API tools faq
paste
paladin316

Docs_c51001ee58b01a5d503953bee84dfe70_doc_2019-07-26_18_30.txt

paladin316
Jul 26th, 2019
2,131
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 237.81 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Sload"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_c51001ee58b01a5d503953bee84dfe70.doc"
  7. * File Size: 86016
  8. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.3, Code page: 1252, Template: Normal.dotm, Last Saved By: Administrator, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Jul 25 12:27:00 2019, Last Saved Time/Date: Thu Jul 25 12:27:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  9. * SHA256: "dd1e8dbe71a78a51da78f68d439c6a63cafefe960f61ee951d7c708875daee8d"
  10. * MD5: "c51001ee58b01a5d503953bee84dfe70"
  11. * SHA1: "eea3c5c2297609cf3d79c4328a2f14664ac45e57"
  12. * SHA512: "e7e1264eb574573ee920c3e2d99d9f0e2ce8818055db156d697ca781ea840bdcc826541e852093bc22aa20384688e9d0a8d6335980123832ab5f128f560dcdf6"
  13. * CRC32: "9DBD0C07"
  14. * SSDEEP: "1536:XvxIDi+c24Nv7BG+a98rmSIHz3TOcIB1m+TLxs:fYbcxxBzIHz3TKXJXx"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "FTPxWIN-sctned.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "\"C:\\Users\\user\\AppData\\Local\\Temp\\FTPxWIN-sctned.exe\""
  23.  
  24.  
  25. * Signatures Detected:
  26.  
  27. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  28. "Details":
  29.  
  30. "IP": "92.123.51.45:443"
  31.  
  32.  
  33. "IP": "65.52.98.231:443"
  34.  
  35.  
  36. "IP": "23.60.72.96:443"
  37.  
  38.  
  39. "IP": "198.54.125.177:80"
  40.  
  41.  
  42. "IP": "104.18.25.243:80"
  43.  
  44.  
  45. "IP": "72.21.91.29:80"
  46.  
  47.  
  48. "IP": "184.28.188.192:80"
  49.  
  50.  
  51. "IP": "52.109.2.18:443"
  52.  
  53.  
  54. "IP": "52.109.2.14:443"
  55.  
  56.  
  57.  
  58.  
  59. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  60. "Details":
  61.  
  62. "ioc": "rame.glox"
  63.  
  64.  
  65. "ioc": "ontent.inf"
  66.  
  67.  
  68. "ioc": "chevronaccent.glox"
  69.  
  70.  
  71. "ioc": "sist02.xsl"
  72.  
  73.  
  74. "ioc": "gostname.xsl"
  75.  
  76.  
  77. "ioc": "pictureorgchart.glox"
  78.  
  79.  
  80. "ioc": "rocess.glox"
  81.  
  82.  
  83. "ioc": "ist.glox"
  84.  
  85.  
  86. "ioc": "gosttitle.xsl"
  87.  
  88.  
  89. "ioc": "architecture.glox"
  90.  
  91.  
  92. "ioc": "iso690.xsl"
  93.  
  94.  
  95. "ioc": "mlaseventheditionofficeonline.xsl"
  96.  
  97.  
  98. "ioc": "chicago.xsl"
  99.  
  100.  
  101. "ioc": "ieee2006officeonline.xsl"
  102.  
  103.  
  104. "ioc": "e.gu"
  105.  
  106.  
  107. "ioc": "gb.xsl"
  108.  
  109.  
  110. "ioc": "adial.glox"
  111.  
  112.  
  113. "ioc": "rc.glox"
  114.  
  115.  
  116. "ioc": "iso690nmerical.xsl"
  117.  
  118.  
  119. "ioc": "turabian.xsl"
  120.  
  121.  
  122. "ioc": "ccent.glox"
  123.  
  124.  
  125. "ioc": "nline.xsl"
  126.  
  127.  
  128. "ioc": "anded.thmx"
  129.  
  130.  
  131. "ioc": "content.inf"
  132.  
  133.  
  134. "ioc": "rid.glox"
  135.  
  136.  
  137. "ioc": "..3b"
  138.  
  139.  
  140. "ioc": "set.dotx"
  141.  
  142.  
  143. "ioc": "iew.thmx"
  144.  
  145.  
  146. "ioc": "harvardanglia2008officeonline.xsl"
  147.  
  148.  
  149. "ioc": "ype.thmx"
  150.  
  151.  
  152. "ioc": "quations.dotx"
  153.  
  154.  
  155. "ioc": "ext.glox"
  156.  
  157.  
  158. "ioc": "rings.glox"
  159.  
  160.  
  161. "ioc": "eadlines.thmx"
  162.  
  163.  
  164. "ioc": "rame.thmx"
  165.  
  166.  
  167. "ioc": "roplet.thmx"
  168.  
  169.  
  170. "ioc": "rop.thmx"
  171.  
  172.  
  173. "ioc": "asis.thmx"
  174.  
  175.  
  176. "ioc": "uotable.thmx"
  177.  
  178.  
  179. "ioc": "etropolitan.thmx"
  180.  
  181.  
  182. "ioc": "arallax.thmx"
  183.  
  184.  
  185. "ioc": "ividend.thmx"
  186.  
  187.  
  188. "ioc": "avon.thmx"
  189.  
  190.  
  191. "ioc": "adge.thmx"
  192.  
  193.  
  194. "ioc": "ircuit.thmx"
  195.  
  196.  
  197. "ioc": "g.n9"
  198.  
  199.  
  200. "ioc": "erlin.thmx"
  201.  
  202.  
  203. "ioc": "late.thmx"
  204.  
  205.  
  206. "ioc": "vent.thmx"
  207.  
  208.  
  209. "ioc": "eathered.thmx"
  210.  
  211.  
  212. "ioc": "esh.thmx"
  213.  
  214.  
  215. "ioc": "amask.thmx"
  216.  
  217.  
  218. "ioc": "rail.thmx"
  219.  
  220.  
  221.  
  222.  
  223. "Description": "Performs some HTTP requests",
  224. "Details":
  225.  
  226. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  227.  
  228.  
  229. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  230.  
  231.  
  232. "url": "http://documents.online-transaction.website/1/bT3NEfMGHNBatch54.exe"
  233.  
  234.  
  235.  
  236.  
  237. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  238. "Details":
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01;=\\xfb\\xde\\xacb9ww\\xbb\\xe5/\\x07\\xfa\\xb7\\x870p\\xeb\\xdbe\\xdb\\xafjr6\\x19\\xaa\\x87\\xc4f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\x15\\x8fx:\\xe7f\\x8ddrhy\\x92\\x91\\x945\\xbb\\x99\\xf0\\x08\\xe0\\x81\\x03\\x82z\\x8a\\xbd\\x0b\\xcdmz\\x97@\\xe2\\xf7\\xee\\xf6\\xdeb\\xb1ta\\x1c*y\\x94\\x0c\\xbe\\xa7mu\\\\x84\\xcb\\x85f\\xba\\x9c\\xd2v\\xd7wf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x80\\x1ap\\x80\\xad\\x82\\x8cg^\\xe8\\xb8\\x17\\xbf6\\x02\\xb6\\x99\\xb1k\\x12\\xcb\\xdb\\x135\\xe5\\x9e4\\xba\\xd7\\xef\\x81\\x93\\xde0?\\xf4\\x8bvd\\xce\\xb3\\xfe\\xff(\\x14"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa2km\\xca)3\\xb9w\t\\xcd4\\xabom&\\xb3\\x8f\\x1c\\xa6'\\xba\\x17\\x96\\x1d\\xa5\\xf9\\xb5\\xe1i7\\x12\\x95\\x07\\x15\\x05\\xc3\\xe3\\x93\\xbfi+\\x89\\xb8nz\\xf3\\x8f\\x17b\\x17\\x91\\xda\\xb2i.z\\xd73\\xc9r\\xf2\\xfd\\xdb1em\\x00\\xaf\\xec\\xc0\\xa4?\\x1di\\xe2j\\x1e\\xd0:\\xca\\x1dm)\\xb7,\\xec\\xfbh\\xfe\\x1d\\x8b=\\xccg\\xe3h\\x15a(\\xac?\\xe6\\xeb3me\\x01\\x1e7m)\\xe3\\x1f\\x1co\\x91\\x96\\xb5\\xf1\\xd1/\\xc0\\x9b!\\x07\\xf9$\\x7f\\xc2a\\xc1\\x12\\xd0p\\x8e/b\\x8fi\\x88\\xd9\\xfer\\xd3)\\xf4\\xbe\\xa7\\x05\\xb2\\xbb\\xc1\\xff\\xfen7p\\x93\\xae^\\xf1\\x96\\xa9\\xa1f\\x1fi\\xdd\\x05%ov\\xdct\\xea\\xcd\\xe0+n,\\x0e\\x96\\x84=\\xfc\\xae\\x84\\xf39\\x92\\xca9\\x9a\\xba\\x0c\\xc5\\xf7\\xfc\\xde\\xd7\\xc2\\+t\\x03v\\xf1\\xf7z\\xa6\\xf7\r\ro\\xe4*r\\x94\\xf9;\\xa1wm\\xf8\\xb9\\xebz\\x92\\x15d\\xf4`2.\\x83tg\\xc36\\x1e/^\\x8dsa"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x08y\\x8a\\xac\\x83_\\x10\\x9b\\xeb\\x89\\xe1\\xcb~\\x03\\xc3\\xc2xzt\\x85\\xd6tsykq\\xd5e\\x97\\xe3z\\x1a\\x8c37\\x14\\xc1\\xf5\\x01v\\xbe\\xc4\\xe9\\xdb%\\x9b \\xd3m6\\xe4f\\xfcq$\\x8d\\xc8\\xe2t\\x02m@##\\xa1b ;z\n\\x03\\xa0\\x9b\\x89\\xf5\\xce\\xbc\\xca\\x1e\\x81\\x0e\\x81\\x1cq\\x11?f\\xeb:\\x05\\xccv\r\\xc2\\xf4\\xa3\\xde\\xea\\xc8rpxw=\\r$<t\\xbc\\x19\\x9b`8^\\xec\\xad(\\xcd\\xa4\\x1c\\x16\\xf3\"\\xdd\\x8f\\xb1\n\\xa9\\xa4\\xe3\\x86\\x1f\\xf8g\\xd6\\x10\\x8bk\n\\xbabw\\xb04\\x80\\xb2r7\\xe1\\xdab;\\xac@d-\\xac..\\xc0\\x14(\\x9f\\xbf\\x96p%cw0\\xf6\\xa7d\\xf1\\xb2\\xe0\\x9e\r\\xa8\\xdai\\x8a\\x16\\x8c\\x15ly\\x9d\\xf9\\xb1m\\xb5x\\x076+\\xc1\\xf1\\xa5 \\xa6\\xcf\\xbd\\xbaa\\xdb\\x068\\x80\\x00\\x88\\xac\\x1a\\x9b\\x18v(\\xc58\\x0ct\\xee\\xa3\\x01tw\\xca+\\xc8\\x8es\\xec\\xaex\\x12\\xf1\\xe0\\xa5!bi\\x0c\\x8d\\x9d\\xeby&"
  256.  
  257.  
  258. "http_request": "winword.exe_InternetCrackUrlA_http://documents.online-transaction.website/1/bT3NEfMGHNBatch54.exe"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01;=\\xfd\\xd2m\\x06\\x0ba\\xc6\\xa1\\x87\\x8b4/\\xcd\\xdd\\xa1\\xbd\\xe2\\xf7\\xadj\\xf3\\xae\\xaa\\xfa\\x8d5'k\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7\\xdb\\x1f\\xf3\\xa7*\\xb7\\xd5w\\xe2\\xbe\\xe73\\xb7%\\x9c(;\\x9257\\xbd\\x97\\xcf\\x03\\x7f\\x1c\\xf4\\xbf\\x8c\\xf2\\x8b\\xd6\"\\x14\\x1fh\\x8bu\\x08;k\\x9f$\\xc2h\t\\x11\\xb2\\x10v\\xca\\x9c\\x084\\xf9e=\\xbb\\x05\\x93\\x9c\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9%\\x17\\xdb\\xd9\\x96\\x9f\\xec_\\x17s\\x0bk\\xd52q\\x1f\\xe27\\x0b\\xe8\\x03\\xf4:\\xe6\\xeeuc\\xae\\xc9k\\xb6\\x98j\\xbf\\x81\\x87`\\xe0\\xd9\\x85$\\x92\\xe6+\\xdd!"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pjt+w\\xc4#\\xb7\\xf1<\\x12\\xcb\\xbd\\xc9^9~\\x03\\xbda1\\xda\\x9a\\xb5)f4\\x89\\xc2\\xff\\x1d\\x9b\\x95\\xfb~\\x95*f\\xb2\\xca\\xabgl7\\xf7\\xf0\\xa8\\xb2\\xe6q\\xd9,\"\\xf9\\xee\\x87s\\xb9nhsoj\\xbe\\xbc\\xfd\\x1ed\\xcb\tn\\x9d\\x95\\xa6\\x00\\x8c\\x0f\\x82\\xf4\\xbb\\xfbcy3\\xe3\\x07\\xb3\\xb6\\xadg\\x02\\x89\\x02\\x9422\\x12\\x87\\xf1\\x04\\x96\t\\xa6\\xdfwq\\xb5\\xd1rl;\\xa5_mv\\xdf\\xf4\t\\xe7\\xca\\xef\\xc8d/\\x88?\\xe4?\\x0cz%\\x16\\xcap\\xb2\\xf9\\xf7o@\\xdf\\xe0\\x85\\xc5\\xed\\xbcr\\xd3#lzm\\xca\\x1fxz\\xad\\x89va\\xa30\\x16\\xf9\\x866h\\x83\\xab\\xc3\\xc6\\xc9i\\xa0%\\xd2\\x05\\x81\\xdcd93\\x8b0\\xcb5\\x99\\xae\\x1e\\xbc\\xcdi\\x9f \\xae\\xc9\\xea\\xc3/\\x9a!3oc\\xaf\\xae\\x9fg\\x9e\\xa5ps\\x0e\\xde\\x8e\\xfcq\\xad\\xc9%\\xb5\\xef\\xb1\\x11a\\xe7\\xba\\x83\\x1eh\\x08\\x96\\xde)@\\x849\\xb2\\xce|d0\\xbe\\xbf\\xa0o\\x1f\\xa8\\x96g\\x91"
  268.  
  269.  
  270. "http_downloadurl": "winword.exe_URLDownloadToFileW_http://documents.online-transaction.website/1/bT3NEfMGHNBatch54.exe"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01;>\\x02\\xbe?\\xd3@0\\xcd\\xbft\\x87dny<\\x96w$\\x02ew\\x80>\\xa5\\x14\\x1b~\\xd9\\x97\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00yd2=|\\xe8_7\\xaad\\xa8\\xc5w\\xe1;\\xb8\\x13$\\xbe\\xcc\\xe6\\x9e/\\xf8\\x8f\\x17\\xb3\\xc4t\\x18\n\\xb1\\xf3k+\\xe8\\x8f9w\\xad\\xe5\\xdc:\\xd2\\xf6>\\xed\\x00i\\x1b\\x16\\x0b\\xc7,\\xd3\\x07!\\xe2sk\\xde\\xb6bi\\x96\\x8d\\x8e\\xe0\\xdf\\xf6\\xa3\\x9dv!rg\\xb2\\xc6\\xe9\\xf2\\x84\\xfa@0%\\xcc\\x1c\\x18\\x0c\r\\x9e\\x84\\x14\\x9d1\\xafg\\x9e>\\x04\\x1e\\x80\\xbf\\x95\\x95\\xddp0\\x91\\xef\\xe9\\xd7\\xb7\\xfbg$%g\\xa0\\xee\\x03\\xa9\\x1c\\x96\\xf2*\\x82\\xfe5\\x84\\xdb*m\\x1c%;\\x1de\\xb7\\x828\\x99\\x18\\x16\\x8f'\\xackzn\\xd5n\\x81xy\\x8b\\x19\\xf2 \\xeee\\xb7e;\\xbf\\xf4\\x12 k\\x8c\\x17\\x89j(\\xd8\\x12\\x19\\x06\\xb1\\xc1\\x9d\\x95\\x17f\\x93\\xa2\\xf0\\xa7\\xf9\\xfa\\xc8\\x9c\\x0e=\\x08\\xbb\\xe9\\xab\\x07\\x03\\xa1\\x06\\x8ccn\\xb0\\x8e\\x14\\xe7\\xb9\\xe0/\\x96\\xb8\\xbfz1l\\x9cr\\x9b\\xc6\\x10\\x84\\xda@\\xe3\\x7f\\xb0\\x15\\xf3=\\x037\\xee\\xe1\\x9a"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`hi\\x0e\\xe0\\xa5pc\\xc2\\x83\\xca\\xb2\\xb0\\xc7g\\xbb\\xb9'\\x155\\xbd\\x8c\\xcf\\xa47p\\xaa\\x0fc`\\xec\\xf5\\x00\\x06\\xcd\\xaa\\xf9dpce\\xf7\\xf7s\\xfdmw\\xd2\\xcc6\\x13\\xa4\\xc6\\xc5\\xe3`\\x9f\\x9f\\xa4ms\\xbck\\xb0\\xedn\\xb6\\x83\"k\\xaf?\n\\x97_w\\xb18^$a\\xcez\\x80\\x10\\xdd7\\xb7\\xde\\x1a\\xc3$\\x142\\xf4\\xa6j\\xbbo\\xc2?\\xd7\\x1b\\x92\\xea\\xb2\\x1d\\x99g_\\x85\"&oz9m\\\\x05\\x9a\\xe2\\xf0u\\xc1\\xdfm\\xacb,f\\xa4=/d_\\x7f7\\xf6\\xe5\\xd2\\x96i\\x0csv\\x19\\x8f\\xc7n\\x94m\\xec\\xba<\\x86\\x86\\xa9\\xd6\\xcb\\x8e\\xebs\\xc0\\xffl\\x1c\\xbc9\\xd3\\xb92\\x07\\xd0h<\\xad\\xf1?/f\\xbe0\\x9c\\xa9n\\xfe\\xcf\\xa7rd\t\\x85\\x98\\x1a\\x89t\\xdep\\xa1s*/\\x93\\x9a\\x7fn\\x81m1\\x16\\x9d\rf\\xe0\\xab-\\x9d\\x8enw\\xd5\\x0ekv\\x12\\xb9@\\x92\\x94m9\\x92k-r\\x9c\\x11\\xd0\\x97\\xb0\\x95;=\\x8d\\x03\\xb5\\x98\\xe8\\x00u"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x98r9\\x17m\\xee\\xcd\\x16\\xaa\\xdd\\x14\\x7f\\xfa\"\\xb6\\xdax11\\xc6\\x99\\xa20$\\x9c`\\x01\\x88$\\xe3\\x87|\\xdaxyh\\x9fa4\\xe9fqr\\x8ay\\/t\\x9cp0\\xf6\\xd6.d\\xb9\\xca(\\xf4\\xd3\\xdb\\x80\\xdc\\xf3v\\xa7\\x1c\\xcb\\xdd\\xe1\\xa9\\xa2%\\x97\\x9do\\x90i\\x8b\"\\xc9\\xab\\xbb<\\x92\\xdfh\\xe4#zgx\\xa4\\x10\\x90\\x04<\\x11\\xdb%\\x97\\xab\\xacfr\\xffr\\xc3\\x84o\\xa7\\x89tx\\xb0\\xa0\\xf86\\xbb\\xeb\\x89\\xdc\\x06\\x88o\\xac\\xb4dus4<\\x1ft\\x000\\x12\\xcf\\xeb;d\\x88y\\x17\\xc1\\xd2y|3\\xbe|!\\xa1p\\xa9<\\xd2\\xc9\\xed\\xb5\\xdc\\x88d^\\1\\xbazt\\x1at\\x05\\xe4\\x88,\\xab\\xa2$3\\x97|\\xbd\\xd4\\x11\\xa8\\x00\\xe8\\x15\\x9d,\\xb3\\xb2\\xbbg\\xd8b\\xa9\\xb3\\xeb\\xdb\\x15\\x83r\\xf8\\x9f\\xce\\xa5a\\x19\\xc2n\\x91?kwl\r\\xcd\\x13>g\\xed\\x95\\xdd\\xc5\\xf9##r\\x02\\x806\\x84\\xda\\xb4\\xf2a\\x93(\\xdd\\xbf\\x16\\xae(1<f\\x05k"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01;>\\x05\\xb3\\x8el\\xe0\\xd0\\x0eg-\\xa3\\xd4\\x86|\\xef\\xf02e\\x10\\xeac9fm\\xe1\\xa7%@\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043\\xc3\\x1f\\x18\\xe6\\xdc\\xbd\\xa3 \\xef\\x91j\\xda\\x04\\xb3\\xd5n\\xf5\\xd4x\\xe6\\x05\\xae\\x9f\\x9e\\xc7\\xe9\\xb7\\xc0.byh\\xd5p\\x8d\\xa2\\xfc\\xa6q\\xe2\\xd0czl\\xba)\\xa0\\x92\\xfd\\xf4\\x87\\xb1*6;\\xd4y\\x18\\xb0\\xc9d\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\xe9\\xed\\x0c&u\\x80\\xad\\xb6a\\xbb\\xab\\x95kn\\xa1\\x11\\x99\\xb3\\xbf\\x95k\\xb1\\xa06\\xa4\\x92\\xe5&\\x9f\\xef\\xaa\\xf6\\xcapx\\xd0\\xb9~\\x87\\xef\\xba\\x7f\\x9b\n\\xef"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb8h\\x98\\xf8\\xdc\\xb3\\xb5\\x1d\\x86\\xfe\\x98\\xed\\xdc\\x0bd\\xea\\x0ez\\x0c\\xe3\\xea\\x7f\\x1fj(\\xad\\xab#\\x843\\xb7\\xea|(kf\\x03z@\\xf6\\xbfi\\x1b\\x10\\x97\t\\s\\xd0@\\xd3%/\\xed\\xd4<\\x8ca|k\\xeb\\x85\\xae\\xf7\\xbep&\\xd9\\xd1\\xad7\\xde\\xe6\\x02\\xc6vi>\\x9d\\xb6\\x1da3^\\xe2 \\x8e\\x064ros\\x1d,\\xc7c\\xab\\xd6\\x98\\u\\xe7\\xcfu\\x93\\xab\\xc4\\xad\\xe7\\xaf\\x8b\\x91\\x08\\xf3\\x96\\x02/#%\\xa4^\"x\\x18\\xb4\\x8d5\\x18r/\\xf8\\x1d\\xa0l\\x15\\xc3x\\xae\\xb4s\\x94\\xae\\xe7\\xa2l\\x89\\xb6n\\xc9z\\x11\\xdd%v\\x18+\\xf6\\xcd\\xfbl\\x98y\\x8b\\x06\\xd1\\xf3rf\\xbf\\xa8\\xa3\\x88\\xdet\\xf2\\x8a\\x83\\xa8t\\x16m\\xcf\\x9f\\xb2\\xa5(je\\xac\\xd3.u\\x1ez\\xae\n\\xecc\\x91\\x17x\\x08j\\xc4\\xd5\\xa4\\xfe\\xee\\x14\\x02\\xb4\\x9c\\xdb?g \\x8d\\xb4n|\\xbdnj\\xb4-\\xed\\xb7\\x0b\\x93\\xe7e\\x98da\\x02\\xe5\\x7f\\xc3\\xe3i\\xeb\\x16z\\x05\\xf8m\\xd2\\xd7\\x03"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x05\\x8bh\\xd68\\xa6\\x189x\\xd3\\xf8\\x8amfx\\x10\\xf1gge\\xe4\\xa2\\xf6\\xd3\\x98\\x81\\x95\\x172\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x063\\xc4\\x1c\\xd6\\x9c\\x9e|\\xdc\\xe0|i\\x7f<m.\\xf8\\x19my\\x9a\\xb34pz\\xc8\\xc0\\xed\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06*p\\x06\\x9fk\\xa5\\xda%\\xe82vk\\xf7\\xaa7\\x11l?\\xcc'\\xd2\\xf5\\xbf\\x9f(\\xe0\\xdbv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xfc\\xa0m\\x02$\\x10\\x1c\\x078\\xd2\\x9b\\x01-~0\\xa9\\xf5\\x1c\\x13\\x9c\\xf8\\xdc\\x92\\x0f j\\x1a\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x93\t\\xa5\\xf9\\x1cc\\xda\\xf1,\\x91\\xa6\\x15\\x06=x\\xf1\\xf3\\xc9\\xd61\\x19q=\\x99\n\\xf6p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06(y\\xfc\\xa8\\xd57c;j,b\\x95\\xddi>\\xbd\\xacn/\\xfe\\xcd\\xbc\"y\\x96v\\xaa\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_f\\x05\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xb5|\\x86;)\\x11\\x98\\x86j+\\x97s\\xac\\x9d\\x8b\\xd7u\\x03\\xcf\\xce\\x7f\\x84\\x1f.\\x0bp\\xecp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06v\r\\x19d\\xf8p<+\\xb1\\x8c\\x9a<`\\x00\\xc7y\\xad\\xab\\xdd\\x1a\\xac:\\xb7u\\x13\\x8f\\xe9\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x8e\\xe5\\x82@c\\xfb;\\xd5vxzk\\x81d\\x8a\\x97\\x1d\\xcd+o\\xab\\x82b=\\xbf\\xd30\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xe1\\xcb\\x13c\\xab\\xf9\\x10m(\\xd9d\\xf6\\x08\\xcc\\x1bd\\xb8\\xac\\xbf\\xad\\xab\\x06a\\xb4*\\xabp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xa3/\\x80\\x166c\\x065\\xcf\\x05\\x1b\\xbbc\\x97w\\xb9h\\x8fk\\x80\\x81`\"\\xe5\\x90\\xec\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x060\\xd0y\\x99\\xced\\xa62y\\x1ew\\x80\\xf4\\xb1\\xe8t|1\\xb5y+\\x8b\\x8f\\xca`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06 <a8g&\\x94\\x017nz#\\x17\\xcf\\x16\\xe1\\xfc\\x00\\xf2\\x85\\xa5\\xdf\\xca|$\\xd8\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x81\\xd0\\x93\\xa6\\x7fk\\xca0(`\\xf0\\xea\\xbf\\x9c\\xcc$\\x16\\xe6\\xe9\\x85\\xff\\xdc\\xc8s\\x13h\\xf1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06|\\xeaf\\xa3\\x81\\xf6b\\x84\\x93\\xae\\x86f\\xc2\\x1b\\xb9\\xf07\\xd5\\xbe\\xb6\\x17\\x7f\\xf3\\xf4\\x11'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06k\\xbb$@\\xfb\\x97\\x00y\\x8cg\\x95\\xf7\\x07\\x8d\\xbe\\xf3\\xf7\\xfe\\xf0\\xc2fl\\xbc\\xf4nw\\x18\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x97\\xccu \"\\xc1\\x1657y\\xb8p\\x84\t\\xbc\\xa9c\\xd2@\\xb6(\\x17\\xe44\\x1d\\xb9zp\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xcb\\xad6oz\"\\xe9$\\xa8\\x7f\\xf0\\x06\\xeew\\xeer\\xdb\\x9b\\x98w\\xd0\\xafi\\xe8\\xf9\\x03\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06zzm\\xb6e\\x95\\xb5\\x8f\\xa2\\xb46#\\x00\\x92w\\x146e\\x1ak\\x9f\\x8c\\xe3\\x93\\x82\\xadl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xa2\\xbe\\x14c\\xaeqs+e\\xe4\\xf8\\x83\\xedq\\xc6s\\x0e\\x8f\\xb2\\x9e\\x92\\xf0b\\xef&'\\x1b5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x067\\x14\\xe3\\x10)\\x07\\x88\\xe5&3\\x89,e\\xde\\xed\\xef \\xc0\\xdb~\\xaf8\\x89\\x1ec\\xeem~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xd4\\xddm\\x93y\\x995\\x98\\xb1co\\xf71\\xba\\xd7\\xab\\xc9-\\xf55\\xff\\xbf\\xd0\\xb7\\x81\\x1e\\x05\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x15#\\xf8\\xce\\xa3\\xba@>\\xf7r\\xf1\\xc2na\\x8d\\xfa*\\xc5\\xed\\x07\\x8b\\x8de*$\\xd4\\xda\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06w\\x17\\x16\\xed\\xa4gm\\xed\\xe0\\xbb\\x15\\xe8\\x00orh\\xa4f\\xf7\\xf6f\\xfbv\">\t\\xa4i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06cg:\\x8d\\xd4\\x93\\xf5c\\x9e!\\x16\\x1dx\\xaev\\xd5\\xf3x\\xd0*\\xeb\\x80chi\\x19\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_z\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x043\\xd0f7sus*\\xc5w\\xa357'\\x8b\\x16\\xf2\\x8d\\x0c>\\xebpj%~\\x1a\\xe0\\x8e)?\\xcdr|z1\\x7f\\xc7\\x9b\\x0b\\xf0\\xcdp1f\\x12\\xf3u\\xa0\\xde\\x95\\x962\\xe3-s\\xcbl\\xb8\\x89\\x94\\xa0\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb4\\x8d\\x83\\xf0\\x04\\xac\\x8c\\xf8t&4\\xeap\\xb4.c\\x06\\xd9\\xfby\\x9e\\xb6\\x88\t\\x81`\\x9b\\x14\\xabg\\xf1q\\xd3)_)\\xa7\\x12\\xa8\\xed)\\xdd\\xde\\t!\\x8c"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\x96dc\\x88\\x86\\x92\\u\\x81\\xc0\ng\\xfb\\xbc\\\\xc6\\xb7\\xe9\\x93y\\x19\\xd9>\\x8a\\xf3$\\xa1h\\xbc\\xe6\\xf6\\xf4\\x95\\xd0\\xe6\\x02.\\xd4\\xa2\\x83f\\x920\\xf0\\x03$\\xb2\\xfds\\x80\\xe4\\xa4\\x05\\xcd%=t\\xda\\xc7\\x1e;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c\\x14m\\xfe\\xe5\\xefm\\x1a\\xc2\\x15\\x83\\xfc\\xaal\\xd3x\\x97e\\xe3l\\x15\\xd7kxc\\x82\\x1d5\\xe6\\xf0\\x85\\xdbp\\x8b\\xa7\\x17\\x1f\\xbb8\\xcfg\\x0e+b\\xf2\\xb6"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xd98\\x90rf\\x98\\x08o0xj\\x9du\\xee\\xe5\\x1af\\x81\\xe6\\xfa\\xded\\xac\\xf3\\xcc\\xeb3|\\xf2\\xd4vtc\\xee\\xac\\xdc\\xa4\\x8d .n\\x9e\\xf3\\x89\\x11a\\x16\\xb2\\xcc\\xb0\\xec\"\\xbd\\x0bx\\xc2@_\\x1eg\\xe8\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\x14t\\xd65z^is\\xcf\\x16\\x03l\\x01q\\xf7\\xfc\\x97\t\\xc9\\d\\xecr>l5a\\x9c\\xf2\\xf0j\\x9e\\xc8\\xf3\\x8d\\xf2\\x06\\x96\\x13n\\xe0-\\x93\\xcc\\xfc\\xe9\\xa7"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xae\\x00l\\xb4\\xdb+_\\xa4a\\xcd\\x15^\\xe4\\xb1\\x1c\\x88\ru;\\xa2\\x0b\\xd7\\xa4)\\xaa>\\xef\\xf0a\\xd1?fk?6>x\\x06\\xd0\\xa3y\\xd546\\x80\\x1cc\\x06\\x1b\\x16\\xdd\\xe7\\xa0\\xdf\\xce\\xb9\\xeb\\x96\\xe1di\\x02;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?x9\\x17\\xf0\\xd9\\xedbo8\\x8a\t4m\\xcez\\xfae|u\\x9fz\\x19\\xfe\\xf4\\xb4\\xdd\\x9c\\xbaew\\xffe\\x19\\xffb\\x00\\xfdn\\xb8\\xc1m\\x08\\xeda\\xfd\\xef"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\xabq\\x91|\\x07\\x8a8n\\x03\\xfa\\xd5\\xd4\\xa61\\xbe\\xbd\\xe7p\\xd6?\\xd5#\\x02\\x87\\xb1\\xfa\\x8e\\xaekc\\x06\\xfd\\xe6\\xb8%\\x0eqk\\x13o`h\\x98\\xab\\x89\\xbc\\xce;\\x9e=3\\xc0o\\x04\\x12\\x92\\x15\\x7f\\xcaft\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xbcz\\xe2\\xc9.&\\x0f\\xb84./\\xce\\x00\\xc1\\x92f\\xe4\\xec\\x93\\xd1\\x05\\xc0\\x83zu\\x92\\xd3r\\xf9\\x03\\xa1\\x9fse\\x10\\\\x84\\xea\\xacu\\xb3t\\x8bzo@\\x91"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_z\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x17d\\xf1jk\\x97\\xd7!\\xf3\\xc8\\xdabq\\xb9\\xe7\\xcc*\\x84\\x8e\t\\x06\\xc7\\xaa\\xfb\\x93\\xd00\\x8d\\x8c\\xb8\\xc9\\xf9\\x80i\\xcb\\xa6\\xb3^\\x98g\\xbb\n-\t\\xe3\\xfd\\xc5\\xca\\xd0j\\xd5\\xf9q\\xc5\\xec#\\xe8$o\\xa1~\\x89\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\xc4\\xd1`\\x13&g\\xd8\\xebq\\x0e\\xf1\\x15\\xa9\\x9a\\x93\\xea\\x1b\\xcf\\x1b\\x07^\\xa7\\x90oz\\xae9\\x00\\x8edr\\xa5\\x90\\x9by\\xe3w\\xbb\\xf5y\\xccw\\xd5&md"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\\x13\\x98-\\x9e\\x10\\x96\\xcd:\\x89:a>\\xe2-\\xdd\\xfc\\xaf\\x8c\\xc9\\x1d\\xa3\\xfb\\xa2\\xc6\\xa1\\xcat\\x9d\\xebl\\xf7\\x1a@r\\xa8md`\\x05\\xe5\\xf34?\\x80b\\x1f\\x8a\\xcf!\\xf7n\\x84\\xc8\rr\\xae\\xde\\xd8\\x00-\\x89\\xd5v\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\t-\\xc9\\xdci\\xab\\xcb\\x86#\\xb5\\xf8a\\x8d\\xea\\x06\\xe82\\x1a\\x80\\xc1\\x87\\x8a\\xaa\\x01\\xad\\x1a$\\x9bi2i\\x1a*\\xede\\x0b\\xd4m\\xa3\\xc5\\xe6\\xab\\x8b\t\\x08\\x7f"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xd4\\xc1o\\x01\\xdch^kty\\x1a\\xb7.\\xaf\\xcc/\\xafwi\\x86\\xdb\\x9b\\x00e'\\x04b\\xdd-\\xc3z\\xd0x\\xdb\\xf3\\x10\\xe6m_\\x04(\\x1fp9\\xba\\x0b$k\\xe3(\\xa0j\\x1a\\xe7@\\x91\\xed\\x0e\\xc1\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9z\\x97u\\xcd~\\xe8\\x9b\\xc4\\x18)@3mp\\x9a\\xc2\\\\x97\\x04+\\x11\\x17\\xe2\\x1ez\\xfb3\\x92\\x00\\xec\\xcd5\\xe4.n\\xc7\\x84\\xf7bme\\xa5\\x19^c\\xfd\\xaa"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ro\\xac<.\\xbe\\xad\\xd6^\\x10yc\\x12\\x98-\\x88^w9\\xc3\\xb8\\xde\rg,\\x84t\\x1f\\x9c|\\xf5nbv'd\\xffr\\xc0h=\\xbf\\xfc+\\x94\\xca\\x07+\\xd7\\x0b\\xd1\\xf1\\x97\\x0b\\x91r\\x81\\x12\\x02 \\xe6\\xc4de\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0be?\\xfa\\xd6\\x18mp\\xe4h\\xf0>\\xf6\\xf7\\x1f\\xcda\\x90\\xfd^;\\xf6\\x83e-\\xb9\\xf6\\xfb\\xb2\\xb7\\xf1w\\xaf\\xa7c\\xa7\\x86\\xce\\x1e\\xa3\\xf6\\xf0/\\xde\\x9bw_"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x97\\xec\\x9b\\xc9\\xcc\\x05\\x19c\\x95\\xe4\\xac\\x13\\xac\\xacl\\xab\\xa2x4uer\\xa1\\x7f\\x0f\\x0c\\x9dx.dsr\\x9d\\xb5\\xe4 \\xf2\\x81\\x984h\\x08\\xcb\\xfd\\x00b \\xe3u\\x7f5\\xe3;\\xfb\\xdc\\x9d\\x12\\xae\\x86\\xea\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xb9\\x07\\xaaq\\xaf\\xae\\x81\\xec\\xeb\\x9c\\xaai\\xea;sw\\xa5o\\x0c\n\\xcb\\x99\\xc9s\\xc7\\x16\\xef\\xdf\nu\\xee9\\xef',\\x7f\\x94sj\\x11\\x16t\\xe8\\x14\\x885"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\x8fzp\\x8ef\\xa7\\xc2\\x87\\x8d9\\xd1\"x\\xa7\\xbe\\x85\\x9a\\xc5;\\x04\\x85\\xe5\\x16r\\x18\\x00\\xf5j\\xe4\\xe45\\xe4\\xc0k\\xac\\x13zv\\xdap\\xa5\\x19\\x7fn*\\xd2h\\x89\\x1f\\xfc\\x89\\x99\\xfd\\xe2(`\\xa8\\xce\\xbf\\x1f\\xc4x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xb3\\xe1\\x02'\\xbcvb\\x96n\\xcb\\xb7\\x0c\\xe7,\\x14\\xfa\\x83\\x1f\\xa7\\x05\\x8a\\xb1~\\x12$!\\x0116\\x03\\xca\\xc2\\xf6w_l-j\\xe2\\xf4\\xc0k\\xa9\\xf7\\x00\\xa4"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s1\\xe3\\xa6\\x98s\\xb0~\\x01\r\\xa3\\x81\\xe0\\x10\\xbd)\\xc5\\x1e\\xe9\\xa3\\xce2\\xf4$\\x0cw\\xb5\\x96\\xcb\\xff\\xc6\\xe1%u/\\xe1z\\x94\\x8cl!.#4o\\xa8\\xa89\"x\\x98\tw\\xab\\x9e\\xe39\r\\xb1\\xd2\\x8fbs\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\xa4\\xcc\\x9b+\\x90\\xb8\\x1a\\x8c\\xe8|\\xbf5\\xa9\\xc1\\xbf\\x00\\x0e\\x85\\xa9q\\x17\\x15r\\xf0pj\\xc4\\xfbe\\xe7\\xccw\\x9f\\x82t\\xc6\\xaa\\x05\\x9bt\\xeb\\x05\\xd4\\xadf\\xaa"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x8do\\x94lg\\x93k\\x98s\\x84@\\x10\\xdb\\x1b\\xe7\\xfe\\xe5\\xcbi&g^\\xc7\\x06\\x8a\\xac\\xbb\\\\xb1ee\\x9e\\xa2pd\\xf9\\x1c:\\xa6\\xe9\\xdd\\xf6\\xf3\\xb8\\xccx):\\xaaf\\x11\\x98\\x8f\"\r\\xb4\\xc0\\xf8.\\xc3\\x87j\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8ea\\xcc\\x81&o\\xfd\\xa8\\x81\\xfe\\x92\\x1fsg\\xcc\tj\\xff\\x0c\\xc7\\xed\\xf7p\\x1b\\xffg\\x89\\xc9\\x1a&\\x8en\\xf6\\x13\\x8b\\xf6\\x18\\x07?\\xc8x\\x02mbqo\\xdcr"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\x04\\x07\\x0c\\xc5)\\xcb=\\xdb\\xf3=\\x81nj\\xe7\t\\x81\\x1e\\xc0\\x8d\\x12\\x1a\\x1b\\x81)\\xa9\\xb5\\xd6\\x04\\x1a\t\\x8e\\x950\\xca|i\\x7f r\\xaa+a\\xee\\x05\\xad\\xc2\\x19v\\xa5\\x9c\\xec!\\xdd\\x0f6\\xfc\\xd3\\xc7s\\xa7s\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xd9qe\\xc7\\xcb\\xf6\\x8d\\xec\\x05\\xbf\\x1d\\xe7_\\xe9\\xb0\\xaf5\\x88\\xa6\\xf6jg\\x1b\\x9c\\xf1|x\\x87\\x8f\\xfa+c\\xd2r\\x9dr'6\\x19\\x8d\\xec\\xda\\xd6\\x84\\xf1\\xf3\\xd0"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04et\\xb9\\xe4`\\x92\\xb0\\xe7\\xb9\\xa9\\xe9a\\x05\\x0f\\x16\\xc2y\\xc2\\x0bgkp\\xae\\xb6\\x9d#\\xf4\\xe6\\x10\\xc0\\xb6ob\\xcf\\xca\\xbf\\xc6\\xc7\\xad\\xa4\\x05\\x96#\\xf6\\xfe\\x0bg\\xd7\\xf9\\xf4\\xe4f@\\xe7b\\x93@\\xf8\\x995\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\x7f\\xc8\\xe1\\x83\\xd0\\xad\\xc4\\xf8\\x92<\\xe8ff\\x15\\x98\\xd94\\xcd\\x8a\\x0fc\\x8d3\\x19o\\x94/\\xd6\\xf5\\xd8\\x9deb\\x07hs\\x0cs\\xd9r\\x9c,y\\xbb\\xf6\\x12\\xac"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6\\xd9\\x80':\\xd0\\xdb\\x9f\\xd4_h~j\\xa4k\\xe66\\x90b\\xb0\\xf8\\x00\\xb2n\\x1d\\x07t\\xc1m\n>\\x01\"gse\\xf96i\\xbb\\x87/\\x04\\xbd\\xe8,\\xd5pu\\xb2=v^h\\x0e\\xf6\\x14\\xe7'b\\xc9\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\x8dp&\\x0f%\\x9fc\\xafb\\xc3q\\xb3\\xdb|\\x90\\x9c\\xf7\\xfb\\xf8\\xbc\\x01\\x17\\xa1zs\\xf0\\xa1\\x97q\\xd3\\xa2\\xb9v\\x17\\xb4\\xbe\\xa7g\\x9b\\xe6\\xcd\\xaco\\x03\\x0e\\xb4\\x8d"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xce\\xe8v\\xb1t\\xfa`\\x91\\x84(kc\\x00~\\x8f\\x10\\xf3~\\xd9\\x93g\\x8c\\xc1x\\xcdr\\xc2\\x8e:\\x95\\x13\t\\x80y\\x8ez:\\xebdo\\xb8\\x93h\\x96\\x98x\\x12sz\\xdd\\x90\\xf3\\x03\\xab\\xfc\\xfc\\\\xda\\xc3\\xd5f\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k_6\\xe7b\\xfek\\x01\\x88\\xc11\\x87\\x82\\xbe:\\xd1\\xf0\\x85^\\xc3-;\\xde`r\\xf2zg\\xff\\xf8f \\xe9$g\\x97x\\xa7\\xa9\\xed\\xf7\\x81w\\x0e\\xc6s<\\x11"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84_uw\\xc9h\\xf73f\t8\\\\xca\\x9dm\\xcd^\\x18>\\xbc\\xdc\\x9b\\xfd1\\xe3q/\\xbb\\x9f\\x9bs8\\xdd\\x0e\\xa6i`\t\\x83u\\xf5\\xebno\\x0f\\xad)\\xbf\\xb55\\xbe\\xa9z<\\xdd\\x1c\\xb6'\\xfd\\xfcl\\xa8\\x98b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0bx\\xf7\\x9eesp-\r\\x18\\xe5\\xa2\\x10r \\x9e\\xea \\xc3u\\x7f\\xa3\\xf9\\xc7k`:\\x9f\\xab7p\\x1e\\xa0\\xca\\xda\\x052\\x1egi\\xd5\\x03\\x88\r\\xd3\\xb0/"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\x06\\x18\\x99/\\xdb\\x97\\xa6i\\x80hwa\\xd77&\\xed\\xfe\\xe6\\x7f#\\x93\\xc8\\x02\\xc2i\\xe4r\\x9c\\x82p\\x87\\xea;\\xac(\\xfc\\xa3\\x88\\xc6\\xba\\xe81?|)\t\\x992\\xbb+\\x17w\\xe7\\x9ek\\xf8\\x07+\\x08l'c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\x87v\\x8d\\xf8\\xd7p\\xb2\\xc2<\\x1c\\x81=\\xf1^\\xeb@|\\xb7d0\\xdc\\x0e\\x8dk\\xae\\xe6\\xc4\\x02@a\\xb3@%\\xa6p\\xeb5\\xab\\x83ebi\\xbc\\xad\\xe4"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xf7h\\x0enm\n\\x06\\xe9\\xd39'\\xcc\\xf0%\\xb5\\xbd\\x14z=\\xf7\\xe5?\\xe7\\xab<\\x94\\xfc\\x1dw\\xf5\\x15x\\x1e\\xe6b\\x80\\x1a\\x08\\xc45\\xcc\\x0ekf\\xc4\\xbf\\x1d\\x00,\\x10\\x90d\\xb0k\\xe5m\\xa4\\xee%\\x08\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb\\x82\\x8b\\xd53\\x19<:g/gi\\xbf$\\x19e\\x1ee\\xccqjw\\x82\\xc3ulw\\xff\\x9b\\x00\\x1a\\x06\\xa0z,n\\xd7\\xb7\\x96;\\x82\"\\xe1\\x94\\x12\\x1e\\xe6j"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x105\\xbb\\xf2~d\\x83\\x99\\xf7\\xda\\xef\\x8a\\xa4\\xde\\x9c:\\xb4\n\\xb6\\xd7\\xe4\\xa5\\xb1eo\\x16c\\x03\\x10\\xc7\\xf3\\x9e\\xce\\xfc\\x10`\\x89\\xd1\\xc7\\xee\\xf7\\xdc\\xaf\\xb4_\\x86\\x00\\xde\\xbe\\x0f\\x8b\\x97\\x8b\\x115\\x0b\\xd8\\x1d\\xd4$\\x83\\xf2\\xd0\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\x8di#\\xdd\\xfd=\"\\xc3x\\xfc\\xcf%\\xf43tmr\\x9d\\xbd\\xe8vzo\\xdf^2\\xe2*3,\\xb3-yi\\x02\\x89y\\xba\\xefs\\xd1|mu\\x13"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xee\\x80d\\xac\\xaa\\xc0\\xb4\\xf4\\xdd\\x08\\x9c\\xfbt\\xd3b\\xd4\\x18\\xa1\\x93\\xefx\\xe1\\xe3\\xcdp\\x8e\\xe4\\x98k\\xc1a\\xb4\\xba&\\xa5\\xb2u_\\x99\\xfc\\x11\\x85r\\xe8b\\x0f\\x92 \\xb9l\\x82\\x97\\x1e;\\xe4\\xe4y\\x01\\xd4\\xe1\\x9e\\x98\\xb2\\xa7\\xc9\\xbb 8\\xfdj6\\xe09#\\xb9\\x0b_\\xf9\\xc4@\\x95\\x7fp \\xd3\\xb6\\xfah\\xba\\xb30\\xe8id7`^\\xab=jkke\\x15\\xb0\\xd9\\xc1c\\xbb\\xd26op\\xda\\x00\\xd7+m\\xc7\\xb5'du/\\x867a\\xf3p\\xf1_k\\xc8`f\\xab\\x8f\\x88\\xdd2\\x07,&|\\xaa\\x95\\x88\\xdf\tqw!\\x95;\\xd2j\\x9e\\xc6\\x80\\x95\\x06v\\x03\\xb4g\\x1bz\\xb4\\x86\\xa6\\x19\\xaf\\xf0'\\xa9\\x1b\\xb1l\\x80!0\\x90e\\xaf\\xe5f\\xcd|\\xa64g\\x7fo(c\\xe4\\x1c\\xd9a\\x18\\xc7\\xf2'y\\xa4q\\xd3\\x9b\\xeb\\xb9\\xea\t\\xe2\\xe2`^\\xbe\\xb3f\\xf6o\\x05\\xb1\\xd0\\x12g\\x91?osd\\xe0\\xae\\xbf\\x94\\x0fk\\xa7\\xea2\\xe6\\x04\\xbc\\xc2\\x97\\xbbz"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8\\xddz\\xda\\xd3)\\x9b\\x91h\\x9d\\xaa\\x035_\\x91\\xfca\\x8dd \\xbes\\xd9|\\xcf\\xda\\x08\\x02b\\x96\\x06c\\x86\\xe05\\xcbs\\x9d\\xdc\\xb8\\x16i\\x86\\x9cl\\xd2\\x0c%6\\xde\\xb8\\xc0,c\\x8e\\xc0\\xf3ya\\xb0\\xce\\xbc\\xbc\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16f\\x14\\x10\\xbd\\x84\\x97\\xee\\xc1j%\\xc2\\x84\r\\xe83\\x86\\x17\\xef\\xe7i\\x85\\xd5\\xa4\\xaape|3x\\x85\\xbd\\xed\\x95\t\\xc6|\\xc0\\xbf\\x9e\\xab)\\xe9\\xfa$$\\x7f"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc78g\\xe4\\xabh\\xe4\\xf3rai\\x97<\\xfe\\xb2\\x002\\x7f\\x87hvfcp\\x8a\\x0e\\xe2d\\xd2g\\xedz&\\x13\\xda\\xd3w2|zcr\\xf5b\\xcd\\xdc\\xca:\\xa3#\\xd9n\\xb5\\xf6\\x1a\\xc6\\xb0l\\xc14\\xado;\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x99\\xa0y\\xc7<o*\\xd3qh\\xb5\\x9ai\\xdc5\\x13\\xe5\\xac\\xa8w\\xd9\\xd6\\xd3tf\\x05wnc\\xf6\\x97x-\\x98'\\x912\\xe4\\x08\\xdc\\xac\\xa4\\x18\\x82\\xf7\\x9a"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\x1b\\x90u\\xe3\\xbd\\x11\\xf7\\x00^\\xc4\\xe04)\\l\\x9f\\x01\\xef!\\xabn\\x19\\x06=%\\xe2l\\xfd\"\\xd3\\xf4\\xad\\x85\\xd9\\xb7\\xcd\\xd9\\x1cpbi\\x96 h\\xba;\\xdc\\x91ca\\xcf\\xda\\xedez\\xc0-r\\xf39b\\xf1\t8\\x10\\xdd\\xe1e\\xa2\ron\\x9c\\x7f\\x15\\xe62>dq\\xb3\\xfd\\xd3\\xa3\\xc5\\x99\\x9b\\xcc\\x1bd8\\xc3pult\"\\xc1\\xeb\\xc28\\xd2,\"r^\\\\xf3w\\xaeo\\x82i\\x1fg7b\r\\xf9l\\xb5\\xbd)\\xce\\x83(o\\xd5\\xe8\\xd0\\xee\\xb4\\xd9s\\x06j\\xc4h>\\xf1,\\x92\\xd8za\\xb1\\xc6\\x1as\\xce`\\x11\\xaf\\xee\\xf4_\\xce\\x99k\\x03\\xf6\\xd4\\xa4u*\\xe4\\x8b\\xbe4f\\xaa>\\xe8\\x8f\\x0f\\x05|\\xe33\\x8d\\x082k?\\x1a\\xc3\\x19\\xafc\\xe7)\\xfe\\xb5^\"qqt\\x15r!\\x8a\\xd2\\xfa\\x1e\\x81\\xdf\\xb6\\xde\\xe8q\\xd3\\xc1\\xcd\\x85\\x07+6\\x18\\xd1oh\\xa1<\\xc1\r\\x1b\\xca\\x15c\\xf6\\xde\\xa0xa\\xf2\\xfa\\x99a`\\\\xcd\\xe0"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_z\\x05\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xfd\\xdd\\x11qi\\x95\\x8a\\xb1\\xecv\\x8b\\xd1,\\xa5\\xbb\\xa2h\\xd7\\xd5p\\\\x04\\xfak7t.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0f\\x98\\x0c\\xb5e\\xee\\xbf\\xab\\xafli\\xd1\\x88l\\xf3\\xa8i\\xaew\\xa9r3\\xd9\\x192\\xe5&\\xd1\\xc6ym#\\xdc9\\xc4\\xe2c\\x13\\xd1\\xf6r\\x8d\\xbd\\xab*prw)\\xf3kj\\x0e\\x1f\\xd1\\xce\\x01\\x8d\\x99\\x04\\x02\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\x11\\x8c\\xad\\x07\\xbaf\\xdab)\n\\x9a\\x00b\\xb6\\x89\\xe9\\xda\\xa9%\\xe4\\xcb\\x9d`\\xcb\\x95\\xf1\\xa0\\x9b\\xdb\\xe7\\xb3\\x8f\r\\x91~\\x9c\\xd3\\xaa\\xc5\\xdfl\\xd71jro\\xc8"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xbb\\\\xce\\xad)t\\xca9/\\xa7\\xe2\\x0c\\xd3qj?\\x93\\xdfb;~slc\\xd0vhv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xb8\\x97\\xafw\\xa8\\xf5\\xc0w\\xbe>\\x93\\xf9\\x06\\xf7ni\\xcff\\x0eo\\x07\\xe3o\\xc5\\x13x\\xf6\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06=\\xdd\\xf88u\rf\\x15z\\xf2\\x8d'8\\x91\\xff\\xbakcv\\xd5\\xc1\\xb4\\x1f\\xd0.\\xd2j\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x0c\\x88tj_kc\\xa5v\\xd2d\\x94\\x01m\\xbd\\xa6!\\xf8\"\\xdc\\x9ah\\xf5\\xef\\x99\\xd8\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xdc\n\\xe8\\xdb\\xc5\\x1a\\xed\\xee\\xc1\\xa4\\x8f\\x10jz3\\xe1\\xcf\\xac\\x97\\xe3q\\xa17\\xad(\\xf7>\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4\\x81t4p^\\x1a*\\xd7$;k\\x04k1\\xa7\\xbf\\xa1\\x8e)/\\x07$\\xdbk:\\xa7\\x04\\xf8?\\xb1\\xfc\\x91\\xa9|\\x84\\xc1k\\x0co\\xfac~\\xae\\xb6\\x0b\\x0e(\\xf3\\x12x6\\x13\\xd6p\\xd8\\xfd\\xccm\\x82w\\xcb\\xc0p\\x99\\xb6%'xi\\xf7\\xd6x5\\xec\\x11\\xdb\\xcd6\\xa3\\xfa\\xd2\\xe6\\xae\\xfen\\xbf\\xa3i<\\xfc?_q\\xfez\\x05\\xf04\\x11\\xf5\\xf1\\xf9\\xad\\xff\\xea\\x92bl\\x81a,\\xcb)\\x9bu\\xb9+o\\x8e\\x93\\xc4\\x7f\\x87\\xe3(\\xb57cv\\x9f$+\\x16\\xdc>\\x19\\xa4gu\\xa8\\xdc\\xcd8z\\xed\\xb1\\x02\\xcd\\xf1\\xb5m\\xa7\\xe7\\xc4;\\xc8\\xeb\\x88\\xe6ng\\xf1\\xb9\n\\x92\\x02\\xc3c/\\xf7\\x19r\\x17\\x123,\\xf9\\x9c\\xe2\\xc8\\xb9-\\xa4\\xddx\\x831\\xae\\xe2\\xbb\\xa9\\x9c\\xb6@\\xd1\"x\\xd7\\x19\\xcb\\x13\\x90\\x7f\\x02\\xa7k\\xd0=\\xedr/i\\xeeoyp\\x10\\xd4\\xa3o\\xfd\\xc4\\x90\\x88x=\\xb9\\x1c\\xde\\x90\\xaf\\x89wm\\\\xe7\\x9b\\xf3\\x84\\x03\\xc7e"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcdr\\xb4\\xfc\\x91\\x088k\\xcc\\xa8q\\xcflx\\x1a?c+\\xda&\\xac\\xa3;d\\x1fl\\x8e\\x80\\xa5y%\\x0b\\xd4\\x01\\xe6p\\x12-\\xe0\\x92\\xa17\\x19\\x9b~\\x04\\xa8\\xfa\\xc5\\xd2q\\x0c\\xba\\xfc\\xf6\\xb5\\xb5.\\xb5\\x94\\xb5b\\xf9\\x1eg\\x81\\xef\\xc9\\x028\r\\x93\\xd9\\xd3\\x8fh@k\\xb7\\x14r\\xa0\\xf4\\xe4\\xe9j\\x89.\\x9aj\\x0e$\\xd5\\xac`\\x83\\xb7'\\x82\\xa0\\xc40;\\xbcy\\x96\\xbd\\xdb7y\\x12j\\xde\\xaa\\\\xc2\\x92\\xd8\\xbd\\xa7\\x946\\xaf;\\xbco\\x9d\\xdf\\x13\\xab\\xdf\\xadxz\\x17\\x14#\\xe9\\x8b\\x91\\x0e\\x0c\\xfcqt2\\x1c\\xc5o\\x88\\xef\\xf2\\xd2\\xf4\\x0f\\x01\\xce\\xc0\\x86q\t\\xe3am(\\r@~\\xc4\\x19\\xe2)\\xe3\\xc7e\\xf3\\xc6\\\\xc22\\x04&q\\x87\\xfa\\x00\\x95\\xea\\x7f\r\\x10t\\xda\\x1e\\xa6\\xe0\\x87\\x90p\\xf1\\x82\\xfd\\xee\\xab\\xa0\\x9a\\x01\\x01\\xf79\\x0b\\x10\\x8d\\xc6\\x90\\x19\\x91\\xed\\xfa\\xa8\\xc7\\x8d\\xa5\\xcf\\x02\\xa3e4\\xf3;i\\xaf\\xc4wg\\xc4\\xe1\\xc5<\\xeba\\xa7\\x80\\x01\\xe3\\x89~"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+c\\xc2+t\\x8bo5\\x8f\\x12\\xb8\\xcao\\xa7(\\x81_\\xd4\\xf5\\x8bh\\xe0\\x00a\\xc2n8@s\\xbf\\xbf\\x1a\\xae\\x83\\xeb\\xcd\\x04\\x82\\x95\\x17b9\\x11\\x8e/\\xf9qy\\xbdst\\xe4p\\xb7d\\xe1;\\xb1\\xd3\\xe1\\x83@\\xe0</h7\\xf8\\xb4\\xf2\\xe85\\x17^qg\\xb3\\xd3\\xb3\\xf3\\x1a\\x10=\\x9b\\x15\\x82\\xc6\\xfe\\xb5\\x18o\\xa3\\xd98\\xf3\\xf27\\xcb\\x18\\xcc\\xf2\\xf0\\xaep`\\x1bc0\\x99km\\xf3\\xea\\xe5l\\xfe\\x0burs\\xda\\xbdz\\xfe\\xad-f\\xa9\\xc2\\x91oj\\x0b\\x98\\x12\\x88g\\xaf\\x08\\x8d\\xbf\\xe9\\x810\\x81\\xe4\\x13k\\xb4d\\xfdq\\xb2\\xca\\xeb\\xbc\\x9b\\xca\\xdc\\x19t\\xc7\\xd6\\xc2$j\\xe9\\xcf\\xfbx\\ s\\x15s\\xb1\\xe7\\xd1\\x19mux\\xf4z\\x01'<\\x0e\\xab\\x1a\\xf7-\\xc0m\\xc8\\xde*\\x96\\x0f\\x9d\\xa0\\xe1u9\\xa7\\x1bl,8\\x97hs\\xfew!\\xed!x\\xe81\\xe5\\x15\\xca\\xf1\\4\\xa4|o\\x1e\\x0c|\\xcfz\\xd5c5\\xf7o|2\"\\x93\\xec\\x83\\x8e"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\x96f\\x80\nv\\xcf\\xa8\\x88\\xed\\xd4\\xa1d\\xae\\xc2\\xd6$le\\xdd\\x06/f\\x96\\x82@\\xd3uo\\x96\\x00\\xc1n)\\xd4\\xb1\\xab\\xde\\xa6\\x07\\xbb\\x02_\\x81b\\xf2\\xb5\\xda\\x84\\x85\\xa5\\xf9\\x88\\xa7\\x89g\\xdb\\xf7\\xab\\x9e \t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bag:\\xe1\\xcc\\xf9\\x0c^\\xabl'\\xd81\\x8a= \\xfcj\\xa7\\xff\\x80\\xdb\\xbd_\\xd3\\xd5\\xefr\\xe3\\x83\\xc5;\\xbf\\xd9t\\x1f\r\\x1e&d\\x87\\xf5n\\x9c\\xbf\\x86"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\xd2\\x18\\xd6\\x99\\xd3\\x04d\\xce\\xca\\xf7\\xb0\\x84\"\\xe3\\x0c\\xe3e;\\xb0\\xbf\\xe9\\xa2az\\xde\\x1a\\x91\\xa8+\\xf6\\xb7\\xdc\\xf6\\xf0i\\xe5q\\xfdn01\\x1a\\x8cu\\xddt`i1\\x95b\\xb7'\\xc3\\xc7<uz\\xb0\\x8a\\xc7 \\xb3\\xb9\\xe7\\xfb\\xf5\\x11`\\x86z\\xae\\xfc'\\xad\\x9e\\xdc\\x0b\\x1f\\x0f0\\xe2\\xe3\\xb4k\\xff\\xc1\\xd4\\x1b\\xd6\\x1a@\\xab7\\xf8\\x0cqv\\x92\\x84xh\\x89q\\xceg\\xbd,p\\x15\\xbb\"\\xe6\\x18\\xd2\\xc6\\xb6w-*\\xca\\xe8\\xbb\\x0eh\\xb4\\x8ai\\xf6\\xf1\\xfa\"\\xa3pq\\xe2\\xbexo8\\xb6\\x91\\x89\\x82ikk`\\xadx\\x81\\x0f8)\\x97\\xe6\\xe6*\\x1f\\xd4\\x91\t\\x8d\\xa5\\xdc\\xca\\xa9n\\x8ew&\\xcd\\xaex\\xf4\\x0e\\xd1\\x02\\xfa\\xd0\\x0e\\xc0\\x91w\\xc3k\\x8d1d\\xaa\\xeciz&p5@\\xa2w\\xd6\\xf7\\x8aug\\xbb\\xf5\\xb3\\xc5ef\\x07\\xa5\\x12\\xa1r\\xcc\\x04\\xda\"d/\\xd9\\xed\\x1d \\xe4p3\\xbb\\xf9\\xd2\\xd6g\\x8a\\xf7\\xd5\\xdd\\xa5\\x8f\\xc1l\\xca\\xae"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xf4\\x99\\x9crt\\x01\\x06\\xa8\\x03\\xca\\x11j\\x0c\\xf4t\\x12i\\xdb\\x83:e@\\xde\\x959\\x05\\x1b<!\\xda\\x0bv\\x89\\xb6\\x99bb-\\xba\\x8c\\xd4t\\xe6\\x8e\\xf0w\\x8a\\x0e\\xdc\\xce\\x12t\\x9c\\xc7q_%\\x8d\\xd4\\xf4\\xac\\xc37\\xef\\xfd\\xbb\\x80z\\xb4\\xc7`\\x1b\\x00;8\\xbdl\\xb3\\xcemok6\\xbb\\x96|\\xd9\\xd2(\\x05e_\\x88k\\xf9\\xf6\\x96\\xdb\\x10\\xc7\\xc5\\xd4nv\\x93\\xbc\\xd7\\xfcnm\\x94\\x8b\\xed\\xce\\x16\\x96\\xac\\xe9\\\\xa9c\\xdawb\\xf1k\\x1d2\\xf7\\xdf\\x04\\xf3\\xa7#$gd\\x82z\\x1b\\xe1=\\x12q\\xe0\\xa4\\xdcd)\\xf2\\xado\\x12\\xf8\\x8d\\xe50\\xeb\\xf0p/c`n\\xc4\\xb7\\xaf\\xa9\\xef\\xf1\\xd4u\\x0600\\xcbq\\x93\\xb7d\\x14\\xc1\\x96\\x95\\xdea\\xa5u\\x11|&0\\xfb\\xfcr\\x86\\xd7\\xb3\\xfd/c\\x1f\\x90\\x04\\xb8('\\xc3\\xea\\xca\\xa8.\\x97\\xe5+dxz\\xc5\\x8d\\xdd(o\\xf1\\x04\\xf4\\x9b\\x06\\x03qq,\\xa0\\xa6?\\x19\\xa7\\xf7\\xf8\\x08k@\\x05sb\tu"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010td\\xe3\\xd9\\xf1u\\xe1t\\x7f\\xbe\\x08\\x15k\\x9d67\\xad\\x12\\xf4\\xd9s\\xccv\\xc4c\\x9f\\\\xbe\\xf8^#\\xfb0rm.k\\xbf?\\xf0l6\\xbf\\x89\\x08h\\x87\\xa6/\\x1f\\xf7\\x1f\\x85\\xff\\xb5~mo\\xb99e\\xfd\\xab\\x15\\x9e\\x8ag\\xcc\\xd7\n\\xc4\\x0c\\xb7p*t\\x07\\x98\\xa5\\x1f\\xe5ez\\xaf\\x98kr\\xfc\\xea\\xdc\\xbf\\x18-\\xb4b\\x0b\\x90@%tv\\x8f\\x94\\xf5\\xba\\xf4^\\xc3.\\x10\\x03\\xcb\\xe1\\x06kp~a\\xe5xai\\xccs\\xcf\\xe3li\\xc7;\\x7f\\xd9\\xb2-\\xc6\\x88\\x06s9dqx\\x8f\\m5k\\xc3u/\\xb9\\xe4j \\xeab\\x18\\xf6\\x86(\\x88\t\\x8d\\x9d\\xca\\x92\\x02\\xc6\\x9f,\\x92^\\xce\\x15\\xb21\\xc6u\\xd3\\xd1\\x99\\x11\\x13\\x0e\\x08\\xb4\\x0b\\x81p=12\\x90\\x96\\x01`\\xe8\\x1c\\xf6\\xbcp\\xd0h\\xaa\\xa7\\x95\\x9c!\\xf4,t\\x11\n\\xa1\\xbb\\xf8\\xf5\\x1e\\xcb\\x13\\xdf\\xeao~\\x0b\\xbf\\x9buqt\\xd7^?\\x0f\\xa5_h>;\\xd4h\\xb6id\\xd1ne\\xe6"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\xab)=\\x9f\\xbd\\xc6j\\x8afc\\xdb\\xab\\x1bz\\x0cq\\xc1\\xc1d\\xe6d\\xe3\\xd0\\x8b\\x17\\x82\\xbe\\x0c<\\xa4\\xf9\\x9f\\xde\\x1ba\\xe0u\\xfb\\x94\\xa4/\\x92\\xf3;\\x04<\\x820\\xc3\\xb1\\xe4\\xb9\\x13-\\x19\\x9c\\xf0\\x88\\xa0\\x1d\\x85\\x96?\\x8e\\x1ebof\\x04d\\x14\\xd3\\xe9\\xca?\\xd6\\xf7\\xbd=*u\\xa5%\\x8bx\\xd8\\x08\\xd6h\\xe7\n&\\x92u\"\\xe9\\x84\\xd4\\xd6\\xa1w\\xabz\\xe7m\\x01\\xdd\\xcc\\x91e\\x1c\\xff*\\x0e\\x10zi\\x8f\\x99s\\xf1\\xeay\t\\xee\\x94\\xa9\\xca)\\x82\\xa2|\\xc7\\xeavtk\\x87\\xbf\\x1a\\xf3l\"ft\\xc9oar\\xcc\\xbd\\xeep\\xb8\\xdciy=\\x0b\\xdb\\x06\\x7ftsx\\xbf\\xbf\\xe5\\xd3k\\xaamd\\x8b\\x0f\\xadwi\\xaf\\xe3\\xd8\\xbe\\xb2v\\xaa\\xbf\\xc6\\xee\\xc7\\x81\\xa0cz?\\x02\\x90\\xe4m\\xeesuf\\xe2\\xe9\\xe6\\xd1\\xaf\\xa6\\xbbd\\x04\\xebw\\x05\r\\xf8\\xf0\\xd5\\x0bh\\xa8b\\xdb\\x1e\\xf6\\xc4\\xe2\\xe2\\xc1t\\x8f0\\x95w\\x8e\\xceh\\x1d\\x10fw\\x15\\xac"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\x90-,\\x05\\xf3\\x06\\x8c\n\\x8e\\xf9vw\\x9e.\\x0b\\xc8\\x82\\x0e\\x12<\\x94\\xb0\\x83l\\xbb\\x9dc\\xaaj\\xe4\\x9b\\x1f\\x8b\\x980\\x94s\\x9dj\\xd2\\xef\\xb6a\\xdc\\x82\\x1c\\xbe\\x16!\\x12\\x15/d\\xbb\\xa6/\\x95\\xd1~\\xdc\\x9c\\xcf)\\xb3\\xd6\\x12w\\x068\\x80\\xfd\\xdf\\xd5\\xdfn\\xbf\\x84\\x05\\xbd\\xdcl_\\xdc3\\x1b\\xc9`\\x0c\\xe3\\x1d\\xf9e \\xddk\\x19\\x15l\\xd1ur1%\\xf0\\x0c\\xbd\\x9c\\xa5o\\x9a7i\\xb6\\xc8z\\x15fr\\xf36\\xf2e_\\x81\t\\xe7\\xeb\\xdfy\\xe8\\x9f5w\\xe9\\x97\\\\xeb&\\x84\\x9a\\xba \\xd3'\\xb3\\xb9kmm\\x92k\\xa0\\xcd\\xc0\\xa1\\xe4y\\xa6\\xab\\x13(\\x1c*l\\xa6\\xb9\\x95;\\x1b\\x8d|\\xb7\\xac4\\x8dc\\xa9\\xa2\\xe6\\x9euc\\xaf\\xb7+lj\\x1a\\xb8\\xa3\\x9b\\xd6qu\\x10\\x17\\xe3\\xaasi\\xaf\\x8f\\xb7\\x95e\\x81\\xc9og/ca\\xfa\\x97\\x1co\\x17f\\x0f\\xdc\\xcf\\xc2\\x80sd\\x1f\\x9c\\xde\\xfc\\x9d\\xd6m\\x1bs\\xbb<\\xea\\xbex\\xc2\\xbe\\xed\\x838\\xe67j"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\x9bn\\xacs\\x9e\\xe2\\xb2v\\x04_\\xcd\\x19\\x90\\xa6\\x0e\\xc6\\x9ecs\\xeb\\x84=5+g<k\\x1a\\xa0\\x82\r\\xee\\x9e\\xe3\\x91\\x8c\\xad\\x89\\xc3\\xd6\\xc83kd2\\xd7#\\x1cg\\xb9\\x81f\\xcb\\xf2r\\x00\\xf2\\xe6\\x837\\x17\\xe2\\x95\\xd5)\\xd51ec~;\\xfd\\xb59$v\\xb0f\\xa0\\x97\\x8e\\xad\\x05\\xbf@\\x90\\xa0i\\x92\"\\x07\\x9b\\x8c\\x88\\xf3\\x99\\x14!rw\\x14*\\x97\\xc6\r,\\x14\\x86n\\x962n>\\xe2\\xd2\\x9c_\\x10\\x90\\xcd\\x84\\x1d\\xb0\\xef\\xa6\\x19\\x8f\\xc0m\\xd8\\xe9'\t\\xd7\\xd0ye\\xab\\xcf\\xe49\\xd2\\x82\\x0f\\x15\\xc9\\xc41,\\x87\\x8bya-\\xe4\\xe4\\xea\n0(s\\x0en)\\x1f\\xd6\\xd8t\\x9093\\xbb\\x01\\xc6\\x08\\x82u\\xd9\\xc4\\xe3=\\xefh\\xe2\\xe1\\xb4\\xf5\r\\xde\\x95ah\\xf1p\\xb4\\xca\\x90\\xd5a\\xaew\\xa5c!e\\xa1*\\x1b?\\x0eq\\xcfdu!\\x8dn\\x1c\\xfe\\xa3\\x93\\x90\\xf2\\xa08\\xae\\xa4\\xb6\n\\x81\\x00\\x0b\\x99\\xf1=\\x9c\\x86\\x04\\x07\\xa2z_\\x91\\xc8\\xbf\\xbd\\xdc"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\x07_d.+\\x16p\\x81\\xb1t\\x7f\\xc5\\xffnwk\\x02l\\x131\\xad-,\\xd8\\x1b\\xac\\xa0\\xbad)\\xb8\\xb7\\x92?2\\xffy\\x81j\\x92>_/\\x1c=\r1\\xf7\\xa8\\xb5f\\x90\\x18\\xb7\\xc6o\\x04\\xd8\\x80r\\x08c\\xc3t^\\x03\\xd0\\x99\\xcf\\x05\to\\x92\\x8e\\x0c\\xf6`d%$n\\xc9\\x9cu\\x9avv|\\xd7\\x95-\\xbd\\xb7\\x92\\x07\\xa7j\\xfb\\xa1i>\\xe7\\x8fiwp\\x9a\\x1a\\xa1,\\xbc\\x0e`\\x05\\xd4\\xeeo\\xb3\\xde~\"\\xe2b\\xf1\\x07\\x9e3el,\\xc5\\x0cb\\x89hx\\xc2\\xf0\\xd7\\x9d\\x9f\\x04mk\\\\x10g\\xf4e\\x9b\\xb1\\xac\\x86\\xb9\\x857\\x04\\x91\\xc1\\xa3\\xc5\\xac\\xab\\x13\\xd9$!\\xe9\\xf1\\xb5\\xad\\x86\\x81\\xfc,\\xb1\\x1b!\\x94\\xda?\\xa7\\x87\\x94d\\xe8\\xc5\\xc2c\\x9f\\xf5\\x02\\xd3\\xbbo\\xa2\\xc40e3\\xbdc\\x17\\x8f\\xc4\\xcb\\xcf\\xea*\\x87!t\\x9a\\xc8\\xcf\\xf3\\xbe#\\xe9lqh9\\xb5\\x1f-f)\\x8d\\xa8\\xa8\\x19\\x84\\xd4\\xc24\\x10)q\\xbe\\xf5\\xf3\\x12\\x7fjm"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa43\\x83\\x9d\\x01\\x08e\\xaf*\"\\xaen?-\\x99\\xac\n*\\x1a\\xdc\\xec\\xa3\\xe6\\xac\\x150\\xce\\x94\\xea!'\\x86z\\x96\\xbd\\x042\\xe8\\xd0\\xd1f!\\xe4!\\xe7=\\xcf\\xb2sv\\x1a\\xbf \\xdb\\xb6\\xf3\\xe2\\xd4/\\xce\\xce!\\x16f\\xcbmv\\x04\\xe3\\xaell\\x97\\x10/\\xc8$\\xef\\xf9\\xa1\\xec\\x84\\x9f\\x9e\\xdf\\x02\\xa3ueet\\xb4w\\xd7\\xef\\xf4\\xad%\\xa5ue3\\xd5ac\\xd6\\xf4\\xc0m*n\\xea\\xeansg\\x0e\\xf0\\xe4\\x82\\x18\\xe0hj\\x13$\\x0eq\\x13\\xe8\\xd7\\xf7a\\xaee\\x01\\x91\\xceqt\\xeb<\\xd9u\"\\xce\\xec\\xd0\\xdd\\x8da8\\xe6\\xbf \\x8e\\xd6\\xb6\\x99'|h\\x1b^\\xe9\\xcati\\x123\\x9a\\x98\\xa7\\x94(\\xe6f\\x14\\x94\\x9a\\xa2\\xb8bv\\x88\\xbd\\xb3%\\x99\\xe1\\x95\\xa8`\\x81\\x17\\xee\\x9e\\xf0\\xf8b\\x11\\x88\\x19x\\xf7tw\\xa5\\xe0?\\xdb\\xa09\\x99\\x19\\xcfy\\xfdh\\x92/,\\x14\\xd7''\\xbf@7$\\x9d\\x9bhi\\xa3u\\xdcw\\x0e\\xc0v|#\\x06\\x94\\xa1ib\\x80"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xe8\\xad\\xb8\\xf5\\xdb\\x8ep\\x89\\xb3t-r\\xcc\\xec\\xa80\\xa2\\xf6\\xb8d~x2\t8\\xe7\\xc6h^\\xb3\\xf7\\xd73\\x8a\\u\\xcc\\x19\\x17j\\xf6\\xd5\\x99\\xfe\\xea\\xf2?+\\xba\\xeb@\\x00\\x1a\\x94>\\xa7\\xc8\\xb5\\xe79y\\x1f\\\\xed\\xcai\\x94\\xf7n\\xb9\\x9b\\x1d\\xf8\\xef\\xd7)\\\\xe5\\xc8\\xc0\\xe6\\xf3\\x83\\x9c\\x08\\xb5\\xe0\\x18\\xbbr\\xa0\\xe2\\x8d\\xca\\xbf\\xc6pe\\xec\\xc0\\xa1\\xbd?_\\xe5\\xe4\\xf8\\x08j\\xd5d\\xd2;\\xeb\\x15\\xbe\\x18s\\x9fb\\x97\\xc4\\xc3 \\x19\\xf8sbf\\x14\\xf0\\xeduqx\\xe4x\\xc8p\\x17\\x10\\xd7\\xc5tr\r\\xaa\\xdcm\\x07\\xc2\\x98\\xea\\xf5m\\xd9\\xa8ll\\x14\\xa6\\xf5\\x99\\x87\\x8ayt9\\xe6t\\xb1'\\xe0\\xb9\\x0c\\x91k\\x99\\x85y\\x96\\x92\\xb7b\\x03\\xac\\xa7\\x8apz\\x1dv\\xa8\\xd0\\x90\\xff\\xcb\\x1bb\\xf4\\xfci.\\xa6\\x14\\xbd\\x03\\xd9\\xbd\\xfb1\\xba\\x1esb5\\xb2:<\\x91bgof\\xc0\\x8e\\x87#m\\x98\\x8f\\xb6\\x9c.\\xf8\\xd2g\\x00,\\xf7\\xd5\"\\xb32b\\x8a\\xba"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\x8c\\x18w;9\\xef\\xa3\\xdb430\\xfa`\\xcc\\xafw\\xfb\\x82\r+~r\\xee\\x92p%m~\\xb8!\\xc2!\t\\xfe\\x1b\\xe8\\xef\\x8b\\xc9\\xbfjuqu>\\xc7\\xf2\\xe8\\xf4r\\x1a\\xdb\\xc7\\xff\\xbf\\x00\\x11\\xde\\x1e~\\x1b\n\\x95\\x87\\x81j\\xa2\\xa1\\x1e\\x16\\x1a\\xf7>\\xee\\xc3h$s\\xca$j\\x02\\x03z\\x8c\\x9c\\xf5y\\xe4\\xae|\\xadt\\xdbb\\x88\t\\x9c\\xf4\\xc0gj\\xe5kl\\x92\\x1e\n\\xd5\\xe3\\xfddc\\xec\\x85\\x94%\\xb6\\x1ft\\x0b\\xa5\\xc8yz\\\\x84>\\xf4\\xda?\\x7fl\\xea\\x83\\xf0\\xbe\\xb5\\xb0ew\\xac\\xb1\\x91\\xea\nd\\x06\\x8b^\\xf7\\x80\\xe0\\xde\\xc5\\xben9)\\xcf\\xa4\\xee\\x83\\xb9*l'b\\x9d>\\xcb\\xc7\\x1al=\\x06s\\x0b\\xf9=\\xc87\\xd9(\\xaa\\xdf\\xf7\\x0f\\xbf\\xf3\\xe4-\\xf0\\x9e\\xea\\xe6(t$lc\\xae\\xa1\\x9d\\x94\\x89\\x83\\x06\\x99\\xef\\xa7\\x08x\\xa7\\x9b\\x86\\xc1\\xda\\x14\\x91\\xe5\\xfa\\x1cp0\\x86\\xd6d\\xcc\\x87\\xa4\\x9f21\\x10w8f\\xc1\\xad\\xbb\\x03\\xa9%\""
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8bl/s\\xf0wlg\\x9e\\xbc\\x9f\\xab\\xf7tw\\xeb\\x0e\\x86\\x0em\nej\\xc9^\\w\\x14%nky\\xc7e\\xbcu\\x88t.\\xbemz\\xefyzh\n\\xac\\xfa\\xa1\\x10e6\\xc3\\xec7\\xc1nf\\x0cg%\\xff\\x86o\\xf3\\x18\\x1c\\x8cv\\xf7\\xb4\\x8fw\\x08\\xda\\xe8o\\xd3r\\x14\\x81v\\xd7\\xec\\xe8\\x9b\\x8b\\xb3\\xd1\\xa9&\\x06 \\x1bpq\\x83\\x18x\\xcd\\xce^\\xc7x\\xf7h\\xe8\\xac\\xc1\\xb20m`\\x82n\\x89\\xff\\xbc\\xdb\\xfb\\xf6k2\\xe4\\xc2\\xf7\\xe2!\\x1c5\\xc4\\x90)4p\\x8a|\\xfc\\xf25y\\xb9\\xdb\\xdb\\x12=8p\\xd7\\xd8(\\x99\\xc1u\\xd1\\xf2\\xec\\xcc\\x93g\r\\x0eg\\x89\\xe4\\xd5e\\xfa\\x8a+\\xff=\\xfa\\xad92\\x13\\xc6\\x1f\\xe9\\x92z\\xea\\x12\\xc4\\xb9a\\x0f\\x10\"k\\xf4f\\xb3\\x06o\\x82=\\xee\\xfd0\\xaa<\\xa2\\x0bh&\\xaarc\\xaa\\xa0\\x8db\\xc3\\x93\\x9c\\xca\\xa9\\xae\\xe5(\\xa2\\xed\\xca\\x84\\x9d\\x98\\x0b\\xf0\\x81\\xdd\\xdct\\xb9hc\\xca\\xa8\\xc4\\xdb\\x85b\\xa0\\x16a2"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc^d\\xfd\\xae\\xf9\t\\xa4\\x91\\x87\\x88\\xa5\\xbcc\\xbc*\\xa6\\xc9\\xd8\\x1c\\xbbxf\\x93m8\\xaf\\x84\\x82\\xc0 d\\x92\\x8b\"\\xbe_\\x00<lq\\x89\\xb2'\\x83\\xbe\\x8b\\x1czfv\\xe5`\\x97\nf\\xa5aq\\x1f\\xd9x\\xfaae\\xba\\xd0r\\xe7\\x80\\xe6\\xa4j\\x1ee\\x15%\\xc9\\xad\\xdd7\\xa1\\xc8a=\\x14o\\xfd\"^e\\xcd~\\xc0\\x1bbn\\x9b\\x93\\x18\\x8fc\\xfc\\xc6\\xa6\\x8f\\xeck\\xb8\\xe1\\x9f\t\\xaf\\xe1\\x9a\\xb4\\xeb\\xc6zh\\x00\\x8e\\xa5\\xcc\\xd0\\xcc\\xbf\\xfej\\xfb\\xd17\\x86\\xf8\\x1a\\xca\\x1d\\xa4\\x9b\\x04\\xfb\\x94j\\x05p&\\x98\\xeb\\xa7\\x97\\x9dv\\xa0\\x0f\\xbe=\\x18\\x8er\\x98\\x00\\xd9:\\xc5\\xa5so\\xb3\\xa2\\xb02\\xf9\\x89\\xb5\\xfay\\xf4\\x8d_\\xb8\\xd6\\xac \\x82\\x1b\\xa5p\\x1f.q\\xd3/\\xce\\xce\\xc6co\\xca\\xb0\\xabd\\xc9en&\\x0c\\x1b\\x85|\\xdd;\\x7fu-\\x85\\xcf\\xf1\\x11\\xaez\\xd2u\\xc0\\xb6\\x91l\\x8b\\x8a\\x0f\\xedl8\\xe8%\\xfd1t\\x8fvg\\x93\\x92; \\x9c\\xecl"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd!\\xd3\\xd4\\x0fp\\x1b\\x93\\xdc\\xbd\\xdfy\\x1f\\xa1t\\x9f\\xf5\\x1ah\\x91\\xee\\x8a\\x10n\\x82l\\x93a\\xfd(\\x1c\\xa41\\xde\\xba'\\x83\\x949\\xaf%\\xca\\xadpe\\xee\\x9ec\\xe7q)\\xa3ef'\\x80\\xf1\\xaebm\\xb3e\\x1a`q\\xddo\\xd7\\xed_\\xc6\\x8b\\xdc\\x18_>\\x13\\x03\\x18\\xaa\\xae\nuq\\xa6>v\\x13\\x87\\xa1/\\x17\\xce^+\\xfeb\\xb2\\xf0\\xbd\\x18\\xec><\\xae\\xc79\\x9f\nb\\xf1x\\x988\\x8e\\xd0\\xc3\\x80\\xb9\"y\\xa6v$0%3,n\\xc7\\x99\\xba\\x8c\\x01\\xc8)mgn_99\\x93\\x9c\\xb0>\\xf1\\xa6u\\x9e\\xb7\\x19c\\xe9!\\xa5pb\\xe5\\x88\\xe8u\\xd4\\xf3\\x83j\\xd5\\x0c9\\x8f\\xc5i\\x8d\\xa1\\xd1\\x97\\xfc\\xa9\\xa0\\x86\\xcc\\xb6\\xba\\xbcy3\\xc6\\xd4\\x01\\xbd\\xe6\\xdd9\\xfa!\\xa2\\x8a\\xe3\\x0ek\\xbf\\xb74\\x05\\xc2\\x18hc\\x81\\xcdnm\\xbf\\xd0\\x0bh\\x07\\xcd\\x82\\xb2\\x06l\\xbbf\\xd2\\xcf\\xea\\xcb\\xef\\xb7\\x86\t\\xad\\x07\\xb7\\x17\\x19\\x1a\\xe4x\\x98y |\\xb5t\\x11\\xcei\\xc5"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfd\\xb3\\xb0z\\x9d\\xc2(\\xc1sn\\xea\\xb1\\xe7\\x7f\\xae\\x91.\\x85\\xfb\\x8c\\x17g\\xb8\\xdbp\\x15+a\\xa1\\xa4\\x95w$\\x99q\\xd9\\x01s\\xad\\xcc\\x01hm7\\xad\\x98\\xc03\\xc6\\x1f/<t\\xd5\\xe4\\xcap\\xbe\\xfew\\xff\n\\x0e\\xf94\\x1fx\\x9a\\xc7\\xa7'\\x92a\\x18\\xbc\\xd5\\xe7\\x16\\xabd&(6l\\xec\\x1dwz-l9\\xcf\\xc8g\\xb5\\xa5g\\xdf\\xc8\\xfb\\xb5@\\xc7~d\\xa9x\\xebbt\\x0b\"\\xda\\x9b\\x01\\x1d\\x99\\x9al4w:\\x8e\\xa8rt\\x9c\\xbf!\\xf61\\xc0&7\\xb9\\xaa\\x15\\x11z\\x95\\xbd\\x82\\xc4\\x9dg\\xcb\\x84\\xa56\\xa1\\xea\\x13\\x18m\\xebd\\xbd\\x90\\x1fq;\\xfa\\xc2\\x8f\\x8e2\\x90\\x12\\xf4\\xf10\\x9a\\xea\\xe4\\xa9\\xae\\xf3a:g\\xff\\xfb\\xb24\\x8f\\x86!o-\\x0cot\\x11\\x9as\\xcf\\xee\\xd5'\\xc87\\xeb(.bn\\xdf\\x0c\\xa1\\xa3x\\xd0\\x1f\\xd8h\\x1e\\x01.-\\xd12b\\x97\\xc3hh\\xe8\\xec\\xc0\\xce\\xa5\\xce\\xe7\\xfe\\x1ej\\x06\\xc1\\x0f\\x98~\\x97\\x8e-\\x89*"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2\\xb1x\\xdb*6\\x04\\x84\\x100\\xa6\\x81\\xf4\\x9buv\\x18\\x0c,\\xaa\\xf7i\\x86\\xfch\\xa0\\xfb\\x00\\xa1\\xd2\\x9f\\xd8\r\\x0c1b\\xf1l\\x10p50\\xbet#:\\xebz\\x94\\x8a\\xe0r;\"\\x831\\x1d\n\\x90\\xc1v\\xa42(#\n\\x87'\\xe2\\x1f\\xce\\xeelbra\\xc7\\xe9\\x82\\xc15\\xf2\\xe0!\\x90w\\xabaqj\\x9c\\x1abo\n0\\x83\\x9e~\\x8fg9\\x00\\xf0\\xa3vg\\x9b\\xd8qv\\xe8\\xe2ql\\x1e\\xc0y%\\xe2zb4\\x06ns\\x7f\\xc6rx\\xf5z\\xbf\\xd5k\\xea3\\x15\\xcc\\xb4\\x13\\x15\\x1e\t\\x1bg\\xd1\\x9f\\xa2z\\xc7(whe1\\xd9?m b+\\xfb\\xc1\\xdf\\x8e\\x08\\xe7\\xb9qd\\xdb6x#\nee?\\xc9\\xe3\\x1af\\xdf\\xca\\xe0q\\x020+-\\xe6\\xad\\xeb\\xf2\\xf8\\x11z,\\xde\\x9b\\xe6\tl\\xbe.|-\\xd5 c\\x84\\x01\\x87=\\xcd\\xc4\\xdf3\\xa9\\x7f\\x8a\\xe7i\\xf6\\xfc\\x85\\x86\\x7f\\u\\xeb\\x19\\xa5\\xf1\\x83\\xb8\\x0c2\\x9d\\xff\\xe6r\\xfc?kl"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+`\\x81s\\xc6(\\xe6!\\x97~\"\\x04\\x92\\xf7ai.p\\xd6y\\xfeh\\xda\\xc1;\\xe2\\x07\\x0er6\\xc5\\xa5\\xd0\\x9a\\x9f\\xe5lc\\x99\\xeb\\x9d\\xd7wf\\xc2<\\xc5\\x1e\\xd87\\xd5\\xb7\\x13o\\x96\\xf0-\\x88\\x1bt\\xd7vr\\x89\t\\x01jzp2(\\x94g\\x93\\x1cpe\\x1e\\xef\\xba7\\x8d(\\x07\\xcc\\xd9\\x98\\xd0\\xa58b\\xaf\\xb6_a\\x03\\xa2\\x14\\xe5\\xcb5\\x98\\xdb\\x1b$\\xc5\\xb6\\xba\\x80\\x9c1\\xf0\\xb9\\xe9\\xa9\\xf0\\xff3a\\xe9<\\x14a`\\xb0$\\xe7\\xd6\\xc0\\x05\\x07\\xc8\\x80\\xb9f\\xees!\\xf6`\\xbe\"\\xbds\\x1d\\xac\\xc2\\xec\\x9d\\xd2\\xb4!\\xe6\\xd5\t\\xd44\\xe9\"\\xf0kw$\\xc6\\x1d-\\x87\\xe8\\xc3\\x92\\x19\\x01+\\x9c\\xc7\\xd2\\xdaf\\x89\\x0f\\xbf\\xe1\\x07\\xe44*\\xaat\\x8fgp=2p\\xab\\xe4\t\\xc8g\\xde\\xf0\\xa2\\xaf\\xc4\\x86v\\xe1j\t\\x86\\xc1t\\xc6\\xc1\\xaf\\x8ec\\xedr\\xa4\\xb7\\xda\\x9a\\x9fm\\xe3\\xd5by\\x15\\xf3\"\\x8cn\\x99\\xf5\\xff*\"\\x86\\xfcyvx"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xc7 \\xf8\\xa3s&\\x91c\\xd7x\\x00\\xed\\xf6\\x95\\x07\\xebu\\x9d\\xe0\\x8d\\x7fy\\x0fr7\\xf8\\x80y6\\xd9\\xacb\\xa3\\xb7*\\xcb\\xda\\x91\\x87\\x9c\\xb2wx\\x1d^\\x82h\\x92\\x8b\\x82\\xa6\\xa1\\x8d\\xf17\\x1a\\xf1\\x1bs\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa&\\xd6h\\xb4\\x9c\\xc5\\xcd\\xbe \\x1a\\xe5\\x8f\\xaf\\xc75\\xe8\\x82d\\xe8\\x8e\\xfcy\\x97y1\\xb1\\x02\\x9c\\xeef\\xb2\\x08\\x8f6\\xea\\xd4\\x1f\\xedg2\\x02\\x18\\xe7\\xf3\\xabi\\x97"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\x8f\\xca\\x85\\x04\\x91\\xd8\\xce\\xc2\\x10\\x0c\\xaf\\xc28\\x94o8\\xb1c\\xae\\xd2zk81\\xf6\\x1e\\x9c/\\xa9\\x12q#\\xe0\\x9c\\x03j3\\xbc2\\xfb\\xef\\xc7\\x11p3\\xd3oy\\x04\\x9c>w\\x81 \\xcd1\\x9a\\xba\\x85|z\\x9a7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xfe\\x1f3e\\x15\\xc0x\\xfdmoc\\xb2z\\xa7x\\xc4cz\\xac\\x01\\xdc\\xd1\n\\xfbs\\x15\\xd1\\x14d\\x8a\\xdc\\xbc\\xfd\\xd0\\xffy\\x1f;\\x7f\\xc9\\xb6\\xd4\\x87\\xf2\\x84\\x8a"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\xcf*=e\\xaf\\xa7\\x1bdo\\xc2\\x9a\\x1d\"\\x7fh\\xeb\\x0c\\xa1\r\\x05b\\xb6\\x1a\\x97\\x1cc\\x9a\\x7f\\xb1\\xf8^\\x82\\xcf\\xee\\xff!a\\xc0o\\x1by\\xca\\xb0\"n\\x8e\\x80vt5|cx\\xd4\\xec\\xc8,\\xfe`$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\xff\\x15\\xc9`\\xf2\\xa2\\x0e\\xc8>(r\\xc7\\xee4\\xa4\\xc3\\xe1%\\xfd\\xc4\\x89\\xa2\\xd7\\xb47\\x06\\xb6\\xa9;\\xe6\\xd1\\xd9\\xaber\\xfe\\xea\\x14\\x05\\xff\\xd0l\\xed-|\\xc8"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef\\xba+g#\\xc7\\xd0a\\xad\\xbb^\\xfa,\\x8d\\xd1\\xf5\\x9e1\\x01\\xea\\x08\\x1fo\\xdb-~\\xce\\xd4\\x83f7\\xc0<\\xf2\\x8d\\x84\\x8f\\xc9^$/o\\xb1fo`\\xc99\\xd1\\x94\\x05n\\xa4\\xd4\\xf7\\x913\\x1f\\xc5.\\xefb\\x9fy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x91\\x07\\xdfg\\x9f\\x82\\x97z\\x06\\x19\\x96\\xe0\\xa6\\x8b\\xbax/\\xc7\\xe1nr1\\x10%jm\\xdb\\xef_\\x99\\x05l\\x94e\\xf6shk.j\\x1ae\rv\\x82h|"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x95\\xb0g\\xed\\xa5\\xc0\\xf3\\xe3\\xde\\x8a\\xfay\\x07\\x16\\xe7\\xf2\\x9d\\xc4\\xabh\\xf2\\xc6f\\xfd\\:\\x88f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s$i\\xd7\\x12u+k\\x8c=\\xb7d\\xa5m \\x11.29g\\x9c\\xfat:k\\xc0\\x87)$d\\x05\\xcc\\x10e\\x8c\\xe4\\x86\\x1b\\xa1\\xdaad\\xe9gk\n\\xbel(\\x93\\xab\\xcb\\x97\\xe9\\x8fh\\x81\\x81\\x83\\x03\\xff\\x007\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff!f\\xd2 \\x9f \\xc4\\xb9\\xa0\\x7f\\xe8\\x980\\xa6\\xcf\\x01\\xb1\\xd5\\xf4\n\\xe3c\\x87f\\xe9\\xceg\\xb0\\xea\\x9f\\x897\\xd68-s8\\x08j\\x10\\x98\\xa7w\\xf7\\xc0\\x87*"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7j\\x7f\"tyqi\\xee\\x99\\x16a\\xeafw\\xd9\\xd5\\x86\\xb91\\xc2\\x1f\\x0b\\x90\\xa9u\\x1d\"\\xf2rz \\xfd\\x9e8\\x99\\x86\\xbbq\\xc9\\x15\\x9e\\x8a\\xd1)o\\xbf\\x01ww\\\\x8dj\\xe5\\x03yd\\x8f;/\\x16rg\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4x\\xdbe\\x1dk\\xa8\\x1amz\\x80\\x1f\\xae9\\xd0-\\x17t\\x85!\\xbbj\\x14\\xec\\x0f%\\xd1\\xacj)\\xdd5h\\xaa\\x16pk\\xcd\\x04\\xfc/\\xdb\\xbf\\x8b\\xab1\\xa9i"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xm\\xb9\\xa6zs\\x81\\x8e\\x0f\\x8c\\x01\\xa1_\\x0b\\xe6\\xea\\xc2\\x02\\x96i\\x01|\\x97u\\xb9\rv\\xdf\\x0e\\xf8\\xb7>i\\x7f\\xa5\\xac\\x0b\\xbc\\xb2zw\\x80_v\\xd2!\\xe1.\\x0c\\x98t\\xffz lg\\xe2\\x84\\x8c\\xc6xa\\xc0\r\\x9fk\\xd9bm\\xa3s_\\xac\\xf7\\xd4\r\\xfb\\xd7\\xf7i\\xf2\\xb3i\\x95\\xd4\\xfb\\xf2xk\\x07\\x15-\\x88n\\xa5oq\\xd6>\\x88\\x1e\\xdd\\x92\\x1c?\\xe7\\x91\\x13r\\xca\\x1c\\xd0|z6\\xf0q\\xe8\\x13\\xca\\xde\\xdb)\\xa13?\\x82\\xd7\\xedxr\\xac\\xa1\\xd3\\xcd\\xea\\x7f\\x91\\x1f\\xc0\\x01\\x9b\\x15\\xc5p\\xec\\xd7\\x10\\xc2\\x8f\\xcc3\\xa8\\xfd\\x85s\\x83\\xac\\x94a\\xc4\\x80m\\xb4\\x05\\xe11\\xcc\\x92\\xfe\\xd2\\x03\\xd4\\xf4\\x98\\xac\\x84\\x03;\\xa0\\x01\\x84\\x93mo\\x9c,\\x18\\x83i\r\\xd8\\xc02\\x1c\\xbf\\xfc \\xe1\\xdd1\\x8e\\xff!s96\\xef\\xc0\\xd4c\\x8f\\xf0\\x98\\x1f\\x8b`6o\\x91\\x0f\\xb4\\x1f\\x9e\\xd2v\\xcf;7hn\\x13\\x9f\\xef\\x8bw\\x02\\xac8n\\x9cgom\\xe9\\xce\\xc0"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd7,\\x1b\\xbf#6:o\\xa8\\x01\\x93)\\x111\\x9e\\x12\\xe9k\\xf7\\xd6b\\xbf\\x18cs\\xfd\\x8daq\\x16t\\xd5p-\\xc7\\xa2|\n\\xcc\\xdc\\xb0\\x82\\x1bi\\x05\\x8b4\\xdc\\xfb.8\\xfa\\xe0*(\\xc6\\xe5\"\\x01\\x85un\\x84\\x94\\x84\\x05\\x0b\\\\xf13\\xb2\\xe8\\xc4c2g\\xb5\\x89y\\x9f\\x8bz\\xbd\\x96\\xd4\\xb3j\\x80\\xe5\\xa5b\\xc8\\xe3\\xff\\xb8o\\x8c-\\xfdx(7\\x18a\\x08&z\\xbe~\\xe3l\\x99\\xd3\\x87\\xed^ y\\xcc\\xc2\\x04$z\\xaac|i\\xa9\\x94\n0b*\\x8e\\xd5p\\xdb\\x192\\xa6\\xfc\\xbb\\x1cj\\x9c\\x9e\\x9b\\x00k\\x08\\x97v\\x9c\\xb6\\x02?l\\x7f\\xd9=\\xf1\\x87j\\xe4.\\x9b6\\x8b\\xcd\\x06g\\x93p\\xc63\\x88t\\x07\\xc2\\xf6\\x85y\\xb6o\\xba\\x16f\\xb1?\\x10\\x14\\x8be\\x81n\\xdc\\x96\\xec\\xd5\\xb6\\x89_\\xf2\\x08\\xd5u;<\\xa0\\x16\\xa6\\xb4i\\xb7\\xd2/'\\x8d\\xcfh*\\xcby\\x8f8zb\"\\xedhfx\\x12\\xc8\\xadc\\xac\\xc4l3\\xdc\\xc3zu"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010md\\xea:su\\xd7\\xc7\\xe41\\xea$\\x06\\x8b\\xab\\xces#u\\xc1y2\\xaa\\x1d75\\xc1\\xfb\\xc4\\x12 \\x8d\\x040\t\\x1d\\x1dv^\\x1edae\\xc3<|\\x02,r\\x8a\\x18\\x83s\\xa4\\x91\\xb0\\xdd\\x06u'2~x'!\\xa7\\x1e\\xe0\\xab\\xc5\\x05\\xc50\\xfc&\\x96\\xed\\xcfd\\xa5\\xf2\\xc4co\\xb7l\\xe8\\xd5\\x84\\xb5,\\xf8\\xbf$\\xc9rg\\xff\\x1a`\\xfb\\x16\\x01\\x0e\\x91\\xe4\\x91\\xfev\\x10\\xb3\\xe3\\x9d+\\xffo\\xfc\\xed\\x8as\\xab\\xa1f\\x93\\xdds\\x00\\xd6\\xf9\\xf0x5\\xbf\\xc4\\xbe\\xc0\\x83n\\x8b\\xda\\xf2\\x01l\\xc9b\\xad\\x18\\x0c*\\xe5\\xc7\\xdbc>\\x90\\xdd\\xd5\\xca\\x89\\xbdh\\x98\\xf4\\xc8\\xd3tj\\x17u\\xf0j\\xcb\\xab:\\x84\\xf2\\xdc8\\xab\\xdf:q\\xa3\\xdf\\xc0e\\xbb\\xb6|#\\x18\\x83\\xea\\xb4b\\x18\\xfdmlg\\x19\\xdc\nn:\\x91\\xca\\xef!\r\n\\x9f\\xf7\\xab\\xb9%\\x85\\xb70\\xb9c\\xac0k\\xb9;y\\xfb!$/\\xe5\\xeb\\x98la\\xe3\\xa1\\xb8a\\x1e_\\xbc\\xa9\\xfe\\xe3\\x97f\\x80\\xe7"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06i\\x0b/\\x85\\xf2,^\\xbc\\x07n\\x13\\x8f\\xa7\\xe0\\xcb\\x90\\x07\\x8f\\x9d#\\xf5\\xa4\\x0e\\xcc\\xb8\\x97\\x8d\\x9d\\xd4\\xea\\xea(\\xaa33\\x0e\\xd0\\xdca\\xffrlf\\xb3\\xa3e\\x1f\\x9e\\xc3\\xe9\\xc6\\x19-\\x8e\\xef\\xf9^\\xd9\\xa9\\x82\\xcds\\x17\rh\\x07\\x17\\xa9\\xb0\\x0e\\xae\\x06`p\tb)\\x9a\\x95\r\\x84\\x99\\xf5t\\xe17j\\x9b\\x07q<\\xc5\\xd9\\x9b\\xeb\\xa3b\\xe1\\x9fro\\x10\\xc7,\\xc0\\xc9\\xc3n\\xbd\\x88gv\\xa3\\x82\\xbbho\\xb8\\xfdeq\\x84\\xb6l\\xd8p\\x8a\\x9ang\\x15\\x7f\\xaf\\xbe\\xcc\\x08q@\\xfep+\\xc9\\x7f\\xd4#\\x15\\xf4\\x19\\xa0\\x98\\x1e6\\x0e\\xee- \\x9b\\x07\\xb8#sf,\\xc2=fk\\x00\\xb5\\xad\\xd9s\\x0f\\xe9\\x8f\\xe8\\xba6<\\x80\\xd9#\\x13\\x01\\xd7p\\x1a\\x7f\\xd4\\x84\\x1a\\x91\\x18mh\\xc1\\xe8\r\\xe4h\\xad/\\\\x86x&-h\\xc2d\\x13\\xb1g*\\xbf\\x8e3\\x05\\x02\\xeb9\\x14\\x94:'\\xd6\\xf5:\\xb8\\xca\\xea\\xdc\\x0e2y\\x88\\xad\\xca\\xcc\\xe9\\xf8\\xef\\x8a\\x8c\\xbfk\\x9ds\\x10"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_f\\x05\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06=s\\xdatv1g\\x8d\\xf1\\xc1\\xa6\\xd6o &\\xa3#\\xae9\\x90\\x91d\\xb2\\xa7\\xd6j\\x9e\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x0c\\xc5_b\\x8c\\xc5\\x8e|\\xea\\xbfx\\xfeb\\xc0\\x16z\\x18\\x80\\xd6gp\"h\\x0b\\xd4\\xc3\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\n\\xf2w\\xc6s/u%\\xf7\\xd8'5\\x91t\\xe2;\\x0f\\x93\\x0b\\xe8\\xe5\\x81\\x01\\x88\\xb0\\xf8\\x02+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xfd\\xaa\\x13\\xfe\\xb2\\xbbo_\\x15\\fd\\xcf\\xf1gr\\x071dy\\x12\\xeb\\xd4\\x8c)\\xeci\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xfdua2\"\\\\xee\\x1e\\x8d\r\\x00\\x9b\\x8a\\xb9\\x8co\\xc2\\xd5\\xa6\\xb3\\xaf\\x90\\xb0\\x92qx%\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xce\\xa0d=g\\x98(9\\x8c\\xf4\\xc9y\\xc7h\\x1e\"b\\xef\\xfd@\\xc6\\x01.\\xba\\x8d\\x91\\x13\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<y\\xff\\x00\\x99u\\xfb|\\xe0\\xa7\\xcd.\\xd3\\x92\\xecs\\xe7\\xe8k\\x00_\\xdb\\xda-\\xb5\\xc4\\xd7\\xbb\\x1a\\xe6\\x88\\xf3\\x0f\\xd4\\xe20q`\\x050\\xdc#\\xb5)\\xda\\xdb\\xdc\\x81\\x9am\\x80\\xb8\\xf6\\x13m\\xeat\\xb5\\x18\\xe6b\\xd4\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\xb2\\xdf\\x03\\x8c\\x807\\x96|\\x96g\\xecx\\xbfc\\xb1\\xfa=\\x93\\xee\\x04\\xae\\xbem\\xe3a\\xb7\\x8bar\\xb1l\\x9e\\xf8/\t\\xcde\\x91.66\rn\\xe6\\xd5\\xa4"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xb6\\xeclc\\x1efc\\xd2c\\xfdj\\xf6(~bg\\xeb\\x9c\\xb1\\x80\\xf0\\x8a\\xf7\\xd0\\xb1\\xba\\x85m\\x9f\\x9d\\xba\\xa7\\x86\\xaa\\x9a(f\\xccsz\\xcc\\x15\\xbd\\xc4g\\x17\\x16\\x9b\\x8fpof\nlh\\xe0\\x7f\\xbbk\\xa7r\\x1f\\xc6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfdr\\xc3w\\xb2\\xbb\\xb5\\xaf*vy\\xa5q\\xb6\\x11\\xbf0\\xf2\\x07\\x1f@\\x16i\\xfb,\\xda-\\x87\\xeb\\x0f\\xc3\\xf0\\x03\\x8b6\\xd1\\xaas\\xc1\\xb4'\\xe6\\x8c\\xc4f\\x9c\\x9bb"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>\\x97\\xc5\\x03-1\\xf2\\xdd\\xf1\\xdfs.*rlb%\\\\xd1\\xec1\\xd8\\xe2\\xa0nlh\\xe9\\xfev\\xbal\\xc5f\\xee\\x1b\\xc3i\\xe4l\\xe7;\\x87\\xe0\\%\\x97ma\\x88^~q\\xb3\\x93\\x1d\\xd0a1\\xf7\\x99\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xcb\\xd2zg\\xbd\\xca51\\xd5\\xf089\\xf9\\xbe\\xa3\\x85\\xf5\\x1f\\xaf\\x99zj\\x99\\x82\\x85dz\\x1cqn*\\x8d^\\x11\\xe0z\\x1e\\x06=\\xe8\\xbe\\xbbl\\xdf\\xa1\n"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x85\\x96\\xca\\xcbhd^\\xc1\\xf0\\xfb\\x94\\x1e3\\xe2c\\xde*\\x82zw\\x80k\\xb4o\\xfcf\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5\\x16\\xc1#d\\x1a\\xcf\\xf3\\x9f\\x82\\x7f\\x92\\xd1^\\xa4\\x94b\\x84it\\xd3\\xa3\\xffp\\x12;\\xae\\xd7l\\xf2\\x95\\x07m5\n\\xc9\\x10\\xde_q\\s,z\\x13\\xc0\\x05\\x96\\xf3\\xec\\xfd:\\x9d\\x91m@*'\\x99\\xa6\\x88\\xb0\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8\\x18q\\x88\\xf0\\x92\\x87\\xf7l\\xed\\xb5\\x08\\x9f\\xc8d`\\xc7p\"\\x85\\xec|\\xc8\\x9e\\x96\\xf7-4u\\xa3\\x9c\\x84@c\\xba\\x80d(!/ku\\xf3(1\\xa9\\xe9e"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xfez\\xb9c\\x9c\\x08r\\xd5\\xfb\\x14\\x8f\\x0c\\xf6\\xd8\\xb2i\\xb9.\\x1ag\\xa3\\xb0.\\xa9\\x99,e\\xc6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xd6\\xcb|\\x9c\\xe0\\xb1\r_\\xe5\\xd6\\x03\\xb8\\x94%\\xb3=\\xfc\\xea\\x10\\x83\\x12o\\xb8\\xa2\\x85^\\xff\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06#\\x11v\\xacs\\xcac\\x9e@\\xe7m\\xf7>\\xb6\\xb7\\xb9\\xbb3\\x03\\xf0\\xb6\\xffz\\xcb\\xad\\xe7\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xd9d\\xe8\\x80\\x1fw\\x936\\x8a\\x15tl/'oce\\xea\\xcc\\x0b\\xb0\\x03cyy\\x00\\xbe>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_z\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xc3\\xee\\xe0\\xf2\\xb8\\xc1\"\\x12vj\\x11)\\xba\\x95\\xd8\\x12h\\x0c\\x95\\x08o\"0l\\x14\\xf7\\xda'\\xd2e\\xf9\t\\xd8\\xc7)\\xe6\\xee\\x9e\\xcd\\xfc\\xf0?\\xcd\\xd2\\x0b\\xd2\\xf5\\x897\\xd2\\x9e\\x91\\x92;\\xefy\\xc1\\xde\\xd3\\xf1\\xc1y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\x8e\\xd6\\xfb\\x82(\\xc0\\xef$b\\xc1\\xf52:x\\xb1j\\xcb\\x0c\\xa2\\xde\\xa1\\x1bo\\xdfeh\\xb0\\xfft+\\x05\\x1e\\x8d\\x07\\xeas\\xcco\\xc7\\xf4r\\xc7\\xfaj2\\xdcq"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb\\xa5\\xac\\xbd\\x98\\xf3,p\tb\\xd1\\xd6\\xf5\\xbd\\xeav\\xc5\\x1d\\x19fi/\\x87x^3g\\xb0iz!p\\xd0\\x07r\\xfcj!^\\xd7fj\\xd97|\\x04|e\\x83\\xe0\\xd7\\x0ef\\xd3\\x1c\\x01\\xb0.\\xf4\\xb9\\xd5o\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000'<w\\xfa\\xe5\\xff3\\xb0\\xd7\\x80\\xf6_*a\\xfd\\x16\\xdc\\xbac\\xa4\\xa3\\x9a`x.r\\xa4\\x9f\\xbe\\xbd\\xae!\\xfc\"\\xda\\x96\\x8a\r>\\xde\\xdev\\xad\\xbau"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\x08w\\xdbp\\xf6\\xb2\\xb2\\xdd\\x10\\x06\\x8a;v\\xf9cq\\xcbt\\x83\\xee\\x02\\xb4=\\x11/a\\xee\\x84\\xa1\\x11\\x82\\x06\\x9en\\xe2\\x00\\xf3\\xbc\\xe6\\xfb\\x08\\xb0\\x97\\x0f\\xfb\\x80\\xf8\\xacj\\x1ac\\x9d\\xde\\xd9\\xca\\xcb\\x0b\\x1f+\\xf0\\xcb\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\xd4\\xb3\\xd44\\xee4|\\x0c\\x04i\\xf4hu,.%\\x04\\xd7v\\xc4m\\xc8\\xd9\\x9a\\x12t\\xa9ac\\xbcm$\\xdc\\xfb\\xfe\\xfd\\xbbs\\xcb\\x8c\\xb5\\xbb0\\xc2p"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xde\\xd5\\x82\\xf7\\xf4\\x18\\x14`\\xd1\\xf3j\\x81\\xa0 \\x98\\xbf\\x17\\xeb\\xd8\\x93\\x89\\xe2\\xde\\xdcz\\xbc\\xa8\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x8c\\xd5\\xdb\\xa8\\xaa/,\\xb3~>\\x1b\\xbf\\x00j(\\xd1\\xddj*\\xe2\\xfc\\x8b\\xa7n,db\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\xbf\\xd4\\x98\\x91\\xda\\xbd\\xe3\\x11\\xce\\xd0\\x8b\\xc0\\x9b\\xd9h\\x81;z-\\x18\\xf1\\x06\\~j7\\x97\\xaf1\\x14\\x89\\xb7\\xf8.\\xfer\\x88\\x04~\\xcam\\xa4\\xcdi\\xe1\\xf3\\xa3~s\\xbb2\\xf0\\x0f\\xaa\\x88\\xe1\\xaa\\xab\\xac\\xffv\\xa7^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7\\x97\\x05\\6e\\xe8j_k\\x92\\xcd)d\\x91\\x9ej\\xd4\\x8e\\x04%m\\x86\\xd5\\xd0\\x9e\\xc7m\\xa6\\xc9>\\xd9\\xe4\\xd58\\x18\\xf8:\\xaf&\\xba<\\xc4az\\x83\\xd0"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xabwu\\xeb@\\x83z\\xa4fu\\xe1\\x07\\xbf\\xfc\\x8a\\xa7\\xd6x\\xc3\\xa3\\xe7g%\\xbf0.\\xf5\\xa6&:ri\\xe4\\xab\\xd5\\x8a\\xf8\\xe63%yq\\x93\\xb2\\xdau\\xcf\\x10\\x8c\\xc6j\\xc9b>/\\xc7\\xb1\\xd9b!\\xd8w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c\\x95\\xea&\\x0b\\xe4q\\x85dty \\xf7\\xe6dt\\xf2nf\\x94\\xe0\\x1fg\\x17\\x07\\x8a1\\xbc\\xe0\\xcd\\x9d\\xe0\\xe4p\\x01u\"\\xda\\xe8\\xef\\xa2\\x95;5d\\xbf\\xef^"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xf9\\x18;\\xd1d\\xaf\\x9a\rf\\x12p\\xbad\\x81u\\x9a\\x11\\xe5n\\x810;\\x86\\xe2\\xca\\xd9\\x88\\x04\\xad\\xd0\\x96\\xcf\"ac\\x1e\\xfb\\xbd$\\xcdl\\x8a\\xff\\xabp\\x18\\xa1\\xf5\\x15ib\\xdc(\\x7f\\x9c\\xd0\\x08,\\x0b\\x93\\xa0h4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcawt'*d7sj\\xa8q\\x8df\\xd0\\x99\\x9e%\\xfd\\x81\\xa5\\xb1#\\xd9\n\\xe6n\\x0bi\\xe2$\\x81\\xa1g\\x10(~\\x8f\\xfe\\xc5\\x18)\\x0e\\x8d\t\\xd6s\\x148"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06.krgo\\xde\\x8e\\xcb\\x80r\\x9f\\xf7\\xd8v\\xb2d\\xba\\xbc9\\x13g\\x1d\\x16x\\xa69u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x060\\xe0\\xd4\\xa1\\xa6\\xf3\\xdb\\x93\\xac\\xc3\\xc9\\xf7\\x95\\xe5\\x00<f\\x8b\\x03\\x1d\\x86\\xf9\\xda\\xa5\\xfc\\xde\\x0e\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xbdg\\xdcimb\t\\x06\\x98\\xc5\\x0cm\\xb0\\xe0\\xe6x\\x9e\\x0e\\xf8\\xb19\\x9aad\\xdf\\xc8\\x82\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06bb\\x7fi\\xe0w\\x80\\x04qzq1\\xe0\\xf19_i\\xc0q^\"\\x88p\\xa2t\\x99h\\xaay\\x04^\\xbe\\x1f\\x93\\xec\\x08q\\xaf\\xe8\\xef\t\\xa9\\x9c\\xc3\\xb5\\xf2|\\x81\\xd1\\xe1\\xe0n\\xbf\\x07dzx\\x88\\xee@\\xb3ej\\xa9\\x85\\x17\\xedf\\xb1b\\xaa`\\xab\t\\xbbq\\xd3\\xd1\\xe75\\xd9\\xbb\\xb2\\xc3\\x9b\\xb7e\\xcc\\x1ea'cs\\xbd\\xc9k\\x8a\\xa9qdw\\xe8\\x02xy@\\x00\\x91\\x11v\\xc1\n\\x9e\r\\xdd\\xadg1\\xecv\\xbaz\\x07\\x0b@;-@\\xe6\\xc5z\\x15\\xcc\\xa5\\xfcs\\x8e,\\x8d^:\\xcd\\xd7\\xd11\\xe3~k\\x95\\xd7\\xa9n,\\x19\\xe7\\xc6\\xb6,\\xd6\\x8bp\\xd8\\xda!\\xde\\x1a\\x07\\x1e\\xbe\\x99\\xf5?f\\xfdu\\x13\\x19\\xc1vp\\xa6iq\\x9cz\\xa3'\\xe0\\xa9z\\xf8w\\x17\\xe9x\\x1ccm\\xd7y\\xc5\\x91\\xbe6=\\xf7\\x90\\xe8i-\\xf7\\xce\\x15*\\xeds\\xeb\\x01\\xa2\"^\tn\\xfd\\xb6\\xf8\tk\\xeb\\xd6\\xdc\\xa5c\\xa5\\xc0\\x8el\\x9d\\x0e\\xeaq \\x8e\\xb0"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xf2\\xa4\\xe8\\xb0\\xaa\\x001sm\\xbfpw\\xf4mr\\xbc2\\xff(ex\\x15\\x99\\xbbs\\x04p\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\xc9\\x187\\xcc\\x1e\\xa0\\xde\\xe1;a\\xf3\\x90b\\xda\\xe8\\x11\\xfbs\\xc7@\\xd0\\xac\\xc0:\\xe7\\xcf\\x15,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x06\\x9e\\x84\\x9f\\x9d\\xcb\\x97\\x0cz-\\xc4\\xb3.\\x02\\xd78\\x06\\xd4\\x94\\xa8\\xc6\\xcc\\xcaa\\xe4\\xa8\\xc0\\xd9z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gtxu\rv\\xa5\\xa2\\xcc\\xe42\\x1c!\\xaew\\xaf\\x86\\x04\\xa7\\xbay\\xdd\\xc9|\\xb0b\\x00\\xab\\xfbu\\xf5\\xb65\\xa6\\xd3\\xff\\xf1 \\x9bqv\\xd3\ref\\xf4\\x8c\\xca\\x90\\xff\\xbadf_\\xb8r\\xbb\\xae\\x8fl#\\x817\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\xcf\\x18\\xf8\\x81d\\xd8\\x8c0m\\x0c?m\\xa5\\xc3\\x14\\xa2m.\\x06)`~x\\xb0\\xbb\\x82\\x9c\\xd9\\x05\\x15\\xd3_.\\xdf\\x12\\x88\\x92\\x18\\xca#\\x1a\\xddv\\xf4\\xdf\\xe6"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2\\x86\\xfbn\\xc8>\\xe0\r#dv\\xe6\\xe5\\x1f\\x85\\xd3\\xa6\\xf7\\xc1\\x0f\\x82l\\xaek,\\x97\\xf5\\x86\\xad\\x1en\\xfdpe\\x02\\x11o9|\\xf9\\xb5\\x8b\\xc7\\xc8\\xffy$\\xff\\xd5\\x93\\x1e\\xcb&o\\x0ft\\x8c\\xe7\\x8f\\x1a`\\xcf\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\x06\\x85\\xbcr\\xd9\\xb6>6f\\xa4\\xfc#\\xd4.w\\xb8\\x97r\\xa3g\\x17\\x1bi\\x83\\xd1\\xb18\\xa1\\xcd\"\\xc5\\x91\\x19\\xb2\\xfe\\x88\\xab\\x14s\\xe8\\xc7\\xad?p\\x8f|"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xb4\\x9c\\x16\\xddd\\xd2\\xc8\"s\\x9b\\x04\\xa1f\\x15\\xc8g\\xaay;of\\xa0\\xfe\\xd1\\xd2$\\xd7\\xf3\\xa0s\\x12\\x89%u\\xcd\\x13k\\x87\\x1b\\xd0\\xa0b\\xf1d#\\xe0\\x9d\\x84,\\xf4\\x1b\\xe3| \\x87;\\x88g\\xea1z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x00\\x87\\x1f\\x05\\x16s\\xdd\\xe7\\x17\\xca\\xf2\\xa3)\\x0f\\xc0\\xa1q\\x1e&:\\x13\\xb9\\xb5\\xda\\xd6\t\\x19\\xff\\xc4\\xeb&wo\\xb0e\\xc3\\xca\\x84\\x83\\xc4\\xe2\\xd2&\\xd9\\x01\\x80\\xa9"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\x8c\\x9d\\xc0s=\\x05\\xd6\\xa4\\xabw7\\x9ex\\xf5b%\\x05\\xd1\n\\xa6\\xc4h\\xd3\\xf4\\xf9#i1\\xb8t\\x98\\x98\\xb9\\x81\\xfdkl\\xd6\\xff\\xd0\\xbe\\x00\\xfdme\\xe4bl\\x9e\\xbe\\x86\\xa7\\xeb\\x86p\\xb4\\xc3\\xcf.ff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeer`n\\x17=8x\\xc9\\xc9u\\xc4\\xdc\\xc3\\x8b\\x88\\xc6@\\x95\\xfd\\x91\\x05\\x7f\t\\x99\\\\xdd(\\xcb\\x99?\\x17\\xb9g\\xf2\\x02!!\\x0c\\xbebxc\\x16j\\xa9_"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\"\\xb2\\xd5=\\xa5\\xc1\\xfa8'\\x8f\\xfc(\\xbf./\\xc7\\xc0\\x8e\\xfb\\xc8\\xf0\\xb6\\x8cxe\\x83je6\\x06\\x15r\\xe4r\\x06\\x00\\x8f\\x9a\\xa3\\xa9\\xa7\\x9e\\x18\\xa4\\x83\\xb6\\xbe\\xb5\\xf3\\xc3)\\xb8\\x04$\\x95\\x92\\xca\\xf1i\\x83*\\xed:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\n\\xe4\\x82\\xc4l\\x95\\x15\\xef\\x8cmh\\x02\\x9b~y\\x17*\\xdd\\x87\\xb3\\xd7\\x0c\\xeel\\xe0\\x9b\\x933\\xec\\xc6\\xc6\\xb0\\x18\\xa2d\\xee\\xf9\\x1c\\xc1\\xd5\\xc5\\x07o\\x19\\xda\\xcd"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&td\\x13\\xa6\\xe9l\\xb4\\x85y\\xbfx\\xa8w\\xaa\\xf4\\xfb5\\x98\\x0b\\x87\\xc3\\xb4\\xb1j@\\x98\\x82\\x94z#\\xc4vx\\xdc\\x80\\xcb\\xd2\\x9f\\xa5\\xa4\\xac\\x9eyq\\xd7wp\\x0b\\xf0\\xba\\xc9\\x1b\\x08\\x1e\\xc9n\\x7f\\x01d\\x91\\xbfq\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2\\x9f7 f\\xf4\\xafu\\xc1\\x91\\x7f\\xb4\\xaa\\xb9z\\xce\t\\xebr\\x8b\\x89;\\x04t9?\\xc9\\xa84x;\\xef\\xab\\xf8\\x92t\\x9b\\x95g5l\\xdf\\x8b\\xe1\\xb5\\xbfz"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x12\\x8b\\xc92\\xae\\x1ew\\xd0\\xe7\\xb3\t\\x99t\\xb8\\xf7\\xb7\\xb6\\x15<\\x08r\\xa2\\xb7\\xad7\\x1b\\xb0\\xaf\\xc3mr\\xb6#\\xa2\\xb0\\x18\\xdfqm\\xe3\\xe7\\x03\\xe2!\\x89\\xfeh8hj\\xd9\\xd0\\xc5;\\xf7\\xb65\\xf6\\x9e`\\xe24w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\x85\\x07\\x07\\xf8\\x0f\\xed\\x85\\xbf\\xe2\nb\\x00\\x1e\\xb9\\xbf\\xe2\\x85\\xe1\\xd9\\xb8\\xeb\\xee\\xa4\\xa7l\\xf1\\xe61\\xfd\\xda\\xa0r\\x17\\xc9\\xc2/\\xc2w\\xb3\\x99\\xfd\\x15\\xe3\\xa2\\x1e\\xc8~"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x7f\"\\xa2\\xf7cn\\xc9,\\xc4\\x17\\xfd\\xb6\\xe4\\xd8\\xb96y\\xa0\\x87n%q4\\x13-\\xf1\\xeb\\xd7ao\\xda`p\\xa3)\\x1d\\x12\\xf7\\xf8os\\x81n\\x9f\\xb8\\xbcj\\xb9\\x94\\xdcm\\xce\\xc8\\x89\\x14\\x04\\xbfx\\xcc\\xdd\\x93.7\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xbfy\\x9b\\xe8\\xce\\xde\\xdd \\xb8+\\xaaz\\x96=\\xeb`=vlf\\xc4\\x07m\\xc5b$\\xbf\\xc2\\x11^,\\x1ep5\\x15zih\\xb9d\\xec\\x8e=+\\xf7\\x95b"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\xc7\\xf1d\\x08\\xd4\\xa1\\xe9so\\xder\\xf8s\\xc7\\xb5\\xfdv\\xd6\\xe8m\\x1b\\x00i\\xc4\\x1c\\xd4t\\x0c\t\\xce\n\\x9e\\x1d\\x82\\x0b\\x16\\xe9\\x9f\\x9e\\x8a(\\x13\\x80\\xc9\\xd2\\xee\\xa5\\xfa\\x99\\xfd\\xa5\\x921l=\\xd3\\x90\\xd6pa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\xc5(\\xb7 \\x1c\\xca\\x89\\xe9\\x88\\xd2wus\\xf0\\xc7\\x17c\\xad\\x98\\xb7\\x93\\xbf\\xf6s\\x07\\xefs\\x04\r\\xb9ydi\\xd8\\x9a\\xbaeu!\\xe4\\xee\\xdb"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\x16y-n\\x0fr3w\\xda\\xc8~\\xdf\\xbcz\\xe9\\xd6\\xe0\\xb8br=\\x80?\\xa2\\x92\\xde?\\xad#\\x19w\\xfa\\xdd+8\\xbb\\xcfz\\x87\\xa6\\xbcg\t\\x99\\xdc\\xa4usr\\xef\\xf0u\\x1d\\xb5x\\xbd\\xbd3\\x0f\\x9b\\x97\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000jh\\xb9e\\xf8\\x96\\xbc4\\xb1r.y\\x1c\\xde\\x999f3\\xaa\\xd4\\x9a\\xcby\\x10\\x9e\\x8c\\xd7\\x1d\\xdb\\x1e\\xdef\\xd2`\\xb3r\\xde\\xa2\\x85\\x1f:0`\\xcfo\\x02\\"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xd3+\\xdd~\\xdd\t\\x99y;\\x04\\xc6\\x12\\x8b#\\xf5\\x17;\\x877\\xa1\\xd5\\xf3\\xbe&\\xd2g\"\\xc8\\x1eb\\x9d\\x17:\\x8a\\x8bv\\xc1\\xc7\\xb0\\xd4o\\x96\\xf6\\xe3j\\xd2\\x05\\x91\\x8f\\xed\\x0f\\xa6\\x9c\\x19\\xb1\\xb7\\xeb\\x01\\xd1\\x0f\\xd2\\xb2b\\xfc\\x91\\xef\\xd38\\xde\\xd9*\\xd9\\xb1\\xa8\\xb7\\xeb\\x0ckz\\x9a\\xab\\xd6\\xf7\\x9c\\xae\\xef\\x04\\xe3\\x87\\xf6\\xc2\\xda\\x9a\\xda\\xbb\\xcf_\\xb3\\xce9\\xc0\\xf5\\xe9`1f\\xddh\\xb5\\x03\\xda\\xeb\\xd4l\\xd5\\xc4\\x00\\x1c\\x916\\xd6\\x18\\xe1\\xe9\\x9cnzi\\x1e\\x8b\\x0e#wn\\xab\\xcftf\\xe0\\x15\\x90)e\\xdd\\xde\\x989\\x04\\xbey\\x96\\xf0\\xb2\\xc7\\x0e\\xe6\\xb9\\xa1l0\\xe3\\xb3\\xb3\\xf0\\xa2\\xc6\\x87%\\x1a\\xea\\x9f-\\x01c(\\x179\\x97\\x84\\xc6\\x97w\\xe1\\xf2\\x14v?\\xfc\\x14b\\x87\\x0c\\x1e\\xda\\xdak46\\xc3\\xfffp*c>\\xbe\\xde|\\x8c\\xae\\xf7\\xbb\\xe2\\xc9wg\\x1c\\x80\\xcc\\xccn\\x8e\\x91)\\x03<2j\\x00\\x98z\\x17\n\\xfe\\xe5\\x8bg\\xf2\\xbf\\xf6\\x8c\\x9de\\xc4y\\x81\\x98"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc2z\\x14\\xb3\\xbd\\xd6\\xb3\\xce@\\x99|\\x17\\x00y\\xa0\\x1a\\xf9\\x83\\xa0\\xe4\\xb3\n\\xfa\\xf4\\x91f\\x85\\xe1\\xc3?\\xed\\x02b\\xefe\\xc9\\xf8\\xad\\xbb\\xb6c\\x8c\\xd67\\xaa\\x8ev=o\\xc4\\xa3\\xaco\\x1f\\x08f\\x94\\xb0\\xa3\\xbfo\\xee\\x10\\xf5\\xea\\x1e\\x0e\\xdc\\xbd\\xa3n#7ig\\x95c,`rk\\xda\\xd0\\x93\\x8a\\xe3v\\xcd\\xb3\\x8b\\xbe\\x9e$\\xce\\xca\\x7fa\\xb2\\xaf.\\xb8ij\\x8f\\xa6@r\\x7f\\x00\\x0frm3\\x9c\\xa8#r\\xd0\\x81\\xe5\\xa29\\xec\\xc1.\\xde\\x1e\\xd06\\xe0\\x04\\xe3\\x7f\\xe3\\xb8\\x8f\\xc5\\x91\\xd4\\xd7\\xeb\\x1b>\\x15\\x96\\x18\\xaa\\x12\\xbd\\x0b\\xd6h ^\\xdf\\xf3\\x0b,\\xe5\\x80\t\\x94\\x834\\xb0\\x8c7\\x02_@\\xe1\\xda/\\xd7\\xf6\\x8e\\x91e\\x8b2\\xa0\\x8e>\\xb5&\\xc7\\x8c\\xc4\\xcc\\x92\\x88\\xa3\\xa0~s;\\xd8\\x16\\xe9d|\\xb4\\xf2\\x8f\\x98\\x81\\x8d\\x9d#,\\x8b\\x91\\xa7i\\x9f\\xa9\\x10\\x7f\\x86\\xc2v.\\xac\\xf3*qe\\xd4\\xb4\\x86\r\\xcb\\xaax\\xefa9\\xcb\\xd5\\xd1^q\\x9fp\\xeax"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109j\\x8a\\x19\\xc5l\\xeb\\xd0)\\x9d\\xb82%t\\x81\\xf6\\x9cra\\xab\\x0f\\x80^i\\xfb\\x9d\\xc4v\\xe7\\xf5\\x08;d\\x98\\xec\\x81h=\\xb7\\xcf\\xc4fn\\xf7\\xb4|7gqq8\\xbb\\xc0\\xad\\xeci\\xc1\"r\\xae\\x19xr\\x9b(y\\xffo\\xad\\xb1\\xa2\\xc7\\x96,|\\xa1\\xff\\x84\\xc8\\x9d\\xf7\\xbc\\xe6\\xb5\\xc5.mx\\x175)\\xa9\\xa6\\xcc\\xa9&+\\x0c$!\\xec?\\xd3\\xb0\\x83*pp-?\\xdc\\x92\\x96\\x81\\xe7\\x8c\\xbb\\x8d\\x82qh@u\\xd4\\x07\\x1c\\xaf\\xb0z\\x87\\x97\\xed\\xbc\\x03\\xe6\\x14\\x95\\x9e\\xca\\x8e\n\\xa0d\\xff\\xd6)e\\x0f\\x05\\x94\\xe7\\xe9f\\x18'&\\x8dw\\x7f3j\\xa2\\x0b\\x18\\xf8u\\x92v\\xb7vf\\xa5i\\xe0\\x7f5u\"\\x18s~\\x86!o\\xeb;\\x05\\xfc\\x13\\x9d\\x19\\xe2\\xf4\\x92\\xbf\\\\x86\\x13\\xa9\\xb4\\xcf\\xd4\\xbd\\xa6\\xe4\\xa8\\xcb\\xf0\\x8f\\xb1r_\\xb8\\xab\\xf9l\\xb2\\xc9\\x90w\\xed\\xb7\\x0f\\xc6k\\x87\\xef\\x8e\\xd2\"\\x0cs(\\x89m\\x88\\x17%\\x1d\\xd4m\\xe8\\xf0\t<|\\xa1\\xb1"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\xdau<\\xabqow\\xb4/\\xc3p\\x0blhu\\xfc\\xd0i\\x8b`\\xbb\\xa3(\\x0fg\\xc3\\xe2c\\x1f\\x94\\x92\\xf3\\xcfc\\x97\\xe8\\xe81\\xcc\\xf3\\xb6\\xb4lo\\x9d\\xb6'2\\xf4u\\xb9\\x96q.\\xd2\\xa0\\x0fe\\x16\\x99i\\xcc\\xf7\\xf1z\\xac\\xae*|\\xd9\\x05\\xc6\\xdb\\xac\\xbd\\xd1\\xcb\\xa6g\\x00h\\xb0\\x9d\\xd9\\xd2(\\xd8a+\\xdcd\\x92\\x9er\\xa5.v\\x93u\\x04\\x90\\xfe\\x95r~\\x1e\\xf5\\xfd\\xbe\\xe8\\xa0me?q\\xbc\\x06\\x0b\\xe3y\\xa4i\\x91\\xd1j1\\xd9d\\xe7.\\x8b\\x1d\\xc9\\x19\\xfen\\xdc\\x9c\\xe9\rs\\xdd\\xc9pj\\xfb\\x02\\xe6\\xbb\\xcc?\\xb5t\\x95\\xe5w\\x06\\x06\\x10\\xf7\\x15z\\xbb\\xed\\xff_\\xec\\x8bn\\x17\\xd8\\xc1\\xe3\\xa0\\x14\\x02\\xa5\\xe0\\xfer^\\x8a\\xfb_5\\x11\\\\x06\\x86a\\xd3\\xdd0\\xa7\\xef\\x91\\x01\\x11\\x9d\\xc8\\xdft$6\\xd2\\x1ba=\\xa4\\xadt\\xb2\\x0f\\xf9m|\\xd9\\x8d\\xa1c8\\x17\\xa0\\x9bz\\xd0f\\xd7;\\x8f\\x18\\xccj5\\x0cpxr\\x07o\\xe4\\xfcjcf\\x87\\xad"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010(7>\\xbb\\xdb\\xe9\\x8bt\\xb4vd\\x08\\xe6*'p\\xe9\\x99sl\\xb61&\\x14j_km\"e;k\\xf6\\xfc\\x94\\x86\\x10\\x93\\x82\\xb1\\x9bs;\\xa4\\xf8\\x10i\\x98\\xb6\\xe1\\xf0_:\\xfd\\x15\\xcd\\xec\\xfd\\xf6\\xefp\\xcf\\x95\\x0bz\\xc6h\\xd4\\xd5\\x86op\\xfd\\xc3+\\xb8^f\\x1b2%y\\xfa66p#a3\\xc3(\\xabd\\xf4\\xcb\\xcf\\x03\\xa2\\x7f\\x17m\\xe1\\x96f\\x1f\\x02\\xa2\\xd5\\xda\\x83qm\\x8d\\xc9\\x99\\xed\\xd3\\xcete\\x10\\xedz\\xce\\xf9\\x87\\xa5|&\\x82\\x0f\\xcd\\xc31\\xbe\\xc6\\xd7\\xd9\\xac$\\xe6ic\\x8c\\xbe3\\xde\\xb3\\xa9\\xd3 3?\\xae3\\x9a\\x9e\\x07\\x07\\xc6\\xeaf#:\\xe3\\x92\\x13\\xb4.w\\xc3\\xbc\\x18\\xd7\\xfb\\x86\\xb6\\xc1\\x1d\\xee\\xe6\\xb3\\xec\\x15$\\x04\\xca\\xdc\\xf1\\xb4\\xc7\\xc1\\xbe2\\xd2\\xc4\\xf0r\\x9d\\xf2\\x0b8\\xd6\\x9bjn\\xadn\\xdb\\xc0\\xc5\\x94#ba\\x1f\\x86\\xd7\\xa6\\x89e\\xa7\\xbaz\\x13qz\\xfe'\\x84\\xa3>!\\xd4vy\\xcb\\xa2%\\xd9h\\xfe\\xb8?!\\x1f\\x99\\xad\\xe5\n"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\xe2/m\\x93\\x1f\\xbc\\x8c\\xe4\\xd0\\xc0\\x95\\xaas\\x89\\x01+\\xa9\\x95w\\x90\\xa2\\xb1\\x1f\\xe8\\x83u\\x1fbz\\xf9\\xbd\\xa2a\\xc0qf\\xdf\\xaa\\x06\\xe4\\xd0^\\xdc\\xd9f2\\x82\\xfc\\xd3\\x07r3\\xe4\\xb7\\x04h\\xf1\\xde\\xb1e\\x8f\\x8d)<\\xd0q\\x17\\x19\\x07\\x8a\\xe9\\xcae\\xa7\\xb08a\\x06\\xd3)a\\xa2\\xbbn\\x90\\xff\\x86\\xec\\x9fk\\xe9\"\\xd8n\\xe4+\\x9cy\\x9e<'\\xd5\\x837\\xd9\\xc3q\\x9a\\xe8+\\x0bc\\x88\\xa0\\x1b\\xf8\\xbbe\\xfdi\\xeddx\\x05u\\x8cu0x\\xa6i\\x98\\x8cz\\x0ebd\\x98t\\xd4\\x028\\x18p*h\\xeb\\x1f>\\xf8\\xbb\\x15\\x06c\\xaa \\xf1#\\xac\\xc5k2<\\xa32\t\\xc9\\x13\\xb6\\x90\\xfc*e\\xda\\x85;\\x07@n\\xa0\\x14k\\x1c\\x0e\\x8d\\x99\\xf4\\xee\\x07c\\xd1nz\\xa2\\xb32|\\xd3\\x0b\\x14`\\x15a\\xabb\\xfc\\x8co\\x06\\xbce\\x81\\xa6\\x94\\xc5o7\\x1f\\xda-\\xb3r\\xe9f\\x82\\x1b.\\xcc4+9d\\x9a\\xf4);\\xfah3\\x1e\\x86\\x83\\x0f0u_"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\xcc\\x17\\xcf\\x00\\x89\\xb1\\x8e\\xd68\\x98\\xb0l\\xc0\\xed\\xe3ww)c\\x94'\\xd6\\x02\\xb6\re\\xe5\\x0e\\xb6\\xe0\\x0c$\\x8da\\xed\\xc5\\xe4\\xd4\\xdd\\xcc>\\xa4\\x92|\\xcc\\xf4\\xb4\\x01\\xf7\\x0bi\\x85r\\x85\\xff\\x1df\\x0fd\\xae>\\xc4y\\xf9\\x1b\\x8f,\\xb4\\x109\\xe8c\\x08\\xfb\\x1d\\xa0\\x7f@\\x9bp\\xa8\\xf5>\\x96;\\xaf\\x8d\\x06\\x9bz\\x1d\\xab\\xe5\\xca\\xed\\xa9\\xf4\\xb5\\xb6\\xca\\xe1\\xb5q\\x18\\xeah\\xf8\\x135\\xab\\xa0\\xb3\\x930n\\xbb\\xf6\\x9c\\xedop\\xc7q\\x94\\x81\\x85\\xba\\xbc\\xe5\\xab\\xe6i\\xd5s\\xb9c\\x19\\xa74is\\xe1n\\xe8f\"\\xc82\\xc5\\xe0j\\xcbv\\x93\\x1f\\x99h\\xe4\\xb1!\\xd6\\x87\\xeb\\xdc\\xf0\\xb4f-\\xaf\\x87t\\xff\\x8ej\\xaf6\n\\xa7\\x9b\\xf7\\xfa\\xf5\\x82\\xef6\\x89g$\\xd3k\\x99\\x80\\xf9\\xcf6!\\xaeuk\\x0b\\x94\\x1d\\x84s\\xcdjbh\\x01\\x0e\\xea\\x906\\x88=\\xcekjc \\xdc\\xb4\\xfdc\\x0c\\xc1\\x87\\xc5\\xc1\\xbbt;d`\\xd7b\\xf6v+\\xa2o"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfa\\xfe\\xd2rn1a\\xbf\\xf5\\xeex\\x83m-k_gd\\xa1\\x9a\\x01\\xc8\\xf0x64\\xe7m\\xd6@\\x03\\xea\\x9cp\\xa9\\x82lj\\x02\\xdcmip\\xb8k$7\\xf9(t\\xb9n\\x02\\x03f\\x84d\\xc6\\xbdy\\xcce\\x9dl\\xbf8\\xfcg\\xf3x\\x89\\xe3\\x81(\\xd25\\xa6\\xb2x\\x9e\\\\xfe\\x04\\xe9\\xe0ke\\xfb\n5\\x8c\\xad\\x05\\x85\\x9b\\x8f\\xac\\xea\\x9e\\x886\r\\x95\\x91yn\\xa8n\\xef\\xffc\\x8am3\\xfc\\xc5\\xd7bf\\x93\\x9b\\xbb\\xb8\\x03hg'\\xe9\\xf30\\x9a\\xd0\\xd9\\x1d\\xbf\\xbb\\x077\\x9e\\xd3\\xc1d\\x15^y\\x00\\x92\\xfa\\xdb\\xddcoj\\xe6>\\xf7\\x905js\\xcf\\x99\\xfe\\xbb=\\x0btl\\x80zp%\\xf3n\\x08\\x82;\\x17\\x00\\x03g@\\xc1y\\xe9\\xb20\\x8e\\x94\\x8f~\\xf0s\\xd2\\xfdq_\\xc57\\xedj\\xaeu\\xb0\\xcf\\x9a\\x16\\x92ls\\xeajju@\\xbdhj\\x17\\xe9*?\\xffp\\xbet=\\x02b\\xb2f\\x86\\xa0\\xf9\\\\x9d\\xa7t\\x82#.\\x93%\\xcb\\xc7\\xae\\x93\\xf2"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01;>\\x07x\\xf5>\\xdd\\xebg\\x8fl\\xce\\x93v\\xae\\xe2a\\xe4\\xff\\xb0\\xd9>l\\xeey\\xda\\xc6\\xef\\xb9b\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x9c=\\x8d\\xe8\\xbd\\xcam\\xc3\\xa3\\xafjs\\xe9\\xde\\x02\\x813\\xc1\\xe6_fe/\\x85h\\x83\\xbdx?&?\\xd1,\\xbc\\xdbi\\x8c\\x1a\\xe6\\x08g\\xa4\\xbbtt\\xf2>\\xb7-\\xcdry\\xd2\\xc1\\xea\\xc8\\x19\\x84\\x87\\xe0v\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xcb\n\\xb4\\x04\\x1f\\xc6\\x86\\xf6\\xf5\\x8f\\x06\\x82\\xd4\\xafuft\\x8f\\xee\\x07\\xaa\\xbbn%\\x9e\t\\xa3\\x07\\xba\\xb0e\\xab\\x9f\\xc1vzv\\x1d\\xb6\\xc2\\xed\\x1b\\xaa?\\xf5\\x1e\\xa6"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\xe0a~w/\\xdb\\x96\\xae\\xbc\\xdb\\xd7\\x9c_\\xf9\\xe9\\x90b\\x1e\\x13_\\xf7&.\\xf6\\xa4\\xf0\\xb1\\xbbw\\xcf\\xe3|z\\xd0w\\xf5\\x86s_\\x1a\\xce\\x1a\\xcc\\x8d\\x1a\\x01#\\x98ani\\x1c\\x05wy\\xe6t1b\\xdd\\x89o\\xdcy\\x14\\x15b\\x04w$s\\xfc\\xf5\\xa3\\xb2\\xees\\x81\\xdahow\\xc7\\x82\\x92x\\xbc$\\xff\\x8a\\xfc\\x9b\\x18r\\xad`\\x9c>\\x89\\xc59`\\xd2\\xaf\\xed\\x9e\\xc5y\\x9c\\xb3\t?\\x16k\\xd2\\x89\\xf2'#\\x0b\\x8fgi\\xe3p?\\x9a\"-\\x8a4\\x84\\xca\\xdc\\xc4iz\\x19*`q\\xb6\\xec\\xa7\\x9e\\xf7\\xf0\\xea$\\xbc'v\\xcc\\xc1f\\xdc\\x17\\x9aq\\x05\\xf7cx '&<\\xb1<\\x94\\xdbd\\xc7kx\\xb4x\\xb4=\\xb2b\\xb8b\\x87\\xd2\\xfc\\xce\\xf8\\x01\\xe9\nht\\xbf\\x06\\x80\t#\"#\\xf0\\x9b\\xab\\xffm\\xe4\\xe6v/\\xb1\\xc81\\x07\\xe9\"\\xa4y\\x83\\x96^\\xf5kb3\\x90\\xd8d/uxde\\x84\\x92w\\xde\\xec\\xb8x\\xe6\\xf0\\xff"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a6\\x8b\\x8a\\xd1\\x11\\xfeb\\xc1\\xf6~1\\xb2\\x11gu\\xbf\\xe7\\x1azoq\\xf4^c\\x82\\x89aj\\x8fl\\x02\\xd4b\\xe6\"\\x1f\\xa0ox\\xec\\xd7\\xd5\\xb6?\\x01\\xd2\\xd8y\\x80p)\\x08\\x802(\\x8a6h\\xaf\\xf9\\xf4\\x0czz\\x92@\\x99\\xc6\\x0b\\xa0z\\xb7j$&y\\xb6\\x08c\\x8f\\xafb\\x90\\xb3n\n\\x7f\\x8f\\x8en\r\\x1f\\xe5\\x00d\\xd0p\\x8a\\x16\r\\xc0\\x93\\x93'\\xc8~\\x1d\\x97@%j\\xc28\\xca\\x84j\\xf1m\\xb3\\xc02\\xc2\\x99g\\xacz\\x975\"\\xa9rf\\xd2\\xb1\\xc6\\xd9 sc\\x9f\\\\x97\\xc0&\\xea\\xbb\\x1b\\xe7\\xfe\\x9ed\\xed&\\xb0\\xec\\xbc`\\xdb\\xfb\\x17\\x14!\\xf2s\\xe9\\xca\\xce\\x15od\\xd0\\xfb\\xe1*?\\x83\\xcf\\xcd*^o\\xb1&\\xdc-\\x8bc+\\xea\\xea\\xc0j\\xa3q3\\x1b\\xd5c%q>\\\\xcc\\xc3\\x94$\\x0e\\xf3\\xbc\\xa4k\\xe9\\x88\\xd8\\xc4k\\x84eeu\\x9a\\x1a\\x19\\xef\\x08|\\xef\\x94)v\\x12\\xeae\\x8ep5\\xb8\\xc4\\x0f\"f\\x95'y\\x99\\xb0\\xddr)"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\x08y\\xea\\x92p\\x1c\\xa2\\u\\xb54;\\xd36_lf\\xc5\\xb6\\x88\\xe4\\x0b\\x8d\\x95\\xa4\\xce\\xe2\\x14e\\xf0\\x07\\xaa`d\\xb1\\x01^\\\\xa8\\xf8a\\x95ts\\xb8\\xc23na\\xe4\\xed\\xa9\\x04l\\xde\\x10\\x06\\xe3z\\xd3\\xe3:0\\xa4n\\x90\\x90aa$\\x8d\\xd9\\xc9\\x00\\xf0\\xe6\\xa2\\xa1b\\x8bt\\x84\\xc1a\\x97\\x03\\x8f\\x0f\\xa1\\x93\\x8b\\xae\\xf7$\\xd3\\x05\\x8a\\x19\\xdc\\xd4\\xdb\\x8esu\\x03v\\x8a\\xc4\\xa7!k.\\xec\\xdbmn\\xa8\\x84\\xf9u\\x18e\rvg5\\x8d\\xbf\\xb1b1\\x8ct\\x19\\xe7.\\x1d\\x0e\\xd5\\xa1$\\xd8\\xa1\\x80m\r\\x98\\xcd\\x90\\x13\\xaf\\xc0t\\x9aku\\x80\\xa6\\x86\\x19\\xe8;\\xe12\\xe5\\x12\\xff^\\xabk\\xf2$1/x\\xe6\\xe8\\xa8\\xd8n6`dh\\x9c\\xec<\\xf8\\xaf\\x97\\xe3\\xee#?\\xe7\\xec\\xd76a\\xbc\\x01\\xfa\\x01\\xc4^b\\xf5\\xd8\\x14b`2\\x07\\xa7\\x96c\\xb9ca%\\x11\\x86(\n\\xaa\\xb6\\xc5\\xf9\\xfe\r\\xda\\xf9t\\xa9\\x8a\\xa5\\xae\\xe9h\\xd9\\x1e#\\x18\\xba"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xcdq\\xbfw\\xc9\\xe1\\x11\\xf2\\xf9\\x88\\x1a\\x81\\xf3\\xaf\\xb0\\xdd8\\xb3\r=\\xf35\\xb1>\\x9e\\xc5\\x9e\\xcf\n\\x87\\xea\\x9a\\xb1\\xf9\\xb0\\x1b\\xce\\xfa\\xfe\\xd7\\xf5\\xea\\xe0\\xde\\x03\\x1fhj\\x03zb\\x14(9\\xbf\\xf0\\xb4\\x05e\\xa0x\\x08\\x9c7\\x88\\x84\\xf04\\xcbb'\n\\x0ef(\\xc5',\\xecq\\x11>l\\x98$\\xe7\\x8c\\xbc\\x89\\xe0\\xd3\\x05i\\xe5\\x93\\xaa\\xa3\\x9d\\xca\\xde\\\\xafh\\xca\\x19\\x9fh?\\x89\\xc8\\x1c\\x06\\xba\\x18\"\\x99\\x18\\xe7\\x93\\xe2\\x82\\xad\t\\xb1\\x8fc\\xedk;\\xdct\\x8fz^\\x18\\xba%:\\xd0\\xb8`\\xd1\\xa4\\xf7m2\\xaa\\x15\\x8a0\\xbb)=y\\xc3\\xf6\\x96\\x8d.y\\xa9\\xe1\\xb1\\xca\\xe78\\xfdcye\\x96bl\\x12\\xc9\\xb7z\\x10\\xe1o\\xfc\\x8d\\xaf\\x95\\x80\\xaa\\x0c\\xaf\\xfd\\x93\\xc8\\x9f\\xd3xi\\xceu\\x93\\x95\\x06e\\x1a*a\\x15d<\\xc7\\x19~\\x8d\\xe8\\x0f\\xeb\\xc6\\xcc\\xf4\\x88\"g\\xd9\\xc5\\x8e\\x88~t8!\\x0c\\x17\\x98\\xa5\\xbc\\xdel\\xb6\\xbc\\x91\\x7f\\xec\\xf4\\xb9\\x88\\x85|vf\\xac"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010dy\\xc1\\x19b\\xbd\\xc8~q\\xf4 \\xc6\\xaf\\x86\\xb9\\xbd\\xa1+!\\xb5!\\xaf\\x1f)\\x18\\xf1\\x95uq\\xb0\\x1c\\x9d\\xd0\\xeb\\xa3lt\\x97^\\xfe\\x05x\\x9b\\xb8d\\xbbw\\xe0y'h(\\xec\\xee\\x14\\x91:z\\xa3\\x99;(\\x87.\\xc0<\\xbagw\\xf6\\xad\\xd8\\xb4\\xd5l+\\xa0a\\x8ftmj\\xe7g#kt\\x85\ti\\xaf\\xe9\\x04ig?bu\\xe0sk\\xf7\\xfbv07\\x0f\\xfd<\\xf3\\xd2f\t\\xa1,\\xdd\\x07u\\xe5\\x07\\xd6\\x00,b\\x8ey\\x16d\\xae\\x1d\\x1f\\x96\\x93\\x1a\\x07\\xf1\\x1e\\x90u\\x00e\\x1c!)\\xca+\\x80\\x96\\x95\\x16,\\xe7<3\\xc4v\\xe0\\x99#o\\x8f,\\xb7\\x00cd\\xa6\\xd0zt\\xc2+\\x1d\\xf5\\x8c\\x17=\\xb0\\xbeox*\\x8cx\\xe3\\x90$m\\xfe\\x97\\xf3\\x84\\xff\\xa1\\x8f\\xe2p\\xdf\\xc72i\\xfd<\\xb4!fv\n\\xc0\\xb4iqu\"\\x07\\xbfg:i\\x1b\\xbf\\xedg:\\xec4v\\xc2$b\\x91>\\xc3\\xa6\\xea\\xd3\\x85\\x9fh\\x86r\\x8a\\x10\\xc3\\xf4\\xeb\\xcb"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\x9b5^\\xc9;\\xb1\\xab\\x9fi\\xf3\\x8c\\xa0\\xabs\\x06\\xe5_1\\xcd\\xbb\\x08\\xe7\\x1aw\\xc5\\x04?\\xd3q\\x80\\x0b\\xca\\x17u\\xec\\xf5kw\\x050\\xb7\\x84\\xf2\\xf4\\xba~d\\xb6\\xa0\\xd2\\xf4\\x04\\xac\\xd1\\xc2\\xb8yr\\xc2j\\xa9\\xc5\\xe8)\\x04&\\xf1\\x8c\\x86\\xd9y\\x1c\\xf4!\\x12\\x00\\xe3j\\x8cj\\xdbf\\x9f\\xc5\\xd6#\\x1b\\xe4y~\\x9bz\\xad\\x83\\x1dqz\\xe3\\xf7_\\xa3\\x13\\xac\\x01\\xbf\\x96z\\xfa\\xcb\\xbe\\xae\\xf1^\\xf4v2\\x95\\xe94s\\x96\\xe5\\x88\\x99\\xa6\\xc8y\\x80\\xe8c\\xc7\\xe3y\\xc8\\x03\\x8e\\x0b\\x80\\x10\\xaa\\x11\\xbdf\\x16\\x9d\\xe6-\\xcb\\xbc\\xfb\\xa6r\\xcf\\x1f`\\x14ad\\x12\\x88#\r\\x0b\\x95\\xfb\\xf4\\x92\\xf0\\xa8\\x9f+\\xd7\\x01vd\\xf4\\x16\\xa1\\xef\\xec\\xf2\\x8ee\\xe66\"\\x81\\xbf\\xdb\\xe1j\\xb0p\\x02,\\xae\\xc8&\\x8f\\x94\\xb5 \\xdc\\xed'\\xe0\\xdd\\xb8j\\xb8\\x0e\\xaa7p\\xb6\\xfd\\x05\\x1d&\\xb1\\x93o<\\xc1\\x96\\x07\\x10k\\xc0+\\xb0\\x86\\xd2s\\x87r\\xf6\\xe3\\x0e\\xbfe\\xb7|\\xa0"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb+\\xa0\\xa2f\\\\xcc\\x9c\\xc8:\\x1c\\xf0q\\xed\\x115\\xb4f>\\xdd_@\\x82\\xe4=v?r\\xb4\\x83\\xb7\\x1d\\x93c\\x9d`\\x9e\\x9f\\x8f!\\x8b\\x12\\x81\\xad\\x9c\\x9f\\x9eh\\x88\\xa3\\xab\\xc2\\xd6\\xffw\\xa7\t\\x9c\\xc1\\x14\\x15@\\xc6\\xa6\\xe2\\x82\\x9f\\xeb\\xfb/t\\xa2\\xe8m\\xce\\xbe!\\xc6\\x17zezu\\xc1\\x0c\\xa9\\x0b6\\x8ea\\xb0\\xfa\\x84\ts#\\xcd(\\x07\\x8e\\xed\\x15i\\xb8\\xd3\\x88k0\\x9b\\xaf\\xd2\\xcd\\xa9y5\\x01\\x01\\x02\\x9e\\x80na8#\\xf8b\\x9a~\\x1e\\xbdd\"ui\\xaa'\\x06\\xa9\\xe6\\xa9\\xfa\\xb9\\xaa\\xec\\xbb\\xdcn\\xe4\\xcc\\xf1y\\xc6\\x81nq\"\\xfci\\x86)\\xdd_^\\xe8\\xdf\\x18\\x96\\x9d\\xe7$>'\\x96w\\x8f\\xed\\x15\\xba4pua\\xb9\\xc6-\\xbe\\x12\\x02j\\x17\\x01oyz\\x1b\\xcave\\x89\\x13\\xd7\\x03\\xaf\\x12\\xa2&)\\x82m\\xd4fz\\x17\\x90\tn\\xa8\\x83b\\xfa\\xa6,u\\x91\\xe1\\x8f7yt\\xe8\\xf1zzyw\\xe6w\\xf5\\xb1\\xe7\\xe2\\xfa\\x86\\xa3v\\xd0\\x8aw\\xdd."
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9fw)\\x11\\x13\\xb6\\x98\\x89iwa\\x02\\xe5\\x9ej\\x1e\\xe2\\xaf\\xe9\\x14\\x97\\xb8v\\xb2\\xe1\\xec\\xe9\\x96\\xe6\\xe6-\\xefgf\\x8c9\\xe1\\x9f\\xd0\\x96.\\xa3\\xac\\x03\\xb0\\xfbeo\\xfe\\xd5l\\xfcx\\xa09\\x8b\\x1b\\x12\\x11\\x82\\xc9\\xb5l\\x98a\\x16\\xb4f\\xc4\\x0e\\x19\\xad.\\x90\\xab\\xc2\\xd4\\x00\\xeea\\xab w\\xe1\\xc7\\x8f\\xb9\\x18\\x90)2\\xc9\\xc1\\xbd\\x00a\\x95\\xbf\\xe4k\\x1c$\\xa44\\x048a\\x81\\x9f\\x15/\\xa3\\x9f\\xcb\\x86fs\\xaa@_ni\\x17ua\\x1d)'q\\x0c\\x1e3qt\\xc4\\xc3i\\xfeu\\x9fzl\\xe3\\x13\\x19\\x93\\xffq%\\x88\\x88\\xf15\\xef\\xc44\\xed\\x84qq\\xd9\\x9f`v*\\xa3o\\xe6\\xca\\x1b~c\\xce&5-\\xc1sd\\xd9\\xae6\\xdb+\\xab1\\xa2k\\xbc\\xf0\\xb1\"\\xc4\\xdb\\xcb\\x82qy\\x936w\\xc8\\xf9d\\x914\\xd8q\\xcf\\xc3\\x8arx\\x8ak\\x17\\xa0\\xb2\\x17i\\x12\\xe4\\xb5\\x1fs\\xd0\\x8a8\\xee\\x1b<+\\x12b\\xb4\\xffp\\x06\\xd3&\\xe1\\xc5\\xe0\\xe2e`\\xb3\\x1e\\x08"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\x8c,\\xde\\x84v\\xb1\\xd8\\x82- \\xf3\\x18\\xa2\\xc7\\xab\\x00\\xdc\\x9f\\xc77\\x10\\xa65\\xe9po\\xeb\\x07\\xf9\\xdb\\x14r\\xe1g\\xd1\\x88\\xcf\\x86\\x8e\\xb0\\xa3\\xb9s\\x80\\xce\\xc5\\x91'\\x10\\xf2\\xac\\xcek\\x9bl\\xda\\xedg\\x19\\xaet\\xca\\xcfx\\xdd\\xe3\\xe30\\xa9\\xd4\\x8b\\xdc*\\x96*\\xf0\\x83\nb\\xc4\\xfb\\x1c\\x12\\x9a\\x8a\\x04\\x8e\\xe0\\x1f\\xa9\\x986\\x8c\\xfe\\x7f\\xaa\\x84ak\\x9d\\x9b\\xe1\\xf7\\xa2e\\xa6x\\xf0\\x7f\\x95\\xca\\xd3%\\x89\\x80\r\\xc6\\xc3`\\xafa,-\\xc0\\xb2\\xe5\\x13 t.y\\xac\\xa8cw\\x95\\xf7\\xfbs\\xaa\t\\x91\\x91yj\\xd2\\xb2\\x89\\x92\\x08\\x8ebn\\xe9\\xc7\\xb6\\x7f\\x17/\\x197\\xe2\\xc3\\x0c\\x98y3\\x1c\\xdc\\xb3\\xe5\\x05\\x17\\xb5\\xcb\\xd8\\xdf\\x8b\\x7f\\xec\\xb6\\xd9\\x14\\xc4\\xa8\\xcc\\xc8\\xd4a\\x19\\x7f\\x0b\\xb5\\x12<\\xee\\x901\\xc3\\xf0zl\\xa2\\xb08\\xff\\xbf\\xa8\\x99p\\xbep,-\\x7f\\x0b\\x96\\x1b\\xe0\\x01\\xd7\\x0b\\xa8\\xb8\\x8aj\\x10^\\xa1.\\xb7\\x900\\x85\\x844\\xc6\\xb3\"j#s\\xf2c\\x8e\\x0c\\x1a\\xea"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010/p\\xea3\\xf9\t\\xa6\\x88xwj`\\xac\\xcb\\xa1\\xfe\\xd1\\x91\\xad\\x0bs\\xeej\\xcb\\xc3\\xb3?l/6\\x8a\\x883d\\x99\\x1c+\\x08\\x84e\\xa2\\xcaug!\\xc3\\xaf~\\x88\\x93|\\xbb\\x1a!b\\xee>f\\x1c\\xfe\\xb9!a\\xd5\\xe9)t\"\\x9f\\xbdso\\x11\\x1c\\xb3r\\xd2c\\xfd\\x1bb\\x15\\x0f=\\x8f.\\x13jq\\x97\\xe0\\xf69h`tdn\\xdb!7\ns\\xad+@\\a\\xce\\xf8\\xf5\\x02\\x82u\\xba\\xb6\\xe4;\\x92\\xe76m<\\xd2\\xa9j\\xd7\\x9fo\\xcf_\\xfe\\xe1\\x08+\\xf1\\xd7&.\\xc6j\\x8f\\x92r\\xe7/a\\x0fl\\xdfv\\x07(c\\xea\\xf4-(&84\"\\xdc\\x8cu\\xd3\\x18j\\xc7\r@\\xc1\\xb2\\x9f\\xdf72\\x00\\xf6\n\\x92-\\x15\\xd8%\\xeap\\xce\\x0b:3u\\xa9 \\xf2\\x98l\\xc3.\\x14\\xab\\xe7\\xb4\\xb6\\x08\\\\xbf\\x1d?\\x8e\\xb9z\\xa5\\xa3xm\\x858p.0\\xc2\\xb44\\xfd\\xbcb\\xe1\\xdc^:\\x04\\x00\\xb1\\xd4^\\xf8%y\\xa1\\xff\\x02rd\\xfe8"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00r5m#t\\xe3\\xa6\\xd2\\xf3\\x8bk\\xbac\\xd8ez\\xd3')\\xe4z\\x8e\\x93\\x05x\\xe6\\xf0\\x94\\xd5h\\x8f\\xcf\\xd4\\xed#3ecj\\xea\\x1cp\\x81m\\xa5\\x84\\xf9d\\x16\\xd8\\xec\\x87\\xcah>a\\xad=\\x1f\\x8ar\\x0bf\\x1a\\xde\\xa2z\\xa5\t\\x8b>\\x8a\\xd2\\x16\\x05\\xbd\\xb3 \\xfc\\xf7z\\xab\\x1a67\\xfb\\xd8\\xed,\\xf4<\\x81(a\\x1b\\xd1\\xe9\\xb5m\\xc0\tz\\x01f\\xddc<.\\x93\\x80\\x00\\xe5s\\xd4mqq\\xa9\\x0e\\x07\\xbaku\\xd0\\xe1\\xf3\\x96\\xb3\\x0b\\x9ctr\\xa8\\xd1\\xc9\\xaeq\\x08\\xec\\x95\\xd31z\\xd38\\xb0'eee\\xbe\\xb1\\xa2$\\xd9\\xad\\x9e\\x1e\\xa3w\\xf4.@ru\\xf6\\x8a\\x9bm\\xc8\\xb8\\x8b6\\x17^$\\xc0\\xe5l\\x10eo2\\x1d\\xac\\x054\\xc0h:~\\x9c\\xa7\\xcc\\x07\\xb1\\xdci\\xe9\\x08\\xb3\\x1e\\x8eb\\x18\\x7f\\xcf\\xe4\\x1aor\\xeca\\x92\\xd7\\xa8\\xab_\\xd1\\xcfj\\xe240\\xb9su\\x94\\xa7\\x7fs\\x84u~iad\\x1fkiv\\xb6\\x82n\\xc4\\xf2\\x9b"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\xee\\xca\\x1e\\xc3\\xae\\xca\\xd3t\\x0b\\x0f?&\\x07\\x18\\x83nb\\xb4\\x1b\\x9d\\x1e|\\x169\\xd3\\xf3\\xb6g\\x81\\x04\\xf5\\x9ab\\xca\\xc5\\x19\\xc7\\xce\\xe7\\xden\\x90\\xffx\\xc5\n\\x1cd\\xb9\\xd6wv4\\xd4cfg\\x88\\x89\\xc9\\x88\\xc7!\\x80\\xec\\xee\\x94\\x0ed\\xdf\\xe86g\\x10\\km\\x80\\xf8.\\xa5<l\\x0f\\x96\\xf1w!s\\xc7\\x8b\\xf5ib\\xcd\\x95aqn\\xcct\\x91\\x893\\xac\\xa5\\xf5\\xde\\xfa\\x86\\xea\\xcf\\xdb\\x06*\\xbd\\x1d\\x9d!\\xfa\\x8d\\x01\\x10\\xcf?-\\xa7\\x95\\xec\\xf9\\xf0l/\\xde2n7\\xe1\\xc2za\\xb9\\xc3\\x1f;$e3\\x10\\x07\\x1f\\x05^\\xb9\\xfbc\\x9e\t\\xf8z?\\x8eq2\\xd1\\x86\"\\x19\\xd9\\xcf\\xdbh\\xe5\\xf0\\xc9\\x0cf'u\\xe2\\xb1\\x0c\\xb7\"\\xf3c\\x1c#\\xe3\\xe7h\\xeev\\xe0q\\xb5\\xcc7\\xbc\\xcf8\\xa3\\xdc\\xe5wv\\x95\\x06\\xed\\x9fj\\xb92\\xe0s\\xb8r\\xdf\\x17z\\x00\\x08\\xee \\xb4\\xed\\x93r0\\xc5\\xeas\\x908\\x9e\\xbe\\xe6/\\x1b\\xb6\\xc5\\xf6o$\\xdc"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z\\xe7z\\xa8\\xd4j\\x0f\\xd1\\xee\\xc1\\x0bubc\\x11\\x14\\xda)\\xe2?\\x11\\xf4\\xbbw\\xd0\\x06\"\\xf0\\xda!\\x1f\\x94t`\\xe7\\x9bn\\x95t\\x07n\\x01\\xb5\\x98\\x8e\\xd0\\xbfn\\x99>\\x04\\xb7p\\x9e\\x18\\xfb\\xf8\\xf5\r\\xdb\\x82\\xc7\\x0e\\xa1~\\xe7b\\xb5)u\\xfbm\\xf7\\xef\\xb4\\xe0x\\x19!@\\xaa\\x89\\x0b\\xa0\\xc7\\xdb\\xe9(e?\\x7f9\\xdd\\xea\\xf4z\\x94\\xc1h4\\x07\\x88\\x8cb`\t\\xca\\xcb\\xe6r\\x08\\xbb/\\x8f\\xbbc\\x9c\\xa8\"@r\\xe1\\xff\\xf1\\x0ckxs\\xae//\\xe7w\\xbek\\x90_'\\xb1\\x12\\x0f\\x0el\\xa6\\x08\\xe1\\x7fp\\xcf\\\\x9b;\\x9fw\\x9bc\\xa5\\xa6\\xcf\\xaa+\\xe0c\\xfb|u\\x81\\xe1'\\x84=\\xc5\r\\xb8\\xb3<rq\\xb7\\x83\\x9d\\xd8w\\xf7z%k\\x82\\xfe\\x17\\xaf0q\\x13\\x0b\\xfd\\x01\\xba\\xf4\\xed\\xc5 \\x10k\\xaa\rsb\\xc3\\x88\\x93\\x0cd\\x90w\\x84\\x90\\x98\\x1e\\xc9\\xcb\\xa7l\\x0f\\xb3\\x98)\\x11\\xdd\\xc4h\\xc1\\xcb\\xd8\\x94u\\xb3d0\\xdf\\xb3\\xad\\xd7(\\xd4o\\x1a\\x9c"
  748.  
  749.  
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6g\\xfc\\xc0\\xd7d\\xf8\\xcc\\xa9\\x08l\\x92\\x94_\\x18\\xacr\\xf6\\xf7+\\x96\"\\x07\\xc2\\xcbu\\xf8\\xcbk\\x07q \\xeb\\xd0(\\x91\\x9e\\xb4u=nb%\\x0c|\\xd4\\x16a\\xd7p\\xd3s\\xcdg\\x8d|\\x98\\xe3\\xc8\\xb6xb\\xbdg\\x9a3p8|0\\x9e\\xb0\\x1c\\xa7\\xbf\\x9e\\x910\\x14\\x172\\xb5\\x9d\\xa7\\xc9q\\x16\\x0c\\xcc*ol#n\\x7f\\x0b\\x84\\xa8y\\xcb\\xfa\\xc7*\\x9b#\\xde\\x15\\x08\\xd9\\xe4tn\n\\xf5aow#s\\xa0#ld.\\xbe\\xb5f7\\xde\\xd9\\x02\\x9f\\xd8\\xb5\\x03\\xf6iw4\\xe2\\xe9\\xc7\\x846b,c\\xe4\\x01\\x19l\\x9e*u>0\\xe7\\xbb\\xf2q\\x962\\xe3v\\xea\\xba'\\xb6\\x1e&\\xaa\\x89\\xb4zen\\x07pgl%y\\x19\\xe9\\xec\\x88\\x8f\\xa8\\x03\\x93b$k\\x9f!\\x8f\\x94\\xb5'gml\\x9d8m-\\xc1\\xb6\\xa2u\\xfdo\\x0e\\x04\\x1dqx\\xffi\\x9f=@\\xe5g%\\xcc0\\x8f\\xe4\\xcf\\xed\\xaf\\x97s\\xcc\\xddfc\\xc7\\xa4\\x8b\\xfa\\xfb\\x0f\\xe7;\\xf4"
  751.  
  752.  
  753. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\xc5,9\\x02\\x0c\\xc2\\x1d\\xbb|\\xa4\\x14\\xc4\\xc5^mk\\xda\\x94\\x048\\xf5\\xae\\xaa\\x03h\\xbc\\xe4r(\\xaf\\x92\\x1bj\\xaf\\x06\\x0b_\\x1f\\x8d\\xd83\\xa9\\xc7\\xdf\\xc6\\xf1`y\\xfe\\xf4:\\x8c\\xc0l|ag\\x13$\\xc7e\"\\x05h^\\xb0\\xad\\xfd\\x04\t\\x8a\\xf7\\x96\\x1c\\xba\\xb5\\xect\\xf2|y4\\x07\\x01\\xf3=\\x8b\\x1b`c\\xa2\\xa4\\x9a\\xe9\\xff\\xe3\\xa9\\xa8\\x0e\\xb8glh\n\t\\xf02&jfc\\xcd\\x12<j\\x9e\\x87_\t\\x9d\\xa2=s\\xcdb\\x7f\\x88\\x84\\xf4ry\\xd2\\x043\\xd4\\xaa\\x8a2\\xa4rv\\x9d\\xd2\\x946\\x8am\\xb0\\xba\\xa1\\x00\\xddg\\x13\\xa8\\x1f\\x17\\xc8e\\xbfd\\xc6h\\x98\\xc4/\\x16\\xae\\xb1\\xfd\\xd4\\xdb\\xd6\\xcf\\xba\\xf8c\\x84\\xd4\\xecs-0\\xe9\\xdc=5\\x7f\\xda(jn\\xdc6y\\x17u\\xae5\\x9b\\x0c\\x17\\x12\\x859gb\\xb6!\\x10\\x9b\\x11\\xe2\\xe7\\xbc\\x10\\x97\\x90\\xf1t>\\xc6\\xc4\\x9cq\\xf6\\x87\\xefe\\x0f\\xaeg\\xdb\\x0c\\x19w\\xbb\\x96\\x92*qq\\xd3\\xa75\\xd7"
  754.  
  755.  
  756. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:\\xbel\\x8bq\\x0c\\x08po\\xd5\\xcc\\xf5\\xacxo\\x80/\\xfe\\xbf\\x9e\no\\xab\\xc6\\x16\\x9c!m\\xc0\\xed8\\xfe\\x01\\x94p\\xd3:\\xeaxf\\x06-e\\x90%\\xd5\\x9awt\\x8di\"\\x15\\xd3\\xf3\\xd6u\\xec\\xcd\\xe1vt\\xaa-um\\xbf\\xb2\\x81=\\xca\\x03>\\xc3\\xd0'\\xcb\\xe6\\xf8b\r\\xa4\\xca\\x1f\\x16e\\xc7\\xea6\\xab\\xc74\\x98\\x9b1\\xf2\\xb8\\xea\\xe6\\x8e\\x00r=\\xab~\\x8f\\xf1\\_^\\xc0o`\\xb3?\\x8d\\x86\\xc6\r\\xca\\xd1\\xf9\\x89\\xdd\\xc1\\x88*\\xa3\\xa0|\\x0cj=\\x17@\\x0e\\x8e\\x0c\\xad\\xddk\\xc5\\xf2\\xcd\\xabh\\x1c\\x1ca\t\\x92\\xd0\\xa3\\x11\\xe7\t\\xc5r/)al^\\x18sd\\xc3\\xd9\\xaci.\\xce\\xcdq\\xa2\\x1dv4\\x8eq*\\x04\\xbf\\x8c\\xff\\xc7i\\x93y\\xf3\\xf6\\xba\\xbb\\xcc1d\\x9doc#\\x04\\xaby\\xd1\\xb1\\x00\\x02\\xf9\\xbdx\\xde\\xa6\\xed\\xb0\\x0c\\xe5\\xbf\\xc3gw\\x0fa\\xbe\\x08|\\xc9x\\x1a'\\x08\\x0cg\\xf8;\\xa4\\x85\\xd4\\xa2\\xad\\x9avp8o\\x83\\xe4"
  757.  
  758.  
  759. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2\\xddv`\\x848r\\xfd%de\\xb5\\xfd\\xd9\\xa1\\x10\\xd0\\x96/8\\xd6\\xad\\xe3\\xcfpfq\\x81a\\xf1\\xb4\\xb5\\x01wi*\\xf8\\xb8\\x07\\x8c(;\\xcfu\\xec#\\x8c\\x80v>\\xf4\\xa3.\\xff\\xd2f\\x02\\xba\\xb8\\xd6c^\\xd0\\x00\\xb56\\x87\\xb8\\x14\n\\x94\\x0e\\xfd3 ch\\xca\\xa17\\x06\\xedxw\\xf3`%b\\xb2i\\xbfm\\xda\\x8fn\\x93\\xf3\\x12w\\xd9\\x19\\xaea\\xcbx\\xdden\\x10z\\x94\\x0e\\xfdh\\xe7\\x17\\x804\\x8f\\xd3\\xd5\\xf6\\x1f\\<\\x9f\\xe9\\x04\\xc0+\\x1e\\xca\\x90f\\xe9\\xcb\\x94hm\\xe0\\xaa\\xb4\\xce\\x02\\xab%\\xc1(\\xe5\\xd1\\x887\\xa1\\xb7,\\xc3gc\\xecs\\x8bg\\x01.9s\\x99\\x19\\x16\\x9f\\x19\\xb6\\x9d=\\xb8h\\xa6%\\xf9,|h9\\x97o\\xf9!_v\\xf5i;\\xb3\\x1f\\x9c\\x90\\xe4\\xaei\\x95\\xdc\\xe6\\x87kcc\\xfd\\x84mb\\xf4\\x19\\xef\\xe7\\x9a\\xcf\\xc4\\xce\\xe7j\\xd2\\xe3\\xa4\\x1dei\\xc0\\xf6\\xe3\\x93t\\x8dr\\xe1l\t\\xc5\\x89|\\xea;"
  760.  
  761.  
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\t\\x94\\xa4\\x89ho\\x89\\xf9\\xac\\xedqb\\xc0\\xfb;\\x93%\\xd9\\xa9\\xe5mys\\xc3\\x89($\\xcd?yd;\\x9b\\x01\\xb8\\x08\\xbc\\x90\\xd7h\\xf4\\x1dn\\x05v\\xfb\\x9d\\x04\\x901\\xa2un\\x85r\\xb8\\xb8\\xe9\\xf4;\\x8at;,m:\\\\xff\\x98\\xb8z~\\xf7\\x96d\\xe8&\\x1ao\\x9c\\x1bbc\\x89r\\xc5\\x06\"v\\xd4\\xd5\\xa1(ui\\x1b\\x04\\xb2\\xe6g\\x07\\xfba\\xa6m2\\x85\\xea\\x96\\xc5\\xbd\\x12.\\xbfh\\x1e\\x89\\xcb\\x14\\xa9\\x80\\x7f\\xa8e\\xa2\\x16\\xe2\\xb5e\\x88\\xb8b9h&b\\xf3\\xc7\\x82\\xb9\\xe7r\\xf6v\\xeaou\\x81\\x18\\x19\\x88\\xa4\\x81w\\x7f0\\x88i:\\x81<\\x15\\xf6)\\x98\\x83<\\xbc\\xfch\\xa3\\xffo\\x08%9\\xd9\\x05\\xb8\\xc1\\x1d\\x05\\xcc\\xbfj\\x13k\\x15\\x9ab)`s\\xa6\\x0f\\x98\\x87\\xcd\\x15\\x1ar\\x08h\\xe0\\x8c1\\xaa\\xf2\\x0fn_4\\x84\\x1ep\\xfa\\xa8\\xe1w\\x9d\\x15\\xfc\\x95\\xc3*\\xcez\\x93\\x9af\\x80\\x97\\xca\t\\x87nc\\xa9%\\x93\\x1a\\x00\\xd0m\\xfb\\xf2\\x00,"
  763.  
  764.  
  765.  
  766.  
  767. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  768. "Details":
  769.  
  770. "office_dl_write_exe": "winword.exe_URLDownloadToFileW_c:\\users\\user\\appdata\\local\\temp\\ftpxwin-sctned.exe"
  771.  
  772.  
  773.  
  774.  
  775. "Description": "Installs itself for autorun at Windows startup",
  776. "Details":
  777.  
  778. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bT3NEfMGHNBatch58.vbe"
  779.  
  780.  
  781. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\__tmp_rar_sfx_access_check_29859359"
  782.  
  783.  
  784. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bT3NEfMGHNBatch58.vbe"
  785.  
  786.  
  787.  
  788.  
  789. "Description": "File has been identified by 18 Antiviruses on VirusTotal as malicious",
  790. "Details":
  791.  
  792. "McAfee": "Artemis!C51001EE58B0"
  793.  
  794.  
  795. "K7AntiVirus": "Trojan ( 00536d111 )"
  796.  
  797.  
  798. "K7GW": "Trojan ( 00536d111 )"
  799.  
  800.  
  801. "Symantec": "Trojan.Gen.2"
  802.  
  803.  
  804. "Kaspersky": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  805.  
  806.  
  807. "AegisLab": "Trojan.MSOffice.SLoad.a!c"
  808.  
  809.  
  810. "Endgame": "malicious (moderate confidence)"
  811.  
  812.  
  813. "TrendMicro": "HEUR_VBA.O2"
  814.  
  815.  
  816. "McAfee-GW-Edition": "BehavesLike.Downloader.ml"
  817.  
  818.  
  819. "SentinelOne": "DFI - Malicious OLE"
  820.  
  821.  
  822. "Microsoft": "TrojanDownloader:O97M/Donoff"
  823.  
  824.  
  825. "AhnLab-V3": "VBA/Downloader.S30"
  826.  
  827.  
  828. "ZoneAlarm": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  829.  
  830.  
  831. "TACHYON": "Suspicious/W97M.Obfus.Gen.1"
  832.  
  833.  
  834. "Zoner": "Probably W97ShellA"
  835.  
  836.  
  837. "Rising": "Downloader.Agent/VBA!1.BA26 (CLASSIC)"
  838.  
  839.  
  840. "Fortinet": "VBA/Agent.DQG!tr.dldr"
  841.  
  842.  
  843. "Qihoo-360": "virus.office.obfuscated.1"
  844.  
  845.  
  846.  
  847.  
  848. "Description": "Drops a binary and executes it",
  849. "Details":
  850.  
  851. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\FTPxWIN-sctned.exe"
  852.  
  853.  
  854.  
  855.  
  856. "Description": "Martian Subprocess Started By Office Process",
  857. "Details":
  858.  
  859. "office_martian": "c:\\users\\user\\appdata\\local\\temp\\ftpxwin-sctned.exe"
  860.  
  861.  
  862.  
  863.  
  864. "Description": "The office file has a macro.",
  865. "Details":
  866.  
  867. "content": "The file appears to have no content."
  868.  
  869.  
  870.  
  871.  
  872. "Description": "The office file created a suspicious child process.",
  873. "Details":
  874.  
  875. "Processes": "WINWORD.EXE -> FTPxWIN-sctned.exe"
  876.  
  877.  
  878.  
  879.  
  880. "Description": "Created network traffic indicative of malicious activity",
  881. "Details":
  882.  
  883. "signature": "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"
  884.  
  885.  
  886.  
  887.  
  888.  
  889. * Started Service:
  890. "osppsvc"
  891.  
  892.  
  893. * Mutexes:
  894. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  895. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  896. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  897. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  898. "CicLoadWinStaWinSta0",
  899. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  900. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  901. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  902. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  903. "DefaultTabtip-MainUI"
  904.  
  905.  
  906. * Modified Files:
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_c51001ee58b01a5d503953bee84dfe70.doc",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF08722F683B6B7767.TMP",
  909. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_c51001ee58b01a5d503953bee84dfe70.doc",
  911. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS036F80F5-4DDB-42CB-BF79-7A480B5CCAD2.tmp",
  912. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  913. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  914. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF46E07AE2-4781-4E6C-808D-B7462FEF6F48.tmp",
  915. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  916. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab209A.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar209B.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\bT3NEfMGHNBatch541.exe",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab477E.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47CD.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47CE.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47EE.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4947.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4967.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D5.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D6.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D7.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49E8.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49E9.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FA.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FB.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FE.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A10.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A11.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FD.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FF.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A0F.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FC.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A51.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A81.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C27.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C77.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C78.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C88.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CC9.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CCA.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CB8.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CDA.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CEB.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CFC.tmp",
  953. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  954. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EB2.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F4F.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50E7.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5108.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50E8.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5109.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab513A.tmp",
  962. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  963. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar510A.tmp",
  965. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab51A9.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51AB.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51BC.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51CC.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51CD.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar513B.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cab522C.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cab525C.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar51AA.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5368.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5378.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C7.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD525D.tmp\\RadialPictureList.glox",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\cab54F6.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD525D.tmp\\Content.inf",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53E8.tmp\\content.inf",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53E8.tmp\\Droplet.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\Crop.thmx",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5476.tmp\\gostname.xsl",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5477.tmp\\rings.glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5437.tmp\\chicago.xsl",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5638.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5517.tmp\\InterconnectedBlockProcess.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B5.tmp\\mlaseventheditionofficeonline.xsl",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\iso690nmerical.xsl",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5476.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5477.tmp\\Content.inf",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD567C.tmp\\Headlines.thmx",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B5.tmp\\Content.inf",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5517.tmp\\Content.inf",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5788.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5659.tmp\\HexagonRadial.glox",
  999. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BC.tmp\\Element design set.dotx",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5636.tmp\\content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5635.tmp\\Equations.dotx",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5808.tmp\\content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD565A.tmp\\architecture.glox",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566B.tmp\\content.inf",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5659.tmp\\Content.inf",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5634.tmp\\content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5798.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566C.tmp\\content.inf",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BC.tmp\\Content.inf",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5613.tmp\\content.inf",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B9.tmp\\Banded.thmx",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5808.tmp\\Savon.thmx",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566B.tmp\\Parallax.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5635.tmp\\Content.inf",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5437.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD567C.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5637.tmp\\ieee2006officeonline.xsl",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5991.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD565A.tmp\\Content.inf",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5636.tmp\\Metropolitan.thmx",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5613.tmp\\Quotable.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5942.tmp\\gosttitle.xsl",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\ConvergingText.glox",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566C.tmp\\Dividend.thmx",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BC8.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B9.tmp\\content.inf",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5942.tmp\\Content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5809.tmp\\ThemePictureGrid.glox",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADB.tmp\\VaryingWidthList.glox",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5637.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5634.tmp\\Frame.thmx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C85.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D64.tmp",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B68.tmp\\chevronaccent.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E31.tmp",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B79.tmp\\iso690.xsl",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B79.tmp\\Content.inf",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADB.tmp\\Content.inf",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\Content.inf",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA6.tmp\\BracketList.glox",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C75.tmp\\ThemePictureAccent.glox",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cab604A.tmp",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5809.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B68.tmp\\Content.inf",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D54.tmp\\Badge.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA7.tmp\\Basis.thmx",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D94.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E72.tmp\\TabbedArc.glox",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E52.tmp\\CircleProcess.glox",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3E.tmp\\content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E52.tmp\\Content.inf",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62BE.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FBC.tmp\\gb.xsl",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FBC.tmp\\Content.inf",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA6.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab638A.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C75.tmp\\Content.inf",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6418.tmp",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D54.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61E1.tmp\\Berlin.thmx",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6543.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA7.tmp\\content.inf",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E72.tmp\\Content.inf",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3E.tmp\\View.thmx",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD627E.tmp\\content.inf",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar639A.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66FB.tmp",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6533.tmp\\Feathered.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61E1.tmp\\content.inf",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD627E.tmp\\Slate.thmx",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\content.inf",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6788.tmp\\content.inf",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6533.tmp\\Content.inf",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\Mesh.thmx",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6788.tmp\\Damask.thmx",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AB6.tmp\\Circuit.thmx",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AC6.tmp\\Insight design set.dotx",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BA2.tmp\\content.inf",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C21.tmp\\content.inf",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BF1.tmp\\sist02.xsl",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C32.tmp\\pictureorgchart.glox",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C34.tmp\\PictureFrame.glox",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C75.tmp\\ThemePictureAlternatingAccent.glox",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AB6.tmp\\content.inf",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C33.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BA2.tmp\\Vapor_Trail.thmx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C97.tmp\\turabian.xsl",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C35.tmp\\APASixthEditionOfficeOnline.xsl",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C21.tmp\\Wood_Type.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C45.tmp\\harvardanglia2008officeonline.xsl",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BF1.tmp\\Content.inf",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C86.tmp\\content.inf",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C32.tmp\\Content.inf",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AC6.tmp\\Content.inf",
  1137. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C35.tmp\\Content.inf",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C97.tmp\\Content.inf",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C33.tmp\\Content.inf",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C45.tmp\\Content.inf",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E8C.tmp\\TabList.glox",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C86.tmp\\Main_Event.thmx",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E8C.tmp\\Content.inf",
  1151. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1152. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1154. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1159. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3E2573FA-E03F-4296-9913-68109A95C02B.tmp",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\__tmp_rar_sfx_access_check_29859359",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bT3NEfMGHNBatch58.vbe"
  1162.  
  1163.  
  1164. * Deleted Files:
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab209A.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar209B.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1168. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab50E7.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5108.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD525D.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar50E8.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar510A.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53E8.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab513A.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5437.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5477.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5476.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab51A9.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar513B.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5517.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar51AA.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B5.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5613.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5636.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5634.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5635.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5659.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD567C.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566B.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BC.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566C.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD565A.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD525D.tmp\\RadialPictureList.glox",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD53E8.tmp\\Droplet.thmx",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5808.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5809.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C27.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B9.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51CC.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5517.tmp\\InterconnectedBlockProcess.glox",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5476.tmp\\gostname.xsl",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\Crop.thmx",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5942.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5788.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5477.tmp\\rings.glox",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD567C.tmp\\Headlines.thmx",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADB.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4947.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD56BC.tmp\\Element design set.dotx",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5798.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B5.tmp\\mlaseventheditionofficeonline.xsl",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566B.tmp\\Parallax.thmx",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B68.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FA.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B79.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD566C.tmp\\Dividend.thmx",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5635.tmp\\Equations.dotx",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51CD.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5659.tmp\\HexagonRadial.glox",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5613.tmp\\Quotable.thmx",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5636.tmp\\Metropolitan.thmx",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C75.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5808.tmp\\Savon.thmx",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5437.tmp\\chicago.xsl",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA6.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA7.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5942.tmp\\gosttitle.xsl",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51AB.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5634.tmp\\Frame.thmx",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\iso690nmerical.xsl",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5109.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD565A.tmp\\architecture.glox",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D54.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD57B9.tmp\\Banded.thmx",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5637.tmp\\ieee2006officeonline.xsl",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E72.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CEB.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E52.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3E.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FD.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FBC.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\ConvergingText.glox",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ADB.tmp\\VaryingWidthList.glox",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cab54F6.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B79.tmp\\iso690.xsl",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A0F.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A10.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5809.tmp\\ThemePictureGrid.glox",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5378.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5368.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61E1.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B68.tmp\\chevronaccent.glox",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\cab525C.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5638.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD627E.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E52.tmp\\CircleProcess.glox",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FE.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FBC.tmp\\gb.xsl",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA6.tmp\\BracketList.glox",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49E8.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cab51BC.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A81.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C75.tmp\\ThemePictureAccent.glox",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47EE.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CC9.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D54.tmp\\Badge.thmx",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4967.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6533.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C85.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA7.tmp\\Basis.thmx",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FC.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EB2.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3E.tmp\\View.thmx",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49E9.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CCA.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6788.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E72.tmp\\TabbedArc.glox",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47CD.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D94.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61E1.tmp\\Berlin.thmx",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FF.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49FB.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\cab47CE.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CDA.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab638A.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD627E.tmp\\Slate.thmx",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\cab53C7.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AB6.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AC6.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\cab522C.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar639A.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CFC.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BA2.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C78.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BC8.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BF1.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C21.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C33.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5D64.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6533.tmp\\Feathered.thmx",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FA.tmp\\Mesh.thmx",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C34.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C35.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6788.tmp\\Damask.thmx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C45.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C86.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C75.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C97.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AB6.tmp\\Circuit.thmx",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BA2.tmp\\Vapor_Trail.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C21.tmp\\Wood_Type.thmx",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E8C.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6BF1.tmp\\sist02.xsl",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62BE.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\cab604A.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6418.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C75.tmp\\ThemePictureAlternatingAccent.glox",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C35.tmp\\APASixthEditionOfficeOnline.xsl",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C45.tmp\\harvardanglia2008officeonline.xsl",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C32.tmp\\pictureorgchart.glox",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5991.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C34.tmp\\PictureFrame.glox",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C97.tmp\\turabian.xsl",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D7.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66FB.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AC6.tmp\\Insight design set.dotx",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C33.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4F4F.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C77.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A51.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CB8.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E8C.tmp\\TabList.glox",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D6.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\cab477E.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C86.tmp\\Main_Event.thmx",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A11.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6543.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49D5.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C88.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E31.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_c51001ee58b01a5d503953bee84dfe70.doc",
  1347. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS036F80F5-4DDB-42CB-BF79-7A480B5CCAD2.tmp",
  1348. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1349. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3E2573FA-E03F-4296-9913-68109A95C02B.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR19B4.tmp.cvr",
  1351. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF46E07AE2-4781-4E6C-808D-B7462FEF6F48.tmp",
  1352. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\__tmp_rar_sfx_access_check_29859359"
  1353.  
  1354.  
  1355. * Modified Registry Keys:
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\4fp",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1368. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1C984EE",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1C984EE\\1C984EE",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1620. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1622. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1624. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1625. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1626. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1991. "HKEY_CURRENT_USER\\Software\\WinRAR SFX",
  1992. "HKEY_CURRENT_USER\\Software\\WinRAR SFX\\C%%Users%user%AppData%Roaming%Microsoft%Windows%Start Menu%Programs%Startup"
  1993.  
  1994.  
  1995. * Deleted Registry Keys:
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\4fp",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\c!o",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1C984EE\\1C984EE",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  2004.  
  2005.  
  2006. * DNS Communications:
  2007.  
  2008. "type": "A",
  2009. "request": "documents.online-transaction.website",
  2010. "answers":
  2011.  
  2012. "data": "198.54.125.177",
  2013. "type": "A"
  2014.  
  2015.  
  2016.  
  2017.  
  2018.  
  2019. * Domains:
  2020.  
  2021. "ip": "198.54.125.177",
  2022. "domain": "documents.online-transaction.website"
  2023.  
  2024.  
  2025.  
  2026. * Network Communication - ICMP:
  2027.  
  2028. * Network Communication - HTTP:
  2029.  
  2030. "count": 1,
  2031. "body": "",
  2032. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2033. "user-agent": "Microsoft-CryptoAPI/6.1",
  2034. "method": "GET",
  2035. "host": "ocsp.digicert.com",
  2036. "version": "1.1",
  2037. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2038. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2039. "port": 80
  2040.  
  2041.  
  2042. "count": 1,
  2043. "body": "",
  2044. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2045. "user-agent": "Microsoft-CryptoAPI/6.1",
  2046. "method": "GET",
  2047. "host": "ocsp.msocsp.com",
  2048. "version": "1.1",
  2049. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2050. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2051. "port": 80
  2052.  
  2053.  
  2054. "count": 1,
  2055. "body": "",
  2056. "uri": "http://documents.online-transaction.website/1/bT3NEfMGHNBatch54.exe",
  2057. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2058. "method": "GET",
  2059. "host": "documents.online-transaction.website",
  2060. "version": "1.1",
  2061. "path": "/1/bT3NEfMGHNBatch54.exe",
  2062. "data": "GET /1/bT3NEfMGHNBatch54.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: documents.online-transaction.website\r\nConnection: Keep-Alive\r\n\r\n",
  2063. "port": 80
  2064.  
  2065.  
  2066. "count": 3,
  2067. "body": "",
  2068. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2069. "user-agent": "Microsoft-CryptoAPI/6.1",
  2070. "method": "GET",
  2071. "host": "crl.microsoft.com",
  2072. "version": "1.1",
  2073. "path": "/pki/crl/products/microsoftrootcert.crl",
  2074. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2075. "port": 80
  2076.  
  2077.  
  2078. "count": 1,
  2079. "body": "",
  2080. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2081. "user-agent": "Microsoft-CryptoAPI/6.1",
  2082. "method": "GET",
  2083. "host": "crl.microsoft.com",
  2084. "version": "1.1",
  2085. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2086. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2087. "port": 80
  2088.  
  2089.  
  2090.  
  2091. * Network Communication - SMTP:
  2092.  
  2093. * Network Communication - Hosts:
  2094.  
  2095. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!