\\xde\\xe7\\xf0\\x9d\\x7f\\xaa\\xe4\\xdd\\xb2\\xaeh\r\\xd8\\xcf\\xd9\\xfd\\xee\\xa8\"j\\x86\\xa0l\\xdb\\xb1\\xa6\\xbf\\x1f\\x0f\\xab\\xff\\xa8\\xbe\\x99j\\x9a\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a=h\\x90\\xf6\\xbb\\x83\\x8a\\xa9\\xfc\\x95g\\xca\\xa5h\\xecs\\x12oso\\x9f\\x83\\xeb\\xab\\x7f\\x9c\\x82\\xa3\rk\\x9awjg\\xee\\xcc|.+\\xed\\xdc\\x8e\\xc1a\\xf1\\x13\\x86"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\x8f\\xcfzm\\xd7\\xcaz\\x8amg\\xc9\\x81\\xfai\\x0cz5\\x02\\xd9\\x9f\\x81#-\\x93\\x12\\xd7\\xd1\\xa2\\xe6g\\x18m\\xdf\\x99q\\xa6\\xd7\rg\\x0f\\x8a\\xb2\\x82a\\xc1p\\xce\\xaf\\xabz\\x05\\xb4\\xce\\x91\\x03\\xe1f#;\\x8d\\xbd\\xe3\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\x07,ejyr\\x12so\\x86\\x89\\xe8wn\\xac\\xd5\\xa0\\x06=\\x9c\\xb4b\\x93:\\xa3\\xc2$\\x186\\x99\\x13\\xb7\t\\xae-\\xdeta?5?\\xdd4f\\xe8\\xe5\\x07"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb(\\x07\\xc1\\xa5\\xea9y\\xe0\\x95j\\xa5?_\\x95\\xfb#c\\xc4\\xf4\\x8d+\\xc2\\x9c\\x90\\xbe'\\xb5v\\x04u\\x80r\\xa7\\x93\\\\x95z\\xcd\\xba\\x827\\xa2\\xd8\"\\xa6\\xa1=z\\x8b\\xd4\\xb4\\xaf\\x8a\\x0c\\x8c\\xb8\\xbf\\x9f#in\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x88z\t\\xf8\\xbc\\xca\\x99a\\xc3dbs\\xbe\\x87\\xc1i\\x1c\"\\xfe\\xc0:r\\x8d\\x1dkwt\\xecpy\\xd6m\t\\xfe\\x92\\x12\\xb9m\\xb0#1\\x80g\\x1e"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\"\t\\xbd\\x01\\xf4\\xd0\\x14\\x07m\\x1b.\\xcd\\xea\\xf1hv\\xeb\t\\xa4~sj\"d>\\xcb\\xe8j\\xab\\x9e<\\xec3n\\xec\\xd8\\xf0z\\x10s8\\x90/~\\xe0\n\\xc7$\\xd3\\xc6$\\x96\\xcb\\xbe\\x87\\xad\\xdf<g(\\xea\\xd17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\x12nc\\xbc\\xeb\\xd5q\\xcf\\xd72\\xedo\\xc9<\\xc7\\x85->/bh6\\x85?\\xe2\\x93hqd\\xba\\xd3q\\xb3\\xa4kn\\xa7\\xcb\\xbej\\x07y_\\xfe\\xaf\\xb3"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\xb0\\xa2\\x8f\\xc6\\xfa\\xc9\\xab\"1fe+\\xf5\\xd9\\xd3\\xe3$a\\xc6?\\xcac&fs#\\xb1;9el\\xbb\\xc1\\xcbc\\xb6e\\xfa\\xfe\\xab\\xc7\\xd4\\x8b\\x0f\\xf6\\xeax\\x14\\xf4^\\x85:\\x0e!\\xcf\\xf9c\\xeer\\x12\\x19\\x8em\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\x18z8\\xda\t\\x9e\\xc5\\xe4)5\\xbdt\\xc4\\xeb\\x0bqk\\x89\\x80\\x19(c\\xcc\\xd0v\\x9ax\\xd8`\\xc4\\x9a\\xb0\\xf5\\xb1\\x16\\xd8\\x16\\x9ai\\x1c?q\\x0b9\\xb4?\\xa7"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xa2h\\x7f\\x91^\tc&&\\x19t\\x90mou\\xa3\\x8esn\\x90\\xa9b\\xbe\\x1d\\xf4b\\x16\\x95\\xb0\\xf9\\x05\\xb0\\x86yo\\x1a\\x91\\x0b\\xda\\xdcc\\x9b\\xa5\\x86u\\xf7\\xde\"!\\xfb\\x12\\xe0\\xd0\\x98\\xe46:k(\\xaa\\x85\\xe6%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xdb\\xf9,)\\xb5\\xf9\\xef\\x8d\\xa9\\x196k\\xfd\\x05\\xfc\\xc0\\xb6 \\x02\\xff\\x1dfx!e\\xd65\\x80\\xcb\\xea8\\x14\\x83\\x16\\x85\\x04|\\x92\\xa2pz\n\\xa4\\xbb\\xa8?\\x9a"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85\\xe7\\xb9\\xf9\\xe7\\xbf\\x818r\\x97\\xe1\\xf8\\x90\\xbf\\xb2\\xdc\\xda\\x82\\xaffmg\\x9bh\t\\xd5\\x9dt$\\xa3\\x12\\x99\\xaf1\\xeee\\xff\\xb0d3\\xe0k\\x81\\xb5^\\xb8_\\xbd\\xcc\\x803\\x07\\xf8\\x1d2\")\\xed\\xabj\\x1a\\xe7\\xdb\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80d\\xfd\\xc4z\\xe4\\x8e\\x05i\\xe3\\x8e\\x86*qgb'\\xd2\\xfd\\xc2\\xdc>\\xa5\\x94q\\xf6\\xfa)\\x80\\xf90`b\\xef`\\xfb;?c\\xe7\\xd0\\xf5k^\\x8b\\xef0\\xe9"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xf4>\\xea\\x97\\xad\\xb2\\xe3u\\xe5\\xa6e\\x9d\\x06mu_7n\\xeeh\\xc1\\xd41\\xb4n\\x1b;7\\xec\\x17\\xdb\\xc8\\x0b\\xe0\\x0f\r~\\xb2%\\x8ec\\xf31\\xe8\nj`s~\\x9dm\\xbf\\x8b%s\\x13\\xaa\\x0e\\xc7\\x98t+\\x1e\\x8d\\x9f\\xeb\\x93\\xe8\r\\xfb\\xa5\\xae\\xf79\\xe0\\x8e\\xbb\r\\xd8\\xbd=zmy\\x89\\x94a\\x0b\\xfa\\xb3\\xb9\\xd0l\\xea\\xccu,\\xce\\xafz1\\xb5\\xc1\\x84fal\\xd7m.~\\xbd\\x98lp\\x08\\xf4\\xa0ogy\\x943\\xbb\\xbe\\xff\\xc1\\xef\\xc1\\xea\\x06\\xd4\\x84a\\xd6\\xe5\\x01\\\\xbd\\xf5p\\x0csp\\xf5\\x8c\\xba\\xee\\xc1\\xf8\\xba\\x19\\xcd\\xda \\xd2\\xe0\\x11\\xc5\\x18\\xda0\\xad\\xfe\\xa1\\xd1?\\xf6vwnzy\\xf2\t\\xa4\\xd8\\xde\\xcd\\xce\\x8a\\xf4\\xa4\\x16\\x9c1\\xea\\xfa\\xa3m y14\\x06h\\x94\\xfe\\x81\\xab\\xef\\xfd~8\\x15\\x03\\xee\\xdb\\xf3r\\x9e\\x9b\\xecw\tf\\xe7\\x8e\\xcd\\x02\\xf6\\xb7h\\xe8\\xcb\\x80z\\x8bn\\xbe\\xdaj\\x84d\\x8fp\\x00;\\xcb\tm\\xba?l\\xcb\\xa0"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04q\\b\\xb6\\xbb\\x8f\\x86b1.c*\\x82/\\x10o9\\x86\\x15\\xfd\\x0b\n\\xe8\\x17\\x92\\xedl\\xfa\\xaadp\r\\x80\\xfbl\\xf4k\\xd9^x\\x91\\xbdd+\\x14\\xdf\n\\x94\\xf6kh\\xcb\\x13\\x81\\xb8\\x18\\x9d\\x0c\\x11t\\x8a\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xab\\xee\\xe8y\\xcfq\\xe8\\xee+\\x95\\x07\\xaa\\xba\\xf6\\x99^m\\x05\\xc1n\\xe3\\xb5\\xea\\x0c\\xb6a\\xb0c\\xff^\\xe2\\xefp\\xaf\\xb3\\x1b?\\xc9)\\xb1yioq"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99w\\x07\\x0f\\xe8\\x98\\xc9\\xec\\x9fwbzs\\xdb\\xf4\\xae\\x82\\xe3\\xbd\\xc2\\x89nw\\x9b\\x9a\\xc5\\x831\\xe9.\\xbe\\xf6\\x97\\x98\\xe0\\x94\\x9fgj\\xe72\\xd6\\x10?c-\\xcb\\xda\\x99\\x85\\x8a))\\xc6\\x9b\\xca\\x9a,\\x17p\\x0fg\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa5x\\xa5\\xf8\\x9e6\\xecp\\xac\\xeb\\xe99=t\\xd8\\xb5\\xd9\\xb0u\\xaf3i\\x03u\\xe9yb\\x91\\x15\\xe8\\x96\\xc9\\x01\\x9b\\xe6z\\x00,nv\\xba\\x83\\x85\\x0e\\xf8f"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\xac\\xa6\\xd5\\xdd\\x05~\\x9frgp\\xda\\xf9\\xfc\\xe1\\x8a\\xc8)o\\x1e\\xbft\\xb9\\x99\\xa6k\\x825\\xd5\\xfc\\xa9\\x83\\xaer\\xca\\xe3me\\xf0\\x87\\x9b\\xd3w4\\xfa\\xb8\\x9a\\x85&\\xba\\xff\\xf7\\xbc\\x0f\\x1ev\\x87\\x15\\x18\\xa9\\xebn!g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xbd~\\xe6u,\\xa1\\\\xef\\x9d\\x89\\xae|)c\\x04\\x84\\xae\\xf0c*\\xf5>\\xb7\\x8f\\x90%2\\x04\\x10\\xba\\xc2\\x15\\xa4\\xbf\\x90.\\x08\\xc9\\x86\\x99|\\xcab=\\xc7*x"
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xa8@\\xbc?\\xff\\xa4\\x9f`\\xeb\\x02e\\xac\\x11\\x7f\\xbag.\\xe2\\x7f\\x7f\nk\\xc2\\xff\\x08\\xae\\xbe@s\\xb4i\\xb3\\xf0\\xe2'\\x7f\\xbd\\x8b\\xaf&l\\x0f\"\\x16w\\x01\\xaa;\\x04ge\\xc9\\xf4\\\\xe3\\x91\n,\\xa1w\\xfc\\x86\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k0$\\x8f\\xaedp\\x01\\xa3(\\xc2\\x0b\\x81n\\x1a\\x9b\\xaey\\x8a\\xdb\\xca\\xfe-\\x05qz\\xe7\\xc5\\x92\\x1a\\p\\xd8\\xb94\\xc5\\x16\\xdf\"+\\xc7+u\\xaf=\\x8b\\xd8\\xcd"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xe1+\\x007\\xa3\\x08t\\xbc\\x9104\\x16y\\xdaut\\x1f\\xae\\xda\\xc4\\xeb\\xcc$ld\\x89\\xc9h!\\xdf\\x87\\xa33j\\x92\\xce\\x12\\xe4q\\x8e\\xda\\x9c\\x9d :\\xc9\\xc6\\x86\\xce\\xdd\\xa02|g\\xfb\\x982\\x91\\x84\n\\xeat\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xe6\\xd6'\\xd8\\x89o\\xec\\xe1gw\\x14\\xc6\\xe8`\\xff\\xaf\\xbe\\x86\\xd74\\x1e-\\x9d4&\"\\xfc\\xa0\\xe3\\xc4k\\x98\\xb8\\x1c\\xeb\\xb4\\xf55\\x7fn\\xd5\\x84\\xd4\\xf0\\xf7"
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x05\\xe3\\x7f\\x00\\xdb\\x84\\xe1\\xcb\\xa7\\xfb_\\x0c& \\xe3os\\x04\\xaep\\xc7b\\x0e\\x8a\\x86\\xf3\\xf4\\x1e\\x95\\xb2d+\\xed\\xf4\\x82\\xe8e\\xa1\\x1a\\xd0\\x12\\xc4\t\\x08\\xbc\\xef\\x80\\xa0\\xac\\x84\\x0bk\\x86\\xf0>\\x0e\\xa9u\\x8b\\x0e\\xb2\\xfap\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6\\x10\\xff\\xb4\\xa3\\xebxd.y\\xf5%\\xd3\\xd6?\\xd8\t\\xb0\\xabv\\xd6\\xbb\\x89\\x0b<\\x9b\\x97\\xd8\\xfe(\\x0c\\xcd\\x7f,~\\x05\\xe3\\xa5tm\\xde\\xca\\xcfnt\\xd4-"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\xee\\xe6g\\x02d\\xd8e\\xd6\\xaf\\xeb\\x01\\xc1\\xce\\xd4\\xdd\\x91\\x8b\\x97w\\xb8\\xab\\xa3>l!>\\x1f\\x80\\x8d\\x16c4n\\xc92\\xd0b9q!r\\x19\\xd4\\xb4u(w@(\\x99s\\xbf^#\ng\\xe3g\\xf8 to\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h_\\x88\\xf6\\xfd\\xd0y=\\xe8yia\\x0c\\xf6\\xed(\\xf3\\xf8\\xd1\\xc8\\x9f\\x0c\\xc6\\xf8\\xd3\\xb2\\x00\\xb0`\\xf5k.\\x15\\x12\\xc4\\x99a\\xbd\\x9c\\xe8,8\\x97\\x7fm\\xcf\\x94"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&\\xafav\\xec\\xa8n\\xb6\\x0b\\xe0um\\x86sp\"\\xcb\\xaa\\xf7\\x13fk\\xb0\\x13\\xda\\x18\\xd8\\x04\\x8ak+j\\xbba\\xff\\xe4\\x89\"\\xf7c\\x12\\xff\\x04\\x9dx\\xb9c\\xc7x\\xe6:\\xb7\\x98\\xafe\\x82~\\xefp\\x95\\xcbyg\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x81\\xec\\xceo\\x85\\x1f\\xc26/pl\\xfa\\x9b\\xd8\\x18n*\n\\x10\\x19e\\xee`\\xbd\\x93\\x13i\\xc5^\\xc3\\xefdkf\\xdb\\x9a\\x0e\\xbb,mp\\x16r\\xb8\\xec\\xeaw"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\x97\\xdd\\xb2\\xff\\x08y\\xa9%\\x8a^\\xca\t\\xa5\\xb6\\xe0\\x97_\\xce|\\xae\\x1djr\\x86\\x05v9\\xe6\\x18\\x08\\xe8\\xab\\xf0\\xad\\xe1\\xde\\xd8\\xa0\\xb5c\\xc2j\\xf6\\x9b\\x9e\\xb9\\xc8\\x03\"\\x89\\x10m\\xf3\\\\xd1\\xc7\\xf4\\xe1\\xb1\\xd8u;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000lxx\\xca\\xa4n3r\\x9e\\xc27\\x1d\\xa7\\x8b\\xe8j<\\xb1\\x96q\\x1b\\xab\\x81l\\x87q\\xdd|s\t\\x9e\\xfb,\\x9c\\xf9\\xc8\\xa8\\xe8\\xed\\xf9\\xef\\xe1\\xf5\\x06p<l"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\xe60f\\xe1\\xb2\\xf2\\x002\\x0bz\\xd0\\xcdkd\\xec\\xe2\\x15sk q\\xf1f\\xa9\\x8d^\\x85\\xd19h\\xb5.\\xe7v\\x8ce\\x05<\\xfa5\\xdd\\x07v\\xb7z\\xb2\\x94jpe\\x04\\xdb\\xce\t\\xd9$l>\\xb7\\x9f^\\xe4\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\xc6\\xaa\\xe8\\x0b\\xacx\\x06\\x8f\\xb5\\xb5@\\xd4s\\x97y\\xab\\xb3\\xa9\\x14b\\xdd\\xd1\\xd3-3\\xf3\\xebj\\xe3\\x0f?\\x04\\x1bt@\\x19i1\\xb2\\x0b\\xb9|\\xa2,\\xe1 \\xee"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\xe0rup\\x1erj(^\\x0e>\\x8e\\x9b0(\\xe9\\xd6\\xbe\\x15su\\x0c\r\\x97\\x1d\\xe7\\x0f^\\xf0\\xc8\\xd1d\\xd4\\x8e\\x1f\\xd1\\xb1\\xae7l\\xca\\xe0\\x10\\x9d\\xb2\\xd8\\xf2be\\xb3\\xdc\\xdd\\xbezdm\\x80-\\xd2,\r/c\\xf1\\xfeiz\\x17q\\xfb\\xe5\\xe4cs\\xee\\x9d\\x89\\x01\\xb2l\\x06\\x85\\x9f\\xb0\\x85r\\xd0\\xf7\\xa7\\xc86w0+^fw\\x1e\\xba\\x1c\\x8a\\xe2\\x8e\\x1a\\xa8\\xb5\\xd1+=n-\\xa3\\xb9\\x90\\x8dg\\xc4\\xb1af\\xbf\\xbd\\x8b\\x1b\\x06\\x15\\x83\\xd3\\xb7&\\x1dd.\r(\\x19\\x85\\xedr\\xcd\\xf3\\xe9\\xdf\\x07\\x1f\\x80\\x13:5b\\\\x04\\x0c.\\x07\\xc2~\\x1a\\xcd\\xdc/z\\xd0\\xe0\\x13\tu\\x0f\\xd8\\\\xb7$\\xbe\\x142b\\xb2z\\x8bd\\xf2\\xfa\\xa5\\x927\\xcc\\xb0\\x1b\\x908\\xf3y\\xe4\\xb2\\x1bex\\x93/\\x9a\\xd2k\\xa5\\xf4\\x98v\\x17\\xd3s\\x8f\\xec\\xff\\xbe2\\xc4\\xea,g\\xbawj:\\xe2>v\\x0b4\\x07\\x9d\\x9d<\\x11\\xa1s\\x92\\xbf\\x88\\xf9\\x82x;\\xd0\\xa5\\xab\\x85"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7y%a\\xb3\\xb1\\xe5\\x8d\\xf6\\x1b\\xe0\t\\x08\\xa0\\xfc\\xa6\\x01\\xc3x\\xd38\\xfb\\x87j.\\\\xda`\t*s\\xab\\x90\\x1a\\x19hqpj\\xd7\\xe3\\xb3\\xad\\xce\\xc2\\x182\\xaf\\x9f\\xab\\x0e\\xe5%:\r\\x94\\xff\\xcc\\x0c\\xda\\xfc\\x13gt\\x0eih \\xad\\xce\\xa9e\\xc1la\\xed;\\xfa\\xb2at\\xac\\xdb\\xf8\\xb8\\x99\\xca<\\xf4\\xef?\\x17\\xf9c-\\xdedi\\xd3\t\\xfb\"\\x01g\\x90\\xb1\\x8e1\\xf5d\\x9d\\x1a\\xc1\\x97-z\\xdd\\xcae9 \\xc5\\xd6y\\xc6\\xa5\\xfd.\\xa2%\\x9d\\xc2d\\xbf\\xa4\\x8e#\\xe2\\xbc\\x98\\xe6\\x0c\\xa7\\x1f\\x99 \\x92&sdd\\xe38\\xac\r))\\xd5^\\xb6\\x13\\xb0v\\x03u\\x128`c\\x0c\\xdc\\xbd\\xc4\\xd8l\\xd7\\xcc\\xbc\\x11y\\x81\\xe8\\xdepk;\\xaf\\xd9\\x9d%\\x19\\xe8x\\x98:\\xb0\r\\x99;y\\x8a\\x9a,z\\x84\\xb5\\xb2?\\x15-jsb\r\\xc9n\\xf8\\x98\\x1ce7t\\xd3z\\x01\\x82qm3;g\\xfa\\x7f\\xa9r\\xd7\\x9b\\x80\\x83l-\\xf1\\x93\\xff\\xe5\\xfa\\xcf"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\xf5ku\\xbbt\\xcb\\xe2\\x9e8\\xd5y\\xa9\\x9c\\xc8\\xe1\\x8eh\\xa5\\xf8\\xfd\\xf2\\xa6\\xfe\\x88\\xd1u\\xd2\\xfa\\xe4\\x06r\\x9cn\\xe7\\x07tp\\xbdjr\\xb8\\x88`,\\xc6d\\xb5\\xca=\\x91c$\\x95\\xa8\\xae=>\\xfc\\xf4\\x9dn7q\\x92\\xa9\\xb6n\\x82px\\xad\\x15q\\x8f!\\xbb\\xb6\\xea\\x9c4/\\xc03\\xa8g$\\x8e\\xf5\\xc7s-\\x9cn\\xe4\\x8f\\xc1\\xe9\\x1d=^6\\xd5\\x81\\xdd\\\\xd7\\x9dr\\x06\\x05\n82\\xb5\\x01\\x15\\x91\\xfeg\\xa5\\x97jp\\x16\\xb1\\xd4-u\\xf2\\x15\\x82\\xab\\x83*\\xf7\\xdc\\xaf\\xd6\\xfa/e\\xf3\\xed\\x1e=\\xcd`\\x17nv\\x10\\xdf\\x9c\\x82r\\xdek\\x0b\\xad\\x0c\\x93\\xeeu\\x92\\xad\\xc3qge\\xbd\\x9fha;\\xefglz\\x90\\xf8\\x0fwi\\xb3=\\x00=\\xe9f7\\x85wz\\xa1bk\\x91\\xea\\x8d|~\\xf9h\\xb5\\xa9s\\xf9\\x91^\\x81v\\x99\\xb9\\x07\\x1f\\xbdoy\\xb9\\xbf>\\xfer#_;\\xa6\\xe6\\x92\ra+\\x82!w`\\xd3\\xf4\\x83tyh\\xd4\\x9cu\\xac\rh"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6g\\xac\\xa2\\xf8\\x13q<\\xee\\xba\\x90\\x0f\\x9c\\x97\\x9e\\x8e\\x18pl\\xc4\\xb3\\xe8j\\xf3\\xe7\\xbds\\xdc\\x95\\xed|\\x89\\xba\\x94\\xdc\\xd4\\x93(\\x04\\xa3\\x1al\\x04\\x9ar\\x84\\xafoy\\x83n8h\\xe7'\\xe6h\\x95`\\xe9\\x88\\xa4\\xca\\x94i\\xda\\xd3%!\\xbd(\\xbf\\x89\\xd9@-\\x08|\\x10\\xda$q\\xecu\\x83\\xb9\\x99\\xc8\\xd2g\\x93\\x87\\x10d\\xb4o\\xa2\\xd0\"\\xbc\\xe8\\xed\\xa2\\x00\\x05\\xe2j\\x1f\\xaa\\xd8b\\x1f\\xc9\\xe0\\xa3f\\x9d\\xb7&\\x02\\xcd^h\\xaa\\x89\\x99\\x87%\\xa1-\\xe1\\xc0\\xaa\\xcb.\\x95o\\xab\\x12\\xe2>\\xf0\\xb2\\xd2\\xd0\\xbb\\xadov\\xd2\\xd9'\\xcb\\xb8z\\x13\\x90\\xac\\xa7\\x9e\\x89\\xe8\\xe8\\x134t`u@g\\xc7.b\\xfcp3\\xb3\\x041.\\x08\\xb4g\\x19\\x01_\n\\x9c\\x17\\xa0\\x9c\\x9b\\xf3\\xd4\\x05\\xe7\\xfd\\x98!\\x04v \\xd2\\x01\\x7fu\\xf8\\xd8\\xf5d\\x10\\x87\\xb8.\\xbav\\xea\\x82h\\xa82\\xad\\xc9\\xe6|`\\xac+\\xc9c4j\\xf9\\xe2\\x9f*\\x1cx\\x15u\\xa9!a\\xab\\x90"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf8\\x10s\\xe7\\xf0u\\x9e\\x18b\\x91\\xdb\\xe9\\xa2s\\xdd\\xfb\\xd8\\x0eh\\xc4\\xf2\\xb8\\x03\\xa2\\x1c\\xea\\x93\\xe4rsf3\\x92\\xfe\\xd3\\xd9.\\xd8\\xc3\\x89o\\xf47\\xd6c\\x1b\\x17_oh\\x16g\\xe3\\xac\\x87\\xd7u\\xa5\\xa3c\\xe9\\xeft\\xb8\\xf5/\\xfa\\x89\\xfe,\\x92v\\x8f\\xe7\\xd4\\x18\\x19\\xc3\\xaf3d\\xf5\\x18g\\xb0\\xad|\\xe0\\xd0/y<\t\\xbf\\xd7\\xc5\\xbd\\x0f\\xc9-to\\xb8v4\n\\x9c7\\xfec\\x86\\xf2\\xa8'\\xc98\\x90|\\xcdh\\xd3>\\xc6\\x00\\xdb\\x19\\x81w\\xfba\\x88\\xc2-p\\xe02\\xf65\\xed9\\xce\\xcb\\x8c\\xa1\\xe0\\xe02)\\xdde\\x15\\xffjw0y\\x93\\x96\\x1f\\x08#\\x06h\\xbd\\x9c\\xdb\\x90\\xf5\\xcf\\x00\\x86o\\xbd+e\\xff1\\x01\\xd4o\\x88e\\xbc\\x82\\xa8\\xcf\\xf8\\x185n\\x9d\\x98;@\\xd9i\\xba\\xa1\\x04n\\xbdd\\xc6/\\xf5\\x18\\xe8t\\xca\\x10l\"\\xd3\\xa7ho\\xf2e\\xe0tper23pv\\xeeifm\\x17\\xbe\\xc0\\xdb\\x91\\xef\\xfc\\xb0\\xb3\\xc9az\\xe8\\x03\\xaf"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.z\\x91je\\x03\\xf7\\x1c\"#\\xc4\\xbe\\xed%\\xbf\r\\xce\\xe7\\xb9x\\x8fe_\\x89\\x8c\\xe1\\xfc/\\xc5%\\x12\\x84\\xd4\\xde0s\\xd0\\xc6\\xab\\x92\\x10\\x19\\xd0\\x0f&>\\xd8\\xdc\\xe9\\xdb\\xac\\xbb\\xed\\xee\\xca\\xd6@ \\xe9\\xc6\\x11\\x87\\x00\\xc5ym0\\xa2'\\x02i\\xa2d\\x8eo\\x1c\\xd1ldv\\xdc\\xd7$\\xda\\xa0\\x90\\xcc\\xc3\\xff\\xcc\\xd9\\x07\\xaf5\\xe1\th\\x95?\\xbd\\x8bd\\x99x\\x1e#\\xf7\\x0e\\x9clz\\xe4\\x1e\\x10\\xcf\\x16\\xdb\\xb5\\xddk\\xa5\\xf0z\\xe52s\\x0f\\x03u6\\xb56\\x18\\xdfyh\\xfb&\\xbfk,$\\xda&\\x01\\xd4\\x81=so\\xa9\\xa6\\xd9\\x89v\\x15\\x01\\xf8\\xda\\x8c\\xa9\\x8f6\\xd7o*\\x8d\\x10\\xa7\\xb3\\xb8\\x8b\\x9b\\xeaz\\x88\\xa2\\x01:\\xeb\\x9bi\\xdf\\xe3m9\\xde\\xa0zh\\xc8rj2q\\x84\\.ggzf\\x98\\x11\\xad\\xf0\\xb6\\xb9\\xc8\\xa9x\\xce\\xc6l\n\\x8e7\\xc1\\x9a=f\\xf5\\xa8\\x19u\\xfb\\xef\\xf9\\xa5\\x01yqb\\xb8,\\xdc\\xa7n\\x11\\xc4\\x83\\xfak\\xfd"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x8d\\xb5\\xd4\\x1c\\x8e\\xb2m\\xbbu5\\xc8+d\\xb5\r\\xafd\\x8bi\\xa0t\\xcb\\xcd\\\\x8e\\x83\\x80\\x1c\\x87#ul\\x0cn\\\\xcf%a\\xbc\\xb7r\\x03\\x10q*\\xb8y\\xda\\xae\\x95\\xf6\\xc0\\xd9\\xe0\\xd2\\x82z\\xe0k/;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\r\\x1d|\\x00\\x04\\xc0\\x9a1\\xfb\\xba\\xd8\"1\\xa0\\xa92\\xf1x\\x1f`\\xb0o\\xe7_\\x1ev\\x85u\\x7fvxy\\x9d\\xe3\\x0f\\xe1\\xb5>j6\\x99\\xa2\\x18\\x95y5\\xfc"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\xf3)\\x14wf\\x06-)\\x1e\\x02\\x18\\x81\\x82\\x9a9\\x10)\\xc3t\\xd0'\\xb4\\xa3\\xab\\xbd\\x0b\\x9e\\xb9z\\xeent\\xee\\x8bclhu q\\x84\\xff\\xb4\\x8d\\xe8a\\xb8t\\x98lk\\x02\\xeeo\\xfb\\xe4s\\xe5\\x97f\\x1bv8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc \\xe7\\xa1\\x07\\x87\\xe3m\\x9a\\xf3\\xd5\\xf7\\x1d1\\x87s=\\xb5\\x0ff\\x0f\\xd4\\x87d\\xa57\\xb6a\\xa4\\xcey\\xb9\\x14+\\xdef\\xa8\\x9c\\xa4\\xdb\\x1f=\\x80?n\\xf8\\x02"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5m\\xa1ho\\x05,q\\x1a\\x07j\\xede\\xd3\\x97yn\\xaa\\xd5\\x0b\\xb8j\\xe4\\xba\\xc5\\x19\\x92\\xb6\\xf5\\x1b\\xd0\\x85\\xb2e\\xda\\xc1>\\xd2\\x94\\xd8b\\xbcn\\x8b\\x00\\xbb\\xaa\\x95\\x05&)^v\\x1f\\xa39h\\x14\\x1e4\\xbb\\xd8i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\x15\\x87\\xeb3l\\xb9\\x01\\xa7\\xba\\xc2\\xec\\xdd\\xa7\\x04\\x98\\xb3y\\x9d\\xdd\\xa5\\xe2\\xda\\xa3t\\xcf\\x94<\\xf8\\xe3\\xf0y5m\\xf5\\x1c\\x95j3rk'.l\\xbc\\xfd:"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e=\\x1fm5b\\xba|\\xfa\\x1d9v\\x17\\xd9\\xba\\x0e\\xf5\\xc9~\"\\x87\\x0f\\x88\\x8a\\x1e\\xf0\"n\\xde\\x9ez\\xd9s\\xeb\\xed\\x90o+o#\\x8adc\\x03\\x00yzl\\xf3^`m\\xedhh\\xd8\\xfe\\x0c\\x10\\xcco\\x93\\xf7\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08n\\xf5\\xb3\\xe9\\x82\\x84\\x93d\\xe5\\xa3\\x93\\x8fy\\xde\\xbd\\x16\\xc5\\xbf\\xcb\\x9b\\xdb\\xebz\\x91=\\xe2\\x94\\xbawzu7\\xff\\x19\\xb3\\xa6\\xea,\\xd9\\x08&\\xe4\\xe2\\x17l\\x93"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83c\\x003\\xa6\\xae\\x8e\\x95\\xe9\\x16wqv\\x19\\x85\r\\xdd\\xe9\\xe9\\xe4\\xa3\\x13\\x863|\\x1d9\\xe5\\xa9\\xa5\\xe5\\xa6o!\\xc1v\\xd6\rr\\xaer\\xd4\\xc5@s\\xc1\\xd03n\\xff\\xdd\\x12\\xe4\\x9e\\xe3\\x81\\x1a\\xa0\\xa5ng\\xefb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\x04vy .\\xf3 \\xfa\\xb3v\\x0e\\xdc8\\xa4h\\x11\\x14\\x9f\\xb7v\\xb9\\x1cvbh\\x1d\\xf8p\\x91\\xee\\x01\\x85)q|\\x94\\xc6-\\xbb\\x8a\\x19\\x968\\x7f\\x9et"
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xb0m\\x9b\\xc2'/.\\xa1\\x8b1\\xc1\\x15\\xbe\\x17y|\\x8b\\xab!d~\\x80\\x9c\\x02\\x03\\xc9v\\x14d'\\x99&e;\\xfad\\xd7\\xcdf\\xbc\\xce\\x9de\\xa3\\xef\\x1f\\xa0\\xef\\xf5\\xac\\x1e8\\x1e\\x05-@z\\x96\\x9a\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5\\x08\\x04\\xc8\\xad@ \\xde\\xa1!w~\\xa9*\\xdf*\\x01\\xb8k\\xbb\\xf1\tu\\x93\\xadmxu\\xca.7tq\\xb1\\xfd\\x83\\xaen\\x15m\\xcf\\x05\\xb2\\xe57\\xed\\xf2"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p14)\\x8f\\xc3 m\\xdb\\x98\\x95\\xcd\\xf2\\xb0\"\\xc6\\xa2f\\xabnt\\xd7c\\xe5a\\xd8p\\xe7\\x1e\\xbb\\xb7\\xc0\\xdd\\x8b\\xa5\\x7f\\x1db\\x80\\x9d\\xefh\\xe3\\x1f\\xf8\\x10\\xd7v\\xf8\\xda\\xedzg\\xf3\\xb9\\xd7\\xc8f\\xeb\\x9d\\x87\\x1c1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xf8\\\\xcc3\\xbf\\x8f\\xdfzc\\xe7t\\xe0\\xb8\\xc4d(v\\x1d\\x9d7\\xe0\\x9b\\x12\\xde\\x98\\xd7\\xb6fp\\xe4r\\xa1\\x10\\xefg.\\xc4\\x8b\\xaaq?y\\xb4<\\xda\\xae\\x8a"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\x071p?\\x10\\xaa\\x15\\xd9\\x94\t\\x0e\\xf2s\\x7f:fn\\x8f\\xc6b@\\x97\\xeb\\xd5\\x83\\xa3\\xde \\xd8z\\xbc\\x02\\xac\\x85\\xa9\\xdca\\x99\\x18\"\\xc2\\x17\\xb1\\x9e-\\xda\\xb2\\xbb\\xff\\x01`\\xb4\\x00\\xddz\\xe7\\xacx\\xd2@?\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0'\\xb1\\xe7\\xc1f\\x1d\\x05jb\\xad\\xe8\\x1b\\xe5\\xd6\\xf70\\xa8\\x82!h\\xb4?c$\\xfe\\xf6\\x10\\x98\\x99\\x8c3l!\\x05\\xd0\\xb8\\x82yv?oy~\\xf0\\xd4\\xd4o"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\xb7\\x18j\\xab\\x06\\xe4\\x1by\\x12\\xfd\\xe8\\x84\\xad\\xbak\\xee\\xab\\xc2=\\xfaw\\x96\\xd8f\n\\x1b\\x07r\r~\\xc8\\x89\\xa7\\x84r\\x03\\xc6p\\xbb\\xe55%o\\xcd\\xdff?\\xc42y\\xa9\\x8c\\xf4\\xd5~\"\\xab\\x13\\xc2\\xdc\\xb1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19~b\\xadp$_\\xda\\xc0\\xf2\\xa9\\x1c|\\x12\\x07\\x04c\\xc38\\x14\\x9f%\\x91g\\xcd\\xb9\\x1dr\\x16\\xf9cz\\xc46\\xb31\\x1cw\\x8ctc\\x8a\\xa2\\x12_@~"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xba)\\xa1\\xdbh!?\\xa5q\\x93z\\x87\\xe9\\xa0\\xcb8\\xc5~^d\\xbd\\xb9\\x03\\xa6\\xf4\\x91\\x05\\xe6\\xdb\\xe2i\\xfa0z\\x1d\\xeba\\x9fq+\\xfeb+\\xe9^h;2)\\x81\\x05\\x96|q\\xa8\\xb4\\x1fn\\xabe\\x8a\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%vh\\xf2\\xe1\\xede\\x1d\\xfak/x\\x88\\xc2\\x9fd\\xdb\\xe7\\xfe\\xcd\\xc1\\xca\\xd4%\\xd0\\xa9\\xf0sd8fv\\xcc\\xdc\\x9b\\xb9\\x06\\xc2\\xace\\xcf\\xd7\\x8f\\xbe\\x97\\x81\\xd2\\x98"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xff\\x12\\xa9,\\x0c\\xef\\xc8\\xec\\xc9\\xd3\\x92\\xc0\\x97\\xa9d\\x96<\\xd1\\xce\\xfc\\x87\\x8d\\xf3^\\xc2i\\x89\\x93\\xa0\\xe1\\xb8\\xe1\\xbc.\\x13\\'^\\xcdw\\xfd\\xc0k\\xe7\\xe6\\x86\t/9\\xd6\\x91\\x1c\\xd5\\xfa\\xabt\\xbb\\xda\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3v\\xd0q5\\xb8\\xe2\t\\xfbp\\x14\\x86r\\xba8\\xbd\\xcanu\\x7fw8z\\xb6\\x9b\\x01\\x84\\xb1\\x82\\xd0\\xeb\\xd3\\x08\\x04\\xa0\\xb5\\x02%\\x97\\x1b\\xbe\\xaa\tsfqx\\xbd"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7\\x9dr\"a\\xc3\\xcc\\xcb, ds\\xab\\xc4\\xb1\\xbde\\xaf\\xcfwa\\xfe\\x9a\\x84>\\xb5\\xf8\\x99\\xa2=\\x02\\xdc\\xfc\\x99!\\xaa\\xacm\\x9f\\xb6\\x8fw\\x87<\\x80\\x9e\\xae$x\\x08\\xd8x,\\xd3\\xca\\xee\\x1a\\xdc\\xd9gh\\x1e,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\n\\xe2_s\\x98\\x19d\\xf0\\x93\\xcf/\\xc0\\x95~\\xa0|\\xebs_\\xa4c\\xd4\\xce\\xa1^\\xdd\\x0c@\\xb3j8_\\xd4\\xbdn\\xb0=e\\x11\\xcc\\x82\\x8c\\xb8\\x1e"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86\\xbby\\x9f\\xf0?\\x8e\\xcen\\x08\\x86\\xb9\\xb7\\xc2m\\x86\\xfa\\xb8\\xbe5px\\x91\\x1c\\xfe\\x18u\\x80\\x11\\xce\\x1b\\x8e\\xcdl`\\x0e\\x064d\\xe71i\\x9256\\xd7s\\xbc\\xec\\xc7\\xd9k3j\\xed\\xc3#0\\xcb\\xcb;1\\x8f\\x15\\xdbse\\xe8m\\xf5\\xdf\\xf15\\x82p\n\\x9b\\xc6eap\\xe9\\xe7\\x08s\\x04\\x90\\xd6$`\\xf7%\\xcf\\x95\\xb9\\xfe\t\\xf7\\xd8\\xca\\x90\\x99hi#\\x8f\\xac\\x97\\x9f\\x0f\\xed\\xfb.\\x01b\\xe7\\xa7\\x9fqz-\\x8e\\xd2\\x8a\\xa5\\xb4\\xf1>b\\xe9e\\xd7!\\xa5\\xdc\\xf7s\\xb3db\\x10t\\x9d\\x98s\\xef\\xedb-\\xe0\\x12\\x0bnpe1(76\\x7f/\n\\x9e\\xf4\\xc4k\\x1c6\\xb3\\x1fn\\xd5a!\\xf2q\\xc1\\x82\\xe7<\\xc6\\xdf\\x17v\\xb8\\xf4\\xab\\x9d\\xaa\\xf1\\x10x\\x8b\\x90\\xb8d\\xda\\x8f\\xe8\\xb36i\\x1b\\x8c/\\x8e\\x1d\\x97\\xb6\\xcfq&0\\x12d\\xbc\\x17\\x0b\\xe60^\\xc5\\xf9\\xb5;\\x0e\\x14y\\xb0*\\xd2\\xe3\\x16hg\\xe40\\xb9\\xc8\\x8dp\\x91\\xab"
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7v\\x9a@`:\\x84d\\xfckl\\xe1\\xe9$\\x95\\xaa\\xe6\\xa2\\xc0\\xbe\\x8els\\xe1\\xff\\xadu\\xd4\\xf7\\x1b$\\x9ae\\x03\\x02\\x0c\n\\xb7\\xacvx\\xacq|\\xf26z\\x04\t\\xe1i~\\xb8v\\xa3\r^\\x9e\\x01\\x83f\\xef\\x8b\\xe1\\xf7\\x98\\xe4\\x06\\x0f\\xa4\\xaf~\\x8fdy\\x1a\\xb3\\xb8\\xfb@5\\xc3\\xa7\\x14\\xb2t\\x8e\\xf3\\xe0\\xa9\\xee\\x05\\xb7(d\\xa1\\xc5\\xb7\\x1a\r>\\xb4\\xa61g\\xf23\\xecq\\x04j\\xae\\xda\\xfc\\xfes\\xd0\n\\xd3\\x0e\\xceap\\xbc\\xcat\\xf6\\xb1\\xb4\\xac\\xc7\\xe0m\\xe9\\x8d\\x17b\\xe7\\xe3\\xe8r\\x1a\\xe3\\xb3\\xbc\\x9e\\xea\\xb2\\x1f\\xec\\x14\\xc5\\xb43t\\x97c\\xe6mj\\x81\\x9c\\x93\\x1f\\xa9!\\xbd\\xeeh\\xcf~\\xb1^*\\x1f\\x1f\\xc1b\\xeeq\\xb4\\xb8\\x9e\\xb2\\x06)\\xa0vz\\x05)~\\x87,a\\xe7\\x8b\\xfde\\x85\\xa5\\xadb\\x88\\x812d\\xb8\n\\xc9\\xa7\\xb1\\xde%wa+o\\x9f\\x05\\x882/\\xbe\\xa2~r\\x91\\x1f\\xc3m\\xe0\\xe1)awp\\xf5\\x03\\x1c\\x01w`&p\\xc5u2"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab\\x9b\\xc0\\x9b\\xba\\xb8\\x8d\\xe2\\xea\\x95~(\\x07\\xbe\\x03+\\xc1i1\\x14\\xc2\\x95\\xa0*n\\x90\\x1c\\x02!\\xe3#o\\xca\\xbc\\x07oi\\xc3\\xa0\\x03\\xcd\\xb2oy\\xcf\\x08\\xeb\\xc9\\x00\\xb5\\x195\\xc2\\xe1\\x97a\\xbd3\\x01\\xfe-\\x99\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xd9;\\xa3\\xaff\\xba\\xbe\\xe8\\xad\\xe70$\\x17\\x0c\\xaed\\xc8\\x98d\\xbc\\xca\\x17n\\x0e\\x15z\\x87\\xa6\\x89$w\\x93\"mf\\x9ca\\xe32\\xa2c\\xeb\\x98\\xce\\x13\\xb3y"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\x90;\\xc5x#\\xf2\\xd7p:$\\xd1\\x1fc\\x1cm\\x0c\\xff\\xe4\\xe9v1\\xa25\\xc6\\xb5\\xaf\\xec^s\\xbe\\x96\\x80\\x1cr|\\xf6v\\xb6\\x08\\xe8\\xa1<x\\x19v-\\xd1j\\x96\\xf7\\x82a\\xbd\\xddj0\\x00l\\x03\\xf1\\x03n\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x8f\\x14\\xce\\xce\\xb6\\x0b\\xb3\\xfb\\xb8\\xc8rj\\x9f0\\x03\\xc8;\\x8a\\xcd\\x92\\xba\\xef\\xe4,\\xdbv+\\xd0\\xe7\\xb7\\x1c\\x1b\\xc4iz\\xe1\\xfa'\\x994\\xe9y%h@w"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x8a\\x8e\\x0f\\x19\\x08\\x90\\xb4\\x93\\x896\\x11\\xac\\xbd\\xa9\\x1a\\xc2\\xacqq\\xf5\\xcfwi\\xf9\\xa8\\xcb\r\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x8ay\\xf6\\x0c\\x01i\\xe9mk(\\x1e\\x82 \\x1fd\\x97\\x0ei\\xae\\xf2\\xb2\\xb6\\xe1\\x96th\\xa9\\x1a\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\x1f)/fbp\\xbf-\\xc1\\xdb\\xb46\\xe98\\x12\\x1d\\xae\\xef\n\\xd8i\\xec\\xf2?\\x9d\\x17\\x8b\\xbc\\xfd\\xb6\\xbc\\xdd\\xeb:\\xaay\\xab\\xc50\\x14db+9\\xb5\\xb5\\x0b\\x1c\\xf0b\\x1f\\x08\\xe7\\x1b\\x0e(\\xf0\\xbd\\xa7f\\x95\\xff\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\x1e%\\xaco\\xe7\\xc2\\xe1\\xe3\\xd69\\xea\\xef\\xf8m\n$s\\x9c\\xdbs\\xbd$\\xc2\\xab\\xb0u,\\x8d\\x00c\\xa7\\x993\\xad5\\x03\\x85-\\xf1\\xf1\\xd2 \\x8f\\xed\\xa1"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01&\\x96\\x8aia\\x1eh\\x13* \\xd0\\xd2\\xc8hmr\\xa0\\x1b\\xb0\\x9bu\\x1d\\xc7iqw\\x14z\\x1e(v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x7f\\x07\\x92v\\xe2\\xb5xk\\x8c\\xb9\\xae\\x18\\xc9:\\xedybi\\x17\\xa3\\x85\\xa6m\\x1d\\x1e\\xd2\\x1d\\x06\\xb0\\xf5\\xd5\\xca\\x03\\x1a8\\xc8\\xc5\td\\xf7z\\x05\\xb8\\x12w9\\xbf\\x95\\x0e\\x95\\x92\\xe7\\xc7&\\xc3j?e?i\\xd5\r\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfec\\xea-:\\xe9r- 2m\\x05\\xe6\\xf5s\\x8c\n\\xf4\\xf5\\x00\\x1c\\xe4\\xcc\\xf9&\\x0e=n\\x1fm\\xff\\x85\\xd0\\xe38g\\xb6\\x13|\\xb2/`\\xf5\\xb9\\xb7\\xd7a+"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xbc\\x19\\x00lmsb$a\\xdd\\xd1\\xdb)\\xfe\\xe6\\xa2\\xb1\\xad\\xfc\\xf6\\xf8\\xb7\\x97\\xb0\\xb6h\\x05&^\\xb6es\\xae/7~\\xf6\\xbb\\xcdu59-\\xd8\\x8d:\\xd9\\x0f \\x0bd!\\xd8~\\xf9?\\x02\\xb2\\xa7\\x8f\"d\\xb7\\xc4\\xc8\\x04b\\x81wt_\\xd4r\\xf3k\\x04\\\\xdc\\x18\\x99\\xc0j\\xa8\\xb6h\r\\xaf6\\xb5v\\xf6\\xce\\xc8\\x04\\xae\\x00>\\xc9\\x1d\\x9e\\x9bp\\xdf(\t\\xe1\\xca<\\x8a\\xdfzz\\xdc\\x97\\x8f\\xd2\\x95\\xda\\xf9\\xc4g.\\xcf\\x1e\\xba\\x03\\xa8o\\x1b<\\x1f\\xc3\\xe4\\xb2\\x9b\\xcf\\x8d-\\xe6\n\\xb8b? '\\x85\\xc3\\xfd\\xd5\\xffe\\x1a\\x1e\\xe3\\xf8\\xcb\\xd1e\\xdd\\xeb\\xf6`\\x933\\xdac\\xa7\\x10%\\xf8\\xf7\\xf0\\xc6\\xde\\xeeq\\x04l\\x9dz$\\xf3\\xe6r\\xbe%\\xea\\x95ox\\x82`\\xdc\\xdeq;\\xbe\\x11\\x9f\\x0b\\xd9asc\\xed\\x10\\xfa\\xd5\\xb97a@\\xbf6\\x06\\x93\\x8ax\\xa5^=h\\x03pg\\xe5,\\xc1c\\x88\\x8f\\x0e\\xbe\\x9da\\x87\\x02\\xebv\\xc9\\xac,\\xa5\\xbc6\\x13"
  549.  
  550.  
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t8\\x06\\x8e\\x90\\xca\\x8c,\\xa4\\xc8<s9\\xe51\\x8c(\\x96\\xc7\\x08\\x0cghc\\x1f\\xc4<\\xca\\\\xd5\\x84\\xe7\\x9da\n;\\xce_\\xdf\\x1e\\xeb\\xcb\\x10\\xb0\\xc7\\x7f'\\xe3\\x16\\x84\\xe8w9\\xbb\\x8aj$\\xa2\\xa5\\x96\\xeb\\x8av\\x05\\xf1oz\\xdbe\\x08\\xe8\\xa7\\xe1\\xf8\\xe0\\xd4k9\\x06\\x04\\xb9\\xf8k`8\\xe2\\xbd\\xd7\\x12\\x01\\x06\\xdet\\x19\\x0e\\xd4\\xdbu4\\xf4\\xdc\\xc7e_\\xc7\\x07\\xe8\\xe4r\\xa8\\x12=\\xbas\\x8c\\xf2\\x0b\\x9c\\xf0k\\x9cpg\\xac\\xb8\"?\\xb8\\xc5\\xc3\\xd4\\xd1\\xe5\\x8b\\xcd\\x81\\xff\\xcfq\\x12l\\x1b\\x8d(\\x93\\xc4@x\\xc2\\x1f\\x14\\x82\\x80\\xca\\x825z\\xe5\\xeb\\xb3\\xc6\\x12\\x7f\\xf2\\x16c\\xaa\\xc7v\\x83\\x8at\\xfd\\xc6\\xfa\\xf4#8q o\\xc4\\xb1\\xc3k0\\x19\\xd3\\x08\\xf6\\xa3\\xc3l\\xdf+\\xa6\\xfd\\x8b\\x810\\xd4\\xfd\\xbb\\x92\\xe6n3\\xe7\\xfe\\x0e\\xe7\\xd7\\xean2\\x0c>a\\x10\\x1b\\x9cg\\xc2\\x9d'\\x94\\xb6\\x94i7\\xeb_\\x159\\xe677\\xa4b\n\\xf7h\\xefy:\\xd1~\n\\xdc"
  552.  
  553.  
  554. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4w;\\xe0\\x8d\\x1d\\xa8\\xb6\\x81\\x0e\\x7f\\x1b\\x90\\xc0r\\xcc\\xf9\\x80\\x89f5\\xd8k\\xe0\\xad\\xa4/\\x90\\xcc\\xd73\\x04\\xd4\\xc3x\\xb5\\xf2\\xef `\\x9a\\xc4c\\xbb\\xe2;v\\x99\\x11\\xad\\xc2!\\xecl\\xc8\\xa0\\x15\\xa5xd\\x06o\\x0c\\x82\\xe5e\\xf5\\x1a\\x9b*\\xcf\\xf4jd4a\\xbb\\xa7o\\x9c.\\x85\\xa0\\xfe.\\xe4e\\xe9.j\\x90\\x86\\x8f\\xcd3\\x1e1k\\x8e\\xec\\xcd\\xb4\\xc6\\\\xdf\\xa3z3a|\\xf9wj\\x1e!\\x90t<\\x1cs\\xc6\\x0bh\\xb4\\x97v\\x97\\x1dt\\xb6('\\xcb\\x05.\\xe1\\xc7\\xbd\\xda\\x1e\\xa4\\x19\\xf5\\xdbrq#b\\xbd\\xcd\\xacl\\xbb\\xa7\\xc7\\xceaa\\x8a\\x96\\x18\\xd7g\\xf8oh|\\xfcmc\\xb3\\xd7_\\xc8\\xa8i\\xe8ssj\\xc3\\xe5:\\xc7/\\x93k\\xd7\\xff%\\xad\\xce\\xa7$1\\xec\\xa9\\xf3\\x15q\\xeb\\x9f\\xc0i\\xde\\x8e\\xb0\\xa7\\xb3\\xcdv\\xc5\\xcc\\xf9\\x19\\xc4\\xe6\\xf3\\x00\\xb1lv\\xb4f\\xfey\\xa4+\\xf0kv\\xd6\\xb8\\xa2\\x0fn?\\x9bo4<\\x96\\x92\\xf1\\x7f)"
  555.  
  556.  
  557. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-9 \\x8em\\x14\\xda\\xde7\\xcbk\\xff\\\\xe8\\xa4\\xb2i..\\xf0\\x05\\x8eb=,\\xeb\\xc4f\\xed\\xa6g\\x0e\\x91 4,pd\\xd3\\xec\\xbf%\\x0e*\\xec\\xd4\\xff\\x88\\xbc\\x9e1\\xb0\\x11h\\xcf\\xb22\\x06\\xaei\\xd1\\xa9.\\xdbr\\x05\\x1c\\x9ah\\xbc\\xd5x\\x1d>\\xcc\\xf7\\xb7\\xd4\\xdf\\x03@\\xca\\xb5\\xc6z\\xb5\\xe7\\xbal\\x89+$\\xc4o\n\\xe2\\xdbk\\xfe!\\xe3\\x8c\\xfe\\x91,\\x1c\\xd5\\xaar\\x14\\x8b\\xbe c\\xbb\\xbb\\xa3\\x80\\x04\\xcd\\xa1\\xe9\\x07\\xe8@tw\\x01\\xaaw77*>\\xae\\x14\\xa9\\x8f\r:\\xe0o\\xc7\\xb2\\x8c-\\x0c\\x9c\\xe2\r\\x17\\xb0\\xa2\\x15$\\x84\\xd1\\x13pw\\xe0h\\xf2\\xd0\\x1d;2e^7\\x82\\xcf\\x8f\\xaafs\\xd2\\x86\\x14\\x11\\xe5q\\xdd\\xb6\\x93\\xf5e\\x07\\xbc\\xbf\\xae\\x00\\xc4\\xc0\\x07w\\xee\\x9f\\x19~\\x83rq\\xb7\\x089\\xecs\\x12\\xdb\\xb7\\x92\\xe8r\\x86!\\xb7: mm\\x16\\x82\\xac\\xf2`lh\\xea\"\\xd5\\x81:1\\x1c\\xfcr\\xf3w\\xd8\\xaf\\x13\\xa5x\\xf9\\xed\\xfd\\xdf"
  558.  
  559.  
  560. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xbdq\\xf9?\\x91;9\\xbd8(\\x7f\r\\x00\\x1a9g\\xa6\\x14\\xb7\\xf6\\x0e\\x1e\\xc0\\xbf\\xe0\\x96\\x7f\\xa2\\xab0au\\\\xdd\\xe4p*\\x93m\\xf5\\x10\\xd4+\\x0e`\\x90by\\xb7\\x92\\x12\\xacf:n\\xac(w7\\xa10\\xca#\\x84.\\x8c`\\x85\\q\\xf6\\x03\\x05>l\\xc0n\\xa3\\x14\\x1fdx\\x88\\x19j\\xaak\\x90\\xa0;\\xb4\\xe5\\x9a+0\\xf0\\xd3\\x8f\\xee+$p\\xfb\\xf2\\x80r\\x7f\\xd75\\x98\\x1c\\xc5\\xb7\\x9dr<c\\xcft\\x05\\xdbo\\xe1\\xa9_e\\xb1\\x1at;z\\xc7\\x95@\\x8d=\\x8br'\\xe8\\x00\\xb4\\xc2a9#%\\xcc\\xf4\\xd1\\xd1\\xdf,t\\xf1m\\xd8\\xf1\\x1c\\xd6l\\x97\\x1e\\x14:pv\\x94\\x82(\\x96oi-\\x1f\\xde\\xc4\\x1d\\xbb\\x8bh\\xc6\\xf8\\x90\\xb4\\xac\\xd4\\x86\\x9f\\xc6dp\\x8b\\xa2-\\xd9\\xe6;\\x8e\\x91\\xeao\\x84\\xa2\\xe7\\xd2\\x84\\x93ar\\x95\\x86\\xcb\\x7f\\x1e\\xb1\\x1c\\xef\\x854\\xc1\\xeb\\x0b\"/n\\xeb\\x11\\xcb\\xeel?nf\\x10'\\xf5x\\x88k\\xa71w!\\xb7\\xa0"
  561.  
  562.  
  563. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\x90\\x96t\\xad\\xaf\\x15\\x97\\x91\\x02\\xc01\\xfaws5\\xfe\\xf4\\xa7\\x9f\\x0b\\x84\\x98\\x08\\xbakq\\xb6\\xa5\\x99\\xf0\\xff\\x89\\x7f\\xbag\\xcf<\\xa2\\xd2\\x9ag>zu\\x06\\x0f\\x7f\\xe1\\xcbo\\xdf\\xd4<\\xc4d\\xae\\x02\\x93\\x9f~\\x1d\\xc9x\\x15\\xd1u\\xe6\\x9ci<v\\xdec\\xab3\\xac\\xb8\\xeb\\xd98o\\x13?\\xbd\\xc6\\x847\\xe5r\\xb3f\\x1bj\\xa7\\xce>\\x82\\xd3\n\\x887\\x13s\\x9a\\xb8\\xe2;\\x01$x\\xc5\\x17\\xc6s\\xda\\x01\\x807\\x97\\xd9u\\xdd\\xb0\\xf7\\xec\\xb6\\xcco\\xf1\\x9b&\\xb1\"\\xfap4\\x7f \\xb4c\\x86\\xbc@\\xe3\\xd5\\xb9\\xac\\x9b\\x11#\\xc0@\\x94/\\xed\\xfd\\x18\\xf4\\xa9>\\xd6i\\x88\\xaf;xvs\\xa4\\x10\\xbc2\\xdf\\x9di\\xc37\\x8e\\x85o\\x98\\x83\\xdf\\xb2,\\xf3\\xfb\\xad9i\\xc2\\xda\\xb0.\\xbc\\xf52\\xb2\\x18\no4=\\x9c\\x96\\xaf-\\x90\\xb9d\\xbe\\xa4\\xe6x\\x05\\x19\\xb6\\xd3\\xa9\\xa5vg8\\x1a<\\xee\\xdc\\x90\\x0e\\xc0m\\xe0\\x1e8\\xa8\\xaa\\x8e\\xb3(\\x03wz\\xb4\\xa9\\xdc*"
  564.  
  565.  
  566. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\xdf\\x15\\x1c\\x0f\\xe4s\\x89\\xc4\\xb4\\xa5p\\x92\\x84\\xeb$\\xba-j_\\xcar\\xa5*\\x1d<\\xfcdv\\x82\\x9b\\xf4\\xd4x\\x0c\\xd6o\\xfb\\xe8p\\xae\\x92#\\x94\\xf3\\x18\\xb8\\xa5\\xd3\\xe1\\xc8\\xf9e\\xa8z\\x1fp\\xc5\\xc9q4\"x\\xf5\\xc4\\x88\\x0e\\xe9\\\\xd8\\xfd5w(!\\xbcn\\x90x\\x8e\\xecu\\x88\\xa4\\xdc~\\xdc\\xeey\n\\xe5uu$\\xe2\\xce\rs1\\x16\\x11g\\xd8l<\\x91\\xa9\tl2\\xf1`/\\xedn\\xf8\\xba`\\xf3\\x06\\xd9\\xbe\\x9e\\x8b\\x88\\x14\n\\xfd\\x1b\\xba_\\xdc\\xb1\\xc2\\x04>\\x98\\xcd`^\\x16\\x15nc\\x18\\xbb\\x01\\xa4\\x14m\\x1a\\x12\\xc8\\xc5\\xf1\\x8e\\xb7\\x12y\\xa7a\\x92wr\\xa3\\x97(\\x97*u\\xa8\\xeb\\x83\\xa7\\x06\\xde\\xfe*\\x98\\xd1=v\\xb3\\xaa\\xe4\\xe1z\\x15\\xce\\xd2\\x08\\xbb6x\\xee\\x95sjk\n\\x8c\\xd3\\xba\\xf5\\x8ag\\xb6\\xcf\\xe1\\x00b\\xad!\\x80\\xbc\\xd2\\xef,\\x98c\\xc2\\x84\\xe8ix\\xeb\\x89\\xbd\\xd00c\\x1fhj\\xca\\xbe\\xeb\\x0f\\x801\\x8a$\\xf1%\\xee\\xab\\x1c\\x0b3"
  567.  
  568.  
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010me:\\xed\\xa4\\xc2\\x1e\\xde,<\\x91~b\\x16f\\xd7d\\xec!\\xb7i\\xec\\x8d\\x9e\\xefa\\xf0t\\xcc\\xebx\\x15<\\xa1(h\\xe9\\xa3\\x1d!\\xed\\x06\\xc8\\xc2\\x94\\xaa\"\\xf6\\xac:u-r\\x9d\\xce\\x97$ zd\\xf7(@\\xf9\\xe0\\xbf>\\xd6\\xa1e\\x98\\xd5\\xba\\xe2\\xbcj1\\xf1\\xcer\\x93rq\\x19+\\x89#\\xf2\\x83\\xb1\\x19\\xcau*\\x1e\\xfat\\xb8\\x07\\x10\\xd37\\xaewp\\xd8\\xf3\\xc3\\xf6\\xc5\\x90\\xb3\\x0e\\x10=a+\\xf4\\xe9vo&\\xfat\\x90\\x89\\xdd\\xb5\\xc9\r0afr\\xdf\\x9e\\xf3m\\xaf\\x96\\xc7\\xfe\\xb7\\xc8\\x9e\\xe9\\x98ng\\xfby\\xe7\\xc34-\\xf4c\\xa5\\xb2\\xa0+\\xd3\\xe2~\\xb6\\xd7?=\\xa7\\xac\\xa23\\xab\\x87\\xdd\\xac\\xc6\\x08\\xc7j\\\\xd6\\x81\\x1cc\\xd6;\\x13\\xbd\\xc9n,\\xf8\\x85\\xee\\x9a\\xb9\\x90j\\x1c\\x1c\\xc6(\\xbb\\x7f\\xa9\\x84\\x10\\x896\\x1e\\x15\\xb4\\xc3\\xca\"\\x97c\\xea\\xdc\\xfe\\xbfnt\\x18\\x96\\xd5\\xfc\\x19+\\x9f\\xf2\\xfa/\\xb1\\xa5\\x8b\\x17\\xd4\\x96\\x00\\x9f\\xe9\\xb4\\x10\\x99"
  570.  
  571.  
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7k\\xda%6\\x9bg\\xf8a\\x91\\x93\\xc4\\xfc\\x8b\\xa9\\xbb\\xa2\\xcd\\xe6/b\\x9ff\\x1b#\\xe3\\x02\\xf8ov\\x01zy'd\\xd5\\xc3\\xeb\\xc1\\x17\\xb1\\0e\\xbb\\xf3\\xbbi\\x15w\\xf1\\xccu\\xfc\"j\\xb9\\x0e\r\\x84$\\x13dy\\x9fi\\xec\\xf6\\xa8\\xa5\\x99u\\xeczdx\\xde\\xf0\\xee\\x9e\\xa2\\xa9\\xaby\\xb6k\\x82_\\xecs\\xa2pfy,\\xb4\\x85j\\xb22\\x9b\\x9b\\x84\\x1a\\xce\\x14\r!\\xf1\\xc1\\x8b\\xd0\\x1c\\x12l%\\xc7\\xffd\\x18\\xff\\xfd\\x80\\xf1n\\xa0\\xf2mv\\xaf(\\x97d\\xbbd8_aw\\xf7\\x19\\xd8\\x1f\\x8e%\\x831c\\xf1\\xd0r\\x8a\\x19\\xd4\\x15\\\\xa8\\xe8gm</\\xe7\\x0e\\x1c\\xe2\\xfb\\xef\\xa0,r\\xa3j@\\xf5)h\\xd6\\x1a\\xb5p\\x0ba$a\\xa5\\xb2jr\\x0c\\xab\\xa4k(\\xbc\\x97\\xf8\\x81\\xa1`\"\\xdc\\x1c$\n\\xcf\\xc3\\x03\\xcf\\xb0i\\xe5\\x90\\xab&sr\\xf6\\xed-w\\xcao-o\\x83|<\\x8e)\\xd5\\xf2\\xb4 k\\x04\\xd0d\\x94\\xa0\\xecj\\x10\\xc4i\\xf48.\\xb5"
  573.  
  574.  
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104j\\x9eae\\x01\\xa9\\xf5\\xa9\\x84\\xfa\\x8a+\\xa7\\xaf\\xc9pg\\xe6\\xd9\\xb7\\x95lkc>\\xa9\\xa2\\x81\\xdd\\xfb\\xc4\\xfe\\xe6h\\xfc\\x14\\xdde\\xa4\\x02x\\x1a\\xe9\\x0e*\\xf3\\xba\\xe8(z\\x9d2(\tz\\xc9b\\x96\\xfem%\\x87\\xdf3\\xd38\\x90\\xfbp\\x98p\\x13\\x15\\x1e\\x1b\\xccm\\xb3\\x96\\x95\\xcf5\rz\t\\xb1\\x83\\xe07~ng\ty\\x93l`\\x14\\%8?\\xdb6\\x15\\x90\\xb7hy\\x8f*\\xa0\\xd4,\\xa4k\\x15h\\xfa\\x80;\\xbd\th\\x11c\\x1fy\\xdc\\xb0;\\x7f\\x1cg`o\\x1d\\xd3\\xc6\"\\xd5cu\\xb61d5`\\xec\\xf1\\xfc\\x9a\\xc1<<\\xfd\\x04d\\xd3\\xcbf\\x99\\x98i\\\\x87+\\xfb\"\\xd5\\x17\\x9e\\x13\\x98\\xb3\\xb1\\x97\\xf6\t\\x7f\\xcfb\\xb3\\x05j\\x19#y\\xed\\xd4rs\\x10\\xb3%\\x9cf\\xa0\\xdc\\xf8\\xe8,4+\\xa10\\x89\\x0b'\\x82\\x83\\xe1\\xf5\\x92w@\\x18%\\x06\\xbb\\xbbp\\xf8\\xfa\\xdav\\x80\\xb7\\x9e\\xaf\\x8d\\x07#\\xbe^\\x94\\x91\\xa6!\\xb0-\\x02\\x04\\xa4\\xfe\\xaew1"
  576.  
  577.  
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\xe4\\x19\\xded\\xeb\\xf6\\xde\\xa7\\x03xe\\xf6\\x06\\x80\\xb0w\\x19\\xf6\\x08\\xa5\\xb0&i\\xf8\\x0c\\xcc\\xecy)\\xa4\\xc2\\xde\\x0f\\xdf\\xc1\\x12\\xab\\x11t\\x84b\\xf6\\x12;\\xd3\\x8f6\\xc2\\x17\\x03\\x1a\\x83\\xbei`\\xe7l1\\xe0e\\x0e\\xe8(\\x95\\xba\\x1f\\xa9\\xfc=\\xd5\\x87ubg\\xf2\\xd5<\\xde\\x01\\xf6\\xa4f_\\xe8\\x88k\\xb9\\x8ch~a\\xa1\\x0c\\x12*\\x10%\\xf8\\xb2d\\x1e>\\xcb\\xf5\\xb7\\xc1+p'\\xf8\\xe2\\x1f_\\xef\\xad\\x02\\xdb\\xd5\\x15l\\xa4\\x12cj6\\x98\\xf7\\xa0(@\\xaa\\x06\\xc0di\\xee\\x1e\\x82q\\xbc\\x00d\\xc6\\xdc\\x87\\xcd\\xb0_\\x08\\xa8\\x8b*\\xdb\\x03\\x0b\\x16o\\xcez>`@\\x86\\xc90\\xa5k\\x810\\xb0f\\x11\\xb8\tc3\\x8bt\\xe3\\xa3\\x1f\\xf6\\xd1\\x86b$\\x9d\\x84mj7\\xa7\\x0c`l?\\x8f2\\x7f\\xcb\\x08\\x8d\\x9e\\xee\\xdd\\xce\\xbf\\xb7\\xee%l6\\xb2+\\x02l_\\xc4\\xb3\\x99\\x01\\xdahbp\\xa9\\xfb\\xf6\\x80\n^\\x8d\\xa8d\\xa3\t\\xfb\\xaa\\x95\\xb4\\xd3\r'8\\x85\\xa5\\xe8\\xa0"
  579.  
  580.  
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4\\xda\\l\\xa5\\xce\\x98\\xd9\\x9e(\\x0et\\xc5gu\\xa3,\\xb0\\xec=\\x7f+\\xf9\\xe5\\xc0\\x03\\x9c:\\xc4\\xe8\\xd9\\xf8yc~\\xe4\\xa9(cdz\\x01h=\\xec\\xf3\\x16j\\xed\\xaa\\x86\\x93\\x99\\xfe1\\xa3\\xd1\\xc2\\xe5\\x05w\\xbeh\\x95\\xfb\\xd0\\x96\\x03j\\x11?)\\xecug&\\xd8\\x0c\\xb3\\x83:\\x1c\\xaday\\x1a\\xa7u\\xf7\\j\\x98\\xed\\xd6\\xba.\\xbd\\xd7\\xa8\\xeao\\x85\\xa1\\xdc\\xf5\\x8bd8\\xdc\\xf9,\\xec\\x83\\x8b\\x93\\x9eilsp\\x92ht/l\\x9f \\x17m.\\xf1\\x13\\xd1?\\x12\\xc4d\\x1b3\\x9a\\xce\\xed\\xe9\\x8eq\"~e\\xb0ypy\\x99,\\x7fa\\x8cjd\\xe6\\x19b<\\xc3a\\x17^\\x96p\\xd8\\x1e\\xf0\\xef\\x98h\\xf9\\x9az(\\xca\\xe8\\xa5\\xc1\\x03\\x90\\xd6\\x06\\x98\\xfclj4n4t'xh\\x06m\\xd7\\xcf\\x1fx\\xdat\\xe6\\xde\\x8d\\xb0\\xbf\\xc6\\xc09\\xcb\\x08'\\x7f\\x04\\xdc\\xb9&\\xe1\\xfd\\xf9\\x07%\\xc1\\xe1t\\x03\\xdc\\x15j\\xd4\"l\\x94\\x8e\\x19(\\xfa\\xe7g\\xa6<`\\xdf"
  582.  
  583.  
  584. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xce\\x9e6h\\xd9\\xd2z\\xd3\\xb6\\x0bi\\xe9\\x80\\xb0\\x0c\\x8d\\xa9o\\x8c\\xf3\\xc6h\\x89\\xa1e\\x8e\\x85*\\x83kh\\x0f?kh\\xfc:\\xf2\\x9f\\xa5:\\x8e\\xd8\\xacep\\x06\\xf0\\xde/q\\x8au\\x15\\xaf\\xe1\\xc9a\\xf1d|\\xfef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 \\xf3\\xecr\\xabvna\\xc9\\x1c\\\"\\xe7\\x95=\\x0ee\\x1a\\x9c\\xef*\\x9c\\xb4\\x17mx\\x9e\\xf7\\x17p\\x0e\"u\"u:\\xdbtk\\xbd\\xcc!\\x95\\xc8\\xc8+\\xd5\\xb4"
  585.  
  586.  
  587. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xecv\\x10\\xd0j\\xfb\\x8d\\xc4\\xb2\\x1dw\\xf7\\x08\\x0f;\\xc9x\\xf7\\x91\\x96\\\\xb6\\x86\\xf86\\\\xcb\\x96#\\x06\\xb7\\xf0\\xa4mv\\xf9p(kllc\\xfe\\x0b\\x15\\xc5\\xc3\\x88\\x96\\xd2l\\xd1\\x81~\\x80\\xc1\\x98\\xcf\\xc5.e\\xf7\\xa3\\x91\\x1d\\x8f\\x14\\x81\\x90\\xc4p\\xbc3k\\x1ey\\xdb1y\\x85\\xb7\\x8a_\\x02\\xd2l*\\xc9\\xa57$\\x82n^\\x94\\xc3\\xb3m\\xaed\\x11h/\\xe0\\xd3_lx\\xa3\\x0f_\\xa5\\x1b\\x0b\\xaap\\xae\tsz\\x94\\xa9\\xe0\\xb0p(\\xdf`\\x88wv\\x13\\xef\\x06\\xcbw\\xaem\\x8cn\\x15x\\xd1)g\\xa6\\xe9\\x05ke1\\xcb\\xd3\\xc4\\xe3\\xd5\\xf5\\xad\\x8f\\xbb\\x8bn\\x89mf!<\\xfad\\xa3\\x86x\\xe7\\xd5\\xf2`l\\xc8i$eu\\xf7\\x16\\x18qz\\xcdj\\xa6v\\xe6\\xef6c\\xf6\\xcf\\xdc\\x1e\\xcf\\xcf\\xbf.\\x90\\x12\\x19i\\x94\\xd7w\\x9c\\x8ap\\xc0g1;\\xc9\\xd7'.\\xbc\\x1bw\\x14kc\\xe9ov\\xa5\\x82\\xab\t\\xd4\\x92\\xfb\\xb4\\x8c\\xaa\\x9fx\\x8e\\x18\\xba\\x1b"
  588.  
  589.  
  590. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x94\\x1a\\xea\\x1a\\xaa\\xf6'\\x86\\xfc\\xa5t\\xf4\\xc7r\\x81\\xa9:dq\\xc3\\xbbw\\x03\\x90\\x1en+cjn<\\xe7\\xfb\\xd6gbq\\xfc\\xcb\\x1bj,p\\x9d^=\\x8d\\xd071_=\\xe6\\x8b\\x12\\xa4\\x80\\xc9n*\\xcarl\\xdb\\xe9\\x8e\\xa6\\xe7\\xb5\\xc4\\x93b%\\xf6\\x93lx\\xb2=ue\\x01\\xa6\\xac\\x00\\xfaj?\\xa6\\xc9\n\\x89\\x90m\\xc5\\x0b\\xa6\\xee\\xa1\\xf4\\xb8\\x82\\x1b\\xc1\\x93\\xbc\\x9ao\\x8d\\xfd\\x81\\xe1\\x0b\\xebw\\xe3\\x18\\x9b\\x91&\\x95q\\xcc\\xf0\\xa7\\xff\\x9cx\\xa9\\x92\\x08\\x0c\\xb4\\x8d+\\xff\\xa1\\xdb\\xc3z\\x0e\\x8c\\xad\\x0e\\x02\\xac\\xaa9\\x07\\xa4\\xba~l`\\x0e\\xaa\\xe1\\xd6\n\\xcb\\xb59\\x9c\\x92\\x95\t\\xc3\\x86\\xe9\n\\xf1d\\x14\\xd6\\xaex\\x02\\xb9\\xcf4p\\x05\\x0cl\\x07\\xb2~\\xd0\\x98\\x84\\xb9\\xd1u\\xbb\\x19\\xa4\\x1dp>/\\x0e\\x8b\\x17\\x85(\\xf6\\x848~\\xad\\xc5d\\xb3`\\xa2\\xcdf!\\xdb&\\xc0*+ \\x89\\x1b\\x0c\\x1e\\x9b\\x1d~6<*0g\\x07\\xe5r\\x15\\xc1\\x13\\xa8\\xb7\\x06\\xc2\\xf8\\x95\\xb3"
  591.  
  592.  
  593. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbfp21\t\\xc0\\xf5(%\\xdd\\x18g\\xde\\xe1y\\xae\\xcb\\x86\n;\\x8c\\x16n\\xdb\\xcb\\x06\\x00\\x86\\xe1\\xb7\\xe8\\xa2q\\x15e\\xf1\\x02\\xe0*\\xa9\\x1f\\xb8\\x8c:ws#=\\x8b\\x074u\\x0f\\xfa\\xcdd\\xf5\\xc6c\\xe9\\xdc\\x0e\t\\x19\\x9fo\\x93n\\xcd\\x14t\\xcc\\x8auly\\xe3l/1c\\xbe*\\x84\\x83~\\x8f\\xff\\xa9\\xcf\\xcae\\xc9\\xa6azt\\x94\\x11\\xa6\\xd3m\\x87\\xc4\\x8f\\xfa\\xcf\\xfc\\x93\\xfd\\x17\\xe4ihk\\x19\\xa0\\xb2\\xb3*j0\\xebw\\x8e:b\\x17|\\x8f\\xcc\\xa3`\\x1cyg\\x0f>\\xc1g\\x08i\\xf9h$\\xa7\\xc2\\xf7/z<\\xd3\\xf4\"\\xdbt\\xc9\\x0c\\x92\\xd19\\xa1\\xa9\\xd3\\xb6\\xf7\\xa9\\xb0\\xb76\\xe5\\xabx\\x8fs\\x08+\\x98\\x04\\x82\\x84\\x08eb;v\\xd5\\x8a\\xbfp\\xf9 n\\xd7\\x84\\xb93~vu7\\xd1\\xea\\1\\xa3\\xe2g\\x95\\xd8\\x1f\\x93\\xad'\\xfe\\xe02\\x11\\x12u^8pdl/\\xc5\\x8b\\x0b\\xa1\\x92\\x81wc\\xad\\x9cx\\xf8\\xce\\xbcw\\xd2\\x15\r\\x8ep\\xb1"
  594.  
  595.  
  596. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\x9as\\xd9zdk\\x02cu\\xf8\\xf3\\xee\\xea\\xf9\\xeb@w\\x03\\xb9\\x9f\\x98\\xc8o\\x0e\\xb7\\x80.x=q/q\\xe8.\\xd2\\xe0\\x80\\xcc\\xc8w\\xd7\\x19i\\xfa\\xa7\\x0flq=\\xf8w\\x9e\\xd1p\\x92e\\x8dhj\\x829\n\\xf2\\xde\\xf5\\x16i\\xe7&\\x8d\\x12+\\xfc\\x97\\xa0\\x19\\xae=\\xe1\\x99\\xb9\\xa7j\\xec1\\xb6\\x9f\\x8b\\xc0\\xd5n\\x14\\xca\\xcfi\\xba\\xb0\\x8b;\\xdcjk\\\\xbd\\x8e\\xda\\x022%\\x049\\xb7\\xc4b\\xaf\\x13\\xd2\\xce\\xfd\\x0f\\xad8\\xe8f\\x83+\\xa7\\xc5jia\\xcc\\x19\\xdf\\xdcq\\x81\\xd1\\x7f&\\xe9ri\\x8c\\x1ch\\x11\\xb37\\xb00\\xee\\x0f\\x9a\\xf6\\xb6\\xe3\\xd7\\xef\\x915_\\x8d\\x84e\\xf5n\\xdd%1\\xa3\\x1b\\x8d\\x8d\\xbc~$\\xba\\x9f\n\\\\xd7\"\\xd5\\x99\na1\\xfb\\xd9\\xa7\\x8a\\xa1\\x05\\xa5\\x81\\x98\\xdfd\\xea\\x83i\\xcb\\xba\\xbb,\\x9c\\x91p\\xef\\xb2\\xbe\\xcc\\xa9\\x99\\xfb\\x0b\\xc2m\\xb1|\\x9d#\\xcd*(\\xd1\\xbc\\xc3\\xb0\\xad\\xc7\\xe7\\x8ec\\xa5\\x9c\\xf4\\xe7\\x94^%p\\xb4\\xb0d\\xa2c"
  597.  
  598.  
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1\\xa6\\xd6\\xeb\\xf5\\x9c\\xd3\\xcb\\xf4f\\xc4\\xa1\\x10\\x11\\xd1x\\x14\\x08n\\xf3\\xd4\\xe8\\xa56e\\xc9-^u\\xf4ti\\xa0\\xd8\\xb3\\x8a\\x1b\\x80\\x0e~\\x95uob\\x07\\x90\\x9er)~v3\\x01\\xd2\\xf1\\xc6\\x18c\\x05\\xe7\\xaa\\xfdm\\x9b,\\x17\\xbe\\xa4\\x9f\\x98d\\xd5h\\x03\\x1f\\xcdv5\\xa1\\xeb\\xed\\x86\\xb2\\x133\\x11\\xdd\\xe7\\x0f\\xcbw'g\\xf2\\xf0\\x03\\xee\\xc7\\xdd\\x11n\\xc0\\xb5\\x83\\x00\\x7fl\\xeb=\\xe5\\x9b\\xac;q\\xb565\\x90\"g\\xeb\\xff\\xfd\\x1c\\xb2k\\xb9\\\\xd3\\x14@\\xeb\\x82s\\xc5\\xe5\\xd7\\x074\\x92\\xf6\\xefm\\xc7\\xda\\xf1\\xb3\\x92\\xc7!\\xd3\\xcd \\x90\\xe7i6\\x92\\x9d\\x01\\x9cxq\\x7f\\x87\\x80lf)\\xec%%\\xb5\\xf7\\xb0\\x8f\\xe1\\x15\\x9d\\xee\\xdek\\xa1\\x8e\\xd4-\\xd4\\x87^\\xcb\\xcd\\xdc\\xcc\\xd2\\x8c\\xbd\\xe1\\x19\\xcb\\xdf\\xf5\\xe2\\xd8\\x148q\"\\xdc\\x96^\\x87\\xc9\\x10+o\\xed\\xd7d\\xab\\x1c\\xb3m(l/e9\\xd6\\xb2\\xf6\\xaa\\x1f\\xb0\\xd7'\\x1dz\\xfc\\xe8/8x\\x16e\\xb8\\x89\\xf4\\xd4"
  600.  
  601.  
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\x10\\xd4\\x83\\xe9\\xd1\\xda\\xe0\\xb9\\x9do\\x1b\\x1b\\x08\\xea\\xb3\\xfay\\xc00\\xd8\\xed\\x83$\\xd8'\\xf1n\th\\xcd\\x8c\\xafq\\x06f\\x1e\\w\\xae\\xc1\\x87\\x1b\\x933\\xdeo\\xa7\\x1d\\x94\\x9b6ok\\xc4\\xa0\\xf9\\x1c\\x85\\c\\x05\\xef\\xc0\\xf8\\xea\\xdeo\\xa3\\xac\\x94jf`\\x1bq\\x0c\\xfd\\x1d\\x0b1\\x81\\xfe\\xc8\\x8c\\xa9\\xf83\tb\\x0b,\\xb5\\xf3y\n\\xac\\xbdh\\x9c\\xec\\xdeh\\xc7\\xf7u\n\\xfaqco\\x89.\\x86\t1\\xe36`l\\xdc)e=d\\xdfj\\x8d\\x9bi\\xb9,\\x0f\\x8f\\x86\\xff^p-\\xed>\\xf3\\x8d.\\xfa\\x99(\\xb0z\\xd9\\xebr\\xf6\\xf8\\xb2,u\\x1b)'\\x80\\xdfy?h-\\xcd\\xb8\\x00o\\xef@\\xcf\\xab\\xe1\\xf8!6~\\x10v=p\\x9aia\\xb4\\xda\\xdf\\x9df\\x8b>\\xdf\\x1a\\x9c\\x8c\\x1dko\\x80+\\xc6\\x9b\\xeb\\xe7\\xeb\\x8d8%\\xd9r\\xfd.\\xdc\\xb8k\\xf4\\x83\\xd0*\\xed\\xfd\\xd0\\xa1u\\xc7\\xea\\xe3\\xb6b\\xab'je\\xd6\\x81\\xaf(+tc\\xa6\\x80'"
  603.  
  604.  
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc2l\\x14\\xea\\xa6\\xd4\\x12+\\xf0\\xc2i\\xc0\\xe0\\xd5\\x99\\x01\r\\xe6wlr\\xa7\\xa7\\x17u\\xc7\\x825\\xe2w\\xe7\\xc3\\xd8\\xd19\\xb6+\\x99\\x99:#\\x9d=uo\\xcdh\\x7fg\\xa7y\\xdc|\\xe6\\xcd\\xfa3\\xe5\\xba\\xf3\\xbfw\\xa5\\x86o\\xbbz\\xe3\\x14\\xe8\\x98@\\xcds\\xdfa\\xbcs\\x8e\\xb5\\x1f\\x18\\xd9\\xa6\r2\\x7f\\xe4\\xf7\\xb3\\xc1<q\\xf0\\xb5\\xd1\\x12\\x95\\x04\\xe0?c\\xe0\\xcc_\\xb12\\x8c\\x1a\\xb8\\xe4s^\\xe3\\x12=\\xe0+>\\xe3\\x83'\\xbfk\\xe6a\\xdb\n\\x1c\\x91\\x94\\xf3x\\xb5\\x0b\\x0e\rv\\xab\\x9fp\\xefk\\xe5\\xb6\\x15\\x96\\x89\\x19\t\\xedi\\xea\\x8bi#\\x1f\\x16h\\x11\\x16\\xb0\\xa3\\xe9\\xba\\x8c\\x1e\\xc30\\x17-\\x02e\\xbf\\x98\\xf9\\x0bk\\x95\\x88# \\xbe#`g\\x11\\x87\\x8d\\xcc%o$\\xcfy\\x85u\\xa3\\x11a/\\x98y2/4\\xb1|\\xc3\\xef\\x12\\xa7\\x8a:\\xe6x\\xbb\\xe9\\x88\\xfb+\\xf5\\xce\\x06n\\xe3m\\x91\\x93\\xdd\\xe5+`\\x1d\\xa4\\xf2do\\x8e\\xbb\\x80\\xd7\\xc8\\\\x16s\\xd3"
  606.  
  607.  
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\r\\xcc\\xfdud\\xcd\\xe1u\\xd1gv\\xa3\\xbb7y0(i\\xc1v\\xdb\\x06y\\xcb\\xe5\\x1d\\x9d\\xf3\\xf5\\xfd\\x1e\\xd2\\x9e\\xdc7r\\x19)v\\x93\\x92\\x84\\xb5\\x812_\\xb7q\\xfd \\x90s\\x85\\x1d\\x8d-\\xb4\\xf7\\xbf\\xc4^e\\xe3w\\x08\\xce\\x9e\\xd2\\xdfyx=i\\xe9o\\x95w2lv\\xc0\\xc3eo\\x93x\\xbb:\\x87\\x84(\\xfe\\xd3\\xb21\\xedh\\xb5a\\xeb*\\x1d\\xa4\\x84\\x86\\xe6*\\x92\\xc1\\x11r\\x8d\n\\x17g\"\\xf2\\xdc&a\\xd5\\xca\\xcd\\x08\\x19\\x02\\xf5*\\xf9a\\xa3\\xf9j\\x14c\\xef\\x0b\\xab\\x8fh\\x01\\xce\\x04\\xd2\\x0e`\\x88f7\\xeb\\x8e\\xa1\\xb9\\xda\\x89\\xd4\\x8e z\\x1da\\xb2\\x9cad\\x0b.\\x1en\\x08\\xe5\\xe5v\\xf3\\x9e\\xe0\\x8f\\x02\\xbfq\\xd2\\x9e\\xb5\\xb7-vnl1#p`\\xe3_\\xc5\\xf7\\xbd\\x8f\\xacq\\xea\\xc3\\xa6^\\xbd5\\xc3a\\x82\\x18z\\x98\\x96\\x8e\\xec\\xd2g\\xc4\\xdbg+\\xf8\\xa3:\\xb5c\\x81m`\\x93.j\\xdb\\x16\\xbe\\x0e7\\x1b`\\xd3\\xf4:\\xac4^\\x04x\r\\x91"
  609.  
  610.  
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xa1,\\x99\\xd1\\x1d\\xd6\\xd9-\\xd0\\xf7v$i\\xb8\\xcf\\x10\\xdf\\x86\\x90d\\xea\\xf81m\\x84\\x97\\x12\\x7f\\xa8\\x16\\x18~\\xd9\\xad\"|\\xc0\\x07\\xe9!\\x04\\xc7\\xfb\\x14\\xd9g@\\x9e\\x0c?\\xcc_v\\xf4&\\xc1\\x9c\\x942jv!.\\xb4m\\xaa\\xe6,k\\xe8\\xe8\\xc8\\xa5;t\\xfe\\xa7rklu\\xe4\\xe1\\x9d\\x13\\xf3\\xf0\\xfd\\x0cr\\xfcu6\\x8c\\x9f\\xf5\\xd7!\\xaa\\xfa\\x88bhi\"\\x05\\xa6\\xf4k\r$\\xc6w\\x16\\x92oy\\xcc-h\\x95\\xbd-%\\xaba\\xc2\\xf7\\xdb\\x85\\x8e\\x1f\\x07\\xe5\\x16g\\xb0\\xc6\\x12\\xc8\\x81\\x92|\\xa6\\xef\\xb9f\\xc8\r\\xbd\\x01\\x15\\xb6\\xb4\\xa2\\xe8;(\\xa8\"\\xcd\\xd5\\x96\\x8c\"\\x18\\xef\\x0f\\x1ds\\xa2\\x7f7\\x10\\x89\\x8d\\x9b.vg\\xc0\\x0bg\\x18\\x1f\t4\\xea\\x80\\x88\\xb3\t^\\x95a\\x10c\\x8d\\x0e\\x92\\xf9\\x96\\xbd\\xb7\\x1a\\x9c\\xca\\xf2.\\xfbg-\\x9d/<_\\x92\\xef\\x9d\\xf7\\xd4+\\x00\\xf7\\xf4b\\xd5xh8\\xe8:8\\xaf\\xbb,\\xf3m@\\xb72\\xc5\\xb3\\xc3\\x8cj\\xe2\\xad"
  612.  
  613.  
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad\\x81\\x15c\\x1e\\x97\\xc8z\\xcejs\\x9b\\xd6?\\x95\\x1e\\x9f\\x19\\x8b\\x1c\\xa2\\xeem\\x92\\xbb\\xdbi\\x94m\\x83b9se\\xb0\\x89\\xfcg\\xf5\\x9d\\xbc\\x0e\\xeb\\x89.\\x98\\xcd\\xe8\\xb1\\xd06#\\xbb\\x14\\xf1\\xf4\\xb9\\x01w\\xc8r\\xb7\\xad\\x9d\\x9f\\xe5+\\xa6\\x07m^kw\\xc0f\\xc2^\\xa6\\x15\\xf0\\xfc3\\x19/\\xa7\\xf6)y\\xd5\\x81\nv\\xc4\\xd3\\xec\\x9d\n\t6l\\x0b\\x10\\xe7\\xafk\\xfa\\x11s\\x0ciwu\\xab\\xbb\\xa2i\\x04\\x0f\\xbb\\xf4s\\x1b\\x83c\\xbbi\\xfbe\\x842yp\\x93\\xcd\\x19\\xd9f\\xad\\xe7)f\\xe8h\\xee\\xd0v\\xbd/\\xd5\\x12\\xda\\xb3\\xef\\xd1\\xda\\xf5\\xdc\\x8cj\\x1a\\xc4|\\xa8\\x9ae\\x00\\x86n\\xb9v\\x84\\x95\\xad:\\x82\\x98\\xe4\\xc0\\xe37x\\xee4\\xc7\\x82`\\x82\\xf5\\xf0q\\x18>\\xaf\\xaa\\x08:\\xaba)cxa\\x8ds\\x0e\\x1c\\xb41\\x01\\xf95\\xf9\\xfb91\\xc8!\\xf5\t '^\\xbc\\xa2\\x1c\\x81\\xfb\\xa9mg1\\xf9\\x9fn\\x91\\xbcl*\\xe8\\x9f!\\xcb\\x9b\\x19f\\xeb\\x0f-\\x0e"
  615.  
  616.  
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b6\\xaf\\x98\\xc5vfx\\xf1\\xd5\\xc5u\\x1fu%b\\x89\\x00\\xff\\xcc\\xa0\\x92\\xe8\\xc3\\xb4?\\x81r\\x967 \\xc9\\xe5d\\x9d\\xbdb\\xc0*\\x97_\\xc3\\xf8\\x11\\xcbo\\xdd;\\x82=\\x16^n=\\xef-gl~\\xee\\x8d\\xfd`\\x8e\\xd02\\xf5\\xde\\xa2\\xf5\\xed\\xdd\\x94\\xba~\\xc5\\x7f\\xf6|\\\\xa5wz \\xf3\\xb2g\\x85`\\x0b\\xb1\\x01\\x06\\xbb\\xf7x\\xcb\\xf0\\x7f\\x8e\\xd8\\xcf\\x01\\x87\\xe9\\xf8\\xe8\\xfc9\\xcd\n\\x9a\\x919\\xbcz\\x07ly\\xa7c\\xa0\\x97\\xe4\\xee^\\x81\\x1a\\xa0\\xce\\xe9\\xbe\\x8a\\x8f\\x96\\xf3?\\xcf\\xd2\\x9b\\xbe\\xf8@\\xbd\\xa0\\xa6v\n\\x80h\\x8cq\\xd5_\\x82\\xec\\xe4\\x14*1?\\x85\\x08j\\xe9_l\\xe2\\xdb\\xc7\\xed\\xad\\x9c\\x05\\x82\\xa3\\x1c\\x88nus\\xbd\\xd4\\xe5\\xd0\\xf5j9\\xff\\xd2\\xa1\\xefi,_\\xac^#mv@p\\x8c*\\xfd\\xdb`mc_s\\xbc-d/@\\xf6\\xde\\xe2u\\x05\\xa3pw\\xb3\\xe3h'\\x05\\xed6\\xc8;\\x1am\\xf6\\xd6\\x8f8\\xe1\\x9d+\\x81i\\x04c"
  618.  
  619.  
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xc3\\x98\\xf8\\xb9\\x84i\\xafu\\x141g\\xcc\\xcb\\xb9a\\x88\\x8fa\\xbdk@\\x94\\xe7\\xd2c\\xe5\\xa9w\\x18\\x19\\xb7\\x83 \\xc6\\xee\\x96\\xe4\\xed\\x96\\xebp\\xb3\\xdb\\x1e=\\xac\\xabc\\x86\\x15_o\\xec\\xa8\\xcd\\xdb\\xa8\\x92\\xbcbw\\x85\\x0f\\xdd\\x12\\xd1\\x08\\xf5\\x17\\x1e\\xdck2\\x00\\xc8\\xd3\\xea#_kx\\x9ax\\xf1\\x9a?\\xa4\\xc2\\x99a\\xcf\\xdc\\x87\\xc2i\\xd3\n\\x00i\\x83\\x01r\\xb5k\\xff\\x15j\\x05\\xfc\\x0c\\xd1\\x8f\\xdd\\xf2g0\\xe0\\xdb|p\ra?;\\xfb\\x01$3\\xf2\\xbf\\x19\\xc0\\x8d\\xb9zh<\\x8a\\x8f\\xab\\x0c\\xcfx9\\x0f5hm\\xf1\\x9e\\xd3!\\x04\\xc6\\xebe\\xe9t_y\\xb5\\xb9q\\xed\\xa7\\x1b\\xe5o+l\\x08\\xc3+t\\xa4\\x9f\\xcbp\\xaa\\xbe\\xe5\\x97\\xb5\\xcb\\xb4\n2v\\xdc\\x0b;|.pw\\xb1(\\xa9\\xe6\\xb5\\x84\\x8b\\x07\\xd9ne\\xd9\\xff:\\xcc\\xc8\\x08\\xe5?\\xb3\\x96@\\x1f\\xa4yj\\xea\\xefl4\\xe6\\xa3\\xdav\"8?e\\x1b\\xe6\t\\xea\\xa4/\r\\x08\\x11\\xd0\\xd2\\xe3\\xe1d\\x12"
  621.  
  622.  
  623. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf64!_<\\\\xc2\\xedho\\xb4\\xb2m\\xa9\\xcf,\\x8a\\xb6\\xbc\\xdd\\xf7\\xbb1\\xcf\\xbb\\x08@\\xa4f\\x04\\x13:\\xd2\\xabv+\\x05j\\xeb\\x8d;z|z\\xa8\\x05k\\xb7\\xe58\\x01`\\x0c\\xc2\\xcd\\xa1o\\xba,;\\xe4\\x8e\\xf0j\\x8f\\xec\\xcc\\x0ep<\\xee6\\x17\\xc14\\xc1\\x0em\\x05\\xbe\\x7fe\\xcb\\x8a\\x87#p\\xeb3`\\x10\\xfe64\\xec\\x08\\x91<\\x1b\\x11\\xf0o5\\x94\\x81\\xb7\\xbe\\xee\\x1et\\x11ur\\xbf\\xc9+d\\xa4\\x0e\\xf4_y\\xe1\\x9a\\xc6\\xe3\\x8b\\xe4\\xc8d\\xc6\\x1a\\x82'\\xd7\\xe3)\\xde\\xcec\\xc3\\x7fu8\\x05\\x06\\xb8\\x05\\xcfo\\xc6u\\xcb\\xaf\\xe5\\xde\\xc2\\xf0\\xc61\\x07\\x18\\x95\\xb0\\x84\\xc3pt\\x8b.bx\\x83.\\xe7\\xfe\\xea\\xc74x\\x85s\\xda\\x1c\\x06\\x96\\xfe\\x06\\xfe\\x87\\xa0_\\xc2\\xa5(70v$\\xe1gq\\xb5\\xec\\xd1/\\x97\\xe8\t\\xe4\\x1eg\\xdd\\x10\\x7fmd\\xddql\\xb7)\\xb6-n\\xb1\\xf1\\xaf\\xd6\\x85\\xc9\\xb25'\\xe6\\x9d\\xef\\xa5\\xdbh\\xff\\x95;\\xe8\\xabv"
  624.  
  625.  
  626. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|\\xd5\\x0buh\\xb0\\x80\\xe3c\\x95\\xa6\\x92\\xfa\\xb1\\xa3\\xda3\\xec\\x0fev|a.u\\x86\\xd4s\\x9d\\xd7b,\\x97\\xabc\\xfaabs5r\\x1d\\xca\\x9a\\xd0\\x01\\x9a\\x0f>\\x9d!\\xcdb\r\t \\xc4\\xd6j.\\x99c\n\\xb2m\\xc4r\\x1c\\xb1x\\xff)\\x06zbb\\xdc\\x12\\x18\\xces4q\\xfdn\\xd6p\\xa3\\xd6\\xcd`)\\xb3\\xef\\xf2\\x0b3\\x80\\xcb\\xd5\\x13\\xc5\"f`\\xd0\\xca\\x12'\\xd1 \\xdcf\\xc3\\x82\\xf4\\x15\"9l&\\xf5\\x80\\x0b\\x01\\xdf\\xccms\\xf8\\x02\\xd8e\\xb5m\\xc1>\\x13\\xb0\\xd6xt\\xee\\xf31\\x93\\x8c\\x00\\xc4\\xe5\\xf2\\xfcd\\xd0o\\xf91\\x93\\xfe\\xccqx5o\\xab\\xb7\\x0e\\x9bl\\xf49xi\\xa9\\xc8\\xb4m+\\x01#\\xbb\\xd6\\x0e?\\xb1\\xe6\\x9b\\x9a)v\\x1f\\xdf\\x15\\xfb\\xf9<\\x86\\x8d8b\\xe0d\\xfd\\xe6\\xc1\\xbd\\xb0\\xc2\\x9f\\xdb\\xaa\\xa0\\xe2a\\xbc\\xc9,6\\xe9p\\x81^j\\x11w\\xe0\\x06\\x9d\\xb1\\x9acj\\xe5 \n\\xa6,:\\xcd\\xc2\\x9e\\x8f5\\x10\\xe5\\xea\\x14\\x8c\\xe8\\xfb"
  627.  
  628.  
  629. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|\\x03\\xd88\\xeb\\xbe\"\\xaa\\xe4\\x03:\\xa1\\xca\\x8a\\xb5\\x1f\\xd6y\\x04\\x10\\x14\\x1a\rx\\x9a\\xb2\\xc1\\xe5g\\x99\\xd3\\x9e/\\xd4\\x15z\\xe0\\x04g\\x83)xhej\\xc1(\\xa2\\xc6\\x01\\x95`\\x9ci\\x1dk\\xcd\\xab\\xc4\\xcfj\\xc6\\xd1\\xfd\\xc0\\x08\\xcb\\xd0n\\x15\\xbc\\xcb\\xa9\\x90\\x1b\\xde\\xed\\xca~\\xcfw|\\x13c\\x9e?i\\x14\\xcf0\\x10\\xb9\\x0bq\\xa8\\xa3gk\\xd3\\xde\\xddk\\x8c\\xce\\xdd\\x81y\\xbb\\x11\\xa0m\\xd2\\xd8\\x19`+\\xe1?)\\x05t\\x9f0h\\x13\\x8d'\\x8d3\\xc6\\xd1\\xc9\\x98\\x16\\xa7\\xef\\xe0\\xb0\\x96q\\x16\\x9b'\\x1a\\xb1\\xb8\\x0cf\\xbd@\\x9f\\xa4\\x02\\xf4\\x8e\\xce\\xdf\\x94\\x1d\\xe4r\\xe7r\\x94&dl\\xd9\\xbe c\\x1c\\x02\r\\x0c\\xeau\\x1f\\xc4j^.\\x01\\x17\\xe0\\xe0\\x07\\xb2%\\xf9\\x93\\x89\\x0bto\\xd81\"\\xde\\x06\\xf1*\\x99\\x83\\x91cn\\x97\\x91\\xbfg\\x17\\xeb\\x05\\xa4\\xf6\\xf3v\\xb4\\xb5\\xed\\lism\\x8a\\x10\\x9a6\\xeb\\xbf\\xf6\\x11\\x1d\\xbb\\xbb\\xbe\\xce\\x98\\xb4\\x19\\x9e\\x7f-\\xfe\\xbe"
  630.  
  631.  
  632. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1nv`\\x82\\xee\\xab\\xb8co\\xfe\\x0c\\x042\\xe7\\x1b\\x02\\x07\\xc5\\xe7%\\\\x87\\xd3\\xdc\\xd6\\xc5\\x025x8b\\xd5&\\x8dt\\xee\\xd9+\\xd7\\x9b\\xd0\\xb8a\\x19s\\xe4\\xc8\\x80\\x14g\\xaac=\\xe9`3\\xba\\x97;<\\xc1\\xf5\\xeeq\\x11f7\\xd7\\x1d\\x82\\xb5\\x17\\x83\\x00\\xd7b~z\\x84\\x17\\xc1\\xe1\\x13bg\\x1c\\x06\\x10\\x90\\x91x\\xf5\\x90j\\xfd$-\\xecs\\xcb\\xe6j)\\xb8dj\\xb6\\x1c\\x89/\\xef!j\\xad\\xc3\\xec\\xaf\\xdfx\\xc4\\xba5;\\xae\\xb1\\x01\\x07\\xd4\\x84\\xa3\r\\x93wm\\xdav\\xee`\\xcf\\xf5l\\xfdrn\\xb7l9s5q\\xb8\\xb9\\x8e@\\xaac^\\xfc\\xdb\\xea\t\\xf7\\xf8\\xfe\\xf1\\xbeca\\x97s\\xb4\\xfa\\xca\\x8a\\xc4\\xa2\\xc1\\x84e\\xbe\\xd6\\x81\\x9b\\xff4;\t\\xae\\x92\\xc1\\x03\\x1f\\x0f~\\x04\\xcd\\xd0\\x97\\xe6\\xec?\\xf1\\xadn\\xc2\\x13\\xbe\\x90\\x97\\x9a\\x7fmw\\xd7\\xed\\xa6^9\\xbc\\xa4ej\\x07\\\\x14hp\\x08\\xd7\\xaf\\xfa\\xcf\\x83oj7\\x87\\x8d0\\xaa\\x95\\x9c\\x11\\x8e\\x1a3"
  633.  
  634.  
  635. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ot\\x10@\\xf5*\\x1a3t\\xd9v0\\xae\\xfe\\xe1o\\xb7\\xdb\\xd7\\x00\\xa3\\xbb\\xc8\\x85\\x9at\\x9b\\x99\\xfa\\xc7\\xf3\\xfca\\xe1/\\x16\\\\xccz\\xb9ttq\\8\\xfdjf\\xefe\\x1ft\\x9fx\\x1a\\xc3\\x07x\\x10^\\x19\\x14m\\xe4\\x05-\\x1a\\x92\\xef\\xd4\\x93\\x82\\xe5\\x11\\x97\\x99g.\\xcd\\xc2m\\xb9\\xc4\\xf8w\\xa7\\x9d\\xc44_\\xec\\xf0q\\x9a\\xa9v\\xe9\\xc7\\xca\\xc0e\\xb5\\x91\\xa9\\x8b\\x17\\xbc\\xfaq\\xcd\\xe8h\\xe1<j\\xcc\r\\x8bw\\xe6\\x0f\\xa7\\xfe\\xd0\\xa0\\x95i\\x8d\\xac$o\\x93\\x92\\x8e1\\x97uz\\xd1z\\xb9\\xbb;\\xc4\\x07\\xa4=\\xcd\\x06\\x87^|\\xea\\xe7l\\xac\\xdda\t'\\xd5+\\x19\\xc2:\\x17\\xea\\xb3\\xd0\\x8a\\xdc\\xd0o\\x0f\\x1b=4gd\\xcc\\x9ef\\xe2\\xcd\\xa1z\\xfb\\xcdw\\xca\\xecx\\x90m5\\x7f\\xac\\xee\\xdd\\xb6\\xb0l\\xf6\\xc6c\\xfb\\x83|!u\\xc0\\x86k\\xc2\\xd74\t\\xecye\\xa3\\x1c\\x96\\xf4\t\\x16\\x90\\x0c`\\x92\\xb3\\xbf\\xae\\xecve\\x8f0\\xf1 q\\x02fl\\xe7"
  636.  
  637.  
  638. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8\\x05\\xf9\\x99\\xa1^\\x81\\xf3\\x89\\x92\\x99\\x14n!\\xba\\xdd@\\x8d\\x01cj\\xd1\\xf9\\xcd\\xe3\\xd9\\xc2\\xef\\x84\\xda\\xc8s\\x9ag\\x97e\\x94)\\xcdvam\\xdep\\xeb\n\\xd5\\xaa\\xb3\\xb02)\\x08+3\\x9e$\\x12\\xb9\\x08\\xe0\\xd0\\xbd\\x98\\xd7\\x95\\xf1n\\xb8k\\xb2\\xc9\\xabx\\x0b\\xc2\\x8d\\x86y\\xe1\\x8d\\x82\\xe2\\x95\\xbd\\xf3\\xcf\\xa9\\xbcj\\xaa\\x11\\x8a|\\xb9\\x95 r\\x8addo\\xd7~8\\xa3\\xbai\\x00\\x1da\\x9c\\xe2\\xda\\xa51\\xaf\\x8dwt\\x14-\\x0c\\xfe3\\x1e\\xa1\\x0co\\xade\\x8e\\x12z\\xcd@\\xf7\\xbb\\xbdw!\\xa4\\x9b\\xa3\\xd2\\xb5u\\x96\\xec|l\\x18\\xff\\xc7\\xb9-\\x15=%\t\\x93\\xbd`%\\xeb\\x82\\x8c\\xad5zv\\xde\\xcb\\xb91\\xe8\\x86\\xb8p\\xbe\\xab\\xf1\\x1a<\\xe6ojr\\xca\\xf7\\xd82\\x9dq$\\x0e6\\xba\\x9b\\x97\\xf6y\\xb1\\xef\\xca\\xe3\\xe9\\xde\\xbb\\x95\\x02=hj\\xd5\\xcd\\x846l\\xa5\\xb1\\x1c\\x0e\\x8d\\x07\\xab\\xe9z\\xb3e\\xfb\\x9f\\xaa\\xb8/\\xf91t\\x82q\\x0e\\x9a\\x1b\\xf0\\xdfbh\\x0c6"
  639.  
  640.  
  641. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\xbfe\\xb7\\xd6o\\xe4\\x11\\xcd\\x01\\xf3 \\xef\\xfb\\xfa\\xfc\\xc5j0e'\\xafc#`\\(\\x946~gtr\\xf03o\\xb3*\\x1f\\xf1^\\xb2\\xb9\\x19w/m\\xe9\\x8d6\\xe5>\\x98\\x1d\\xa6\\xebb\\x0f\\xc9\\x01\\x84\\x0bl\\xc0\\xd2\\x1f\\xb3t\\xb3\\xd0\\xf4\r\\x02\\xeda\\xf0\\xa9\\xdf\\x96\\xd8\\x9c\\x8b\\xa6\\xbez\\x14e\re\\xd9\\xdb\\xd8\\xe8\\x08\\xd4xk.\\xce\\xfbk\\xffgx\\xbdnz\\xd3\\x15\\x9cpfzr\\xe0\\x1a>h>\\xbec\\xfd62\\xbe\\xebv\\xfd4%t<e\\x92\\xe8\\xf4;\\x0b*\\x95\\x16s\\x07\\x9e\\x18\\xffk\\xd4\\\\x93\\x84\\x85q\\xbe\\xc3\\xeb \\xdf\\xaf\\x19m\\x9f\\xc6\\x91\\xb2\\\\xce\\xa0 d\\x8a\\xce|\\x80\\x9d\\x80\\xd7\\xa9\\x9f'u.\\xf6u\\x95\\xcb\\xb7\\x8f\\xc7\\x9d\\xc2\\xc3\\x9c\\xb7\\xb4;7\\x05f\\x98(\\x17i\\xaa\\x14u\\x14\\xbfy\\x1f\\xcf\"\\x08<o3\\xf4\\xb1\\x0e\\xfa\\x91\\x7f9\\x9dtes\\xee\\xcfb\\xb7>os\\xd4\\xd7\\xa6\\xf6\\x04\\xe9_\\x98*z\\xe0+"
  642.  
  643.  
  644. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4v\\x9d\\x86p\\x04\\xe5\\x1f\\xd6n\\xf1+\\xcfql\\xa1\\xd4\\x94\\xf2\\xd0\\x0eq\\x85\\x8d\\xeen\\xcb\\x00\\xebwnzb\\xfe(\\xb8\\xe9\\xe7\\xad-\\x8f\\xd2#\\x0e\\x93\\xc8 \\xa6\\x97\\x7f\\xaa\\xbf\\xe9=\\xb7\\xd7\\xf1\\x1a\\xe6\\xdan\\x08o\\xc2)\\xbf\"\\xc4d+\\x87\\x0f\\x9d\\x91\\xf0\\xf7\\xc3t\\x86j\\x88\\xb9o\\xf6\\xbbs\\xea\\xe7kf\\xad\\x1b\\xad\\x95\\xdc\\x85j\\xe2\\x8a \\xd2vx(\\xe6\\x9f\\xf7\\xa2\\xe3\\xcb>\\xa18\\x8e\\x88d\\xb2bp\\x1de<\\xfbez\\xae\\xc4\\xff\\x88q-jm\\x98\\x1ax\\xe2\\x05t\\x96\\xfb\\xda&\\x8c+jv\\x96g\\xec\\xfb\\x8fy5\\x1b\\xc2qn~\\xe2j\\x979\\x17\\xa8d\\x16\\x98\\xe7\\xbf\\xa5\\xef\\xb9qg\\xb3\\xab\\xbe\\xdd\\x95d\\x8a?\\xa4\\xec8\\xb4v 6\\x86q\\xd5 \\x1fpv\\xaf\\xe4\\x94\\x95\\xffd5\\xb2ls\\x88;\\x16|#(\\xc8\\xfbk\\x0c\\xd7\\xf8\\x97\\x1f\\xa8\\xd3\\x90<\\xe5g\\xc1\\x0f\\xa6\\xd605\\x1a\\x8e\\xa3\\x12(\\xa7k\\xe5o\\xd3\\x86?f\\x8e"
  645.  
  646.  
  647. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\xe5\\xa2\\xeb\\xceu\\xef\\xcb\\xd1\\xfb\\x03:\\xfc\\xecw2?do\\xed\\xf86\\xb3\\x81x\\xde)) su7\\xf3\\xb3\\x8b\\xc8y\\xa8\\x17\tcz\\xaf\\xae\n\\xc0\\xfb\\x8f\\x02b\\xdc\\xb5\\x0c\\xd5\\xb3\\x18'\\xd9\\x1e/\\x99\\xcbc\\x08\\xe1\\xb1\\x06vv))o\\x14\\xe0j\\xe7\\x93\"\\x0f\\xa1@\\xead\\x9df\\xbbj1d\\xbfy\\xdf\\xd1\\x84\\x17\\xc4\\xb7\\xbff\\x1f)\\xcc\\xb3(\\xc2\\x9a\\xb7\\x1f\\x95\\xaa\\xcc>\n\\x98\\xdb<\\x80%\\x81\\x91\\x18b\\xeb\\xcf\\xce\\x0e\\x88\\x90\\x0fdnvsp)$\"h@\\xa6\\xda\\xc3\\xfawl\\xb0$r.x\\x18\\x1d\\xb8^\\x14\\xc1\\x19t\\xcc\\x9e\\xe9\\x9f/\\x19\\xbf(\\x8c\\xc3\\x88\\x8c\\xcb>\\xe0(\\x83\\x92's\\xa0\\x9b\\xe5\tdgyl\\xd4\\xbc4p\\x99\\xb9\\xc3i\\x9f\\xd4!\\x05\\x85\\xf5\\xc9\\xf9\\xd4\\xce^u\\xba\\xb7`\\xd0\\xb1*\\x8ey\"w3n0jz\n\\x9d\\xcewv\\xe8\\xea\\x02\\xbcwuj\\xee\\x89p\\xc5\\xb1\\x1d\\xa8\\xd6\\xc7 \\xb2a\\x03_1d\\xb4"
  648.  
  649.  
  650. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\x9e\\xf9*\\x11\\xf5\\x1bj\\xb7\\x8b\\xb6\\x86\\xd6\\xc1\\xed;/\\xb2\\x9c\\xcdi\\x88\\x7ft\\x04\\xdf\\x10-\\x80\\xe1\\x8c\\x93\\xa2\\xa8\\x18\\x94\\xd5!\\x9c\\xd5k\\xde.k\\x85\\x9e\\xcb\\xc5\\xba@\\xae\\xf5ckj\\x82i)\\xbf\\x81d!\\xa6\\x93\\x87a\\x8b\\x94\\xfck\\xc5\\xcd\\x95\"0\\xd7\\xbb\\x9a\\xe5\\x89\\x84\\xfd\\xc9\\xe6%\r\\xc3e\\xca\\x81\\xfe\\x81\\xee\\xf8ca\\xfc\\xbc\\x10g\\xd2\\x19\\xbe\\xdc\\\\xe8\\x943\\xd7\\xe0\\xd8 \\x9b!\\xf3\\x86\\xddrb\\xf7\\xda\"\\x18\\x146\\xd1y#n\\x93\\x1e\\xd3e\\x849&l%\\xd1\\xb3\\xc7\\x88\\xcf\\x00\\xfc\\xd6\\x02\\x84\\x90\\xf0\\x9ag\\xafwc\\xdd\\xa9\\xc8\\xc1\rf\\xaapb\\xb8\\xd0\\xe2\\x1a\n\\xf1\\xba)\\x01\\x86 \\xa5b\\xdd`p\n\\x92\\xae\\x83mi\\x0exu\\xa6\\x85\\xc86\\xa8/\\x8a\\xe5\\x07\\xa8\\\\x1f\\x91\\xb5\\x0f\\xf5\\xa4\\xd3hh\\\\xe4s\\x1a@\\xfafg\\xbf\\xa97\\xe8\\xc52\\x9cl\\xf5)&\\xd7\\x95\\x9e0\\xac\r\\xa95\\x02 \\xe5\\xd7\\xbe\\xe1&\\x80\\xbcl\\x97\\xbf\\x9d"
  651.  
  652.  
  653. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|\\xb5\\xd4\\xa8\\xf8c\\x8f\\x8b\\x82\\xe4/o\\xcfs\\xd0\\xb7qh4$\\x9dm\\xca\\xe4\\xe4t\\x198\\xf2\n\\xa4\\x887\\x83\\xb3\\xe5(\\xb4\\xcd*\\xf93|\\x85|\\xc74\\x7f\\xd4h(\\x9b\\xa4\\x9d\\x99\\xe2s'\\xcb\\x9a3\\xd5\\x1cp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84\\xe7&e\\xf25\\x96\\xe4a\\x1cz\\x00\\xf9\\xb1#gc\\xe6\\x03\\xd0\\x97\\xadl\\x87\\xa3\\xc8\\xea\\xb0\\x8e\\xdb\\xd3|\\xd8\\x1ce\\xd3\\xa5\\xfe\\xb7h\\x90\\xf5sj\\x00_"
  654.  
  655.  
  656. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbd\\xc7\\xc7\\x96\\xcc\\xe1,0\\x96o\\xa3t\\xc3b2\\xe4\\xd5k\\xe3\\x02\"\\xcd\\xb9\\xe8\\x96\\xa3m\\xa9p\\xc7)$j\\xfa!\\xff?\\xcd\\xa1*\\x96\\xb1r\\xfe2\\xd1:\\x894k\\x98\\xbc\\xb1c\\xcf\\x8c\\xd9\\xdf\\xe5o\"\\xdc\\xe2\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6+\\x0c2dq\\x10b\\x94\\xb9\\x9b\\xfe\\xb6\\x14\\xb6\\xa0\\xfdr\\x037\\xff\\xce\\x99n>\\x99\\xbdo\\x87c\\xd2m\\x8a\\xd8\\x94*\\xa8\\xd8\\x1ez\\x11\\xff\\x91\\xfa\\xebcab"
  657.  
  658.  
  659. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x05~&\\xe4*\\x98\\xc4\\x95?;\\x04f\\xa2\\xd8\\xa2h\\xf5\\xbf2\\x82\\xbc\\xff\\x8a\\x14\\xe8\\x08;\\xa8\\x1c\\x14kf:\\xc3bg^\\x80\"='\\xbde\\xbc\\xeb\\xc0\\xe8\\x9e\\xc1\\x99\\xdbr\\xdbsvb\\xff\\x8e\\xe8b\\xbedp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81r\\xa4-\\x1c\\xbbb\\xd8\\x8ft\r\\xad\\xb5w\\xa0 8\\xd0!\\xc2~\\xe3p/'\\x86\\xd6\\x97v\\xbeek\\xc62g\r\\x8ek\\xb9\\xe30t\\x03\\x8c\\x9c\\xb0\\x9a\\xe3"
  660.  
  661.  
  662. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xebh\\x14\\xb9i\r\\x12\\x95\\x98t+!q\\xa0\\xb8\\x80q\\xfe\\xc0\\xef\\xc62'\\x17.\\x1d\\x06\\x03\\xfe\\xa4n\\x91\\xde\\xcf\\x86\\x9a\\xfa\\\\xa6\\xd2x\t\\xb0\\x07(\\x05\\x16\\x9a1\\xbd\\xe6\\xfe\\xdc|9\\xd3\\x94lu\\xcf\\xf9\\xab\\xd0\\xe7`:\\xef\\xccy\\xe8\\xfe e\\x18\\x02\\xbc\\xfd\\xef\\xa8\\x83)8\\xd1\\x9c\\xd7\\x15\\x91\\x87\\xc6\\xae\\xc9y\\x04\\x9cu\\xe1\\xcdv\\xdab\\x85\\xf3\\x83\\x1b\\x95\\x9f\\xb4\\xc78\\x186\\x0f\\xf7s7\\xdc\\xf5\\xfc\\xe9\\xba*\\x10y\\xbat\\xbc\\xf9\\xa1\\xa4\\x19b\\xeb\\xc6\\xc4\\xeel\\xa2g%\\x04\\xaa\\x96x\t\\x95oi/\\xd8\\xb5\\xd9\\xae)\\xc7\\xc6^m\\xa8\\x97\\x16\\xe0\\xfd\n\\x1e^\\xa9\\xa5\\xd9,\\x00\\xbf\\xbc\\x9f\\xabd\\xab\\x8c\\x9fri\\xa1\t\rda\\x9e\\x0e.h\\x1f\\x9fk4\\xa4p#\\xbd+\\x90\\x01\\xf0\\xc8f\\xda\n\\xf5kn>\\x9f\\xd3\\xe4\\x05/%\\xd3\\xfd\\xdc\\xae\\xed\\xbc\\xab\\xda\\xd9\\xee\r\\xc7\\xe54\\x11$\\x9a\\xa3n+\\x1e\\\\xf9;\\xb6\\xfb-"
  663.  
  664.  
  665. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108\\xd3p&\\xac\\x0c\\xa3o\\x10\\xe3z0\\x02\\xfci\to\\xf0\\xab\\x1e9\\x03f\\xc4\\x8d\\x07\\xba\\xc0\\xc6\\x12\\x0b\\xac\\x0f\\xfbz\\x08/c>\\xa5\\x9c \\xca\\x85\\xc0\\xb1\\xb6\\xec<\\xae\\xa5\\x88\\x0c\\xf5\\xdf\\xef\\xf3\\xe0\\xfc\\x05\\xf3\\xbd\\xa0a\\xfd\\x86\\xfe\\xb9\\x7fp\\x9ea(\\xd1\\xb7\\x9aq\\xbf\\xcf\\x85\\xd8\\xd0%\r\\x83\\x13\\x81\\xf1\\x81\\xe2\\xd3\\xa0\\xe1$\\x18z\\x8ay\\xc5\\xb0\\xd9\\x1dl\\xd5f\n`&qi\\xad\\x00o\\x0f\\x0f\\xb5vlr\\xb3\\xf4\\xb3\\xbd\\xcd)\\xd6\\x9d7\\x02\\xc2\\x91\\xec\\xae\\xc70\\x92\\xbd\\x1d\\xcb\\x9b\\xe0\\x11\\xa7\\xef\\xf1fi\\xfa\\x12k5_\\\\xa8xu*\\xecgt\\xb7\\xb1\\xda\\xe8\\xa8\\xbd\\xf2\\xef\\x05@\\x0f\\x90:m\\x074 \\xbe9=\\xa4\\xeb\\xdc\\xcc\\x92lz\\xd2\\xe8\\xd0\\xc6\\xcd\\xcc\\xebs\\x92\\xe0\\xa8\\x9d\\xb1\\xbfw)\\xd9\\xc1\\x00o\\x08\\x17\\xf1w\\xd6a\\x96\\x1d\\x1f?`q\\x1c\\x19=qh\\xbbf^\\xd0y\\xb5\\x9a%o\\xdcl9\\xac\\x9f\\x1e4\\x1d\\xc1`\\xe4g"
  666.  
  667.  
  668. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\xe6\\xf7\\xd8\\x01\\xb2i\\x1a\\xec\\xc2\\xb2\\xb2s\\x85\\xd7\\xc0\\x80\\x83e~\\xf8\\xe8\\xd5\\xd59\\xec\\xbaj\\x81\\xb0z-\\xcf\\x1d\\xa5l\\x82!\\x86\\xe2\\x8c\\xd9;\\xac\\xf9\\xda\\x9a\\xae\\xd4\\xaab\\xf7\\x89s0y\\xf9b,\\x9f\\xa0\\xd7\\x8e09\\xf8/\\xfd\\x1b\\xe5\\xc7\\x0f\\xd1\\x05il\\x1c\\x023\\xe6i%\\xe8\\xde\\x00\\xads\\xfe\\x87\\x94\\xa1\\xc7\\xd3\\xb7\\xa1a\\xf7\\xae\\xe0d8!wb*\\xf8\\x07\\xad\\x95\\xa7v$|\\x00\\xa0f\\xca\\xc9\\x11w\\xfd'27\\xa18\\xa5\\x89\\xd0\\xf1\\xed\\xe5omdsq\\x11/y\\xbe \\xb3/,\\x1b\\x83`\\x1a\\x94\\x19\\xae\\x83\\x98\\xf5\\xbe-\\x04n\\x8fg7s\\xb7e\\xd2(.\"\\x1b\\xe2\\xc9\\x91\\xfd\\xdd\\x00n;\\xf6\\xa7p\\x8e\"\\xab\\xcd1\\xeen\\xe4\\xb9\\xbf\\x0c\\x01\\x1e\\x1ed\\x04\\x97n\\xd7\\x9eh/l\\x81\\xb9\\xcf\\xdbf$\\x1b\\xe4rb\\x03\\xf9q|\\xcd\\x89\\xd0 \\x89\\xfdb\\x13x\\xf1\\xb0\\xd6e.\\xa0\\xb1\\x82\\x96sfvr\\x7f\\xdc\\x1f%\\x91\\x16\\x80\\x03"
  669.  
  670.  
  671. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x1e\\xb1\\xcax\\xc4(\\xb7'ws4\\x15\\xcd\\x11w\\xf4\\xdb>\\xb1\\xe79%\\x82\\xe7\\xe6\\xf5\\xcc\\xb9\\x89\\xe3\\xee\\x88l!|\\xe0\\x91o\\xb8\\xff\\xe7\\x86w\\x0b~s\\xdd\\xe3v\\x91\\xe7\\xf0\\x1e\\x96\\x93\\xf1o\\x0ep^\\xbag\\x98bdw\\xd0\\x04\\x0c^q\\xc9k\\x90\\xce\\xe6\\xe5\\x06\\xbc\\x00d\\xb0\\x95\\xee\\xcf\\xf5oq\\xcbw\\x85\\xb3\\xccj\\xf1_\\xff\\xfa\\xed'\\\\xa9f\\xa8\\xacim\\xd8\\x8a=\\x7f\\xa7cn\\x94\\xfb\\xb2\r\\xd0g a?\\xbd'\\xd2w\\xe6\\x87\\x1d'\\xed*\\x1a|\\x82\\x8e\\xd5\\x04\\x07me\\xff\\xa8\\x9f\\xf6n<\\xa5\\x9be\\x80\\x1e\\xfd\"\\xb6w\\xe8\\xd7s\\xfa\\xd1n<2\\xf6h\\xf7)\\x85\\xcd\\xa4jb\\xd4\\x92kh\\xe2\\x8cjy\\x9e*\\x98\\xbc&\\x99\\xb6\\xf2\\xafc\\x82ad\\x87\\9f\\xa9\\x13\\xbf<\\x91q:\\x11i1\\xf4\\x96\\x97\\xdf\\xef2%p\\xd5\\xf6\\xf4c\\x8ca\\xbc\\xe1\\x96\\xfef\\xd1\\xdb\\x1b\\xd9y\\xcb\\x1b\\x02k\\x92_\\x88\\xc7\\xc5p\\xb8\\xe5"
  672.  
  673.  
  674. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\x9e\\xc6d\\x14\\x8b\\x01,\\xdd\\xc1\\xff\\x0f_xwj@\\xfat\\xfcy\\xa7\\xae\\xae\\xb7\\xad\\x94;\\xda\\x8cqn\\xc9\\x93\\xfb\\xf7\\x12\\x0bae3\\x81\\x95\\xc5\\x83\\x12\\x1d\\x860n\\xcf\\x8cz\\xf7\\xa0\\xe2\\xc1b\\x0c\\xf7o\\x08:\\xb3\\xd0a\\x1as\\xc15\r7\\xff\\x9c\\xc7\\x06\\x83j\\x0f\\x99\\x1c\\xd9\\x8ba\\x18cc\\xd9p\\xb7,\\x8e\\x98\\x86t\\xb2z\\xe3\\xf3\\x0c\\x94lr\\x04g\\x8a';h\\xfb\\xfa\\xb7\\x9b\\xff\\xe0\\xa0x\\xfe~\\x99\\xe6\\xf3\\x80elq\\xa9\\xf0_\\xfa\\xf3\\xe8\\x8fj~\\x85\\x91\\x8d\\xc7\\xba\\xbcqmg\\xa6\\x90\\xca\\x8a\\xfe9\\xb9e(\\xe1\\xde\\xd9\\xad\\x03\\xdc\\xa9\\xa4m\\x0b\\:\\xa8q\\x96c\\x1a\\xffk\\xe0qdok\\x95f\\x9f\\xc79\\xb1\\xd1\\xce@^\\xe9\\xf9\\x9f)0\\x9fmw\\x03\\x10\\xf5\\xff\\xa2\\xe0\\xa6t\\xb2\\x0b\\x93\\x11!\\xceq\\x10b\\xe3j\\xbb \\x1f\\xcb\\xc5'y\\x19\\xb5\\x90\\xc0\\xcc\"\\*\\xcd\\xa9\\x84*\\\np\\x06\\xf6q=\\x9b\\x9e|\\x8c"
  675.  
  676.  
  677. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xd3\\xbd\\xe2\\xb1m\\x08\\xa3\\xf23\\xa0\\x87\\xf5oc\\x1d\\xa5\\x95\\xfc\\x01\\x89!\\x8c5n\\x12j(~\\xd1\\x1e+\\x9e\\xac\\xc9\\xf8tc\\x8fwp\\xcb-\\xd3\\xd4\\xb8\\xdcs\\xff*v\\xa6\\x15\\xe1\\x0el\\x97q\\xfa\\x98\\x9b\\xe5\\x03h\\xaal\\x90a\\xde\\x05q\\xfb\\x10*\\xea\\x8fr\\xab\\xe4\\xde\\xa7\\x8at9r\\xbb\\x89\\xe1p\\x0e\\x0f\\xffp\\xa3\\xb4\\x80\\xe3\\x98\\xcb\\xfdf\\x9d\\xd5t\\xa4c\\x1a\\x13\\x96\\x0c\\x02\\xd1\\xa9\\xcc_\\x1f\\xe2\\x17s\\x10i\\x07\\x1d\\xe9\\xb9\\x95lk\\x11\\x95pz\\xce\\xdei\\xb46\\xbf!\\xeb\\x8a2\\xbc\\x99q\\x9e\\x83\\xc9~\\xeeg\\x92tdo\\x96\\xf5\\x8ci;\\xd3\\xdeqj\\x1d\\xa2/a\\xf6\\x94\\xa1icp\\xd1\\xce\\xfegu\\xf3\\x98\\x8c\\xc5\\xb3\\xbb\\xd4\\x04\\x8ez\\xbb\\xa9\\xeek:\\xeb\\xc5z(\\xa4\\xa35^\\xaf;\\xe2\\xf65^am\\x8c\\xda\\xa1@\\xb4q\\xa7\\x05\\xd2\\xbb\\x87\\xb6\\xb9\\xc1z\\xae\\xb2\\x8a\\xe3\\xcf\\x9e_=o\\xab\\xe1\\xcc\\x18\\xb4\\xb9\\x7f\\x99\\xfd\\xc0\\x15\\x8f\\x19"
  678.  
  679.  
  680. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+u\\xe3\\x11\\xd6e\\xd7\\xa1\\x84\\xc5\\xca\\xd7ma2\\xefw\\xc0\\x98\\xed\\x83<g7\\xa8da\\xf0$\\x1b\\x81\\xben\\xe5\\x9d\\x0c\\x17\\xc7\\x9e\\x85\\xcf\\xae\\xfam\\xac\\xff\\xd2ej\\x01\\x84a\\xc9\\xeaj\\xc3u\\xd47)\\x90\\x82\\xc9\\x88\\xf7\\xf3\\xaf\\xaa\\x98\\xb6u\\xab)\\xd8\\x1a%\\xd9\\xb7\\x87\\xcb\r\\xdb`\\x07\\xc0\\xa2\\x11\\x85\\x87nos\\x8a\\xe7x\\x03\\x82,g\\x84\\xb1dg\\x81\\x055\\xa3xu\\xd8i\\xff\\xceal2\\x19\\x01\\x12j\\xdb\\x04\\xfd\\xa3\\x91rh\\xba\\x86\\x10\\x14\\x9am!\\xfd6\\xa8n\\xf73*'i\\xa4\\x13k\\xed\\xb8\\x1fi\\xf1l\\x19_:\\xf5\\xef.\\xf4\\x92\\xcf\\x16\\xa98g&\\x98)r\\x84\\xa53\\x8b-cu |7\\xf6\\xcb\\xa0\\xc6r\\x035\\xc6\\xc7o\\xb3h\\x83\\x87\\x8drg\\x83\\x99\\xf8\\x98\\xe8\\x08\\x0ey\\xa2c\\x8e\\xef\\x8e\\xa2\\xf1\\xfd\\xae\\x106\\x1cw8q\\x01w\\xf5\\xf0\\xe0\\xa60\\xee\\xcazg\\xff\\xb0?\\xff*p-\\xf4\\xdcc\\xa8:\\x9dv"
  681.  
  682.  
  683. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa98js\\x07\\x12\\xd1#\\xbc\\xf3\\xe0d\\xfa\\xd3#)u3\\xfd\\xdf;\\xd1hl\\x86\\xc1ykn\\x93n\\x0c2c\\xe3\\xe84)/\\xd67\\xcf\\xd0\\x92o\\xb7\\xd2\\xd5\\xed!$\\x14yzh\\x17-\\xdeh\\x1dy\\xeb\\xd7\\x0e_\\xb9g\\x8a\\xc9z\\xdd\\xb5\\xae\\xb0\\xfa\\x81\\x9c\\xe8c\\xb1\\x1bbt\\xbb=\\xb2\\xf7\\x01\\xfag\\xdd\\x02\\xeap\\xc7\\x81\\x02y\\xd7-t\\x05.\\xb8\\x89\\xd4kk\\x94\\xffo\\xb2s\\xa6\\x9c\\xe3\\x1b\\xa9\\x80f-\\x1e\\xf8)\\x8c@gd\\xa5+\\x1d\\x05!o\\x1e!\\x94k7\\xa6\\xe6clb*\\xbeiy/\\xe5\\x82e\\xabi\\x0ezhho\\x1fm\\x00\\xfa\\xb1\\xedi\\x07\\xa1\\xd4\\x9b\\xd0o\\xe0#\\xe0q\\xf9 \\x8d\\xc0\\x99\\xc6\\xc2\\x7f\\x1c\\xa9x\\x90\\x97\\x0e\\xeb\\xeb\\xc7\\x93\\xc9 \\xbc\\xb7\\x11e,\\xee\\xe24\\xae\\xbfi\r\\x03o\\xc2$\\xf9\\xc8\\xab(\\xc9\\x9b\\x89q\\xfbo\\xfa\\xc24w\\xab'-\r\\xe3\\x94j\\xa2\\x13\\xe6.v\t\\xbb\\x9f\\x02\\x83\\xb5\\xe2\\x95y"
  684.  
  685.  
  686. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7\\xc8`\\x856\\x00\\xc7\\xda)\\xab\\x94\\xf5\\x7f3\\xa2\\xd0\\x08\\x01\\xeb`\\xe4s&\\xc4\\x95ct\\xc1\\xd7\\xa7\\8\\xd2\\xa9&\\xaaih\\xc7\\x16\\x1e\\xb4\\x0e\\x11\\xec\\xb9\\xc14\\x84\\xfe\\x00\\xde3(\\x7f\\xb9h\\xc7\\xa5\\xdev\\x05h\\x88b`\\x89\\xd2\\xe7-\\x00\\xabsh\\xd9k\\xc1<\\x9f\\x8f\\x82\\x86i+;\\x07wvd+v\\xa2 \\xa4ox\\xe1\\x0b8\\x0b\\xa7\\x0b\\x98\\x0c\\xfau\\xbb\\x11\\x92jz\\xb4\\xfa\\xe9\\xady\\xe6\\x81\\xca\\xf02\\xce\\xe4\\xa3\\x97\\x8e\\xf3\\xc1\\x02\\xd8r\\xbb\\x9fpv\\xbe;;e\\x9a\"\\xfb\\xead\\x11p,\\xae\\x83ap\\x05\\x036\\x1bk\\xd3>\\xd4\\x99\\x17)\\xee\\xed\\xe7\\x12l\\x82/\\x93\\xa9a\\xdd57:\\x00\\xd4\\xb3\\xfb!\\x8eu\\xbfxb\\xfb\\x8e\\xa7\\x03\t\\x8em/\\xefgxxhp\\xc1\\x0b\\x03\\xa6\\x16\\xc5\\xa6l)\\x8a\\xba\\xe2x\\xed(\\xdc\\x9cx\\xc8\\xe8\\x08\\x94s\\xbb\\xaa\\xef\\xd4\\x95m(\\xa2\\xbbj\\x84z\\x9c\\x88g\\xad3a4\\x85hp"
  687.  
  688.  
  689. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\x01\\x03\\xeb\\xc9\\x8e\\x81i\\xeds\\x8b\\xect\\xa6\\xf8\\x12\\xbd\\x14\\x8e<q'5\\x8fn\\x8c\\xb6\\xa1n\\xd3\\x13\\x9f\\xcb\\x8a\\xc3\\xca\\xad\\x9b\\x04\\xfe\\xbd\\xd3t\\x14\\xf3\\xc8x\\x0b\\xa0\\xdf\\x82\\xc3\\x0b._\\xd1t\\xc8\\xeegm\\xeav\\xdd\\xef\\xb0\\xc2\\x1a:a\\xabi@z\\xf3\\x89\\xfd\\xc2\\xd8\\x1aw\\xe9\\xa2|\\xc5\\x8e\\x89\\x93\\x85\\xbe!o\\xccf\\xdf\\x87\\xe7\t\\x98\\xe4sew\\xd9\\x1dhvj\\x9c\\xce\\xc8\\xa0\\xb9\\xff\\xa1?\\x00\\xa0j\\xf6\\xaai\\xce\\xa0\\xde \\xf9\\x1fb\\x8a\\x8dk\\xff\\xf8\\xd8\\xa1er/\\xf6\\x0erpep\\x88\\x85\\xc0\\xa0\\x1eu\\x87bq\\xaeo\\xde/\\xd0a\\xedtpz+\\xe9r`\\xab\\xa9\\xfe\\xdf\\x94\\xa3\"4y\\xf3\\x11\\xf3\\xf6\\x93\\x11ov\\xc3=@\\xbb\\x86\\x17\\xb6\\x97c\\x93\\x8ee\\xe5-\\xf9\\xde\\xb0\\xc7\\x81\\x8f\\xe8\\x99\\x9b\\x87\\xfb\\xaa?\\xd5\\x90kc@\\x88s\\x047\\xf7\\x8e\\x98r\\x8c\\x9b\\x16\t\\xc2t\\xae\\xd8\\x11\\xbd\\xa4sg\\xfb\\xb8\\xd1qp3"
  690.  
  691.  
  692. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\t\\xea\\xb5\\x95\\xf9\\x80\\x90\\x80)\\xfc\\xdf\\xba\\xce\\xfa\\x95\\x82\\xacjs\\xed^\\x91\\xbb0 \\xd7\\x95h!\\xf7\\xaf\\xffs\\xbf\\x91\\xb2\\xe3u\\x92\\xa7\\x0f)\\xe7\\xdc\\x846k\\x0c\\x8dt\\x06\\xa2\\xe3\\x11\\x9c\\xb6\\xc7\\xf7v,s\\xc2\\x81y\\x84\\xa6\\xda\\x94\\xe5\\xd0cr\\xd1\\x04lj#\\xd9\\xaf\\xc6gxro7\\x14\\xee\\xc6\\x8a\\x1b\\xc6\\x87\\xac\\xf1\\x982;n\\xe17\\x81\\xc6%a\\x17\\xbam\\xd3\\xbbm!\\xf0 \\xc6c\\xb1\\xad\\xaf\\x8e\\x93\\xb5\\xc0\\x86n\\x86\\x10\\x1f\\x1e\\xddeg\\xb1\\x82\\xde\\xa83k:\\xba\\xd4:\\xa7f\\xad\\x8c\\x0c\t\\xf4\\xbdp\\xf7\\xf0\\x8e+\\xaaj\\x140l(\\x0b=\\xcf_\\x14_\\xa3q\\xff\\x97\\x8f`)w\\x1aa8\\x10d\\xeew\\xa2\\xfa\\xa4\\x87\\xa9\\x08\\xbc0\\xaad\\x05\\xaa\\xd9r(\\x88\\x85\\xef\\x94?\\x92\\x9f\\xfdx\\\\x8c\\xf59\\x92\\\\xd3\\xca\\xff\\xe0\\xfaf\\x90h\\xaa\\x9d\\x0e\\x9e&\\x9a\\x1c\\xfb\\xd6by\\xd2ss\\xce\\x174q\\xc1@\\xb2\\x914\\xe6"
  693.  
  694.  
  695. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  696.  
  697.  
  698. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  699.  
  700.  
  701. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01&\\x96\\x8d\\xed\\xdf\\xb4\\xde\\x1dw\\xb3\\xe5e\\x8c\\xe0qd\\x92s\\xbe\\xa2\\xe0m\\xd2\\xc0p|\\xe4\\xc8\\xbf\\x13\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  702.  
  703.  
  704. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x14!_\\x82\\x0e\\x85\\xddi\\xfc\\x916\\\\xa6\\xd5\\x93\\xc3o\\x03\\xb9\\xb2\\xea\\xc4\\xba\\x9e,\\x98\\xe6\\x0ffw\\xeb\\xd3\\x8c\n\\x7f\\xc41:\\xb1\\xdf'\\xf2\\xf3;\\x94k\\xe0\\xdf,*/\\x93\\xd7\\xa7\\xedr\\xf8mv\\xad\\xd2\\xd9&v\\xf5f\\xb4\\x19\\xde\\xc5\\xe5\\x93\\xd9(k+\\x9c\\xa8y\\xf3f\\x85\\xb5\\xf0,\\xb5u\\xd3\\x90ly\\x91aw\\x04,\\x18wv\\x02\\xc2\\x162\\x03\\xe0w\\xc6*uf\\xc2\\xf1\\x146\\xe4\\xf9\\x06\\xbah\n\\xefa\\xd2\\xc4\\xca.\\x03\\x13\\xbb\\x8cq\\xf1^o\\x82%\\xd4\\xb1\\xa5\\x87\\xe8\\xdb\\xd0+\\xa3;\\xe2\\xf2\\xd2\\x882r\\x97ksn^\\x18-\\xed=\\xea\\xdadhh\\x8cn=\\x86uw\\x91\\xde\\xbea5;gb\\xdf\\x8a\\x10\\xc7v\\\\xec\\xb0j8\\xe7\\xfe\\x9ar@\\x94\\xfd\\xf8\\xf8\\x05wuo\\x15h\\x82\\x0cx-\\xe5\\x91\\xb2\\x88\\xeb\\xe9je\\x92\\xfa\\xe7\\x1c\\x95\\x86g\\x8d8\\x80\\xf8\\x08\\x12\\x86\\xda\\xbb\t4\\xc2\\x81\\xf2;p\\x1b"
  705.  
  706.  
  707. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`j\\xa4i:\\xc8\\xc1\\xf5\\xfe`\\x1a(\\xcdb\\xf0/f\\x16z!_\\xa7t\\xf9\\x93\\xee\ny\\xb6\\xa4\t\\x1a\\x9a\\x8f\\xd6g\\x906\to\\xc0(\\xf6\\xc2\\xd7\\x9c\\xcb\\x95\"\\xb01h\\xd6\\xe7yy?\\x12\\x80\\x1e\\xb9f@\"\\xcc \\x9an\\x0c,\\xdff~fu\\xb2\\x17\\xe4p\\x89\\xda$\\xa0\\xf2\\x04$\\xfe\\xb4g\\x98\\x04\n\\xb3\\x85\\x0f|\\xa2m\\x1f\\xe0\\xe7wvwn1\\xa16z\\xc1=_\\xc9\\xe3s\\x92g\\xf3\\x97\\xb0t_f\\x10\\xb0e\\xd6\\x85\\xbc\\x1fr7\\xaa\\x87\\xacrw\\xff\\x86\\x14\\x0f\\xedp\\x14\\x88\\xf0\\x9bk\\xd9\\xfd\\x8b\\xc7\\xda\\xa0_3\\xcbi\\xf3\\xd7z1\\x85<r\\x96\\xbck\\xa3\\xd5\\xf3u\\x07\\xa7\\xfb\\xa9i\\xad\\x8c&i\\x0e5\\x10\\xbb>6\\x9f\\x9e\\x14\\x06\"\\xca\\xa5\\x0cw\\xb1\\xc2\\x0c\\xe5w\\x96\\x7f\\xf8\\x8c\\xef-\\xf5\\x87t7\\xbb\\x81\\x98\\xee\\x1e\\x12\\xbb\\xe9\\x1ds\\xdd\\x10\\x88\\xc3\\x1b`\\x9e\\xe7\\xf9~dp\\xa1\\x88\\\\xce\\x84\\x8d\\x02\\x1f\\xd5\\x99h\\xac\\x85\\xa60\\xf5\\x1b\\xc0"
  708.  
  709.  
  710. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xc5z\\xe99\\xadz\\xb2a\\xbc\\xa7niu\\x95\\xfb\\xab\\xbb\\xd7f\\xca\\x87\\x0f\\xff\\xde\\xe4\\x7f\\xb6\\x93\\x00\\xa2\\x8b\\xdf\\xe6\\xef\\x9e\\x16=\r\\x84\\xee\\x04\\xaa\\xdcm\\x07v\\x8c\\xa3-\\x87e\\xaf'\\x1e\\x81\\xe0\\x1f\\x82\\xd0\\xce9\\xa6\\xee`\\xc2\\x05rp\\xb1\\x18-\\x9b\\x90vc)\\xe7a\\x184\\x18n\\xe8\\x13r^ma\\xfe\\xf4\\xcc@)\\xf5\\x1ez\\x9c\\xb0d\\x81\\x1fj\\xd9\\xcas(\\x933\\x0c\\xa8\\x06l\\x8do\\xe5r,n_\\xee\\xf74\\x87\\xc6\\xe7-\\x12\\x87xs\\xad\\xac\\x0b\\x83\\xfbu\\x97\\x95\\x19i\\x9cv?q9zg)d\\xe5|\\xe0\\xb4\\x87l\\x01\\x13\\x0f\\x9bo\\xa6\\xe9\\xe7\\xb5\\x1a\\x81\\xc2\\xf8et\\xba&\\xaf\\xe9\t\\x04\\xba\\x88\\x9e\\x13=\\xff,\nv\\xcf\\xebzi\\x9a\\x87y\\xf8\\x12\\x0b\\xd5\\x90c\\xb5;`&j\\xf0xyctx\\x1f\\x84\\xdd\\xfe\\xedy\\x85\\xae\\\\x9c\\x9a\\xcb\\xf0\\xe9\\x97#)\\x14\\xac\\xaa2\\xb9n\\x88\\xf3r\\xe3\\x9d\\xffo\taye\\xc6\\x1f\\xa9\\x1b\\xa5"
  711.  
  712.  
  713.  
  714.  
  715. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  716. "Details":
  717.  
  718. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  719.  
  720.  
  721. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  722.  
  723.  
  724. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  725.  
  726.  
  727. "McAfee": "Exploit-CVE2017-11882.ah"
  728.  
  729.  
  730. "Symantec": "Bloodhound.RTF.12"
  731.  
  732.  
  733. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  734.  
  735.  
  736. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  737.  
  738.  
  739. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  740.  
  741.  
  742. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  743.  
  744.  
  745. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  746.  
  747.  
  748. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  749.  
  750.  
  751. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  752.  
  753.  
  754. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  755.  
  756.  
  757. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  758.  
  759.  
  760. "TrendMicro": "Possible_SMBCVE20170199"
  761.  
  762.  
  763. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  764.  
  765.  
  766. "Sophos": "Exp/201711882-P"
  767.  
  768.  
  769. "Cyren": "CVE-2017-11882!Camelot"
  770.  
  771.  
  772. "Avira": "HEUR/Rtf.Malformed"
  773.  
  774.  
  775. "MAX": "malware (ai score=86)"
  776.  
  777.  
  778. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  779.  
  780.  
  781. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  782.  
  783.  
  784. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  785.  
  786.  
  787. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  788.  
  789.  
  790. "GData": "Exploit.RTF-ObfsStrm.Gen"
  791.  
  792.  
  793. "AhnLab-V3": "RTF/Malform-C.Gen"
  794.  
  795.  
  796. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  797.  
  798.  
  799. "Zoner": "Probably RTFObfuscation"
  800.  
  801.  
  802. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  803.  
  804.  
  805. "Ikarus": "Exploit.CVE-2017-11882"
  806.  
  807.  
  808. "Qihoo-360": "susp.rtf.objupdate.gen"
  809.  
  810.  
  811.  
  812.  
  813. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  814. "Details":
  815.  
  816. "target": "clamav:Rtf.Dropper.Agent-7017504-0, sha256:32423869bcc4023c1f7af8b735807da61cdc496d42563e6882a6a8f156372cc6, type:Rich Text Format data, version 1, unknown character set"
  817.  
  818.  
  819. "dropped": "clamav:Rtf.Dropper.Agent-7017504-0, sha256:32423869bcc4023c1f7af8b735807da61cdc496d42563e6882a6a8f156372cc6 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_554ae0b60388ba9b40ec29f74b84363a.doc, type:Rich Text Format data, version 1, unknown character set"
  820.  
  821.  
  822.  
  823.  
  824.  
  825. * Started Service:
  826. "osppsvc"
  827.  
  828.  
  829. * Mutexes:
  830. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  831. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  832. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  833. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  834. "CicLoadWinStaWinSta0",
  835. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  836. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  837. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  838. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  839.  
  840.  
  841. * Modified Files:
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_554ae0b60388ba9b40ec29f74b84363a.doc",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_554ae0b60388ba9b40ec29f74b84363a.doc",
  844. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF5C9EED5D-E4CC-4494-942A-0ACAB44F0A09.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  846. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6ED56127-8ED7-4AE7-9194-6220CEEC9F06.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE26D9F1B-4889-498C-9613-24C533F7C432.tmp",
  848. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  849. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  850. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  851. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab83E8.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar83E9.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92ED.tmp",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931D.tmp",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931E.tmp",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931F.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9320.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cab939E.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cab939F.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DF.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93E0.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93F0.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9401.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9412.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9413.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cab954C.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9770.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9781.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9791.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9800.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9802.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9813.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9815.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9817.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9818.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9898.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9803.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98B8.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98E8.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar982A.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9829.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9801.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9814.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9816.tmp",
  886. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  887. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  888. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  889. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  890. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A62.tmp\\PictureFrame.glox",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A62.tmp\\Content.inf",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A75.tmp\\ieee2006officeonline.xsl",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A52.tmp\\BracketList.glox",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A63.tmp\\harvardanglia2008officeonline.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A51.tmp\\ThemePictureAccent.glox",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A74.tmp\\gostname.xsl",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB4.tmp\\rings.glox",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A51.tmp\\Content.inf",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A52.tmp\\Content.inf",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB5.tmp\\gb.xsl",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB4.tmp\\Content.inf",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A63.tmp\\Content.inf",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF7.tmp\\APASixthEditionOfficeOnline.xsl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A74.tmp\\Content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A75.tmp\\Content.inf",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF5.tmp\\turabian.xsl",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B18.tmp\\sist02.xsl",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF6.tmp\\VaryingWidthList.glox",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B7A.tmp\\Equations.dotx",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B08.tmp\\Element design set.dotx",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B49.tmp\\gosttitle.xsl",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B69.tmp\\TabList.glox",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B38.tmp\\mlaseventheditionofficeonline.xsl",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BF9.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF6.tmp\\Content.inf",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B7A.tmp\\Content.inf",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B9A.tmp\\TabbedArc.glox",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B18.tmp\\Content.inf",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B08.tmp\\Content.inf",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF7.tmp\\Content.inf",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B69.tmp\\Content.inf",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB5.tmp\\Content.inf",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF5.tmp\\Content.inf",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B49.tmp\\Content.inf",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B38.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B9A.tmp\\Content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E5B.tmp\\Basis.thmx",
  932. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F66.tmp",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA032.tmp\\iso690nmerical.xsl",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E5B.tmp\\content.inf",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  947. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA032.tmp\\Content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA16C.tmp\\Crop.thmx",
  951. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA18C.tmp\\pictureorgchart.glox",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA16C.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA323.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA18C.tmp\\Content.inf",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA43D.tmp\\content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA43D.tmp\\Savon.thmx",
  962. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA5E4.tmp",
  964. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B0.tmp\\Feathered.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B0.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA951.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA1D.tmp\\content.inf",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA1D.tmp\\Slate.thmx",
  971. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD0C.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD5B.tmp\\Headlines.thmx",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD5B.tmp\\Content.inf",
  975. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB740.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB879.tmp\\Insight design set.dotx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB879.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  980. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  981. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9E935954-92D1-4618-8535-78499FB3B204.tmp"
  982.  
  983.  
  984. * Deleted Files:
  985. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab83E8.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar83E9.tmp",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464fn=Dividend.eftx",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496fn=Parallax.eftx",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464fn=Dividend.xml",
  995. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434fn=Wood Type.eftx",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496fn=Parallax.xml",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464fn=Dividend.xml",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434fn=Wood Type.xml",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1004. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496fn=Parallax.xml",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434fn=Wood Type.xml",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9802.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9803.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9818.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9800.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9813.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9814.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar982A.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9815.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9817.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9801.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9816.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9829.tmp",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  1020. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A62.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A51.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A52.tmp",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A63.tmp",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A75.tmp",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A74.tmp",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB5.tmp",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB4.tmp",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF6.tmp",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF5.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF7.tmp",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B08.tmp",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B18.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B38.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B49.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B69.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B7A.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B9A.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A52.tmp\\BracketList.glox",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A62.tmp\\PictureFrame.glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93E0.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9781.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A51.tmp\\ThemePictureAccent.glox",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9791.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E5B.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB4.tmp\\rings.glox",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93DF.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A75.tmp\\ieee2006officeonline.xsl",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B08.tmp\\Element design set.dotx",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9401.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A74.tmp\\gostname.xsl",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab954C.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab939E.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF6.tmp\\VaryingWidthList.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF5.tmp\\turabian.xsl",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA032.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93F0.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9770.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B69.tmp\\TabList.glox",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B7A.tmp\\Equations.dotx",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A63.tmp\\harvardanglia2008officeonline.xsl",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B49.tmp\\gosttitle.xsl",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AF7.tmp\\APASixthEditionOfficeOnline.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B18.tmp\\sist02.xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B9A.tmp\\TabbedArc.glox",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931F.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B38.tmp\\mlaseventheditionofficeonline.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA16C.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E5B.tmp\\Basis.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AB5.tmp\\gb.xsl",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931E.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92ED.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9412.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98B8.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9898.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9320.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA18C.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA032.tmp\\iso690nmerical.xsl",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab939F.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BF9.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\cab931D.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA16C.tmp\\Crop.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98E8.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA18C.tmp\\pictureorgchart.glox",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F66.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9413.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA43D.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA43D.tmp\\Savon.thmx",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA323.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B0.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B0.tmp\\Feathered.thmx",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA5E4.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA1D.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA1D.tmp\\Slate.thmx",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA951.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD5B.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD5B.tmp\\Headlines.thmx",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD0C.tmp",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB879.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB879.tmp\\Insight design set.dotx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB740.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_554ae0b60388ba9b40ec29f74b84363a.doc",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1132. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9E935954-92D1-4618-8535-78499FB3B204.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6ED56127-8ED7-4AE7-9194-6220CEEC9F06.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE26D9F1B-4889-498C-9613-24C533F7C432.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR6C67.tmp.cvr"
  1136.  
  1137.  
  1138. * Modified Registry Keys:
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\a&w",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\14F0BEA",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\14F0BEA\\14F0BEA",
  1159. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1460. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1466. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1467. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1468. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1773.  
  1774.  
  1775. * Deleted Registry Keys:
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\a&w",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\w7u",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\14F0BEA\\14F0BEA",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1812.  
  1813.  
  1814. * DNS Communications:
  1815.  
  1816. "type": "A",
  1817. "request": "thecoverstudio.com",
  1818. "answers":
  1819.  
  1820. "data": "164.132.235.17",
  1821. "type": "A"
  1822.  
  1823.  
  1824.  
  1825.  
  1826. "type": "A",
  1827. "request": "vemvemserver.duckdns.org",
  1828. "answers":
  1829.  
  1830. "data": "205.185.125.42",
  1831. "type": "A"
  1832.  
  1833.  
  1834.  
  1835.  
  1836.  
  1837. * Domains:
  1838.  
  1839. "ip": "164.132.235.17",
  1840. "domain": "thecoverstudio.com"
  1841.  
  1842.  
  1843. "ip": "205.185.125.42",
  1844. "domain": "vemvemserver.duckdns.org"
  1845.  
  1846.  
  1847.  
  1848. * Network Communication - ICMP:
  1849.  
  1850. * Network Communication - HTTP:
  1851.  
  1852. "count": 1,
  1853. "body": "",
  1854. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1855. "user-agent": "Microsoft-CryptoAPI/6.1",
  1856. "method": "GET",
  1857. "host": "ocsp.digicert.com",
  1858. "version": "1.1",
  1859. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1860. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1861. "port": 80
  1862.  
  1863.  
  1864. "count": 1,
  1865. "body": "",
  1866. "uri": "http://thecoverstudio.com/modules/jmsslider/views/img/layers/app/gorwxf.msi",
  1867. "user-agent": "Windows Installer",
  1868. "method": "GET",
  1869. "host": "thecoverstudio.com",
  1870. "version": "1.1",
  1871. "path": "/modules/jmsslider/views/img/layers/app/gorwxf.msi",
  1872. "data": "GET /modules/jmsslider/views/img/layers/app/gorwxf.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: thecoverstudio.com\r\n\r\n",
  1873. "port": 80
  1874.  
  1875.  
  1876. "count": 1,
  1877. "body": "",
  1878. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1879. "user-agent": "Microsoft-CryptoAPI/6.1",
  1880. "method": "GET",
  1881. "host": "ocsp.msocsp.com",
  1882. "version": "1.1",
  1883. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1884. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1885. "port": 80
  1886.  
  1887.  
  1888. "count": 10,
  1889. "body": "",
  1890. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1891. "user-agent": "Microsoft-CryptoAPI/6.1",
  1892. "method": "GET",
  1893. "host": "crl.microsoft.com",
  1894. "version": "1.1",
  1895. "path": "/pki/crl/products/microsoftrootcert.crl",
  1896. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1897. "port": 80
  1898.  
  1899.  
  1900. "count": 1,
  1901. "body": "",
  1902. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1903. "user-agent": "Microsoft-CryptoAPI/6.1",
  1904. "method": "GET",
  1905. "host": "crl.microsoft.com",
  1906. "version": "1.1",
  1907. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1908. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1909. "port": 80
  1910.  
  1911.  
  1912.  
  1913. * Network Communication - SMTP:
  1914.  
  1915. * Network Communication - Hosts:
  1916.  
  1917. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!