API tools faq
paste
paladin316

Docs_cf4c484e82505c3f81a9e81a620a25b7_doc_2019-08-01_08_30.txt

paladin316
Aug 1st, 2019
2,159
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 179.20 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_cf4c484e82505c3f81a9e81a620a25b7.doc"
  7. * File Size: 267409
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "f5b5e8b2e11acc7afc4fb68d6859cb9a0ced369e26255936fa7e14c97725a501"
  10. * MD5: "cf4c484e82505c3f81a9e81a620a25b7"
  11. * SHA1: "259bc7754e08ac80d5c1d888468bafaabb76ecac"
  12. * SHA512: "981011abde9d57a0c265550ce886db21ad5f64b395192cfebd32a6d33f6a5647d528c6a2d5d5d9b78899ca31f8195c1e4c4f66cf9935dc253ba352d360475827"
  13. * CRC32: "063D573E"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLejNJB3DQy9It1q9YgoXgjLiOPG+RUKda9Q3d+i:sxxQW3yD6Yhbt89pzMD"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 744"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "A process attempted to delay the analysis task.",
  33. "Details":
  34.  
  35. "Process": "WINWORD.EXE tried to sleep 275 seconds, actually delayed analysis time by 0 seconds"
  36.  
  37.  
  38.  
  39.  
  40. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  41. "Details":
  42.  
  43. "IP": "23.60.72.96:443"
  44.  
  45.  
  46. "IP": "23.213.38.244:443"
  47.  
  48.  
  49. "IP": "65.52.98.231:443"
  50.  
  51.  
  52. "IP": "104.18.24.243:80"
  53.  
  54.  
  55. "IP": "184.28.188.178:80"
  56.  
  57.  
  58. "IP": "72.21.91.29:80"
  59.  
  60.  
  61. "IP": "52.109.2.14:443"
  62.  
  63.  
  64.  
  65.  
  66. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  67. "Details":
  68.  
  69. "ioc": "ist.glox"
  70.  
  71.  
  72. "ioc": "ontent.inf"
  73.  
  74.  
  75. "ioc": "turabian.xsl"
  76.  
  77.  
  78. "ioc": "nline.xsl"
  79.  
  80.  
  81. "ioc": "rc.glox"
  82.  
  83.  
  84. "ioc": "ccent.glox"
  85.  
  86.  
  87. "ioc": "pictureorgchart.glox"
  88.  
  89.  
  90. "ioc": "ext.glox"
  91.  
  92.  
  93. "ioc": "sist02.xsl"
  94.  
  95.  
  96. "ioc": "adial.glox"
  97.  
  98.  
  99. "ioc": "harvardanglia2008officeonline.xsl"
  100.  
  101.  
  102. "ioc": "architecture.glox"
  103.  
  104.  
  105. "ioc": "gostname.xsl"
  106.  
  107.  
  108. "ioc": "gosttitle.xsl"
  109.  
  110.  
  111. "ioc": "iso690nmerical.xsl"
  112.  
  113.  
  114. "ioc": "content.inf"
  115.  
  116.  
  117. "ioc": "rame.thmx"
  118.  
  119.  
  120. "ioc": "rocess.glox"
  121.  
  122.  
  123. "ioc": "mlaseventheditionofficeonline.xsl"
  124.  
  125.  
  126. "ioc": "rame.glox"
  127.  
  128.  
  129. "ioc": "chevronaccent.glox"
  130.  
  131.  
  132. "ioc": "iso690.xsl"
  133.  
  134.  
  135. "ioc": "asis.thmx"
  136.  
  137.  
  138. "ioc": "rings.glox"
  139.  
  140.  
  141. "ioc": "etropolitan.thmx"
  142.  
  143.  
  144. "ioc": "rid.glox"
  145.  
  146.  
  147. "ioc": "..3b"
  148.  
  149.  
  150. "ioc": "ieee2006officeonline.xsl"
  151.  
  152.  
  153. "ioc": "e.gu"
  154.  
  155.  
  156. "ioc": "quations.dotx"
  157.  
  158.  
  159. "ioc": "set.dotx"
  160.  
  161.  
  162. "ioc": "anded.thmx"
  163.  
  164.  
  165. "ioc": "ividend.thmx"
  166.  
  167.  
  168. "ioc": "chicago.xsl"
  169.  
  170.  
  171. "ioc": "adge.thmx"
  172.  
  173.  
  174. "ioc": "iew.thmx"
  175.  
  176.  
  177. "ioc": "uotable.thmx"
  178.  
  179.  
  180. "ioc": "eadlines.thmx"
  181.  
  182.  
  183. "ioc": "rop.thmx"
  184.  
  185.  
  186. "ioc": "avon.thmx"
  187.  
  188.  
  189. "ioc": "gb.xsl"
  190.  
  191.  
  192. "ioc": "roplet.thmx"
  193.  
  194.  
  195. "ioc": "arallax.thmx"
  196.  
  197.  
  198. "ioc": "ype.thmx"
  199.  
  200.  
  201. "ioc": "eathered.thmx"
  202.  
  203.  
  204. "ioc": "erlin.thmx"
  205.  
  206.  
  207. "ioc": "rail.thmx"
  208.  
  209.  
  210. "ioc": "vent.thmx"
  211.  
  212.  
  213. "ioc": "ircuit.thmx"
  214.  
  215.  
  216. "ioc": "g.n9"
  217.  
  218.  
  219. "ioc": "late.thmx"
  220.  
  221.  
  222. "ioc": "amask.thmx"
  223.  
  224.  
  225. "ioc": "esh.thmx"
  226.  
  227.  
  228.  
  229.  
  230. "Description": "Performs some HTTP requests",
  231. "Details":
  232.  
  233. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  234.  
  235.  
  236. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  237.  
  238.  
  239. "url": "http://muhendismeraki.com/main/gsmfzt.msi"
  240.  
  241.  
  242.  
  243.  
  244. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  245. "Details":
  246.  
  247. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\xf9\\xb1\\x1c\\xe9b\\xc1\\x9c\\xdd\\xf3c\r-\\x14\\x1b\\xd1\\x88\\xe4\\x92\\xf2\\xa6\\xe4\\x07\\x18\\xdd\\xdf\\x1b\\x1d\\xad\\x9496\\x08\\x18\\x1c\\x05\\x9f\\xf4\\xe0\\xf3\\xa6i\\x90\\x7f\\x85\\xc3\\xfd\\xf2\\x0br\\xc5\\xb7\\x8bx\"\\xc0\\xf6\\xd9\\x7f!\\xf6\\xe6x\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xc3\\xc9\\xb1f\\xa0\\xef\\xed\\xd0\\xa0\\xdc\\xb0\r\\x7fr0<\\x97\\xa4\\xf0u\\xafx\\xe9\\x81\\xc2\\xee\\xe1ca\\x83\\xaa\\xf2\\xcctz-\\xb5\\x0c\\x93\\g\\x02\\xab\\xa0id8"
  248.  
  249.  
  250. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pe\\xba\\x0c\\xc0\\xb5\\xe2%\\xc2v8\\xbd\\xde\\x05?9\\x0e9\\xe1a\\xfe\\xd0\\xfe\\x93\\xe6x~.\\xedt\\xdc\\x94\\xb24\\x1f\\x12qm\\x97\\xe1\\x7f\\xc1ok\\xb1\\x95\\xb6\\x00\\x17\\xd8\\x96\\x89z\\xe8\\x9d\\xe8\\xf9m\\xa7\\xab\\x1c2\\xe9\\xddb\\xebn\\x80\\xd3\\x9d\\xff\\xbb;\\xbf\\x8e\\x94\\x06\\xbd_\\xe5\\x89l\\x1b\\xe1s/-\\xc1\\xefg\\xb4\\x83\\xeb\\xb1$\\x19u-\\x8e\\xa9r\\xba\\x10\\xd2%2\\xf9wic-4q\\xcb?\\x88\\x8a\\x98\\x1f\\x84\\xff66kdv\\xc30\\x9a0@5\\xc7e#\\xf5\\x8d\\x11m3\\\\xe9\\xeb\\xbe7\\x98\\xa9\t\\xb3\\x1c\\xdf\\xda\\xc2\\x17e\\x04\\xff~\\xb9\\x9e\\xecy\\xc1\\x95\\xbdu\\xb0\\x1a\\xc5)\\xbd0\\xd5\\xb2\\xa7d\\xdddq\\xc1\\xbc\\xde\\x8d\\xed\\xf3\\xc2\\xce\\x80\\x076\\x90\\x87\\xbet.u\\xa0\\xbb\\xa3\\xc7\\xc6q\\xba\\x18\\x0f\\xecz\\xf5\\x0e+\n\\xc5\\xd9\\xe4\\x8b\\xee\\xd9\\\\xc7\\x9e\\xc8\\xf7\\xae\\xd4*\\xa6\\xc9\\xda&\\xa5\\xb0\\xc0\\x91ke\\xae\\x13\\x8b|\\x88\\xab\\xf6\\xa1\\xd2z'h\\xa2"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xd8a\\x10\\x03j\\xa1\\xd2#swz\\x9cj\\xbc\\xda\\x13\\xe7r\\xf9+\\xcft8\\x89f\\xfbn~%\\x92\\xf4\\xee\\xe9n\\xe5a\\xb8k\\x0b\\x88\\xd5\\xe1toqa\\xa0\\xb22\\x9b\\xc5p\"\\xc6c\\xf1\\xe6\\x95\\x87\\xe4\\xf0\\xearc\\xbb\\xaa\\x1c=\\x83f\\xb0\\xcb\\x13mno\\xc2rr\\xcd!\\xa6e/_\\xde\\xb8'\\qp\\xae\\xb9\\xf2\\xf5\\xe2uu\\x1f\\x17\\x7f\\xe0\\x11s\\xf1#u\tt\\x81w*\\x0b\\xbd\\xc2\\xa15\\x88h\\x02\\x92\\xe41\\x03, \\xb3\\xd0\\x19\\x91\\xa0\\xc0@\\xd8\\xaa\\xcba\\xfd\\xc0m\\x01`4\\xdf\\xe8\\xc8\\x16\\xc1\\x11\\x0c4o\\xc3%\\x99\\x01\\x06\\xb2%.\\xc3\\xe2\rv\\xe1\\xf4\\xf3b\\x07\\x1d\\xfdf\\x80md\\xbdm\\xc6\\x15\\xe2s\\x9b\\xd0\\x9fz\\xe6\\xe3\\x85>\\xe2\\xbe\\xbc\\x84\\xd7d6\\xedt\\xcd-\\xcehw9i\\xf93\\xabhk\\xf3vcv\\xff\\x98\\x0b\\x080c\\x1b\\x1e\\xf9_\\xdf\\xa5\\xe7\\x9b\\xb4\re@\\xcas\\xb3'7\\x06\\x05x\\x8ay\\xe2\\xa78\\x170\\x0b"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01b\\x9aa\\xf6\\xd3\\xbel\\x1b\\x88\\x8f0\\x8a@\\x98\\x9e\\xa9@fp2\t\\xef\\xafr\\xd8\\xdb\\xf4\\x15e_\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\xa1\\x06#\\xc5#x\\x1c9w\\xb3\\x893\\x11\\x06c2r\\xdcm\\x99\\xe5\\x84\\x8d\\xc1\\x1aj\\xb4\\x7f\\xed.,d\\x887\\xa4k\\xb8\\x05\\xf03\\xea\\xc6\\x9a\\xa3\\xf9l/\\x89\\x85\\xbb\\xa4\\x17\\xbe\\x87\\xe4\\xa9\\xe3s\\xd1\\xbag\\xaa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xb3x\\xb0.\\xd2\\xc0\\x07\\xb72\\xfd\\xfd\\xdd#\"a\\xac\\xa5yi\\x91f\\xdcz,\\xb82ep\\xe6\\xfaf8z4\\x17\\x06\\xa1t\\xbd\\xa3cq\\xec\\x02\\x9e\\xc4?"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p9\\xa2\\xf9\\x874\\xd9\\xfe\\xd6)\\x9d\\xd6-\\xeb\\xedg\\xb8\\x94\\xae\\x93\\x94\\xdb\\x8dc9m\\x91pu\\xaes\\x91f\\xe2\\xf4\\xfbtp\\xc4\\x8d\\xd0\\xabf\\x8157\\x80\\xc2\\x82\\xe2c\\x1d\\xc1\\xa8\\x1c\\xfd`\\x05?cd\\x0f\\xcb>|\\xean\\xbb\\x86\\x87r\\x9fg\\xc06)\\xdb\\xc7%\\xac\\xb7\\xd6\\xd8\\xc0\\xecv|v\\xac9\\xf0`d\\x87\\x01\\xc8\\xb2f<\\x06v\\xba\\xf3\\x95\\x0e\\xff\\xf8\\x1ez\\x9aa1\np\\xbe\\x1f\\xbe\\x0f\\x10\\x82\\xae0x\\xe2\\xb9\\xf5i\\x83\\xefh\\xbc1\\x073\\xca\\xee1\\xd5i+@\\xbf\\xbfe\\x00\\x1e\\x16\\x8a\\x0f4h1i\t\\x078\\x9d\\xf1\\x1a\\xa8h\\xf3\\xfb\\xe6\\xb6\\xb9\\xaaz\\xaer6_'m\\x94=g#\\x8d\\xb7\\x86\\x13%,r\\x028y\\x0f\\xbe#\\xe9\\xbc\\xddc\\x84\\x1a\\x97\\xe8\\x99\"k\\xb9itwh%\\xae\\x9a\\xa3?vj\rt\\x88\\xf3\\xe0\\xb1rv\\xcck\\x98\\xc3bk)~\\x1bo\\x84\\xde\\xe0n\\xabg\\xdc~\\xa3\\xeb\\xb2\\xc1\\x8fcu\\x19\\x89"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01b\\x9ab\\xf4/?\\xed\\xf4\\xee\\x0e\\xc2q\\x87\\x7fj\\xa3\\x18\\x80\\xd4.\\xcb\\xfa\\x05\\x9bm\\xaf\\x88\\xfc\\xc1\\x9a\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05f\\xed\\xfbh\\xfdp\\xc0\\xae\\xc3\\xe6\\xcf=\\xa2j\\x12\\x10\\xd5c\\x82\\xf9\\x82\r\\x19!n\\xb0\\xca\\x16\\x9c;\\x9f5d/?#i\\xdbf\\x80h\\xd7\\x8a\\x96\\xf1\\x0f\\x94\\xb8c\\xb6\\x9e\\xaf\\x85z:\\x81\\x0b\\x94\\x95\\xd7\\xdb\\xdd\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;aw\\x9dc\\xb0\\x80\\xfa\\xd8j\\xca\\xf8\\xb6\\x8cd\\xach\\x1e\\x12\\x8a\\x9a\\x11\\xe1c^b\\xa1/j\\xdbl\\xd1\\x94\\xea\\xcbp\\x88\\xff2\\xed\\x08i<dx\\xa3\\xa8\""
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\xf8\\xecg\\x08\\x18\\x83e\\x08ik\\x88\\x91\\xba\\x06i\\xefm\\xc6x\\xdec\rr\\x1a\\x08ga\\x99+\\xa6\\x89\\xf9\\xef\\x9d\\x9f\\xd5\\x92\\x92\\xb1\\xbc\\x86$\\xd4%\n\\x95\\x83\\xbc\\x8d\"-i\\xfa\\x1cg\\x02\\x89\\xb3\\x04\\xd0\\xb3\\xcbu\\xf2p&\\xc4\\x8e\\x9ep\\x01\\xd5\\x8d\\x90;\\x86\\x00c>\\xc7\\x1ef\\x05\\x9e\\x88\\x142\\xb1\\xc2\\xbcu\\xdf\\x00\\xf3k\\xe4r\\xbb\r\\xdc\\xbb\\x84n\\xe0\\xb1/\\x05\\xd0\\x83p\\x8fxw^0\\x8c\\xb1\\xc6,\\x03\\xd3\\x1f\\x0e\\xdb\\x19:l\\xc4\\x01\\xee\\xef\\xe8\\xe3\\xd7\\x001\\xffc\\xfc\\x01\\xba\\x8f\\xfa\\xd8\\xb7c*1/\\xeb\\xc1\\x96\\xf7\\x81'\\xda\\x7fn\\x12bsj\\xc6\\x87\\xa4\\xa9\\x90\\x1f\\x1abh\\xec\\xe8\\x0e\\x8bd*+\\xd50\\xe0\\xe8\\xdcw\\xc3\\xbfo\\x18\\x80\\xc0\\xfc\\x1dv\\xf4c\"\\xe8\n\\x10\\xe1\\x0e\\x91_\\x9a\\xaa\\xbe\\x84 i'\\xac.\\xe8\\xa5\\xees\\xf85\\x12\\xe3d\\xfaey\\xdel\\x19c\\xf2y\\x93\\x83\\x18-\\x05\\x15\\x89/n\\xcc\\xc2a\\x95\\xed\\xa3\\x1a=\\x10\\xa5k"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9acy\\x92\\xd1\\xee\\x0e\t\\x1e\\x9cr\\x01w\\xb6\\xfc0dn\\xba\\x81c\\xfal\\x06\\x1fa\\x7fku\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xe3k\\x97\\xb2d\\xb6opx\\xba\\xb7+\\xc1=\\xfc\\xf0\\xfc\\xf4\\xd5-\\xea\"\\x1d\\xe8?\\xfc\\x15\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xe7\\xf0\\xe6\\x0ewx\\xe7\\xea<\\xe2\\x12\\xfe\\x8f|qb\\x03%\\xe0a\\xcdu\\xc2\\xab\\xa1\\xb7c:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac+\\xce\\x17pqm\\xe6\\xff\\xad\\x82\\xed<\\xcc\\xd3\\x04\\xf5\\xd86\\x89\\x93\\x80x\\xffu\\xdb<x\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9aci\\xd7;\\xed\\x06\\x96\\xe4qw\\xf1f\\x00\\xb0b\\xe5\\x98i~\\x15\\x1bge*\\xd2.bu\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9aca\\x9d\\x05\\xd4\\x92\\x15\\xf4r\\xb7s\\x91(\\x16\\xac\\x85\\xfd\\x15\\x91\\xfc\\xcc--\\x03\\x10\\xb8\\x7f\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9acl\\xf5o\\x9f:p\\xcf\\xa3\\x92d\\x03\\xc5\\x8cw\\x01\\xa8\\xa7\\x9fh\\xa7dn3\\x9a\\xf89\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x1d\\xcc\\xf0\"\\xfe\\x1c\\xc0\\x05\\q\\x05\\x9a\\xb1<\\xc0\\xbd\\x10\\xb8\\xa7\\xa6\\x19\\xa0l\\xf8\\x02&tm\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x10\\x8e\\xe6\\xf5\\xbe\\xa3#\\xde-%\\g\\xcc,\\x9e4\\xf3\\x9b\\x95pa\\xfcb\\xda)\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x1d\\xf8\\xdek\\xedf\\x03\\xeb\\xe2\\x04#\\xde\\xc8`mg@\\xf3\\x9d\\xa7h\\no\\xa1:+\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xb0\\xf9(\\x93 zw\\x11\\xd9\\xad\\xc8\\xfa\\x11\\xff/\\xeb\\xe5i\\xae\\xaa*\\xe4js\\xf2\\xd7!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x16\\x83\\x14\\xf3\\xae>%#a\\xe6p\\x06\\x82\\xf7\\x07<\r\\xa4\\xe7j\\xb4\\x83r\\xf9\\x90\\x85\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xdd_\\xde\\xed\\xb0\\x89,\\xb0b^z\\xfd\\xbe\\xccb\\x8b^\\xbf\\x0f\\xc8\\xca\\xec\\xf2\\xcc=+\\xa1\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9acc\\x1b\\xd9\\xd1\\x0e\\xfd|\\xd1\\x1a\\xee\\xa9\\x11\\xf5eu\"ey\\x7f>\\xbd\\x00\\x1f\\x00\\x9ag\\x92\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9acs\\xe9+:m\\x04ka'\\xc5i\\x83\\x9c\\xbbp\\x1a4\\xce\\xe7\\xc3\\xbf\\xc9#\\x83\\x1bq\\xb4h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac/\\xd6\\xb9\\xa5`\\xc2\\x8c\\xc5-\\xaa\\xfd\\xe6\\x8a\\xe1\\xe6\\x13\\xe1\\xeb\\x1a\\x10r\\x8e\\x99\\xc4k\\x86\\x87\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xbb\\xfa1\\x19\\xc9\\xf4\\x84\\xc2\\xc4ad\\xbcd\\x9fo\\x86\\x0e\\xb4@\\x1fy\\xc9v1m\\xd2-^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x9e=\\xd3)>\\xf6p\\xddi\\x83\\xb0\\x91\\xff\\xf4\\xbbb\\xd0\\xfb\\xa6\\xdcxc(r\\x17l\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xc3\\xe3\\xf4\\x18t\\xe4\\xcd\\xfa&\\xefi\\xa9b\\xa0\\x85\n5i\\xd5\\x0cd\\xfe\\xc6\\xae\\xae\\x9d\\xc3\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfdph\\x13\\xf4e\\xc6\\x9f:\\xad\\xc3#\\x99\\xf2\\x03@,^\\xed\\xb9\\xc6cp\\x89\\x93\\xd7\\x950\\xf8\\x96\\xa9g\\x81\\xa5\\x10\\xf5m\\xab\\x838\\x84\t\\x87\\xa7\\xa3\\x01u\\xc2\\x83u$\\x96\\x14\\xfao`\\x18gw<\\xc6$\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xe1\\x8bt\\x17jf\\x17\\xb5y\\xda\\xb9:$x\\xb5\\x02m\\x826\\xbd\\x1bqh\\x0elo\\xf2\n\\x99s\\xcd\\x16+xx&h\r\\x05\\xc3\\xd4\\xf1\\x823@"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xaen\\xf1aa\\xf3y\\xdf\\x99&\\x82z\\x8ae.\\x88n\\x1f\\xab\\xb7\\x96=\\x9ef\\x9dj\\xd9\\xfc\\xbe(\\xba\\x05<!\\xf4w\\xeb\\x856\\xe8\\xda\\xa2\\xd6;qj\\xe7f\\x0c\\xc3\\xf4u\\xcc;k\\x88m\\x8c\\xc3\\x94\\xc3\\x91\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xd4\\x05\\xd6;^\\xad\\xaa\\x04\\x1fd\\x9d\\xeer\\x97j:i\\x81z\\xbe\\x82d\\xd1/\\x00\\xfb\\x9e\\xd6\\xc2\"\\xea\\xa4t\\x01_\\xe20w\\x80\\xd7\\x8e\\x16\\x96y\\xf4"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\"\\xdc<\\xb0\\xeb\\x90s\\xf0p\\x90\\x8c\\xe1\\xc4\\xeeh\\xd5\\\\xad\\xee8\\xa5\\xffi\\xebl\\x1a\\xcc\\x101\\x85\\xdep\\xc6qy\\x8e2m\\xaeh\\x87\\xc9x\\xd8\\xa0g\\x88\\xa9,\\x14\\xe35\\xe9\\xd8\\x7f\\xc2\\xa5\\x84c\\xc7\\xdd\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f nd\\x8c\\xee\\xfc^\\x15\\x9a\\x05\\xbe\\x8e\\x8f\\x05\\x81\\xbd\\xf0.\\xc0\\xc5\\x8e\\xd4-%\\x86e\\xe2\\xa3\\x0f\\x06\\xf6\\xf1h\\xd1\\xce\\xb7b\\x9bf\\x92\\xf8&\\x17\n\\xdf\\x84\t"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1\\xf4qg\\x0c\\xf7\\x190\\xd4\\x03\\x98n\\x14\\\\x0c\\xd8\\xb6\\x9a\\xb3\\xdbga\\x95q\\xc5=i.\\x02\\x93\\xbb\\x89j\\xb4\\xd6\\x13\\xe1g~m`\\xb3\\xa7\\xa64yw\\xba\\x93\\xa2\\xeem\\xcevo\\xae,\\xae0g\\xb8\\xc3\\x86\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7gs31\\xc5.d\\xc7\\xf92\\x08\\xa6\\xc5\\xd8\\x98'rlp\\xf5\\x99\\x07^\\x95\\xa1'\\x0b\\xb5\\x0e\\x9ed\\xf9\\xa5vp(\\xa5\\xc6\\x93^ce\\xbf\\x9c\\xef@"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\xdc\\x86\\x17\\x00\\xef\\x9f\\xb7\\x11kfo\\x1cv\\xe1\\xde\\xea\\x7f\\xd3p's\\x1c\\xa8\\x913\\xc8\\xae'5c$\\xb4\\xbb\\x07\\xfd\\x9d\\xb39\\xbfyh\\xef\\xf9\"y\\xa1\\x02\\x02\\xb9\\x07\\xdc\\x01\\xba\\x8a^\\xa3\\xb65\n\\xd4\\xef\\xd0\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x98np\\xc3\n\\x13\\xd8r\\xfa\\xd9\\xf4\\x0f\\xe5\\xbf\\xf3\\xc4\\xcd\\x84\\xd3~\\xc5\"\\xe0\\x12\\xec\\x974\\x12\\x01\\xff\\xe1*\\xfb\\xe5\\xe0\\xb6\\xea\\xe6\\xfbt\\xc9\\xc5\\xe8\\x85f\\x8ez\\x9b"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\x83m\\xe1a\\xdd@6\\xd1\\x1arro\\xc7s\\x06\\xee\\x86\\xba\\x03n\\xd0\n\\xc3$\\xa8\\xaex\\xba\\xf1nv`\\x8a\\x9ck*\\x88\\x90q\\xe8\\xffn\\xde\\x07\\x13\\xbb+e\\x05u\\xb0\\x00-\\xecz\\x11\\xa8\\x05\\x0e2\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xf4iz\\x08\\x03\\xbab\\xf5\\xe2\\xb6\\x06z\\xd2\\xdc\\x0e\\x95\\x00\\xac\\x82\\x84\\x97\\x16t\\xb9\\xb4\\x1dn\\x0c\\xbf\\xb6\\x11@\\x9d\\xd2\\x89\\x01%\\xea\\xcd\\xee\\xed\\x1ddy\\xbc7\\x01"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d$ek\\x0e_z\\x7f\\xe2\\xe2\\xc0\n_\\xe9\\xa4+<\\x88g\\xbe\\xb6%\\xacj\\xca\\xf3c\\x91\\xc2\\xf2%a\\x02%\\xc1l\\x10\\xd4\\xbe\\x9d\r\\xad\\xc0c*$\\xf9\\xeb\\xcbq\\xb3\\x05\\xd2\\xe8\\xce\\x89\\x8c\\xc2\\xca&9\\xc0\\xb3\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xa8\\xb6\n\\xdd\\xfev\\xdek\\x1b\\xe4d\\xcb\\xd0\\xdd\\xf7\\xdc\\x9b6|\\xe2<\\xbd\\xdezk\\x92$\\x9e\\xf2\\xa7\\xdfl\\x88\\xf0\\x8f\\xf0\\xc2\\x9c\\x83\\x01\\xe99/6~`\\x85"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\x05\\xaee*\\x05\\x1df\\x9bc\\xcbq\\xda\\xf6\\xaa\\xad\\xb4\\xaf\\xfe\\xa7\\xe5)\\x1e!\\x93\\xb3\\x05\\x16y\\xfe\\xb5\\xec\\xebq\\xb8\\xf0x \\x1e\\xed\\xe4\\xa1\\x8bd.!9\\x97\\x01\\xf8w\\xf8\\xe0l/#h\\xb1f:\\x02u\\x05\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\xa6\\xaa\\x90\\xa4\\xe7\\xaf\\xd6\\xed\\xbd\\xef\\xd2,\\x1c\\xa5\\xe2\\xf8\\xdd\\x83df\\xcc\\x1dj\\xca8\\xa4\\xc9\\x89\\xf7i\\x13~\\xc5g\\x80\\xcdv\\xa1%\\xf9w\\xda\\xae`\\xd3\\xbaw"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2\\xa8\r%\\xc2y\\xea\\x08k?\\xc3\\xcaa\\x95\\xec\\x8dm\\xca,'\\x98\\xf4\\xdb\\x97i\\xb8\\x93or\\xa1\\xef\\xd3\\x8fn\\xf9nj\\xd9\\xe4\\xaag%\\x15n\\xb4\\x14\\x1ebly\\xee\\x94\\xba\\xe3?&9\\x80\\x13%\\xa9\\x06\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7ihw\\x14\\xb9&\\xc54b\\xd1&\\xb0p\\xf8\\xef\\x1di\\x16d\\xb7\\xecy\\x0f\\x15&\\xaab<\\xe1\\x0cs\\xeb\\x9f\\xaf\\x84\\x97;b\\xc1%h\\xe1;z\\x8b\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\n\\x90\\xb2~\\xdc\\xfd\\xbf\\xd7\\x19\\xe3!e\\xf4\\x8bor\\xb0\\xad\\x80\\xb6\\x9e\\x8b\\xae\\xf3o\\x1a\\xa5\\xbd\\xc4\\xb1i\\x99 \\x95\\\\xfd\\xb8\\xf1\\xf1\\xf6\\x84b\\xe2du\\xaf\\x81\\x0f\\xf6j\\xb7i\\x82\\x9c\\x19= .\\x90\\x8c\r\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8``n\\xc6e\\xb1\\xa7\\xeb\\\\x85\\x13q\\xa0n\\xc0c\\xf5\\xfa\\xa0\\xc6\\xfbq\\x9d0\\xfbt!a\\xf2\\x8b\\x986\\xf6m\\xc6*\\x86r\\xedg\\xa6\\xb0\\x94\\xd7 \\x18\\xff"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04cfk2\\x99hk\\x12\\x8b\\xf3\\xdbh\\xd5\\xe5\\xb5\\xeby\\x04\\x14\\xfc\\xef\\x8et\\xe71fts\\xb8)\\x12uclm\\x14+\\xad\\x16\\x9b\\xd6\\xd3\\xe4q\\xd3* \\xa3z.$\\x88fr\\xe7n\\x96\\x16)\\xd6\\xd6\\x8f\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xb4\\xdc\\xbe\\xf3qf\\xa5\\x94\n\\xa9m^\\xcf\\xc3\\xe5\\xe6\\xa0\\xae\\xe3\\xce\\xfb\\xef\\xb0\\x1e\\x11\\x11&\\x13\\xe3\\xf4\\x85\\xfb\ni\\xa3\\x84e\\x94\\x83\\x05x\\xd6z\\x1fk"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8\\x7f=/\\x18\\xaauu\\xec\\xae\\xaf\\xe0\\x8e#1\\xe4\\x13\r\\xe0/\\xdb\\xb0\\xa5\\xfe\\x0flm\\x88\\xcc\\xe6\\x15\\xf8e\\xb4\\x93\\x96l\\x83#\\xaeo\\\\xad\\x04\\xee\\x19\\x0ft%e\\x94\\xf6v\\xbc\\x81\\xf3\\xb68\\xbb\\x05\\x98\\xb7*\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe50\\xd6)f^\\x04\r\\x9c\\x84\\xe2\\xfd\\x08\\xcd6\\xd8zx\\x9c\\x9f\\x01\\xaa9\\xb6.\\x9d\\xb1\\x99$s\\xf5\\xee\\xe1x\\xc6\\x11\\xdf\\xfd\\x15(:\\xe1md\\x85\\xf2\\xfa"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\xeb\\xb1~\\xcd\\xb3\\xf3m\t\\xb2'\\x00\\xd9\\xc9\\xca\\xd3*\\x10\\x87p\\xfeh\\xcb\\x036\\xfep2i\\x7f\\x1a\\xa4\\xf6\\xbb\\xf4>\\xfcbp\\x89\\xad~\\xc9fs\\x9d\\xe7\\x19\\x9aj?\\xf9\\xd0\\x8fb\\xd3\\x0c51l\\x14\\x84e\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\xa0k\\x81\\xe5>\\xb8\\x89\\xbaw\\xc0y\\x8c \\x9b#z\\x1d\\x18\\xd9e\\x96\\xea\\x13%\\x90\\x82\\x90\\x82 0\\x88\\xa7@\\xca\\x8a(\\x17\\x0f\\xe7'wqv9`\\x95\\"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ov\\x92\\x909\\xb0\\xa5fs\\xa7\\xbf\\x81y\\xfb\\xc3)hs\\xef\\xa1\\xbak\\x84\\xeei\r\\x93\\xa5\\xa1\\x80mn\\xb4js\\xb2\\x01\\xcdlp\\x027y?\\xba\\xdf\\xc8\t\\xa0'q\\x82g\\xaf\\x9a\\x94\\xe5.\\x83\\x1bdz\\x1e\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ry7e=\\xf1~+\\xbf\\xa4\\x94yeyl\"hl\\x07\\xd9\\xed\\x16&u\\x8ah\\xbd&\\xa9j\\x83\\x11\\xa8\\xd1\\x923z>i\\x18m~\\xab\\x02\\xf0"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x03\\xddx\\xe34\\x06\\xb1\\x97z4\\x14\\x88\\x11v\\xa3y\\xcerz3\\xc1u w7\\xe5;\\xa3\r\\xa3\\xcf\\x0e\\xeb^\\xb6x\\xc2zc\\xf0\\xf9\\x843-\\xc4u\\xe0\\xf4\\xde$?\\xa7p\\x97\\xa8\\xcb_+208\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3m\\x97\\xfe\\xc1\\x08\\xc6\\x81\\xa9j\n\\xcc\\xed&\\xbad\\xcb\\xf0z\\xc6\\x16\\xe4:f\\xa5\\x9a\\x9a\\x97\"\\x94\\x7f\\xc9\\xc2>\\x81\\x97\\x03m\\xb0\\xc7'\\xc4\\xd8\\x02v\\x7fa\\x14"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 q\\xba#\\x81\\xc1`$\\xf6ik\\xf8w\\\\xfev\\xc1\\x96\\xf4i5ycm\\xd1_\\x9bh\\x92\\x84;\\x98\\x02\\xe7\\x8bpx\\xd9h\\xb2\\x8d\\xad\\x0cw*\\xc9\\xfee\\x0c'n&\\x05\\x16)\\xa3\\\\xce\\x01r\\xeb_\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xeco\\x80\\xea\\x01\\x04\\x95\\xb5?\\xa1\\xce\\xf1\\xd3\\xf8\\x95n\\xe3\\xb5\\xee\\xa1en\"y\\xedd\\xccf\\xbc\\x16\\xc0,\\x17\\xb6\\x0e's5\\xeaj\\xcas=\\xcbb\\x1e"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3t$\\xda\\x14t\\x80\\xc7v(u#\\xdf\\x98c\\x9d\\xd5\\xb4\\x8c\\xe1\\xa1s\\x80\\xf7\\xf1\\xe8\\xe7\\x92y\\xe5\\x8d\\xb0\\xeck\\x81c\\xa6\\xd2\\x95\\x9c\\xf0\\xedb\\x88\\xd4a\\x17rj\\xfdvx\\x9b\\xfdq\\xfc\\xf8\\x1f\\x1b\\xace\\x88\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&\\xc5?,\\xf3\\xda\\xf3\\xf3\\x11y\\xbc\\xdck\\xb3\\xe7a5\\xb3\\x89\\x0f\\x877\\xab\\xa9\\x98\\xe9&;\\xdcc1s-f\\x87\\xd1\\xf7\\xed\\xddj8\\xe8\\x06\\x8e\\xbf\\xcf"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\xc4\\x00\\xa7\\x000/p\\x08b\\x00\\xae\\xd7r\\xba\\xea~z\\x14\\xafu\\x0e\\x93\\x05\\x13u\\xa6\\x02\\xfc\\x97\\x83#-~\\xe7\\xf2\\xa9\\x08\\xdd\\xe5\\xdb\\x05+\\xf8\\xcc\\xc8.\\x98y\\xfd6\\x8c\\x177\\xcb\\x18\rt\\xeb\\xb3s\\xb2z\\x11\\xc94\\x18\\xact\\xe6\\xfa\\xf9\\x971\\xfb\\xe2vn\\xf4\\xb9\\xd2\\x8du\\xdb\\xf4\\xf1\\xa2\\x01+\\xc2k\\xad\\x1a\\xae\\x1c\\xd0=\\x07\\xd0\\xf5z\\xef\\xbft\\xa72\\x1e\\xcb\\xa9\\xe8(vd\\xfe\\x1e\\x07\\x06\\\\xfe\\xfb\"8t\\xeb\\x00\\xc7\\xef\\xc7\\xac\\xc5\\x10\\x7f\\xc2\\x89\\xca;\\xc1\\xdc\\x80\\xb2\\x18\\xb0:\\xd88\\xc9\\xc3\\xbe\\xcf\\xbfq\\x10(\\xd3\\xb3ia\\x87\\xa7\\xc0\\xa2y\\x0b\\x92\\x8c4ks\\xac(\\x13\\xdco~!\\xfcb\\xae\\x1f8\\x12\\xf4d\\x1ee=\\xad\\xde\\xef\\xdd\\xa9ms\\x9d\\x05\\x02dr\\x9d\\xc2o>\\xe5\\xc9`n\\xc4\\xf6\\xd0\\xe5\\xee\\x19\\x9bh\\x87\\xbeyb\\xd9\\x99f\\x07\\xacni\\xdfr\\x0b\\x00\\x8d\\x8a\\x00\\xf9\\x04\\xe9\\x81\\xf4\\xa4\\x1bv\\x1d\\x93a\\xa1\\x98\\xe0\\xd3\\x19u\\x7f\\xd0\\xed\\x0b\\xbe"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc5\\x8d\\xb3\\xe8\\xc0`\\x07\\xee\\xfb\\xa2\\x88\\x99\\xd2\\xfb\\x1ayif\\x1bs\\x82#\\xda\\xfc\\xd3v\\xc8d\\xe48w\\xb4d$\\x81\\xec\\x15h\\xec\\xf8nu\\xd11\\xc6\\xc2\\xf9-\\x8e\\xbb\\xf0\\x85<\\xac\\xc2j\\xd8\\x19\\x8a>-e\\xca\\xcew\\xc0\\xb2$df \\xdf\\x15\\xd3o\\x05=\\x9c\\xd2d?>;ank\\xde\\xfa\\x96q@\\x0fav\\x96he\\xb7\\xba\"\\x0b\\xfd\\xa7\\xabe21ouf\\x8cgw\\xa9kyg\\x18\\x96m\\x9e\\xda>\\xaa&dd\\xaa\\xf9-\n\\x80\\xbd\\x97\\xa8\\x9fv\\xed\\xbf\\xb5\\xdb\\x1b\\x14\\xbf\\x1b\\xe7\\xf3\\xae%\\xb9u\\xb7\\x8fz\\xf15\\xfbf\\x83\\xea\\xc4\\xcb\\x1f\\x82c\\xa0\\x8c\\xbdures\\xf4<\\xa3i\\x90\\xc6nlix\\xf3!\\xe5k\\x04j\\x1cv\\xb4jb3\\x08w\\x0c\\xd7\\xec\\xbf\\xc9\\xac\\xda\\xf8\\xf6\\xaf@\\xb9)0<\\xf0\\xa4g\\xed\\xf0\\xbf?\\x93z\\x93/\\xf7\\x8e\\xff@b\\x9e\\xed\\x9e1xg\\x1c\\xec:\\x07\\x9e\\xe9\\x9f\\xf8\\x14\\xb6sx;"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfe\\x04\\xdd\\x8a\\xdc\\xd2c\\xec\\xd1\\xa6\\x9e\\xa2\\xc4l\\x8en\\x93\\xfd\\xf5\\xbfg\\xf3\\xd3p0m\\x1a\\xbb\\xc7yy\\x9a\\xb9m|\\xaa\\xe1i\r\\xdd\\x1d&x\\xc9unp\\xaf\\xe6t\\xb3\\x91\r\\xb1\\x94\\x05\\xf2\\xb1\\x19\\xd2evz\\xa9\\xb4\\x02-\\x1e\\xa5\\xf4\\xf5\\xbf\\x88\\xbd<\\xedoeklg\\xe0\\xff\\xa4\\xc1\\xb0\\x80+8g\\x90\\xa9vx\\xcaf\\xecv>\\xf9\\x83\\xc3\\x82\\xee\\x0b\\xe0<\\x17\\x1bf(\\x9f\\xa5\\xce\\xdf\\xa1\\xb3\\x98(k4\"\\xd7\\xdbicu\\x8e\\xae\\xfc\\x02eq<%\\xe4\\xe2\\xce\\xfcf.\\x1e\\xc2\\\\x98\\x04\\xba`\\xdd\\xd0\\xe6\\x98\\xa3\\xf9\\xc4-\\x05lp\\xe7\\xcd\\x99_9\\x80\\x8b\\x80<<\\x18\\x0b\\x14\\xe8\\xdc\\x87\\x83\\x1fg9\\x8f\\xa2\\xf5\\xda~\\x05\\xfar\\xf6\\xc4\\xfb\t=\\x07t\\x15\\xe7\\xe0c>\\x13q\\x92\\xf8\\x19\\xb8o\\xaf\\xaa \\xac\\xdc\\xd1\\x1d\\x94h\\xbb\\xe9\\x04`\\xe0z\\x19>!\\xb2\\xc0\\x95\\xaf-\\xf1g\\x16.ip\\x7f#\\x0bw>\\x1b\\xeb&\\xf1\\x92\\x9d;"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b:\r.0\\xaf\\xaf\\xc0\\x0f\\xaa\\xfd\\x12\\x9e\\x80\\x04\\x9c\\xbb/\\xe7j\\xc0\\x1f\\x86\\x8c6d\\x85f2\\xc6\\xe0\\xa2a\\xe2\\xc9(x\r?t(\\xd6\\x0b\\xeb\\s \\xda\\xf2~\\x018\\xb3y/\\xe3v\\xfbj\\xd7e\tc`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\x13\\xb3e'\\x90?8\\x08=\\xd3\\xa0|\\xc5t\\x82\\xcb\\xaa\\xb0t\\x11\\xbd\\x920g\\xa87\\x1b\\x87\\x92\\xe0\\x9d\\xdf6\\xdf\\x16s\\xb0\\xafp\\xc3.s;\\xf9\\x8f\\xd4\\x18"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\\x1bc\\xb8\\x86\\xa6rz3\\xcet\\xb6\\x05\\xcd\\x97\\xce\\xfd\\xa6\\xbb\\xe2\\xff\\xba~s\\xef\\x7f.\\x8a\\x86\\xc8\\xe2\\xd5\\xa6\\xd9\\x9c\"-\\x8e.e\\x17y\\xe5;\\x9b\\xa0e\\xd1'\\x1a\\xfb\\x16\\xa2\\x96\\xc5<\\x0590\\x07\\x18<\\xdfwfw\\xcfn\\xc9\\x95\\xbe5u\\xbb\\xdex\\xd9\\xf5\\xc5l\\x96zv\\xf7a1\\xafn\\x1a$\\x18\r\\x94r\\xc7f\\x99&\\x9e\\xc7\\xbf\\xa5:mb\\x9ax\\xcf\\xfd8d\\xc7@:a\\xc93\\xa3\\x1e\\xf6=-\\x0c\\x0f\\xc6\\xec\\xca\\xe6\\xa9s\\xe4\\x9a\\xb13&\"\\x1c\\xee3\\x01\\x84\\x0e4\\xd9\\x93\\x11*ru\\x95\\x87\\xa1p\\xd9(\\xdb\\x05wf:\\xec\\xae\\xc7\\xee\\xb8a\\x8d/\\xf3\\xcd\\x82\\x8d8\\x10bog\\x0bxb\\x02b\\xcf\\xb4\\xe6\\xfc\\xbc\\xb4\\x89\\x859\\xd7\\x8c\\x9f\\x11\\xbc\\xd0\\|\\x9f\\xb6\\xcb\\x19zg\\xa9\\xb2\\xae\\xcc\r/5s\\xc7\\x16\t\\xe233*m\t\\xe4\\xa2\\xbd\\xd1-\\xd2\\xfd\\x00\\xff\\x9cg|\\x18\\xd5\\x99\\x06\\xe5\\xde\\xb8\\xde\\xe8\\xd1\\x81l\\xaa"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;\\xed\\x8b\\x7f\\xba\\xc2\\xf5\\xdb\\xe4 \\xaa\\xb7\\xdeut`9\\xf3\\x1e\\x94c\\x0f\\xcenr\\xf0\\x12gt\\xfb\\xbc\\x97\\x11\\xe7e\\xe6\\x9es\\x1c\\xa9\\xc8\\x0f>b\\xb5\\xed)ff\\xdb\\xeb\\xa0=a<\\xc5z\\xaf\\x7f\\xe3\\x8d\\x05\\xd6\\xcbc\\xa6\\xf3\\xa1?\\xb9\\x82\\x84\\xcb\\xa1w6\\xed\\x86\\xa9\\x8fe\\x9a\\x08\\xae\\x15\\xae\\xf4\\xc1\\x8b\\x99\\x99s\\xd3z\\xfb\\xb1\\xa5w\\x8f\\xc5\\xd9\\xeb\\xea\\xe9\\xd8j\\x94.\\x0ec\\xe4\\xe9p\\xd5\\x02\\x00\\xef\\x8b9\\xe2-\\x90\\xd6\\x87\\xd6\\x14-\\xe5\\x87\\xfdps\\xe0\\xf3\\xa2(\\x86<\\xf6\\x07\\x83\\x18\\x0f\\x19\\xd1\\xdb\\x852\\xedm\\xd6\\x9bl\\xf246~|\\xb2~\\xf5n\\xee\\x90-o\\xea*3\\x83\"\\xff\\xf0\\xbd;\\x1d\\x81\\x8d\\xb4\\x18c\\x996\\x9cy$\\xd6\\xeec_\\xf6\\xdf\\xe9&\\x93\\xdc\\xe5oawkk*\\xa46\\xff`\\xbb\\xe6\\xed\\x9cq_\\xac0\\x83\\x88\\xafp\\xb5kd\\x82\\x0bvy\\x0b~\\x867\\xca\\xfes\\xd8\\x94 \\xe8\\xde\\x8f\n>\\x12q\\x87m\\x86e;"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda;\\x11\\xc6\\xafp\\xd7\\x96\\x99\\xab\\x13\\x7f\\xfc\\xf4;\\x8bt?\\x93\\xa4\\x075\\x1e\\xa2\\xc0\\xf9\\x02mh\\xc1\\xad%-eb\\x0b\\xd6\\x99\\xcbw#\\x00k\\x1a\\xa5x\\xd0|\\xb0\\x9e\\xf0\\x80b\\xe1;w\\xf7\\x9d\\xc1\\xe1\\xbd\\xbc\\xf2\\xcd\\x93\\xc1\\x92)\\x97\\x85\\x17\\x0b\\x8cuee\\x81i\\xd9\\xdf\\xe9\\xd3\\x03x\\x9b\\xcf\\xd6\\xf7\\xbd\\x0f\\xd5 \\xbf-je\\xe2\\xe3\\x1fqr\\xf1\\xe6\\xef\\xe9\\xea\\x93\\xca\\xfe\\xc0\\x13\\xb2\\xd1\\xf5\n\\x0f\\x0f\\x88\\xfbj\\x0b\\x1d\\xd1\\x8b\\xa0\\xda\\x1b\\x84\n\\xa3t\\x92n\\x8b\\xed\\xa6\\xfb\\x83)\\x18s\\x9e\\xe1s\\xb8\\xb2\\xf1k@e\\xd8\\x91g\\x08\\x86\\xd5?\\x7f\\xcf\\x94\\xa6\\xe1\\x84@ps<\\xab\\xbd\\xf4\\xa0m\\x8bu\\x88\\xfc$\\xe7\\xe1\\x82\\xa1'\\xd7$d\\x87\\x0ef\\xd1\\xb3\\xc0\\xbf\\xf8\\xa5g\\x8b\\xd8b\\x02_\\xa2x>\\xa7\\xabm2k\\xc9\\x93\\xcf\\xe8\\xb8wj\\xd1\\xa2\\xe3\\x01~v\\xd5 \\x98\\xbb/\\xbc\\xaa\\xff3\\xa6:\\x82p\\xc3\\xdd\\xb9\\xca\\xf7\\xee\\xac\\x05\\xa7\\xe4\\xbb\\xc0\\xd1"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\\x9d?\\x04p\\xcd\\xdd\\xd8cg\\xa0\\xbe\\xb1w\\xb5\\xcf\\xbfi\\x8d\\xcd\\xdd\\xd1#\\xa5\\xd1d!\\xf1\\xf1lnm\\xcc+x\\x9f$<\\xcb\\x8f@vf\\xf4\\x13x\\x94\\xd5\\xf6\\xa1w\\x13\\x9b\\xf1hh\\xf6\r\\xfd\\xd5a\\x85\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xb0\\xa4\\x127\\xb3z\\xb6\\x101\\xa4~\\xfe\\xff=\\x89\\x1axu\\x02\\xe1\\x1el\\xa2\\xcf1\\xbd2i\\x14+5\\x97f\\xfe\\x06e\\xf3&\\xacv\\xf8b\\xe7\\x8c2n\\x14"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xbex\\xc7;\\xf1:f\",|\\xc8|\\xd6\\xffe\\xcc\"\\xac\\x08^(x\\x16\\xaedb\\xe4\\xbc\\xdao\\xd1\\x96+\\xd8\\xe4\\xe7'\\xc3.\\xe9\\xde\\xc3\\xf8ln\\xc0\\xed\\xae\\xe2\\x13\\x83hs)\\x94\\xd8\\x92\\xf3\\x01o$z3\\x1d\\\\xb9f\\xe7\\xce\\xd6\\xfa\\xe3w>\\x18\\xd1\\xf7f\\x94l51\\x1f\\x05\\x1a\\xe1\\x87\\x82\\xce2u\\xee\\xa8\\xc01\\xe6\\xbb\\x82\\x1av;mg\\x96a\\xcf$\\x83\\x1bom@\\xfe\\xe9\\xc2\\xa2\\x00s1\\x13\\xdc\\xf0\\x81k\\x17\\x8a\\xbb\\x82\\xf9\\xee\\xd3(,\\xed\\xaf\\xed\\xd7\\xe8 \\x85\\xb5\\xd4\\x9d\\xeb$\\x01\\xa6u\\xba2\\x90\\xa5\\xcb\\x82\\xc3\\x08m\\xce^\\xda\\xca\\xb8\\x96\\xe5\\x1e\\xaa5\\xd3=\\xc3<du8\\xa2\\xb2\\x1b\\x93u\\x06h?qh-\\x19z\\x0c\\x87n\\x9b\\xd7j\\xc0\\xab:\\xa2\\x82\\x0c8\\xa43\\xac\\xe7\\x9a\\x10>\\x85\\xe2\\xebu\\x0c(\\xc9\\x9a\\xd1u*\\xf9\\xd9\\xc7q\\xf02((x\\x1e(\\xbd\\x80\\x04\\x0ct\r\\x8f\\xacu,\\xa8"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9r\\xba\\x17\\xef\\xd4k\\x8a\\xa9\\xe9z-\\xb0\\xf1\\xf6\\xe2r\\xcc\\xd3\\x02\\x9f\\xa3\\xa4~\\xbe\\x10=\\xc1j\\xdecb\\x98j\\xd4\\xb5\\xe8j\\x04\\x14\\xf3\\xe6\\xd0\\xe1\\x9e\\x9f|\\xa1\\xf2\\xb0\\xdf\\xce';\r\\x8dp\\xc2\\x154\\xadt\\xfd\\xb2*\\x86kyk\\xf1o\\xe9\\x99t\\x05\\xc8\\x16\\x0e\\xd1y\\xb7\\xbd\\x19j\\x089w\\xd0r\\x01#\\xd8\\xf35\\x18\\x13r`7\\xfc\\xc3\rr\\x99\\x94\\xc9\\x8f\\xdf\\xc9\\xc7(\\xb2\\xd2`\\xe4 a\\xcf\\x15cj\\xe7\\xda\\xe8~\\xb0+ir\\xfbid'\\x9f\\x1e\\xf8\\xf8\\xceyfw\\x1fd\\xf60\\xed\\xc5m\\xc8\n\\x92owf\\xb84\\xe4\\xc0\\xc5\\x82\\xcf\n\\x12\\xfc\\x82\\xb5\\xb5\\x06/\\xb1\\xc9@w,\\xbf\\xc0\\x18\\x1e\\x10\\xd7\\x1afod*<\\xe2\\xc2\\x85\\xday_\n\\xc5e\\xbd\\xa9\\x10_q\\$\\x83\\xba\\xc6u\\xc4\\xce\\x80\\xa6\\x97\\x9d\\x0cz\\x9a^6h9\\xbf*\\xa7\\x01wlqs0\\xda\\x08\\xb3\\x00\\x87\\xa1z9m\\xf91ck\\xb9\\x93t\\xe4\\x17\\x1c`\\x89t"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1a\\xe9\\xf8\\x8b\\xc6\\x88\\x1f\\x1c\\xf0\\xfaa\\x19\\xe8\\x8e\\xb7\\xe8\\xb2bp\\x14\\x95\\xf2r;/r9\\xb4\\x01-\\x08l\\xfa~\\xd1\\x0c;\\xf49*z\\xad\\xaf\\x1e\\xc6\\xbf\\x19i\\x1c\\xf2\\xde\\xd4:\\xb9\\x84\\xba\\x8a\\xa5\\xa5\\xb4\\xbf \\xc0\\x95e)vrt\\xb8\\xc5wq,!h\\xc8udu\\xa1\\x1e,lp\\xd5\\xf0\\x96a5\\x08\\xddk\\x15\\xba\\x7f\\x96\\x8e\\xe4ru\\xb3\\xec\\xc4\\xe6?\\x9bi\\xc4\\xff\\x8b\\xc4\\xb3g\\xa9\\xcb\\x9f\\x8a\\xd6\\x07a\\xd7c4\\xeck0\\xd3y\\x92\\xad\\x90\\xf1\\xaa\\xb9\\xdf\\xd6\\x92\\xe5\\xc2\\xad\\x96\\x8axt\r\\xe59\\m6\\xe3\\xad6&\\xe2x4\\x1f\\x88\r\\xcd\\xf7#\\xe0\\xdbaf\\x80/\\xd3g|\\x8e\\x89\\xfcld\\xf6kc\\x13\\x9d\\xe0\\xa5\\x82i\\x01\\x19<\\xaa\\x1a\\xf5\\xfab\\x91x\\xde\\xcf\\xc8 js\\x1d\\xfa\\x17\\xa0\\x85zq_|\\xf7\\x8f\\x8d\\xf1\\xa9\\xa8\\xa8\\xe9\\xa5\\xf0\\x801\\xe88\\xd7t\\x12d\\xfb7\\x0c.\\x91\\xf6\\x16\\xa6\\x14\\x9a\\xfa\\x13k`\\x1a4\\xa4"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010_x7 x?@nkm\\xe2t\\x8f l\\xf4\\xf4\\x04\\xe6'\\xa5i,t\\xbc\\x04a\\x1c\\xffx\\xe3ku\\xd9\\xbe;\\xeb\r4c&\\xea\\xe0k\\x8a\\xfb\\x84e\\xbe\\x8c\\xd1\\xc4,\rz_\\xa7p\\x16\\x01\\xbc\\xa6i: \\xa1\\xa9\\xf8\\xa0a\\xecux\\x12a\\x1b\\x85k\\x9a\\xfa\\x06\\xd3\\xd9\\xed= e\\xd6\\x11\\x9cu\\x17w\\xd1\\xc7\\x90\\xb0cy\\x015\\xd2\\x9c?m\\xb5\\xce\\xde\\x15$\\x14e\\x98j\\xf9a\\xa9\\x802\\x84z\\xb0\\xfeb\\x90a\\xe7\\xd4\\xa2\\xdb\\xe5\\xaf \\x99\\xf5'\\x06\\xd6\\xdc%\\xd5y\\xd7\\xd4\\xaf\\xbc\\x91'g\\xbc',be\\xd3\\x9b\\xc8\ts\\xf7\\xc9\\xe5\\xd0\\x12\\xe6\\xfd\\xd3\\xd4\\xa6\\\\xca\\x9cv\\xdaf\\xc3\\xbb*\\x98\n)\\xc9\\xf1ysf^\\xa4|\\xdfk\\xb0c@\\xdd\\x1b\\xdaa\\x99\\xa1a\\xd9\\x03\\xcbx\\x1bd:\\x1fm\\xb0\\x1b0g\\xb9\\x97\\xae\\xdd\\x89<\\x01/\\x9d9\\x03\\x04a\\xd6\\x17\\x84\r7\\x98\\x11\\xb0&\\x11\\x98\\xf1\\xa2\\x01\\x93\\x9a\n\\xb3\\x1d5\\xdd\\x15"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\x92\\x910\\x11e\\xce\\xbdm\\x04\\xb9\\x98\\x879a\\x0e\\xcc\\x85\\x08\\xb2w\\xe1\\xa2\\xbf\\x0e\\xc4t\\xd8\n&z\\xcc\\x0f\\xf9a\\xf4\\xf8\\x18s\\xb6b\\xa74o)\\x06\\x88\\x13\\xdd\\x8f\\x9c\\x95,\\xf7\\xae\\x8c\\x91\\xea\\xd3v\\xe5\\xb5\\xd9\\xe6~\\x1d\\x9f\\x1f\\x1b*x\\xce\\xac\\xc9=\\xef\\x96\\xd3\\xb8pps\\xc9t\\x8c\\xd4d\\x14k\\xa3)\\xbb\\x1a\\x8d\\x84\\x85\\x1bt\\x17\\xe6\\xe2yk\\x0f\\x87\\xcf\\x8f\\x86\\xf2\\xcf\\xd4@\\xd98\\xcb\\x83g=\\xe4\\xa0\\x87x\\x0fg4\\xabf\\xb2\\xe1\\xd7\\xb6_\\xf733>\\xc2\\x18?\\xd9\\xf7\\x91$t\\x16\\x0c(jx\\x1c=g_\\xd8\\xff\\xce\\xa5\\xc9\\xcf\\xa53\\xa1\\x97@\\xf07u$\\x94\\xc0\\x1b\\xad\\xc0\\xf6k\\xe3\\xd5'\\xdb\\xf5\\xd0\\xca\"\\x971d\\xa0\\xcezv\\xf1\\xba\\x1a\\xcc\\x9d\\x80j\\x83j\\xa9sa\\xb3\\x16\\x8b\\xf8\\xc4r\\xce6\\xc8\\x99\\xea\\xc3\\x8exp\\xd1\\xab\\xce\\xcf\\xe8\\xa53\\x0e\\x1d\\\\x08\\xd7d\\x12\\x9em\\x7f`t!\\xd8%'\\x99n\\xe9#f/w"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xeb\\xb2\\xf4\\xe7\\xf4v\\xaci\\x97\\xc2\\x11\n\\xb4\\xd6\\x0f\\xc7\\x82\\xb3\\x92\\xc7l\\x1ak\\xd3\\x89\\xd93s\\x05\\xbc\\xb5\\xe3>\n\\x12r$\\xc1b\\x9ca\"\\xb7\\xf6\\xad\\xb5\\x02\\xb0\\xc8\\xd5\\x08\\xa3\\xddwz\\xbe,\\xcb\\xc7+\\x86\\xe0\\x1f\\xaf\\xcdd\\x95\\xda\\x02\\xe8\\xa3\\x81\"\\xc2|\\xe0b\\xd10\\x19\\xa0\\xa5$\\xfb\\xe6jr\\xd9w\\xb9\\xb1\\x04\\xbd\\xfcu\\xf3\\xe1\\xa5u\\x1d\\xe5\\x9e\\x16\\xb93\\x03g\\xf8\\xd6\\xc4zcz`$\\xa0\\xe7e\\x88\\xdcl\\x03z@g\\x8a\\_\\xcf\\x0f\\xf2|\\xa2k~s\\xeb\\x0bla\\x12w`\\xe1\\xc9<%n\\xff%\\x08\\x10$\\xce=q\\xecx\\xa3\\xf5\\xc0\\x17k\\xd5\\xbe\\x7fw\\x9f\\x1f\\xd4\\xf4\\xbb\\xb3\\xee\\x89\\xfc)\\xa7\\x880\\xf0\\xb8\\xa2n\\xa5\\xae\\xcc\\xf7|t\\xfd\\xe8\\x14\\x02z\\xdd%\\x96uztj\\xdb-f\\x95\\xed\\xd8\\x02t\\xc8yy\\xad&\n\\x85\\x1c#'\\xc3\\xdc\\xc5\\xd0\\xa3jp\\xc6\n\\xe2\\xd85\\xd2\\xaerrr\\xeb\\x057\\xc0\\x94\\xb14\\xeak0\\x0e\\xed&"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\xf6\\xe8\\xda\\xbf\\xf1\\x18n;8\\x17\\xd0\\xd3\\xc7\\xc9\\xd9\\x93\\xee\\x06\\x90i\\xddxo\tb\\xa47iz\\xb9!w\\x8d\\xe6|ci\\x9c\\x853\\xba\\xec\\x06\\x87\\x19\\xd4#\\xe8\\xfd\\x17y\\xd4b\t$\\x8d\r\\xd7\\xfd\\xe9\\xad|\\xb8\\x94\\xe8\\xa0\\xe2w\\xe5\\xb18q<\\xe8\\x8e\\x18\\x9ebh\\x95&\\xfbw\\xb7pv\\xab8\\xdd\\xe4\\x85\\x86m\\xb6\\x17\\xff\\xe8l\\xd8$\\x7f)\\x87\\x1do\\x18\\xc0\\xc66;\\xdd\\xce\\xae1\\x141\\x14\\x0e\\x81\r\\xad\\xc3o\\xf4\\xf3vw\\xaeg\\x9d<\\x9a\\x04?r\\xd2\\x99^\\xb3\\x04\t\\x13&\\xb6z\\xb2\\x85ay\\x87@\\x84\\xda\\xc00\\x04@\\xd6\\x07\\x93\\xea\\x19\\x99hy;\\x0c@\\xc4(\\xabn@ub\\xa6\\x06y\\x93j\\x0cj\\x8e\\xdb(h\\x8e^q\\xbaj\\x0e\\x86'\\xb7\\x90\\xe2\\xbe\\x8c\\xc9\\xbfs\\xc3\\xac6\\xad!\\xb6e\\xba\\xd0\\xaa#\\xf0#w\\xa4\\x85\\x08\\xc5u`\\x8fv\\xba\\x8f\\x82\\xfe\\xcc\"\\xd4qh\\xd4\\xf3e\\xe8\\xbf\\xb4c\\x86\\x98_$qu\\x19\\x19"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde_\\xa3\\x9b\\x03\\xc2\\x16i\\xf6)ao\\x8b\\x92x&\\xb4q\\x1f\\xc2\\x03nh\\xf3\\xec\\x08\\x8a\\xc0\\x8c%\\xee,|q\\x8a\\xaf2\\x1c\\xc4k\\xe1\\x86\\xe0\\xa8\\x00\\x8d\\xf9@\\x83\\x1e+\\x91k\\x0f\\xa5\\x8c\\xb0\\xda\\xaan\\xf3\\xf9\\xcb\\xad\\xd0\\xe6\\xcf\\xa7\\x82+\\x9a\\xe3\\xb2\\xfb:/\\x84\\xb7\\x7f\\x02(\\x9ay\\x86mk\\x08|\\xa1\\xa8\\x14\\xf4v\\xd2\\xb2\\xa0\\x9b3\\x03\\x1a\\x88\\xaa\\xdcaq\\xf8\\xbf\\x1ah\\xe2\\x9a\\x1be7w\\x12!\\xb9\\xfb\\xd84w\\xd3\\xcf\\x9av5\\xf2>t(\\x16\\xdb6\\xc9r\\x0f\\xc9\\xd6,\\x9fj\\xe4\\xbe2\\xb2\ne\\xc9?9\\xce\\x9fqg\\x98?\\xbe`\\xb4p\\xadx\\xc4\\x1c\\xf9yz\\xf2\\x03\\xa2\t\\x8c\\xe2\\x8e\\x18\\x1e5\\x0f\\x91r\\xec\\x89m\\x1e\\xe0o+\\xa8\\xe0\\x89\\x94w\\x85\\xf1\\x9ej\\x06\\x84r\\x1a\\xd33a\\xe6w\\xdd\\x95?t\\x14\\xfa\\xe7\\xa5\n\\x8en\\x9bc\\x96\\xd6\\xf1\\x83\\xd1\\x98\\xe77lu\"\\xcc\\x1btdb\\xa7\\x02@\\x08\\x18\\xf9\\xafk\\x94\\xfc\\xb4\\xd2"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xba\\xcd\\xa4\\x1d\\x8c\\x1b\\xde\\xdey\\xcd\\xdfw$k\\xcfi\\xbc\\x87x\\xe3\\xd1\\xd4\\xf9\\xf4^v\\x04\\x01\\x95\\x8d\\x8a\\xcb8\\xfb!\\xb6fh_(.tx\\x11`\\x99\\x04\\xaea\\x80\\xe1\\x90\\xef5;\\xf2\\x0b\\x87om\\x0f\\x8b\\x98!u\\xe3,\\x9c\\xb9\\x83\ndg\\xb0cx_x\\x1d\\x13\\xf7ro\\xa5cl\\x88\\x87s\\x0b\ra\\xd7\\x00\\x93|\\x83v/fk%b\\xb2\\xdan\\xb4\\xd6\\x86\\xaf\\xc0m\\x89\\xd8\\x11\\xc9z\\xc6\\xe7\\x87\\xca\\xba*\\xad?\\x05\\xac\\x82z\\xf3#\\xf4\\x1f\\x05\\xc8=\\xe1\\x86x\\xdd`(i\\x86\\x98\\xa0\\xa5\\xbec,\\xd8\\xda\\xd6\\xf0\\xd4\\xa2th\\x96\\x04\\x9a\\xf27\\xff6\\xeb\\xe6\\xed6az\\xb9\\xafx\\xec\\xae\\x8f\\xc1q(\\x89$\\xd2\\xb2z\\x1c\\x80\\xfa\\x97\\xb4?\\x98pka\\xb1\\xd7\\xea\\xb7\\xa5\\x96\\x12vu\\xbd\\x88\\xabg!d\\xc2\\x8a\\x94l#d\\xbbq\\xd2\\xc4w\\xde\\xa03\t\\xaez\\xade\\xe7\\xf6\\x86+,o\\x15l\\xd5?\\xa2\\xe8b\\x0cggx\\x89\\xc1"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\n\\x11\\xcb\\x19af\\xd77\\x98\rtu\\xc9\\xbc\\xf68\\x85\\x07k\\x9d\\xa9l\\x88\\xd0\\xa1\\xadgm\\xe3\\xb8\\xb3\\x14\\xe1\\x80\\x80ht\\x83\\xa3\\x07\\x9f\\xdf\\x07\\xf4\\x07zmy\\xc4\\xb0\\x80+t\\xd7\\xe8\\xa82d>\\xb3m\\x7fy\\xeb\\xa1\\xd3w\\xe0\\x8c\\xc0\\x02h\\x06\\x1a\\xe4\\xbd|\\x8b\\x9fr\\xa4x\\x14\\xd3y\\x9b#\\x80r*\\x0e&<,t\\xb5\\x14\\x1e\\xfc\\xa8l\\x1a\\xfb\\xea\\xaa\\x95\\x97\\xa3=\\x90?\\xa1\\x0f\\xb8\\xfe\\xac5e:rka\\x99\\xd9\\xc5c+\\x99:8\\xe7t5e\\xf6e\\xd1\\xe3\\xae,\\x91%\\xacu\\xaa\\xd3lh\\xe3cs>\\x8e\\xd9\\xfc\\x01$\\xba\\xff\\xca\\xb3\\x836\\xf2b\\xa0\\x1di\\x9f\\xa5\\xb9\\x8a\\xe9\\x81\\xc5\\xb7\\x8fc\\xca,t\\xa2\\xb4)\\x9b\\xe4\\xf7n\\xb0a\\xbb\\xcb9\\xb5\\x94?\\xb6\\x02ui\\x14\\x05\\x9dmz\\x0el?\\xf09(&\\x1f^\\x96k\\xca\\x03z\\xaa\\xbe\\xad0\\xad\\xe6\\xc4\\xca\\xd8nogp\\xbe\\xf39\\xc7\\xae\\x06\\x99\\x91\\xcb\\x08\\x92\\x98\\x1c\\x9c\\xe7<"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ycc\\xdcw\\x03\\x16\\xd3\\xc5\\xc5u\\xa9\\xe9\\x85\\x1c\\xfb\\x8d2\\xec\\xe8a\r\\xd1et\\xe92\\xa0bp\\x19\\xf4\\x8f\\xc5e\\xd82a\\x8d\\x8a\\xb3\\xeb\\x80\\x12\\x040\\xbfpm\\x07l`\\xb0\\x9c\\xa2\\xc8\\x9e0\\x07\\x85e\\x07\\x13\\xcajikf\\x8f\\xee_\\x16\\xa4\\x19n\\xb4\\x93\\xe0\\x05\\xcc\\xf0g\\xfc\\xfa\\x949\\x05 \\xc4\n(s\\x16@\\x98\\x88\\x88\\xf0m\\x12\\xcf`\\x95rx2\\xc7\\x9a.\\xd9\\xb50\\x99=\\xbd\\x1a\\xc6\\x0f\\x81\\xddn\\xaan\\xf1\\x15o\\xbe\n3\\xc4\\x13\\x80\\xe4#\\xb1\\x11z6\\xb1lg\\x0c=m!o\\xb1\\x12\\xe4\\x94\\xae\\x07\\x9d\\x8bk\\xd0@\\xd9\\xf1,\\xd7\\xb6\\xb2\\xcb\n\\xdf\\xa7\\x04n\\xacz\\x8c\\x17,$\\xe8\\xe3\\xc6\\xf4\\xad8m\"\\xc2\\x93\\x8d\\xbc~\\x7f\\xe9\\x7fx8t\\x18z\\xd3gmh\\x88\\xd4\\xee;i|p\\xbe\\x9e\\x01n\\xc7q\\xf9\\xe0\\xa5\\xbc|;\\x10=\\x99a\\xfa\\xa8d\\xf4\\xccz\\x12\\xe54\\xf3\\xb7\\xba\\xf08x\\x07\\xc0\\xa0\\xa1\\xbe\\xa5\\xdd"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\xb4\\xfa\\xff\\xb0\\x9fn\\x19m\\xeepx\\xc3\\xef\\xb6\\x96/\\xe8\\xa0\\xb5\\xd1\\x9c\\x80.\\xc6!\\x94\\xa2\\xe4s\\xb4\\xd7\\xaa\\xa0\\xe5\\xcf\\x100\\xd1\\xdcb\\xf69\\xf9\\x8f\\x8b(\\xb8\\xcfq\\x9c\\x1fz\\xad\\xde\\x06\\xfc'\\x8bn\\xa4y_\\x07bu\\xc9l\\x12\\x1f\\x1bxj\\xf6v7\\xdb\\x8e\\xbaa\\xbe\\xbb\r?\\xc2\\xfct\\x0f^u>\\xa1\\xcf\\xc6\\xca^\\x85\\xbb*\\x88\\xef\\xf7\\x7fl0\\xd4\\x16a\\x8e\\xe3\\xa3;\\x04\\xda\\xf10.ql\\xf6\\xa9t56\\xad\\xf6\\xa65\\xd2l\\xf8\\x87f\\x04\\xb9\\xcb\\x14ir\\xb6\\x90p\\xd2\\x1f\\xb66\\xc4\\x11\\xaa\\xb6\\xe9\\xa7\\x15\\xe0k\\xa0\\xd94\\xe8\\xe1#\\xaf\\xf9 \\xd7e\\xf1l\"\\x8ev\\xbd\\x1d\\xe9\\xd5\\xa3\\x84\\x8d\\xc6\\x9c\\xe0\\x81\\xa0\\x13\\xdd\\xb9\\xc4bth\\x89\\x0cc\\xf2\\x12\\x83\\xaf\\x19\\x9a\\x94gf\\x94\\xbe#b\\xd3\\xa2i k\\xef\\xc3\\xcbr\\x92\\xb5n\\x8a\\x0f4\\x96\\xb1p!=r\\x1d8\\xdbu_\\xb3\\x8a\\x16sq\\x10\\x90\\x02\\xdd\\x83\\x9d5\\x0esc\\x1a2\\xcd0"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3\\x0bi\\xc7\\xca=\\x0c\\x82\\xf8\\x86\\xef-\\x86\\xbd\\xd1\\x04\\x9c\\xee\\xd3\\xb0l\\xd0\\xd5z\\x02\\x9bp\\x80\\x12@c\\x86\\xaf\\xd4i19\\xfb\\xae\\xebix\\x1cg\\xd4\\x00\\xe8\\xdfa>\\xe8^\\xd1\\xca\"\\xcf\\x9a\\x93\\xd4p'\\x12\\x9e\\xd2#e\\xc3\\xa9\\xf9t\\xfa\\xa7\\x818\\x95\\xea\\xd4\\xb6\\x99\\xa2\\xd8\\x04\\xb2\\xa1\\xad\\xde\\xc79\\xabo\\x17\\xaf\\x83\\xe9>\\x16,\\x12u\\xf6\\x82\\xe8\\x02\\xb2\\xabn\\x89_i\\xdd\\xbd\\xef\\x95=\\xeaic\\xbd`<\\xe2\\xd8y\\xe6\\xc5j\\x0f\\xbeln+>\\x9f\\xa6\\xf7\\xb9\\xd2v\\xa8\\x96av\\x94\\x99\\xd1a\\x83\\\\x9b\\x95\\xa2\\xe1\\xf7\\x7f(dv\\xe4\\xb8'#k\\xa1\\xfcv%\\xec1ug\\x86\\x01\\xc8vd\\x82\\xa2\\xae\\x07\\xf1#z\\xb9\\x9f\\x86t\\xa5\\x93\\xe2.\\xa8\\xd73\\xdf\\x97\\xc4\\xe7\\xdc\\xe7\\xde\\x83\\xcdp\\xc9\\xae\\x96k\\xc2\\xfdq\\x95?1)w*\\x01\\xb0/\\x1as>g\\x8b \\x89l\\xac\\xe9\\x85\\xe3zg\\xcei\\xa8k\\xa8\\x16x\\x03+&\\x94\\x93"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\x92a\\xbf\\x9ern7\\xf2x\\xa4^\\x1d\\x18\\xd9\\x06\\xe2>\\xca\\xe8\\xfe\\x1ch\\x9a\\xca\\xc3dx\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ac\\xce\\xf7\\xfa\\x7f\\xde\\xbe9\\x01\\x13)a'\\xa0\\xa0\\xcb\\x8c\\xf9\\x83\\xceu\\x14q\\x88\\x0e\\xba\\xc4\\xbc\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\xdc!j\\x8an\\x11\\xa3\\xd4>\\xeebf\r=4+\\xc8\\xd2\\xc8zq\\xc6\\x87\\x1e\\xe4\\xe7\\xf9\\x97\\xe2\\x8d\\xed\\x1f5t\\x94jjdo\\xa4\\xac\\xdfjp\\x9f*\\x1b\\xa0\\xe49\\xeen\\xe1ku\\x8a\\xc4\\xfc\\xb0\\xc24\\xceu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\xca\\xdf*x\\xd8gz\\xdd\\x03\\x81:\\x06\\x1f\\xc6\\xfao\\xf1\r\\x0fn\\xf1\\xe4(z\\x83\\x18\\xfb\\xd1(\\xce\\xc5x4\\xa4\\xacw\\x90o\\xb9\\xdb\\x80\\xbdz\\x9dc\\xaa\\x07"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbcf\\xf6w9\\x03\\xf8\\xe3\\x81q1p\\xb3o\\x8b\\x94\\xe8\\xd5\\x99d`\\x1f\\x1f\\xa0\\xafn\\x8d\\xd9\\xc4\\x10\\x04\\x82\\x03\\xbcu~d\\x90\\xab\\xa6s\\x96*\\x81\\xd40\\x9b\\x89!z\\xce\\xe2\\xd4\\xf8)\\xf4\\xb1\\xd5\\x0b\\xe3h\\xf0\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f5\\xe5\\xc8\\xcd\\x89\\x16\\xe5.v\\x9b\\x01\\xf6\\x86\\xebs*\\xae\\xe8w\\xb6\\x80\\x0e\n\\xf7.\\x1an\\xe1\\xf6\\xf7\\xf1\\xefi\\x8d7\\xcb\\xef\\xd3\\xb9\\x1e\\xd6\\x8f\\xc7\\x02\\xbe\\xc5\\"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xd6_\\xd5\\xbcg0\\x95\\x8bf\".\\xcax\\x1au\\xdfp\\x9b\\x8e\\x7f\\xf6\\xe9?i\\xe2wmj\\x7f\\xfb\\x8cb\\xf7)d>5\\xfd\\xbc\\xae\\x88\\xad\\xd4\\x7f\\x12j`l>\\x95\\x1b\\xb5\\xc3\\xd96\\x14\\x12\\xa4\rf\\x05f\\x1d\\x86\\xe8d!\\xe3>\\x08ky\\xff@\\xc7<\\xc2\\xcb\\x08\n.f/c\\x02\\xf5a\\xbb\\xb7\\x97\\x11o\\xd1g\\x8b,?\\x9doi\\xa4\\xfb\\xb1\\x05e\\xe15\\x00\\xa9*0m\\xe9\\xc3\td^\\xfe\\xfcmo\\xce\\xcb\\xa4\\xbf,\\xden\\xdcg;\\xcb\\xaf\\x81\\x15v\\xfd96\\xce\\xc4\\x97\\x88\\xc3v\\xeb\\xdan:x|x\\xdbl\\x8e\\xbf\\xfb\\x92^.\\xff\\xbc\\xaf\\\\xd5\\xc6:\\xa2\\xfd^\\x89\\xca2\\xc6\\x9e\\xe1\\x95\\xc9bf\\x84\\x81\\x7f\\xbbv\\xd3zu\\xa1on\\xf5\\xd0:\\xc2\n\\xd7\\xc3\\x86\\xb6\\xbd\\xd3\\x8bj\\xb7m\\x95\\x8c\\xaa\\x8d\\x8e\\x99+\\xd6\\xb3a\\x02\\x83\\x13\\x82w\\xf5\\xe8`\\x01\\xaax\\xc8\\x8b\\xc9\\x1ei\\xea\\x8f\\x1f=v4\\xb5'\\xdd\"\\xad"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ad5a\\xe6\\xf3\\xec\\x9ab`\\x86\\xf1\\xc7\\xa0\\xe7$j=z\\xff~\\x8c\\xd9\\xaa\n\\xcc\\x8b\\xc8\\x13\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\xc4\\x00\\xa7\\x00x\\x0ee\\x0f\\x08\\xb1\\xe4\\xd1\\xaf3\\xf2\\xd5d\\xa2\\xad\\xf3\\xb6\\xf8\\xb7\\xb02\\xc4\\xc3:\\x9el\\xa3;;\\xc3\\xaf#\\xe1j\\xc5\\xd9\\\\xef\\xc3\\xe5\\x9a\\xed\\x9d\\xd5\\xec\\x83'\\xcd\\xa5\\x1a\\x12\\xb8!\\x16\\xa9\\xab):3\\xb2\\x91\\x8b9\\xa6\\x1f9\\xd0$c\\x98rn!v\\xab\\x82\\x93\\x16\\xa0\\x1f\\xb7\t\\x96i\\x91\\xa0\\x94\\xb8\r\\x9c/\\xd7\\xaf\\xd2\\x84\\x0f#e\\x81\\xc8iz\\x1a\\x9cs\\xb2\\x86\\\\x8e\\xdbn/$\\xfb\\xf5\\xf2(\\xb9\\x14\\\\xa8\\x0b\\xb4\\x9b\\xa1o\\xef\\xff\\xf2\\x13<>\\xd4\\x0e\\xa2=v\\x98\\xdc\\x1f\te\\xf6%\\xf3\\xcf\\xeb\\xd8\\xe2\\x84o\\xc9\\xde\\x7fkg\\xb4\\xc4\\x12\\xcd\\xd7\\xc1f\\xacmp@\\xf4y=\\x0b\\x1e=\\xcc\\x7fxq\\xb56rn\\xb1y\\xa5h\\xd0\r\\xa3\\xbco)\\xc4\\xa9hm\\xc1\\x9b\\xa0\\x93,!\\xee\\x9f\\xa9u\\x16\\xc6'\\xc5\\xcc\\x188n\\x05\\x7f\\xe6(\\xa1!4j\\xaa\\x86\\xe2r\\xd3\\xbch$0\\x86\\xbe\\x01\\xdc\\xe3\\x12\\xf7\\xd8\\xc0\\xf4\\x02\\x89\\xba\\x91"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12h\\xe7\\x93r\\xf0\\x120\\xce\\xc8y\\xe5q\\xe7_k\\xc2'\\xae\\xfaj\\x88#\\x80\\x92 \\x87\\xd3\\xf4\\xcb\\xb6wb\\xcep\\xeb\\3\\xa4+\\x1f_w\\x9f\\x8f$8\\xa8\\xcb:u\\xc9\\w6\\xf7\\x1b\\xeb\\xc5\\xab\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&,h&\\xf8\\x1a\\xdc\\x961\\xa3u\\xf5\\x97\\x8a5\\x01\\xda\\x17\\xfa\\x14\\xd2||\\x06\\x9f\\x19\\xc6\\xa5\\xd1_\\xc8\\xe5\\xb3\\xddtg\\xd2/\\x9b\\x1a\\xec\\xabr7t\\xd3\\xac\\xbd"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010zi\\xb29\\xfe\\xe6\\x195\\xf6\\x7f\\xa5p\\x98\"q3\\xa8\\x0c\\x166j\\x8c\\x9fco\\xb8\\xc0\\xb0\\xe7\\xc2~\\xd8\\x05\\xc1\\xd0\\x8c\\x7f9\"\\xd8\\xff\\x1d\\xf5e\\xea@\\xd7\\xb2\\xabh\\x106\\xef\\x1a\\xb1\\xf8\\x9e%\\xdaw\\xc7\\x02du\\xffu\\xb5\\x80\\x0bh\\xa7\\x91^\\xceq\\xe7\\xeb\\xf6\\x8cu\\xb1\r\\xd3\\xe7\\xe4\\xdd\\x19gx\\xe7\\xec\\xe4\\xc7\\xa2\\xd7p\\xf4n\\xaek\\xc2\\xe1pl\\xe4\\x08j\\xb4\\xa2k\\xd6\\xd2\\xd2\\x0b\\xa9\\xafph\\\\x1a\\xb4xon\\xcdwh\\x93<\\x9dw\\x8a\\xc6f\\xe7\\x99\\xea\\xfb\\xcap4\\xdc2\\xa2\\xf28!\\xea%d`\\x9f\\x02\\x99%b'\\xe6\\x82\\xc6\\xee\\x01\\x99\\xa0x\\xce\\xcftuj\\xca\\x1fqy\\x08\\xd0\\x07\\x99\\xc5\\x9ff\\xae\\xa0\\xe8\\x96=\\x9f\\x00p\\x1f?\\xe6\\xb1\\xa5\\x1e\\xc4x\\x04e\\xde\\x89\\x8d\\x8cy\\xd8m\r\\x7fz1.\\xbd\\x15\\x03g\\x99\\xdf\\x1a\\x8e\\x80\\x19g\\xa9\\xf42d\\xf3\\xb8\\x06\\x06x\\xff\\x0e\\x0f\\xcf\\xcc\\x8d\\xc3\\xe7\\xe09\\x07\\x80m\\xa1\\xc1\\xcf"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ad\\x93r7\\x1d\\x90\\x90\\xe1-\\xf0;\\xd2\\xb9_\\xb8g\\xb3\\xcb\\xda\"\\x93\\xce\\x7f\\x90\\xe9\\xea\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\x871\\x90\\xb7'\\x15-/\\x93\\x95\r\\xa6\\xefitwpk\\xb4\\x98i\\xa1j\\xb2g!kp~\\x1b\\x9f\\xc9l\\x9d\\xec=);\\xbf\\xa5\\xf5\\x86-\\x1e\\xae\\xf7\\x1bk\nw\\xd3io\\xb1\\xf0\\x8fy\\xba\\x81\\xd5\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb8\\x01\\xee\\x937\\x9b c\\xa7l\\xa0\\x0e\\x88\\xd5 c\\xaan\\xb9\\xad\\x9ei\\\\xc7\\xea\\xbc3\\xe8\\x12\\x81&\\x08!\\xbc\\xf0\\x83ng`\\x07+\\xa5g\\x13\\x1fg"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<\\xf6\\xc7=\\x0ci;\\xfd\\xaam\\x92\\x8eo\\xd9<\\xabb\\xe6+pn\\xa1x\\xd44\\x99vif\\xe5\\xc3q1v!\\x8a\\xc2\\xff\\xb2y5\\xd8\\x8d7\\x98m>\\x1b|uv\\x8d\\x0c\\x88m\\x9e\\x06\\x87\\xda\\x1d\\x1d\\x1c\\xca3\\xd07\\xa7l\\xc8x7\\x99\\xc4\\x17\\xf3\\xa8\\xf5\\x1b_\\x7f\\xa0(\\x08\\x84)\\xd0i\\xfad\\xf2k\\xff\\xcb\\xd6\\xa7\\xf4e\\x97\\x91\\xab\\xc1\\xa9\\x8c5\\xaa\\xc3/d\t<\\xe1g\\xeb\\x9f\\x0c\\xcb\\x87\\xc3\"\\xed\\xc2\\xfd\\xb4\\x9c\\xaf\\xbd\\x96\\xbe\\x92\\x1f3\\xfc\\xb9\rb\\x8b\\xbc4\\xf8(w\\xc4%o\\x11\\xfd\\x95jc|\\x9br\\xbe'\\xd1\\xce&\\xf8@-s\\x99ihaj\\xc7l\\x0fw\\x0f\\xf3\\xdc~\\xcc\\xbc\\xddw\\x85\\x88\\xbe\\xa2d\\x030\\x19i9w\\xf7p\\x0fy\\xa8\\xec\\x15\\x9f,\\x15\\xea)\\x95\\x9f\thai\\xf4\\x16\\xcd\\xf5*7dc\\xc0\\xd5\\x95pg\\x17\\xb0d\\xd1\\xff\\xfd|f\\x8d\\xcd\\xf5\\xee\\x01\\xdd\\xa0\\x04w\\x04c@\\x89\\x9a2rc\\xf3"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01b\\x9ae\\x92p\\xaf\r\\xb7\\x04\\x06+\\x17\\x8e\\xf3zo@\\xfe\\xc3\\x8f\\xeci\\xef91\\xf5\\xd0\\xba\\x8c\\xf1\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xb3l\\x93>i\\x02f\\xc4g\\xb1\\xac\\xbcz\\xa9\\x92\\x80\\x9d\\xa6\\xec\\xb5\\xb4\\xe2~\\xa1\\\\xdd\\xfb\\xeb\\x89\\xf1h\\xbb\\x13\\x91\\xee\\xfc\\x1cdl\\x97\\x96\\xfa\\x12\\xc9\\x1a03\\xb5\\xe7\\xb2\\x03\\xd36`\\xd5\\x84\\x98\\x84\\xda\\x03 \\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xd4k\\x15\\xd2n\\x1e\\xb6\\x13\\xf9\\x83\\xb3\\x15\\xfc\\xfc\\x98c\\x89y\\xd5\\xb3\n7\\xd8r\\x8f\\xa7hn\\xbbd\\xa5\\x83\\xe5\\xdcfr\\xab\\xce)3\\x171\\x03\\xe3\\xac"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\x12\\x87\\x14\\xab\\x01\\xe4-?\\x10.\\xc2\\xb3\\xac\\xf8\\x96\\xdf\\xa0\\x06\\xeb_\\x87gm\\x93\\xec\\xcc\\x8f\\xe0v$\\xb7\\xe1\\xf1\\xdc\\xa4\\xa7,+x\\x0fm\\xd3\\xddf\\xb3\\xb6\\xb8\\xff\\x87\\xb9\\xa0o\\xe1\\xbf\\xca\\xc0%\\xd9;\\x96\\xf3a\\xd2*\\xeen\\xfe\\xce(xd\\xef\\xa4\\xfe\\xdf\\xa7\\x1f\\x1e\\x98\\xa0\\xcb\\xa8\\x9eux\\x17c\\xf4\\xba3b\\xca\\xe4\\xdd\\xd9\\xc5\\xda!@>=\\x9e\\xf7:5\\xb9\\x13\\x8c\\xf6\\xe6\\xbac\\xde\\x1da/\\x01\\xe8\\xa3g\\xc0d\\xde\\xe9ul\\xed/\\x82$\\x0e\\xf9\\xc8\\xd9\\xb0w\\xc80\\xfd\\x10\\xaf\\xb5\\x92\\xcbl9\\xdc\\xc2\\x9ez\\x93|\\xbe\\xc0\\xe6o\\x93\\x82\\x81\\xa0\\x10'i\\x7f\\xd6\\xa0\\x81c\\xa4!|\\x02\\x14\\xd8\\x98\\x07o\\x82\\xf70\\x9f\\x1e\\x88\\x10\\xbbq\\x9a,\\xf4m\\x1fo\\xb0\\xae\\xcb\\xb6\\x9b\\xaa\\x17r\\xcb\\x071\\xe1\n\\xa0li\\xaf\\x14\\xd3\\xe3\\xb4\n\\xbad\\x81+t)\\xbb\\xf5?\\xab\\xe0\\xa0p\\xf1\\x95\\xfac\\x85q ~\\xee`\\xfd\\xd9\\xb9\\x1d!gu\\xb9i\\xf0*x"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01b\\x9aq\\xfbe\\xca\\x8f\\xdb\\x1da\\x8ca\\xa3\\x8d\\x03\\x17w\\x14\\x80\\xd0\\x018!\\xf2\\xc8\\xd9\\xf0\\xf62\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xa0\\xd4\\xa0\\xf2\\xee\\x8d\\x8f\\xde\\xac->;n\\x08\\x8e\\xd2\\xb5 \\xac\\xdd\n\\xa6`\\x95\\xdf-\\xde\\x7fd\\xfa\\xed\\xdfo\\xdd\\xe0n'7im\\xe4\\x8f\\x08\\x1a\\xbb\\xdb4\\xb8\\xe2\\xc9,*\\x13\\x03\\xaa\\xe7\\x9d~)\\x9e\\xbc??\\xbbl\\xd2v\\xa0\\xc1\\x94c\\xba\\x809\\xa9bi\\xb84m\\xa3#\\xdd\\x9f\\xc4\\xb1\\xc3\\x8b\\x80\\xc6\\x12\\x8e\\x1e\\xbb9\\xf77_\\x8dgz\\xf1\\xef$\\x8f\\x9fyp\\xb0\\xfe\\xdd,\\x04\\xa2q\\xfbs3\\xfd\\xbd\\x98q\\x98\\x01wy\\xbe\\xc2\\xb7`\\xd1\\x9e\\x99\\x8c\\xe66u_\r.\\x03\\x9f\\xe6\\xcd\\xb9\\x07\\xb4lvq\\xc7\\xc6\\xd3\\x8b-\\xb2<\\xdd\\xf0\\xe4n\\xfbfue\\xae\\xacj\\xb3\\xac:\\xad)\\x1d\\x06@\"\\xe88s7w\\xa5.(k\\x84\\xb2\\xe7<\r\\xd7\\xe5\\x1f\\xed.\\xe358\\xdcp\\x10\\xe09\\xf0_\\xef\\xbd\\x85lc\\xc7\r\\x84o\\xa7\\x9eq\\xfe\\x8d\\x9b\\x7f\nw\r@\\xf4\\xe7\\x84\\x9d\\xd7\\x96\\x11\\x9cnkv\\xa2\\xd6\\xf7\\x9e\\x1a"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xcf\\x9b\\x11)\\xec(l\\x84+\\x9fv\\xdb4\\xc5\\xb0\\xb7l\\x05\\xba^c\\xd0?\\x1e(\\xeed\\x106$\\xc6\\x87\\x9c\\x0c\\xdd\\xfaf\\xe8\\xb2!\\xa99\\xbc\\x19\\x06\\xeb\\xff\\xd3\\xa4\\xbc\\xf5v\\xdb\\x1b\\x9f\\xa6\\xbdi\\xa2\\x06\\x8drw\\xbf\\xa7\\xb1w\\xf5\\xc1\\xbapf-;\\x85\\xf0\\x0bd\\xac\\xa1\\x06\\xab\\xbd\\xfew\\xbe\\x85\\xb7\\xa8\\xf3\\xe1\\xc63\\x14\\xbf\\xfb\\xf5:z\\xd4\\x9a\\x81\\xec\\x19\\xa6\\x9e\\x8d\\xf1a\\xe9\\x94\"z\\x1d0\\x05\\xd9\\xec\\x03\\xcd\\xb9\\x93\\xfc'\\xe2\r\\xdf\\xd2\\xe8\\xb1\\xc6j\\xc11\\x1d,\rafr\\xbf\\x03o\\x11\\x92q\\xd6\\x92>\\xbbt9\\x1eib\\xe8\\x1c\\x1e\\xc4\\x94\\x18\nb\\xbbam\\x15\\x05\\x17u\\x81$\\xf1\\x00(\\xfa\\x17y\\x12\\xd7\\x12\\xcbk\\x84v\\xa1\\xcf\\xfch\\x9c\\xe58\\x16c\\xea\\x0e\tg\t-\\xd0\\x16`a\\x90;\\x8bj\\x914\\x94r5ku\\x03\\x95.\\x0f\\xe2*qo\\xfc?$\\x83\\xe3\\x85\\x96yd\\xf1\\xe9&f\\xce\\x93\\xa4\\xd9\\xcb\\xf5\\x8c.\\x84z\\xfc\\xd0"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_h~m\\x08\\x98z\\xa9\\x0f*\\x1e$43\\xea\\xfak\\xa3~\\x9d\\x0cz+u\\xae.w\\x87\\xaa\\x9d#o\\xef\\x90\\x86t\\x82\\xb1\\xad'\\xa3\\xef\\xf2\\xa6\\xc4\\xfb\\xe4\\xe5\\x8b$r\\x7f|\\x89sf\\xa3\\x8e\\xc6a\\xf9\\x1b0\\x86\\xbc\\\\xb1\\xe8\\x92\\x01\\x94\\xe2\\xb2\\xb2_\\x81p\\xdbtgp\\xe4\\xe6\\xad\\xf9\\xb0q\\x87\\xe2\\xd2\\xfa\\xd1\\x17*\"-rq\\x1c\\xf6\\xe0\\xb4\\x19f\\xf0\\x19&\\xcc\\xaep\"qh\\x8d\\xd7\\x8f\\xdfg\\x08\\xb1i`\\x0f\\x1f*\\xe7\\x03\\x0eoi\\x17\\x9c\\xae4\\x13\\xee\\x87\\xf8\\x85,\\xa8\\xcf8nv^\\x8dq\\x9e\\xe6\\xc2\\x03\\x11\\x83\\x03\\x05\\xfe\\xd8\\xc3\\xdc\\xd0\\xa2w\\xcd\\xff\\xf9e\\x85\\x08\\xe5\\x81\\x10h\\x92lr\\x03!v\\x1d\\xeb\\xa0\\xa6\\xca\\xe3apl\\x9fw-\\x8b\\xf3\\xca\\xb90\\x13\\xda\\xf6\\xfe*\\xdb\\xeb t\\x82\\xc8e\\xd2\\x8bf\\x81(\\xb2\\xaa\\x8b\\*s\\x19\\x13\\xea\\x12\\x940\\xcbu\\x80q\\xbc\\xb9_\\xb4\\xc5`\\x9a\\x17&\\xf2\\xc8yca\\x88\\x93\\xd1\\xb5\\xe2\"z>>v"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 18 jul 2019 05:00:49 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  515.  
  516.  
  517.  
  518.  
  519. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  520. "Details":
  521.  
  522. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  523.  
  524.  
  525. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  526.  
  527.  
  528. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  529.  
  530.  
  531. "McAfee": "Exploit-CVE2017-11882.ah"
  532.  
  533.  
  534. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  535.  
  536.  
  537. "Symantec": "Bloodhound.RTF.12"
  538.  
  539.  
  540. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  541.  
  542.  
  543. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  544.  
  545.  
  546. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  547.  
  548.  
  549. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  550.  
  551.  
  552. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  553.  
  554.  
  555. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  556.  
  557.  
  558. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  559.  
  560.  
  561. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  562.  
  563.  
  564. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  565.  
  566.  
  567. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  568.  
  569.  
  570. "Sophos": "Exp/201711882-P"
  571.  
  572.  
  573. "Cyren": "CVE-2017-11882!Camelot"
  574.  
  575.  
  576. "Avira": "HEUR/Rtf.Malformed"
  577.  
  578.  
  579. "MAX": "malware (ai score=94)"
  580.  
  581.  
  582. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  583.  
  584.  
  585. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  586.  
  587.  
  588. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  589.  
  590.  
  591. "GData": "Exploit.RTF-ObfsStrm.Gen"
  592.  
  593.  
  594. "AhnLab-V3": "RTF/Malform-C.Gen"
  595.  
  596.  
  597. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  598.  
  599.  
  600. "Zoner": "Probably RTFObfuscation"
  601.  
  602.  
  603. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  604.  
  605.  
  606. "Ikarus": "Exploit.CVE-2017-11882"
  607.  
  608.  
  609. "Qihoo-360": "susp.rtf.objupdate.gen"
  610.  
  611.  
  612.  
  613.  
  614. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  615. "Details":
  616.  
  617. "target": "clamav:Rtf.Dropper.Agent-7087512-0, sha256:f5b5e8b2e11acc7afc4fb68d6859cb9a0ced369e26255936fa7e14c97725a501, type:Rich Text Format data, version 1, unknown character set"
  618.  
  619.  
  620. "dropped": "clamav:Rtf.Dropper.Agent-7087512-0, sha256:f5b5e8b2e11acc7afc4fb68d6859cb9a0ced369e26255936fa7e14c97725a501 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_cf4c484e82505c3f81a9e81a620a25b7.doc, type:Rich Text Format data, version 1, unknown character set"
  621.  
  622.  
  623.  
  624.  
  625.  
  626. * Started Service:
  627. "osppsvc"
  628.  
  629.  
  630. * Mutexes:
  631. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  632. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  633. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  634. "CicLoadWinStaWinSta0",
  635. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  636. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  637. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  638. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  639.  
  640.  
  641. * Modified Files:
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_cf4c484e82505c3f81a9e81a620a25b7.doc",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_cf4c484e82505c3f81a9e81a620a25b7.doc",
  644. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF61436E6B-4EA7-4988-8103-0DDC165ACC4E.tmp",
  645. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28F1C2AC-9F6A-45D2-AB71-131F79AF28B9.tmp",
  646. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A0D9914-E077-4212-B34B-8B55F170043D.tmp",
  647. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  648. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  649. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  650. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab22DD.tmp",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar22DE.tmp",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\cab35BB.tmp",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\cab360A.tmp",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\cab360B.tmp",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\cab362B.tmp",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\cab362C.tmp",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363E.tmp",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363D.tmp",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3650.tmp",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\cab364F.tmp",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363F.tmp",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3651.tmp",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3681.tmp",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3682.tmp",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3694.tmp",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3693.tmp",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B5.tmp",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B6.tmp",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B4.tmp",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3715.tmp",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3725.tmp",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3746.tmp",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3795.tmp",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37A6.tmp",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3882.tmp",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37A5.tmp",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3910.tmp",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\cab396F.tmp",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A98.tmp",
  681. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A99.tmp",
  683. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AAA.tmp",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B47.tmp",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B58.tmp",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C43.tmp",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D1F.tmp",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E87.tmp",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F44.tmp",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FC3.tmp",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FB2.tmp",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4022.tmp",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4043.tmp",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4032.tmp",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4083.tmp",
  697. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  698. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4054.tmp",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\cab417E.tmp",
  701. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  702. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\cab426A.tmp",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42A9.tmp",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4318.tmp",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4396.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4415.tmp",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43D5.tmp\\PictureFrame.glox",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43D5.tmp\\Content.inf",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4468.tmp",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4446.tmp\\architecture.glox",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4445.tmp\\Basis.thmx",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4467.tmp\\Crop.thmx",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449A.tmp\\content.inf",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4489.tmp\\pictureorgchart.glox",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44CB.tmp\\Headlines.thmx",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4446.tmp\\Content.inf",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449A.tmp\\Metropolitan.thmx",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4456.tmp\\ieee2006officeonline.xsl",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44BA.tmp\\content.inf",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\chevronaccent.glox",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4456.tmp\\Content.inf",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD450B.tmp\\turabian.xsl",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452B.tmp\\BracketList.glox",
  725. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44BA.tmp\\Savon.thmx",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\Content.inf",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FA.tmp\\chicago.xsl",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452C.tmp\\gosttitle.xsl",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452B.tmp\\Content.inf",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4489.tmp\\Content.inf",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4675.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A5.tmp\\content.inf",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452C.tmp\\Content.inf",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4776.tmp\\ConvergingText.glox",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4445.tmp\\content.inf",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FA.tmp\\Content.inf",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4746.tmp\\gb.xsl",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D6.tmp\\ThemePictureGrid.glox",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44CB.tmp\\Content.inf",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4756.tmp\\APASixthEditionOfficeOnline.xsl",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD450B.tmp\\Content.inf",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4706.tmp\\content.inf",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A5.tmp\\Dividend.thmx",
  745. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4746.tmp\\Content.inf",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A6.tmp\\Element design set.dotx",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4776.tmp\\Content.inf",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4675.tmp\\Content.inf",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4882.tmp",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4467.tmp\\Content.inf",
  752. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D6.tmp\\Content.inf",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4706.tmp\\View.thmx",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4797.tmp\\HexagonRadial.glox",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49CE.tmp",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496D.tmp\\content.inf",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4756.tmp\\Content.inf",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4797.tmp\\Content.inf",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A6.tmp\\Content.inf",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD499D.tmp\\gostname.xsl",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49CD.tmp\\RadialPictureList.glox",
  763. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496D.tmp\\Droplet.thmx",
  765. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49CD.tmp\\Content.inf",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AC9.tmp\\rings.glox",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD499D.tmp\\Content.inf",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AC9.tmp\\Content.inf",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4CBE.tmp\\InterconnectedBlockProcess.glox",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4CBE.tmp\\Content.inf",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E94.tmp\\Banded.thmx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD500C.tmp\\content.inf",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E94.tmp\\content.inf",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5167.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5127.tmp\\Feathered.thmx",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD500C.tmp\\Parallax.thmx",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5117.tmp\\ThemePictureAccent.glox",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5197.tmp",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5117.tmp\\Content.inf",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51A7.tmp\\content.inf",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51A7.tmp\\Wood_Type.thmx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5127.tmp\\Content.inf",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD532F.tmp\\Berlin.thmx",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\content.inf",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\Vapor_Trail.thmx",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54A8.tmp\\content.inf",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54A8.tmp\\Main_Event.thmx",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B2.tmp\\Circuit.thmx",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5650.tmp\\content.inf",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5650.tmp\\Slate.thmx",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5670.tmp\\TabbedArc.glox",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5681.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5670.tmp\\Content.inf",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B2.tmp\\content.inf",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD532F.tmp\\content.inf",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D3.tmp\\iso690nmerical.xsl",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5914.tmp\\sist02.xsl",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5903.tmp\\CircleProcess.glox",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5944.tmp\\iso690.xsl",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D3.tmp\\Content.inf",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5903.tmp\\Content.inf",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5914.tmp\\Content.inf",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5944.tmp\\Content.inf",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59A2.tmp\\VaryingWidthList.glox",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59A2.tmp\\Content.inf",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  844. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AFB.tmp\\ThemePictureAlternatingAccent.glox",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B0C.tmp\\content.inf",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7B.tmp\\mlaseventheditionofficeonline.xsl",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7A.tmp\\TabList.glox",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B0C.tmp\\Frame.thmx",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BCA.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AFB.tmp\\Content.inf",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7B.tmp\\Content.inf",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7A.tmp\\Content.inf",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BFA.tmp\\content.inf",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BFA.tmp\\Damask.thmx",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  858. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E4E.tmp\\Badge.thmx",
  861. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFF.tmp\\Equations.dotx",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ECC.tmp\\harvardanglia2008officeonline.xsl",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ECC.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E4E.tmp\\Content.inf",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFF.tmp\\Content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3A.tmp\\content.inf",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3A.tmp\\Quotable.thmx",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FE7.tmp\\Insight design set.dotx",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FE7.tmp\\Content.inf",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6325.tmp\\content.inf",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6325.tmp\\Mesh.thmx",
  880. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  882. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A9A3B170.tmp"
  883.  
  884.  
  885. * Deleted Files:
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab22DD.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar22DE.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4032.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4054.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43D5.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4446.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4445.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4456.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4489.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449A.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4467.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44CB.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44BA.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452B.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452C.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FA.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD450B.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43D5.tmp\\PictureFrame.glox",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4675.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3910.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D6.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A5.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4706.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A6.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4746.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4756.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4776.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4797.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44CB.tmp\\Headlines.thmx",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4043.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4446.tmp\\architecture.glox",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496D.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab362B.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD499D.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49CD.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AC9.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4456.tmp\\ieee2006officeonline.xsl",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B5.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452B.tmp\\BracketList.glox",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab35BB.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4445.tmp\\Basis.thmx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B58.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4746.tmp\\gb.xsl",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4415.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4489.tmp\\pictureorgchart.glox",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4CBE.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\chevronaccent.glox",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3681.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B4.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4776.tmp\\ConvergingText.glox",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452C.tmp\\gosttitle.xsl",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD450B.tmp\\turabian.xsl",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3682.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab360A.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab364F.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449A.tmp\\Metropolitan.thmx",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4756.tmp\\APASixthEditionOfficeOnline.xsl",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AAA.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E94.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A5.tmp\\Dividend.thmx",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD49CD.tmp\\RadialPictureList.glox",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cab362C.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FA.tmp\\chicago.xsl",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3693.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E87.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F44.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4467.tmp\\Crop.thmx",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4797.tmp\\HexagonRadial.glox",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FC3.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD500C.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A6.tmp\\Element design set.dotx",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363F.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C43.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4706.tmp\\View.thmx",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44BA.tmp\\Savon.thmx",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AC9.tmp\\rings.glox",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4083.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37A6.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD499D.tmp\\gostname.xsl",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cab417E.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5117.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5127.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363D.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51A7.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46D6.tmp\\ThemePictureGrid.glox",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cab37A5.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496D.tmp\\Droplet.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4CBE.tmp\\InterconnectedBlockProcess.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B47.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E94.tmp\\Banded.thmx",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5117.tmp\\ThemePictureAccent.glox",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A98.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4675.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD532F.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3715.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3795.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD500C.tmp\\Parallax.thmx",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5127.tmp\\Feathered.thmx",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54A8.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cab426A.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4396.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B2.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51A7.tmp\\Wood_Type.thmx",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42A9.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5650.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5670.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD55B2.tmp\\Circuit.thmx",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5670.tmp\\TabbedArc.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3694.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4882.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54A8.tmp\\Main_Event.thmx",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5167.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D3.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5903.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5914.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5488.tmp\\Vapor_Trail.thmx",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cab49CE.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5944.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59A2.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5650.tmp\\Slate.thmx",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5197.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD532F.tmp\\Berlin.thmx",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4468.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD58D3.tmp\\iso690nmerical.xsl",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5914.tmp\\sist02.xsl",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5903.tmp\\CircleProcess.glox",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36B6.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3650.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5944.tmp\\iso690.xsl",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD59A2.tmp\\VaryingWidthList.glox",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7B.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B0C.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\cab396F.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AFB.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7A.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3882.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cab360B.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BFA.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5AFB.tmp\\ThemePictureAlternatingAccent.glox",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3746.tmp",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7A.tmp\\TabList.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFF.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3725.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E4E.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B0C.tmp\\Frame.thmx",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B7B.tmp\\mlaseventheditionofficeonline.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A99.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ECC.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\cab363E.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5BFA.tmp\\Damask.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3A.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5681.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FE7.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5E4E.tmp\\Badge.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5DFF.tmp\\Equations.dotx",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5ECC.tmp\\harvardanglia2008officeonline.xsl",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F3A.tmp\\Quotable.thmx",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4022.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3651.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FE7.tmp\\Insight design set.dotx",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FB2.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D1F.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BCA.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6325.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6325.tmp\\Mesh.thmx",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60C3.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_cf4c484e82505c3f81a9e81a620a25b7.doc",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1058. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF21C38B3-319B-4FF9-A477-C818A9A3B170.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS28F1C2AC-9F6A-45D2-AB71-131F79AF28B9.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS9A0D9914-E077-4212-B34B-8B55F170043D.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1B5A.tmp.cvr"
  1062.  
  1063.  
  1064. * Modified Registry Keys:
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\d=",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1130105",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1130105\\1130105",
  1077. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1379. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1382. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1383. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1688.  
  1689.  
  1690. * Deleted Registry Keys:
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\d=",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\i|;",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1130105\\1130105",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1699.  
  1700.  
  1701. * DNS Communications:
  1702.  
  1703. "type": "A",
  1704. "request": "muhendismeraki.com",
  1705. "answers":
  1706.  
  1707. "data": "193.70.19.218",
  1708. "type": "A"
  1709.  
  1710.  
  1711.  
  1712.  
  1713. "type": "A",
  1714. "request": "worldbest.duckdns.org",
  1715. "answers":
  1716.  
  1717. "data": "172.82.179.254",
  1718. "type": "A"
  1719.  
  1720.  
  1721.  
  1722.  
  1723.  
  1724. * Domains:
  1725.  
  1726. "ip": "193.70.19.218",
  1727. "domain": "muhendismeraki.com"
  1728.  
  1729.  
  1730. "ip": "172.82.179.254",
  1731. "domain": "worldbest.duckdns.org"
  1732.  
  1733.  
  1734.  
  1735. * Network Communication - ICMP:
  1736.  
  1737. * Network Communication - HTTP:
  1738.  
  1739. "count": 1,
  1740. "body": "",
  1741. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1742. "user-agent": "Microsoft-CryptoAPI/6.1",
  1743. "method": "GET",
  1744. "host": "ocsp.digicert.com",
  1745. "version": "1.1",
  1746. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1747. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1748. "port": 80
  1749.  
  1750.  
  1751. "count": 1,
  1752. "body": "",
  1753. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1754. "user-agent": "Microsoft-CryptoAPI/6.1",
  1755. "method": "GET",
  1756. "host": "ocsp.msocsp.com",
  1757. "version": "1.1",
  1758. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1759. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1760. "port": 80
  1761.  
  1762.  
  1763. "count": 1,
  1764. "body": "",
  1765. "uri": "http://muhendismeraki.com/main/gsmfzt.msi",
  1766. "user-agent": "Windows Installer",
  1767. "method": "GET",
  1768. "host": "muhendismeraki.com",
  1769. "version": "1.1",
  1770. "path": "/main/gsmfzt.msi",
  1771. "data": "GET /main/gsmfzt.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: muhendismeraki.com\r\n\r\n",
  1772. "port": 80
  1773.  
  1774.  
  1775. "count": 3,
  1776. "body": "",
  1777. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1778. "user-agent": "Microsoft-CryptoAPI/6.1",
  1779. "method": "GET",
  1780. "host": "crl.microsoft.com",
  1781. "version": "1.1",
  1782. "path": "/pki/crl/products/microsoftrootcert.crl",
  1783. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1784. "port": 80
  1785.  
  1786.  
  1787. "count": 4,
  1788. "body": "",
  1789. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1790. "user-agent": "Microsoft-CryptoAPI/6.1",
  1791. "method": "GET",
  1792. "host": "crl.microsoft.com",
  1793. "version": "1.1",
  1794. "path": "/pki/crl/products/microsoftrootcert.crl",
  1795. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1796. "port": 80
  1797.  
  1798.  
  1799. "count": 2,
  1800. "body": "",
  1801. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1802. "user-agent": "Microsoft-CryptoAPI/6.1",
  1803. "method": "GET",
  1804. "host": "crl.microsoft.com",
  1805. "version": "1.1",
  1806. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1807. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1808. "port": 80
  1809.  
  1810.  
  1811. "count": 7,
  1812. "body": "",
  1813. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1814. "user-agent": "Microsoft-CryptoAPI/6.1",
  1815. "method": "GET",
  1816. "host": "crl.microsoft.com",
  1817. "version": "1.1",
  1818. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1819. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1820. "port": 80
  1821.  
  1822.  
  1823. "count": 2,
  1824. "body": "",
  1825. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1826. "user-agent": "Microsoft-CryptoAPI/6.1",
  1827. "method": "GET",
  1828. "host": "crl.microsoft.com",
  1829. "version": "1.1",
  1830. "path": "/pki/crl/products/microsoftrootcert.crl",
  1831. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1832. "port": 80
  1833.  
  1834.  
  1835. "count": 1,
  1836. "body": "",
  1837. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1838. "user-agent": "Microsoft-CryptoAPI/6.1",
  1839. "method": "GET",
  1840. "host": "crl.microsoft.com",
  1841. "version": "1.1",
  1842. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1843. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 18 Jul 2019 05:00:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1844. "port": 80
  1845.  
  1846.  
  1847.  
  1848. * Network Communication - SMTP:
  1849.  
  1850. * Network Communication - Hosts:
  1851.  
  1852. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!