API tools faq
paste
paladin316

RTF_c5aa69e61dc2352feacd760764bf6108_doc_2019-07-23_11_30.txt

paladin316
Jul 23rd, 2019
2,343
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 222.85 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Dwsx"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_c5aa69e61dc2352feacd760764bf6108.doc"
  7. * File Size: 77134
  8. * File Type: "Rich Text Format data, unknown version"
  9. * SHA256: "d20391dfea270f4cadf76493cb818021be7d9cb76d7c8f25efcc2bb3794180ec"
  10. * MD5: "c5aa69e61dc2352feacd760764bf6108"
  11. * SHA1: "cb31c494c53222218fba5843da53dc9025d383c5"
  12. * SHA512: "86ea938d9ac13493cabd6f8a5a0efa159ab256685a127664bd488d3c3d14184ee16b0ae39b7effe93462b01470329bdc36c2759c157a93cda8d78299ec674c15"
  13. * CRC32: "582F736C"
  14. * SSDEEP: "768:5mTHqAFtFBONbJqT7GixmD+KNLBb4BkBExBkPrFJpnM+u3+:5BAFUViYC8tb4BkBExBkPxJpnM+u3+"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE",
  18. "splwow64.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "C:\\Windows\\splwow64.exe 12288",
  23. "\"C:\\PROGRA~2\\COMMON~1\\MICROS~1\\DW\\DW20.EXE\" -x -s 2496"
  24.  
  25.  
  26. * Signatures Detected:
  27.  
  28. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  29. "Details":
  30.  
  31. "IP": "52.109.20.1:443"
  32.  
  33.  
  34. "IP": "23.60.72.96:443"
  35.  
  36.  
  37. "IP": "65.52.98.231:443"
  38.  
  39.  
  40. "IP": "23.223.55.43:80"
  41.  
  42.  
  43. "IP": "184.24.187.54:443"
  44.  
  45.  
  46. "IP": "72.21.91.29:80"
  47.  
  48.  
  49. "IP": "52.109.2.18:443"
  50.  
  51.  
  52. "IP": "104.18.25.243:80"
  53.  
  54.  
  55.  
  56.  
  57. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  58. "Details":
  59.  
  60. "ioc": "rame.glox"
  61.  
  62.  
  63. "ioc": "ontent.inf"
  64.  
  65.  
  66. "ioc": "rc.glox"
  67.  
  68.  
  69. "ioc": "ist.glox"
  70.  
  71.  
  72. "ioc": "chicago.xsl"
  73.  
  74.  
  75. "ioc": "chevronaccent.glox"
  76.  
  77.  
  78. "ioc": "pictureorgchart.glox"
  79.  
  80.  
  81. "ioc": "architecture.glox"
  82.  
  83.  
  84. "ioc": "ext.glox"
  85.  
  86.  
  87. "ioc": "ccent.glox"
  88.  
  89.  
  90. "ioc": "ieee2006officeonline.xsl"
  91.  
  92.  
  93. "ioc": "e.gu"
  94.  
  95.  
  96. "ioc": "gostname.xsl"
  97.  
  98.  
  99. "ioc": "gosttitle.xsl"
  100.  
  101.  
  102. "ioc": "rings.glox"
  103.  
  104.  
  105. "ioc": "rocess.glox"
  106.  
  107.  
  108. "ioc": "harvardanglia2008officeonline.xsl"
  109.  
  110.  
  111. "ioc": "sist02.xsl"
  112.  
  113.  
  114. "ioc": "rid.glox"
  115.  
  116.  
  117. "ioc": "..3b"
  118.  
  119.  
  120. "ioc": "quations.dotx"
  121.  
  122.  
  123. "ioc": "set.dotx"
  124.  
  125.  
  126. "ioc": "iso690.xsl"
  127.  
  128.  
  129. "ioc": "iso690nmerical.xsl"
  130.  
  131.  
  132. "ioc": "gb.xsl"
  133.  
  134.  
  135. "ioc": "turabian.xsl"
  136.  
  137.  
  138. "ioc": "adial.glox"
  139.  
  140.  
  141. "ioc": "nline.xsl"
  142.  
  143.  
  144. "ioc": "mlaseventheditionofficeonline.xsl"
  145.  
  146.  
  147. "ioc": "content.inf"
  148.  
  149.  
  150. "ioc": "ividend.thmx"
  151.  
  152.  
  153. "ioc": "iew.thmx"
  154.  
  155.  
  156. "ioc": "adge.thmx"
  157.  
  158.  
  159. "ioc": "etropolitan.thmx"
  160.  
  161.  
  162. "ioc": "rame.thmx"
  163.  
  164.  
  165. "ioc": "arallax.thmx"
  166.  
  167.  
  168. "ioc": "rop.thmx"
  169.  
  170.  
  171. "ioc": "asis.thmx"
  172.  
  173.  
  174. "ioc": "anded.thmx"
  175.  
  176.  
  177. "ioc": "eadlines.thmx"
  178.  
  179.  
  180. "ioc": "uotable.thmx"
  181.  
  182.  
  183. "ioc": "ype.thmx"
  184.  
  185.  
  186. "ioc": "erlin.thmx"
  187.  
  188.  
  189. "ioc": "avon.thmx"
  190.  
  191.  
  192. "ioc": "late.thmx"
  193.  
  194.  
  195. "ioc": "ircuit.thmx"
  196.  
  197.  
  198. "ioc": "g.n9"
  199.  
  200.  
  201. "ioc": "amask.thmx"
  202.  
  203.  
  204. "ioc": "roplet.thmx"
  205.  
  206.  
  207. "ioc": "vent.thmx"
  208.  
  209.  
  210. "ioc": "eathered.thmx"
  211.  
  212.  
  213. "ioc": "esh.thmx"
  214.  
  215.  
  216. "ioc": "rail.thmx"
  217.  
  218.  
  219.  
  220.  
  221. "Description": "Performs some HTTP requests",
  222. "Details":
  223.  
  224. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  225.  
  226.  
  227. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D"
  228.  
  229.  
  230. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D"
  231.  
  232.  
  233. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  234.  
  235.  
  236. "url": "http://www.mectronics.it/images/klmy.jpg"
  237.  
  238.  
  239.  
  240.  
  241. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  242. "Details":
  243.  
  244. "Process": "WINWORD.EXE (3016)"
  245.  
  246.  
  247.  
  248.  
  249. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  250. "Details":
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\xbe\\xcevt\\xb2\\xf3\\xd9a\\x18\\xb5c*\\x8c\\x1d\\xbc\\x8d`\\xb5\\xa7e,m\\xca\\x92m\\xb1\\xea\\x90\\x94\\x1a\\xa7l-\\x88\\x82r\\xe3ic\\xb7\\x95\\xea\\xee\".bs\\xf2\\x08\\xdb\\x0c\\xb9tv\\xc3\\x90\\x04\\x1f \\xc6\\x82\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\x00\\x8a\\xd5\\xa4?%+\\x98\\x0f\\x11\\xaeq\\x060\\xe7\\xae\\xa3\\x12\\xc4g\\x8f\\xb6/\\x08\\xe1\\xf2\\xbb\\x116f\\xf7\\xe2\\xa4\\x95,\\xc3\\x9a\\xe1\\xb9:\\xb8g/yv\\x82\\x8f"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x96\\xc4b\\xc35\\x9f`\\x07\\x99\\x0f\\xea\\x12\\x13p\\xda?3`z\\xfc#n\\xf4$g\\xa0\\xe5\\xf5\ri^\\xe3\\x1d\\x9b\\xd6\\xac\t\\xa1qt\\xa5\\xee\\xe9ag\\xadr/\\xa8\\xb3\\xbe_\\xb9p\\x8du\\x17\\x0b7,\\x14\r\\xac\\xfa'm\\x19\\x19\\xceta\\xe4b~\\x8e\\xa9f|\\xa0:.n\\x00y\\xca\\xacq5\\x15\\xe9\\xe8\\xc0\\x94\\xa4\\xb6.\\x8d\\x89iz\\xfa\\xfe\\xfb\\xdcl\\xa0\\xfe3\\xd4\\xf1\\x87\\xd8\\x91\\xff\\xda\\xec\\x11\\xac\\x8c\\x12\\x1f\\x9a\\xba\\xe8\\xd9\\xb9(\\xdf\\x99\\xb2\\xf0\\x19\\xbbq\\xdc\\xa7\\xde\\x17\\xe6\\xdb\\xd2\\x087\\x89\\xff8\\\\xcd\\xec\\x02\\xdb\\x17\\xd0\\x1by\\xf5\\x88\\xf1y\\xc8\\x85o\\xfe\\x0c\\x9a\\x9a7\\xc1;o\\xa3\\xd0?s\\x1e\\x9cm\\xdf\\x12it\\x83/\\xa6\\x0ee\\x82\\xcft\\x0b&\\x0b\\x02\\xc2r\\xf4\\x99\\x92\\xd3o\\xfcp\\x93\\xc3\\xe1y\\xfb\\xf4\\xabo\\x07jfh\\x858\\x99$\\xf5\\x8a\\xd6\\x04\\xf5\\x87\\x99\\x99\\xd8\\xdd9\\xb9\\xa6\\xd9\\xf5\\xf3\\xa2f\\x94\"b5\\xf7\\x7f\\x81w\\xb5x"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x016\\xe7\\x0c\\x0b\\x06\\xe5\\xd9\\xf5\\x04\\x93\\xa6\\x7f\\x88\\xccr\\x83\\xa0v\\x91\\x93o\\x8f4w\\x97=\\xec|y\\x95\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90\\x89\\xd6\\xa5z\\xe5w\\xe3\\xf74\\x0f\\x86\\x11h\\x07\\x19\\xad\\x18\t@\\xdc\\xac\\x8c\\x14\\x0c>\\xa6\\xe2\\xfe&\\xdb!\\xf7\\x02\\xa7\\x00f\\xe0\\xb8%\\xa2\\xe0\\x0c|\\x15xy\\xc0\\xfebf\\xe2\\xe4=\\x16\\x84\\x9d\\x19@\\x07\\xb5o\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\xb3\\x8b\\xb4\\xbe\\x99\\x14\\xbe\\x9c\\x02\\xf76\\xbe\\x11 w\\xc6_\\xb4b\\xbe\\xb2\\x13!o\\xa4\\xcc\\x00\\xa2s\\xc2p\\x1dl\\x1b\\x1b\\x92%j\\xc8\\x12\\x18\\x01\\x95\\xc8\\x80\\xf2\\xcf"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc2/s`\\xdes\\xe3\\xa2\\x1cp\\xa2a\\x9a\\x8e9\\x84\\x9c\\xf3\\x1e)j\\xb6\\xb5\\xfb\\xf2\\x8f\\xbf\r\\xf3\n\\x83p,b\\xc8\\x92\\xf6\\xfd&\\x1f\\x8f\\xc5\\xcc\\xe0\\xc5\\x8f\\xca\\xc4\n\\xb2n\\x07\\xdd\\x84\\xab\\xdd\\xf5bp\\xd3l\\x84x4\\xa2\\x04ut\\xa4z\\xb1cn\\xcdi\\x1d<\\x1f\\xc8\\xfdh\\xd9w\\x19\\x18#7u\\x87\\xbcr\\x9er\\xe0\\xd9\\xb2kx'\\x0c*q\\x91\\xb7\\xe5\\xf1~'\\x97c\\xcdk\"|\\xe5ci|s|6\\x81\\xe1\\x8cl\\xad\\xa6\\xee\\xbdkq\\xf7\\xa9\\x17\\xe2\\xd1\\xdf\\x8a^\\xc0!\\xa5\\x01m\\xbe\\x8baq~\\x90e\\xffg\\\\x9a\\xa2\\x15%\\x8f\\x92o\\xf0\\xae\\xef\\xf46\\x01?\\xde,\\xa3\\xe6\\xc9\\xfe\\xd3\\x19\\xa1\\xab\\xa9r7\\xca6t98;\\x1br\\x91\\x01\\xd4\\xbd\\x94@\\xec\\x87!\t<\\xc2\\xc5v\\xc3\\xbc>\\xfe\\xfd\\x9e\\x8ed\\xc3\\x93\\x06\\x04\\xa4\\x7f\\xc4\\xc4\\xd4\\xa0\\xf5\\x93!\\(<\\xb8;\\xe1\\x08|\\xad5\\xaan\\xcd\\x84\\xd8\\x06>\\xaa\\xfa\\xee?\\x84\\xc8jn"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xee\\xb1df\\x8a9dt\\xfb\\x07\\x99\\x8dr\t\\xc3\\xf8+\\xd0@\\xbf\\x0f\\xcfh4\\xae\\xaem\\xf3\\xa1\\x900\\x93\\x9c\\xdfa\\xbaa\\xb9\\xe0m\\xb5\\xba\\xb7g\\x9d\\xb6\\x98\\xcb4\\xa3\\xe8\\x0b\\x7f\\x99\\x9bul\\xf7g\\x04\\xc3@%\\t|yo\\xfb\\x08\\xb7\r\\xb0\\x92\\x07/\\x06h\\xac\\xc81\\xa0\\xb1\\x8d\\xe9k,\\xe5s\\xf1\\xe2\\x05~\\x1c\\xf8\\xb9\"\\xb0\\xbd\\xa9o\\x8ex\\x1c\\x8c\\xc4\\x86t\\x95\\x01\\x8a\\xfe\\xf6\\x9ez\\xf6\\xdd,m\\xeetk\\xbd\\xc6\\xe2\\xf3\\x84\\xf8\\xaa\\xec\\x1biw>\\x02\\xe6jul\\x15\\x1f\\xbc\\x10.\\x87=k\\xc4\\xa5\\x11\\xc8w2#\\x8c\\xb4-#\\xdes\\xfb\\xfey~\\xb1\\xed\\xe8\\x94\\xe8\\x07\\x7f\\xfd\\xd4\\xf9\\x9babt\\x0b\\x92\\xb8\\x85e\\xe9q\\xad\\x94\\xd1'z\\xce\"\\xb8ma\\x8e\\x1bbxt%\\xd0<\\xe5:\\xdc%e\\x8d\\xb1#\\xecz.\t\\x98\\xa6f\\xaf\\xfa!q\\xe3\\xac\\xb7\\x0e\\xf5\\x9fgk\\xc0\\xb7 \\xcb|\\x12\\x11\\xd7a\\x96\\xa6\\xf2q\\xd2\\xf5"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x016\\xe7\\x15!\\xb6r\\xeb\\x19++\\x8dcnk!\\xd2\\xdd\\xf4\\xf7\\xc4g\\x08\\xe0<!s\\x91cu\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xfa\\xc2|\\xc4\\xea\\xf8\\xdd\\xf8q\\xae\\x00\\x904\\x80\\xa2\\xda\r\\xe1s\\xd6h\\xde\\x84sw\\x9b\\x96<\\xd0\\xeb\\x13\\xf5+\\xd9\\xd1sk\\xeb.nv)\\xd8\\xbd\\x17m\\xd4\\xf1t\\xb5<\\x0c\t\\x93\\xa9!p\\x8e\\xb4\\x03\\xc8\\\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\xa2\\xa5e\\xd153$\\xbd\\xea\\x96\\xc0(\\xde\\x07\\xf7\\x1b\\x88\\x08>s:m\\xf6\\xb2\\x84\\xa5x+\\xfb\\xd6\\x98x\\xe9\\xbb\\xc7\\xa6fwi\\x01\\xf6\\x96\\xdd\\x81\\xc6."
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p:\\x94\\xc3\\xaf9\\xf8\r\\x99\\xdc\\xbb\\xb0>\\xc8\\xad\\x9f\\xa6\\xa2\\x88~\\xb7\\xcc\\xa2#i\\xae\\x82;n\r\\x1eh\\xaavs\\x8c\\xf6\\xea~\\xc2\\xd5p\\x80\\xb7hb\\x1b\\x14\\xcd\\x86\\x11\t\\x19!g\\xd6l\\x02r\\xcab\\x9d\\x19\\xa7\\xae\\x86\\x1b\\xb5\\xb2~\\x1d\\x9d\\x8b\\xb8\\x1d\\xc1\\xf3\\xf3\\x93q \\xa5\\xea\\xb0\\x13\\\\xc8j\\x91+g\\x14\\xa8\\xc3\\xce\\xaa\\x9cws\\x95\\x0f\\xda\\xd8\\xd5\\xbchi\\xc6\\xfcfo\\xf0\\xf0\\xde\\xfd\\xb9\\xd4\\x05b\\x1c\\xac\\x88\\xd3\\x1e\\x1beg\\xe8\\xb3\\xcfy\\xeck\\xf2\\xa0\\x00cn~f'>?\\x9b\\x07=\\xbb\\xf6\\xd5\\xff\\xea)\\x0c\\x8d\\xdc\\x12\\x82\\xb6\\xf4\\x87\\xab\\xb8\\xc0\\x8b\\xdfl\\x97\\xe4\\x99\\xb1\\xee\\xec0k6\\xb3z\\xcb\\x04\\x029\\xc0\\xb7\\x18\\x95u\\x83\\xcc_\\xe5`\\xae\\xc6\\xb7\\xf2p\\xcdr`\nql\\xc2?\\x9b\\xc1\\xb7\\x13/\\xa7\\x05\\xfa\\x0bx\\xc0\\xa6z\\x13\\x147\\xe2p\\xbc\\xc5\\xa4\\xb7\\xfd\\xf2\\xc5\\xf9\\xae\\x9f\\xcf\\xcb\\xa1\\xa4`\\xc3\\x86\\xf8\\xe4\"<vj\\x86\\x8c\\x98\\xca,"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x016\\xe7\\x1d\\x8d\\x9c\\xff\\xf8\\xcc\\xac\\x8b\\xf7\\x95\\xe76\\xc8\\x85\\x19\\xf2,q\\x08.mp\\x03\\xa1b\\xde\\9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc\\xea\\xd1\\x7f\\xa8\\xbe):\\xaa\\xe8o\\xbct\\xae\\xd1\\xc5\\xb63\\xeex\\x1b\\x0fm\\xef\\xfb\\xe7.\\x1e\\xde\\xac\\xb9`\\xd0z\\xa7\\x8e\\xba& ~r\\xb7\\x90\\xd6-\\x11\\xfd\\xac\\x9a\\xda0\\xbcny\\xf3di\\xae\\x87yo\\xbc|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\x98\\xfdud\\xfd\\xd8|\\x9a\\xb9\\x83\\x99\\xeb\\xd2\\xbdbb\\xe2\\xa8\\x18c\\xeaf\\xd7\\xc9%\\xc4\\xe1\\x17j\\x92\\xe4\\xcd\\x13\\x19\\xe4\\xcf|\\x96%r\\xca\\xf7\\x1b\\xca\\xd2\\x8d\\x8a"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01paf\\xb4o\\xe4\\x13< bq\\x9f\\xfdr\\x0c\\x7fi\\xc8\\xc82\\xf8\\x10nmb1\\xb6\\xec\\x0b)m\\xc3q\\xfb/0w\\xc0\\xa31\\xc4q\\x1edj\\x9ey%\\xe6(~\\x7f\\xb4\\xda\\x05jual\\xa7\\xf7\\xe7\\xf9o\\xfc\\xa3a\\x84#\\x036\\x19_\\xfa\\x99\\xd3c\\xef\\xe6\\x03\\xaa\\xc1\\xb1l\\xe1a2\\x15\\x8f\\xd7\\x02@\\xa7\\xc9v\\xb2r\\x80 pyrp<\\x1aw\\x94\\xf8c\\x16\\x91i^q\\xe2\\x15a\\x8d\\\\xa4\\x15\\\\x98\\x93\t\\x80\\xe5\\x12\\x1ag\\xfd\r\\xdc\\xe5\\x80\\x8b\\xee\\xdf <\\xbd\\x7f\\x10\\xad\\xedw\\xbc\\xcbi\\x8a>?c\\x1d\\xf7\\xe2\\xa2\\x01^\\xc5\\x16\\xd83\\x11uo|\\x8bw#9\\x80-%p)\\x9f\\xe2+@\to\\xa0\\x19\\x1fh\\xc9\\xbfn z\\xf2\\x85\\x17\\xdf#\\xc1\\xc1\\x0f\\xde\\xb0\\xc1\\x16*\\xf5x#s\\xa0\\x82\\x0f\\x05\\xc6\\xcc\\xe1\\x89\\xe7h\\xda\\xb2ln\\x9b\\xc0\\xe1$/\\xe4\\x0cf\\xa3\\xb4f\\xf4\\xab\\x81\\x9d\\x1933s\\xf3\\xf1\\xb5\\xbe\\xdf\\xaa\\x80g"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xd2\\xa5\\xf8a%\\x81\\xd4\\xddo/\\xe7\\xb1\\xff\\x0ff\\xfd7\\x84\\xb9\\xe8\\xa1\\x06\\xc0\\x1d\\x94v0\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xc18\\x01\\xfdq\\xa6\\xfa\\xc1\\xa3,\\xe3\\xab\\xd8\\xa9\\x18.\\xa4\\x14q\\xe4\\xf3!\\xa2\\xab\\xb2\\xaa\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x04\\x058\\x0f\\xa3\n\\xfbr\\xa1nm\\x0b\\xc4f\\x8a\\xd8 \\xeb\\xfaf\\xcd\\x82\\xe4\\xdeu\\x8a\\xb4-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1dg\\x9e@>a\\xf8\\xbf\\xe2\\x92\\xb3vg\\xb4c(;\\xb7\\xa6\\xb2\\xbc<jv!\\x9d\\xb2\\x872\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xa0\\xc8\\x17f\\x9f\\xb8h)g\\x1e\\x1c\\x01\\x0e\\xa2\\xfbl\\x1d\\xa0\\xeb\\x18\\x99\\x07m\\xb7w@\\xad\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xb8-s\\xef\\x92 +;d\\x82\\x9cf\\xf0\\xe3s6\\xb3\\x91\\xd2?\\x85ku\\xd3\\xa9-p\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1ds5o\\xaf 5\\xe2\\xe1\\xc4\\xa8y\\x00\\x8ey\\x06+\\xf4\\x15_|\\xdemh\\x10ti\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d!n\\xfa\\x9dp\\xc0\\xf8\\xbft\\xd9t<\\x02\\xfbh\\x9f\\xd7e\\xc4 2\\xbc\\x1df\\x16\\xc7\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xcc\\x01\\xf0\\xb46ftid\\x17-\\xadd\\x0f=\\xc2fr\\x1a\\xad\\xc1v\\xaf|e\\xadz=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1dn\\x9b\\xcb\\x02\\xcc\\xc0b\\xa9\\xe0y\\x88\\xff \\xb3onm;\\xbf^\\x99\\xb2\\x89\\xf8l\\x07\\xb6\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xffk\\x96l\\xc3\\x1a\\xaa\r!\\xd3\\x7fo\\xf3\\xd9\\xfci\\x8e<\\xea\\xfd\\xd1\\x9b\\x17\\xc3!\\xb8\\xfd\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\r:\\x8a8\\xd9\\xd9rz\\xb71\\xbb\\xea\\xc3\\xcc\\x03\\x9b\\xcc\\x07s\\xe9\\x83\"^\\x13\\x88\\xf0\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x83\\x9c\\xea\\xa6\\xd1\\xe2\\xb4x\\xea\\xba\\x89\\xa4\\xcf\\x9f\\xb6\\xf4\\xc6\\x05j7\\xea\\xb5\\xd3\\xd1\\xf7&=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xaa\\x03\\xdb\\xc1\\xc5$\\xfby\\xefq\\x12\\xb9f\\xbd\\x8a\\x10(\\xc2\\xa7\\xec5\\xb7\\xc1b\\xac\\xf7\\x03\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x12%\\x80\\xbf\\xf3\\x85\\xc3\\xfb\\xf0q\\xfekl9u\\x05\\xe2d\\x10ax\\x1d\\xear3\\x04\\x04\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xa1v%\\xf4\\xae\\xfbb0\\xec\\x15\\xc3\\x8a;\\x19\\x1a\\x1a\\xfd\\xd3\\k\\xdcnb/xk\\xa3n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d*\\xc5w\\x15r\\x8c6h\\x8d\\x82\\x12z\\xc5s7g\\xb1(\\xf0*\\xcf\\xde\\xde\"\\x14l5f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d!^,!\\x05\\x87\\xce)o`ws\\x82\\x8b\\x1c|\\xa1\\x8c\\xdc\\xa7\\x0f(un\\xa1h\\xec\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_v\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1dp\\xe0\\xa6\\x8e2r\\xf4~\\x1b:\\x91u\\xb8#dw,\\xfd\\x80-\\x90\\x99\\x01\\x98f\\x9f\\xf1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xc0\\xac\\xc6\\xdfd\\x80\\x10f?\\xd4\\xabg#o\\xdf\\xa1\\xf6\\xcb\\xb7\\xb3\\xea\\xb1 \\x82\\xd2|\\x7f\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x94am\\xe5\\xa4\\xdfn\\x07\\x90&\\xfa\\xdfn\\xe0\\xb3\\xc6\\x16\\xaa\\x0f\\x89'\\xb9^\\x13\\x7f<\\xd2\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xee\\xb7,o\\xcd)u\\xdf\\xbao\\xbch\\xb1\\xad\\x80&\\x98\\xad7e\\x95\\x0e\\xdf\\x88u2n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x94\\xfe\\xdfu\\xdd\\xe8c\\xeb!\\xfa\\xd1x>\\xd3g\\xfe\\xd8\\xfe\\xeaj\\x0cma\\xd5f\\xee\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1dw\\x99!\\x93\\xcc\\xae,\\xf6\\x8at\\x94f\\x85\\xc7h$gm\n\\x1f\\xa7\\x18\\x1fe`\np\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\r:\\xc4\\x94\\xcfs\\x15\\x0b\\xabzp\\x15z\\xbf\\xb8n\\x8c\\x94\\xf4l\\xedqa\\xdb;\\xcf\\x8df\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xb2\\xa5c\\x88\\xf6\\x9a\\xe8\\x87\\xfb\\xa6\\xb5\\xef\\xd3e\\xae'o\\xcahv.\\x80\\xcb\\xa7g\\x92\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d-o%y\\xa64\\x15p\\xf3\\x8f%\\xd2\\xc1u\\x9e\\xa25+\\xf0\\xbdx\\xcbk\\x11\\x9c\tw\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x1be-~c\r\\x8a\\xfd,\\x84\\xdc\\\\xee\\xd9k\\xccz6a\\xe6\\xf6v%v-\\x00\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x95h\\xd9\\x17u\\xa0\\xe4'\\xe4$\\xae\\xa7\\xf7\\xcf@\\xd7\\xb6z\\x91b\\xbeh4\\xec(i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xba\\x14\\\\x143\\x9ag=\\xfd\\xc7/c\\x17p\\x87\\xb4\\xb0\\\\xcf\\xf9\\xff\\xc7\\xf7\\xd3\\x98^\\xc2\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x1e\\xfb\\xd8\\xb2a\\x96\\xb6\ra|\r\\xf3\\x81\\xa6\\x9cicj\\x11\\xd6y\\xf9\\x82\\xe2\\x12\t\\xabz\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\x1b\\x96\\xb2\\xe3\\xe4\\x8dh\\x7f\\xb6bmr\\x9c\\x10\\x0bh\\xe3\\xd7r\\xec\\xb0b-\\x12\\xcffj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1d\\xfa\\xe1-\\xa2\\x8d&l\\xa0\\xd0\\xbc\\x1e\\xdb%\\xcfm\\xd4|^\\xa1\\x8d\\xf6@j\\xb7\\x9f\\xab\\xa7e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1eq\\xe4\\xee\\x8co\\x7fa\\xa1\\\\xc0\\xc5\\xdf>a\\xf0\\xfdh\\xb2\\x9c\\x84\\x9ef\\xbc\\x8a\\x9f\\x0b\\xd1t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e.\\xa2x.a\\x1b\\xe5\\xa4.\\x85\\x1a`\\x979e\\xc9\\xfe\\x1c\\x17\\xfa>8\\x85\\xf9r\\xd4\\x15\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1ebe\\xaees^\\x18q\\xc7k\\xe8\\x19\\x1f\\x1e\\x9b\\xc5\\xe4 #(\\xfde5\\xce\\xfa\\xd6\\xcd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1eb\\x96:\\x83\\xa4l\\x0cn@\\xe6\\x91n\\xec\\xf4\\x1d\\xd9\\xc3\\xa4\\x98`\\xbeyr\\xd8\\xf5\\xda\\xe81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1eb\\xf3\\xec\\xf2\\x1ew\\xd7\\xa5\\xe61\\xb8h\\xf5o\\xc9\\xa2ww\\x08\\x13\\x15\\x1dy\\xa6\\x86\\xc9.$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xd3\\xfd\\xa8\\xe7\\xf3\\x08\\x9d\\xb5a\\x1b\\xf7\\xffh\\x84g\\xbf\\xdb \tp 1%\\xd6h\\xe5<\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xd1c\\xc7\\xd4 \\x8c\\x91\\x1f\\xea\\xc6\\xc6\\x17~h\\xd9\\xd3$\\x8a\\xa7u\\xb4t,\\xab\\x1a\t4u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xc0c\\x11a8\\x14i\\xbf2\\x03\\xb2\\xbeh\\x89c\\xe6\\xbe\\xbat\\xb6f\\x07.\\x1e\\x1d1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\x8a\\xac7\\x80\\x9d\\x84\\x89:nb`we1\\xc4\\xc4iw\\x8a\\xf1n@\\xf4\\xb1\\x90\\x9d\\xcc\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1eugr\\xd7\\xf7-\\x80\\xb1\\x0c\\x82\\xc1\\x02\\x8d\\xd9\\xaf\\x05\\xbc\\x04.\\xfb\\xd4w\\xf0s~\\x19g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xc6\\xec\\xb0u!0\\xb8\\x11\\xdc/c\\xc4\"%e\\xc4\\xde9\\xca\\x1d\\xdd\\x9br\\xf2\\xe5\\x94t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\x10>\\xcb\\xac*`\\xcc\\x9e)8\\x1e\\x80'\\x16\\xe6\\xd5'\\x06\\x97\\xb0;\\x12\\xe4b45\\xc8\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0e\\xc78s\\xc8\\x18\\x8c\\x819<d\\xf7\\x87\\x9ejo\\xc5d\\x11\\xfb\\xaf\\xf2\\x06\\xa4\\x8e\\xc5\\xf4i\\xa6\\xda\\xe3\\xa0\\x9d\\x86\\x82\\x13\\xa8\\xccli\\xef\\xeb~\\x95kouk\"q\"\\x1b`\\x9c\\xc8\\x94\\xf3\\x95\\xa7\\xaf\\xf4y\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\xb0\\o\\xca\\x11\\x83\\xe0m\\xba99\\x04h\\xb1\\xf6\\x83\\x01\\x8cc\\xa7\\x9d\\x05r\\xdb-\\x83\\xba\\x19w~|\\x85u\\xfah\\xc7t$w9\\x97c\\xbe\\xe9\\x9f\\xb8a"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17$)\\xa9\\x8a\\x8b\\xa5k&\\s\\xbf\\xf7d\\xfd\\x90\\x83a\\=\\x0b\\xbbe\\xf3~g\\xc8\\xb6\\xef\\x9c\\x9c\\xb5d\\xc3\\xda5\\xbf\\x1cnf\\xa4!\\xf3\\xf0\\x04\\x96q)\\xde\\xa6i%\\xdf\\xc5\\x83\\xb9\\xbe\\xcf\\xa49\\x04l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;c-\\xb3q`\\xb4\\x14\\x9d\\x94\\x87\\x1f(v\\xd7\\x11\\x85l*\\xeba\\xaa>\\xcfezn2|\\xdf..m\\x17\\xe3\\x9b\\x96\nk\\x19e\\x98\\x1e\\x04\\x84\\xb1\\xc7"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd75\\xd6\\x06\\x8b$\\x038\\xb4\\xcer\\x06:4\\x8ae`\\xac\\xd3\\x14\\xbd\\x1a1=\\(\\xdep\\x9bx\\xf5\\x08\\x14\\x0f\\\\xa4\\xfb\\xc0\\x95\\xd0\\xbc\\x89t\\x9c\\xe0\\xfe\r\\xc5o\\xa5\\xe3b\\x88\\xc7w\\xd5\\xbfe$g|\\xc4\\xb6\\xb2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x86\\x9b\\x0c\\x9d\\x80\\x962+\\xfad\\xc88\\xd4\\x8d\\xcf\\x95d\\xbe\\x7fm\\xdf8\\x8f\\x8a\\x86\\x04bk\\x99\\x8c\\x12\\xaf\\xd8\\xf4vda\\xe4b\\x8cj\\x9d\\xf6\\x14\\xc2"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xb9\\x1c\\xf7g\\xc3\\xcac\\xcf\\xfa\\x13tb\\x1ey%+\\x10\\xc2\\x1fj\\x87/\r\\xb08q\\xc5\\xf3;bd'z\\x17\\xae\\xcfs\"tg\\x13\\xd9?\\xbd\\xfc\\xef\\xccs\\xe3!\\xc8\\xd1$\\xdc\\xec\\xb5\\xb4\\x8fo\\x84f\\xd2i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\xa8\\xb5\\xcf\\xfft\\xe5\\xe3,&\\x01ge\\xb2+h\\xa8\\x05\\xfb\\xee\\xc8\\x18\\x8b:\\xf6\\x14\\xfc\\xe06lj\\xa3\\x13\\x08\\xd9c\\x00\\xb9\\x8b\\xd0\\xd1\\xd9<\\xc8#\n\\x00\\xac"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04kr:\\xe8\\xf0\\x90\\xb6\\x12>\\x92 \\x16\\xef\\x01\\x04y\\x82\\x99n\\xa6\\x0e\\xfe\\x0c|\n\\xcb4\\x9a!\\x84`\\xe8\\x84\\x15\\xe5nz\\xaa\\xb6\\x9d\\xd5\\x02x$ap\\xd0\\x1f\\x9e\\x07\\xfb\\xe9\\xf1\\x9c\\xf1\\x16\\x02\\xd2\\x84\\xb2\\xac9ws\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3\\xbf\\x92\\xd3-%\\xe0\\xb0\\xcc\\xf6\\x13\\xa0;9\\xa3\\xebs\\xec\\x94\\x7f)\\xfc\\xfe\\xe6%\\x87\\x08\\xbe\\x1e\\x99\\xa4p^\\x16j\\x07\\x17gm\\xa4t\\x1d\\xce\\xd4)\\x8a*\\x8a"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc_\\xa7\\xe5 \\x02\\x88p\\x99\\xef\\xab#\\xdc\\xb6\\x81\\xad\\x8a'g\\x97\\xaah\\x89\\x17r9\\x8a\\xc5\\xb3\\x03qm\\x06\\xfe\\xf7\\xd0^\\xe4\\x17\\xdc\\xe0\\x99b\\x86 \\xb2\\xea\\x05\\x12-6\\xd8\\x9b\\xa3pv\\xb7\\xfb\\x94\\xc3\\x19\\x84;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaev\\xdda\\x9d\\xde\\xc9\\x9er4\\xc0\\xc9\\xf5\\x95\\xc6\\xfeqo\\x06\\x07!\\xa9\\xfe\\x05jp3\\x12\\x94j1\\x89\\x96\\x90\\xce\\x82\\xc5\\x84\\xdc\\xf5\\xdf\\x80\\xe07mp\\xb8"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xcf1\\xd4\\xd6\\xd6\\xcc\\xa3\\xd9\\x01\\xf1\\xccp\\xe70t\\x1f\\xe9\\xdf\\xb8\\xb1yww:i\\xe1b\\xe8,#\\x03\\x05d\\xf3fb\\x9d*\\xb5\\xf5\\xcf\\xd5!\\x0co\t\\x01nld\\x90\\xb58\\xb0d\\xb1\\xcbp\\xd6\\xcfy\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\x16\\x0b\\xa2\\xc4\\xa8#\\xe1_m\\xe3\\x99\\x1f\\x0e\\xb4i\\x0b\\xa8\\xe0wg~t9%\\xc4#t\\xf9\\xd8\\xfa\\xb0\\x02>\\xdcm\\x10\\x07yyo\\xb4\\xa95\\x17/)"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\x1e\\xc2\\\\xc9:\\xf4crs\\x9a\\x15\\x04\\x83\"\\x10\\xb7\\x9f\\xdc\\xbf\\x86\\xa2l\\x19a\\x8e\\xdb8\\x9b\\x86u\t\\xbfd%\\xde\\xad\\xc6\\xc1\\x9b|\\xd0\\x8b\\xa3\\xe2\\x02\n\\xf8$_\\xf27\\xecv\\xb82ts\\xb9\\xbb\\x18ai\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\xd1no\\xee\\xae\\xa4*\\x87\\x810\\xa5\\xa0s\\xf5\\x1dou\\x82\\xb8ll\\xf5\\x07d\"\\xa4\\xbd\\x93\\xa5\\xea\\xa6\\xdb\n\\x10\\x9cxfj\\x1bm\\x1aef\\xcb\\x00"
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\xd0\\xc8%\\xdfi\\x02\\xf0q\\xd4\\xeac\\xc9\\x8bxen\\xb8t\\x06\\xe7\\xf5\\xd6l8g<z\\xca\\xed\\xd0\\x0bx\\xdc\\x1e\\x8e\\xe0\\xcb\\xa1\\x8d_\\x83\\xc1\\xc3\\x1e\\x7fw\\xb3\\x06\\xf6\\xc1\\xc8c\\x9c\\xe9\\xc94\\x9a\\xa8\\xd4\\x1fug\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|j\\xd4l\\xc6e\\xf4\\xc8\\xe4s\\x02\\xbbx\\x10\\xdf?\\xedj\\x83e\\x93\\xbdj\\x086\\x94sv\\xafl\\xb3:\\x81p\\x1dw\\xd8\\xbd\\xa2\\x1b!\\xf4\\xb7\\xfd\\x17z\\xbe/"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0p\\x1f\\xe5\\x15\tb\\x04\\xf2\\x8d\\xb4&vr\\x1b\\xb4mj%\\xa7ru\\xd7\\x07(\\xc0\\xbf~\\x1bw\\xd9\\xfc:\\xbap\\x14\\x86,\\x03\\xf1\\xac\\xf7\\x9a \\x8a\\x1c\\xbd`\\xde\\xde6\\xbd\\x9a\\xe0\\x1b\\xeb1\\xcb\\xdc\\xd0\\xee\\xd1\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\x03\\xdc\\xef`\\xa5\\xe3>\\x0e\\x0csx\\x93\\xf7\\xc2\n\\xfd\\xba\\x85\\xf2\\x95<z\\x7ft\\x13\\xb4\\x15\\xaa\\xdfi\\x8b\\xe5\\x9a\\xbf\\xb4`\\xf2\\x7f/v\\x89r>kp\\x00"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a+\\xf4\\xbf\\x9e\\xb5\"\\x8d\"\\xcbjb\\x1d\\x01\\x8d\\x82f\\xf9cqw?\\x04\\x10\\x19\\xcc\\x86(\\xe3\\x12\\x8d\\x06\\xfatw\\x0b\\x9f\\xb3dd\\xa0\\xa2\\xd9\\xce\\xb3\\x03.7\\xcf\\xfc9!\\xed\\x98m\\xc3:\\x07\\x01\\x8ad\\xf8`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaej\\xf1\\xfa\\xa9m\\xf0\\xa6\\x16\\xb9. -\\xbc\\xbf\\x82i\\x9chf\\xbfr\\x11\\x94\\xa17\\xb3\\xe1\\xfd\\x86\\xcc\\x8dt*\\x05\\x08\\x89f\\xb7+\\xc4\\xb3\t7w\\xf8\\xf0\\xe1"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\x03\\xadxi\\xb3\\xa4\\x8f3v2\\xad=8\\xe2\\x96\\x1c\\x82vf\\xe1\\x1a\\xb6`\\xbb:rr(\\xd6\\xfd\\x06\\xd9s\\xba,\\x11\\xd2\\x05?\\x06\\xc1\\x88b\\x04\\xc4\\x00\\xff\\x8d\\xf2t\\x9d\\x12i\\xda\\xcc\n\\x12\\xf3\\xde\\xd2\\x87p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce.\\xed\\x895\\x8b\\xcb\\x11\\x96u\\x14\\xea\n\\xd7-7\\x969<v\\xbe\\xfd\\xd0\\x14t\\x00\\xdc|\\xd1\\xbfitc\\xb2b\\xb4*\\x8b\\x9ew\\xde,\\xc7\\xc1i\\xfa\\xe7."
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*'\\x8aj\\x11k\\xd3=\\x89\\xb0\\xd8(\\x0f\\xe1\\x83>v\\xba\\xa3#\n\\xee\\x13\\x80\\x02%wn\\xa9s\"w!\\xcd\\x05\\xbd\\xa9\n\\xe5\\xc6\\c\\xce\\xbe\rl\\xc4\\xd0h\\xe5\\x1d\\x06^\\xb7b\\x8er\\x14\\x9by\\xdedw\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x99\\xe2\\xc2\\x9c\\x88\t\\xc7la\\xff\\x03\\x1dc\\xf7s\\xbale6\\xc3\\xcep\\x9a\\xc5v\"\\x1efu\\x88\\xa3fa\\xbc\\x9c\\x82?2\\x1d6+z\\xf0\\xb7.\\x8e"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa2q\\x8c\\x02<,\\xdf\\xe9\\xf9\\xc4v\\xa2\\xdb\\x01\\x12)m@\\xaeuj\\x85\\xeff\\xf0\\xa4\\x936\\x00\\xe7\\xa6\\x01`\\xa0,\\xa7\\xf8\\xdcu.izw\\xcagcv\\x9d\\x99x\\xe1z\\x02)lra\\x91\\x86\"b\\x9c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6#\\xce\\xcf_5l\\x9d\\xe1r=\\x96\\x12\\xaf\\xd7b\\xce2\t\\xa9\\xb6\\xb3\\x0e\\xb2\\x0b\\x00\\xce\\xd6\\x8c\\xfe\\x95\\xcb\\xa18\\xa7\\xc0#\\xd3a\\x84\\x90.\t*'\\xef\\xef"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9dc\\x14\\xf49\\x0f\\xa1ig\\x98c\\xa8\\xfb\\xa4\\x05q\\xd1*tmo\\x94\\xa0*\\xfbx\\xa8\\xb8vgbt0s\\x99\\xc7\\xb6\\xf3d\\xaat\\xad\\xaee\\x88\\xea7\\xfd\\xbfm\\x9b\\xb0r\\x0cs\\xd4\\x8a\\x1b\\xb2\\x10\\x8d7\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004\\xbd\\xc7\\xb1\\xb8\\x0ch\\xa57\\x95\\xd3)w\\x19\\xafu\\xed>\\xec\\xad\\xbe\\xcbg\\x91a=\\xc0\\x8co\\xff\\xc5\\xdf\\xf2\\x1dr\\x92\\xc1\\x8e\\xdb,\\xebj\\xe5\\x1e\\xf1\\xd8_"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xce4\\x87\\x0b(q\\xbc\\xc4\\xd7\\xe7\\x1fn\\xdb\\xdc\\x94qe\\xf7\\xe6\\xa9\\xe6s\\xa9`\\x81\\xdb3;\\xc8j\\x11\\xd1\\x84\\x87g\\\\xd2\\x89*\\xaa\\xf5\\xa4\\xbd\\x9b$c\\xc8\\xe8\\xa6\r\\xf5\\x8a\\xd8a\\xce;f\\xcc\\xb1\\x03\\x02\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xeb\\xc6p\\xc8\\xf1\\x9dhp\\xa0\\x9a\\xc5b\\xcf\\x1e\\xe9ly)z\\x97r\\xe7\\x89l\\xcb\\xc3n\\x81(\\x82\\xe4\\xdbj\\xd8vw3r8 xch\\x96z\\xb2("
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x0e\\xbak\\x89\\xc6a\\xa3\\x7ffz\\xc1\\xde\\xd6i \\xe3q\\xa7\\xbbd|\\xca\\xe7e\\xd3\\x83\\x18\\xa6\r\\xd6.\\xb8%\\x98h\\xef\\x18\\x00\\xbbzn\\xfd\\xca\\xfd\\xb6^\\xb1d\\x0c8\\xe2x\\x82\\x02\\xab7\\xd3\\xaf\\xe7\\xf6\\x0b\\x8dh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2\\xaa\\xda\\xdaz\\x9e\\x9ec s3\\xcf\\xfd\\x85p-\\xc4\"\\x0cb\\xbb\\xc9u\\x04\\xb6:\\x0b\\x1e\\xea\\x01%\\x0bnf_\\x8b\\xbc\\xc8\\x16\\x90\\xe6\\x92\\xfb\\x9e\\x95,&"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xd2\\xd0\\x85_\\xa8_\\xf3\\x93&/\\x194\"\\x13\\x989\\xbee\\xfd\\xb2\\xcb\\x18\\x00^t\\xc6zd\\xa3)\\xf9\\xeaz\r+\\xcal~ru\\x8dsl\\x1c\\x87\\xa5\\xb9\\xd5\\xf5\\x8d\\xab\\xb5\\x88\\x03\\x0e\\xc7pqd\\x03\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2?_\\xb2\\x01pn+\\xdf\\x84\\xbe\\xc3:\\xd4%\\xf8\\xe1\\xeb\\x04pw\\xef\\x82\\xeb\\xcer7\\x8bd\\x96\\x0fo\\xce\\x12\\xf4\\xf9\\xd0o\\x0e\\xeb\\x7f5\\x17e\\x88\\xde\\xd0\\xf3"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\x15\\xe9%7\\xd1x\\x02\\xb7\\xb0\\xd6\\xa4z`\\xa07s\\xe6)$o/\\xccl4\\xc5:\\xfb\\xa4\\x10\\xd4y\\x81c\\x01\\xf9\\xbc\\x1a\\x90\\xc0\\x92\\x94\\x036\\xb1-(2\\x84xg\\xba\\xb31\\x01\\xb2\\x8e\r'\\xafb\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3a\\xb2\\xc7r<\\xe3\\xcb\\xad+\\xfb\\xcbr\\xaa\\xb9\\xee/h\\xc99\\x1d\\xc974\\xd9\\xb8\\xb0\\x8av\\x17\\x1b\\x86s\\x80\\xfbre1\\xf1cy\\xfe\\xae\\xf4\\xe1\\x83\\xfe\\xc1"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x15\\x17ha+\\xe1<\\xe6\\xbb\\x0ee\\xdeec\\x93\\xa3\\x85\\xb8y\\xaf\\xf7\\x95\\x99\\xbbm\\xb7)\\x1ezy\\x8c\\x8e\\x1df\\x0cwfi\\x92q\\x9c\\x99\\x19\\xa0!'s\\xa4bp\\xd8\\x84\\xe4\\xf3/\\x8f\\xb6\\xa0s\\xbd\\xd0go\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\x1b\t|\\xfe\\xd1\\xc9\\x9e\\x87\\x8bw\\xd7,5\\xaaly\\x17\\x16\\x18`xf\\xae\\x0by7\\xcb\\xfa\\xe4\\x99\\xec\\xb6\\xab\\x8a\\xde@.\\x11\\x88^\\xb7\\xe7\\xed\\xa9\\xdd\\xe7\\xad"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd99\\xa3cy\\xa0\\x1a\n\\xc7\\xe3\\xb1\\x16=\\xc9\\x99\\xa0,\r\\xe6\\xed\\xb7\\xa9\\xd5\\xf1i\\xd2\\xa9-\\xbd\\x004p\\x9d\\xd6\\x01gc\\xef|_q\\xbc\\xe7j\\x18\\x88rk\\xa5kg \\x83\\xb6z\\x9b\\xc6\\xa1\\xe0\\xbe\\xe2\\xea\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004\\x13p\\x80\\x82\\x8d8b\\xbf\\x02f\\xc3\\xcd\\x07-\\xc0\\xcb6\\xdbi\\xec#\\x9a\\xe9\\x02hn\\xf2u\\xe3\n2\\xd8v\\xfb,?:\\xd5~l\\xa9\\x9d\\xe3'm\\x0fx"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xc1\\x1fz\\xc3*\\x7f\\x01\\x8b\\xe6.s\\xc3\\xd13\\x9b-\\x04\\xe5\\xc5\\xf3$8.\\x17\\xf9m\\x8c\\xc6\\xc99\np d\\xcc\\\t\\xcf\\x179d\\xe6\\x99\\xfap\\x17\\xa0\\xae\\xa5\\xab7/\\xda~\\xd7\\xa7\\xa7\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r3b%\r\\x01\\xcdat\\xfa\\xec\\xc3\\xae\\x1f\\xb1\t\\x82\\xa6\\xc6\\x1a\\xd1(\\xb6\\x12\\x01\\x9b\\xd2oy>\\xf7\\x01j\\xcb\\x87\\xd9o\\xed\\/34\\xd2:\\x95\\xef\\xa3\\xdf"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x87\\=i\\xd2\\xc3\\x06y\\x02\\xa6%4\\xc2\\xa3\\xbdx\\xe9\\x06\\x12\\x7f\\x92\\xa7\\xd4\\xae\\xe4\\xb1\\xb0\\x8au\\xcc\\x1f\\x16\\xf8;\\x01de3\\x1e\\xa4\\xe7g\\xeao\\xfdv\\xb8\\xdamz\\xc0/\\xef?\\xea\\x05\\xa0\\x1b\\xf9\\x1e\\xe9y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xfahele\\xb55h=0\\xcc\\xa3\\xdd!e\\x89$\\xfe\\xa4\\x9a\\xf4\\x86$u\\x94\\xad\\xd4\\xbfz\\x9c\\x93m\\xbc\\xaby\\xe4\\xc0f\\x1d\\x11fvjr\\xaco\\xc6"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046\\xb1\\xc1m\\xfct/\\xc04\\xc5\\x052=7ee\\xe5h4t\\xbe1\\xbeb\\xc9\\xf8~n\\x89\\x06i\\x1f\\xe8\\xe7\\xd4,\\x99\\x7f_\\xf8#kd\\x19y\\xa8\\xbc\\xaen!\\x8f\\xed\\xe9\\x85d\\xa1\\xf5f\\xfa\\x9d2\\x93d\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8fi\no\\xfc~\\x8a\\xed\\x02\\xf4\\xe6\\x13+*\\xd2\\xcev\\x100\\xbd\\xf95\\x88c\\x81k\\x98s\\x0c\\xe4w\\xdb\\xefg\\x85\\x05\\xed\\x10r\r\\xa3\\x83\\x8c\\x1ej\\x06r"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee:\\xcf\\xd5g5z>\\x9a:0\\xb6)\\x92>\\xb9f\\xfdh\\xc0l&\\x07\\xffut\\xbc\\xa6_\\xf0\r9y\\x10\\xcc\\x04\\x19\\xc7;\\x970\\x97\"\\x9f\\x1f.\\xd9\\x985\\x81\\xbey\\xe3\\xb6\\x15\\x88\\x8f\\x1d\\xcf\\x1bs\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x105\nx\\xd4\\xa1\\xd4\\xc8\\x87?\\xccj\\x1ei=\\xd0\\xfd\\x1f;\\xb6\\x82\\x00\\x84!\\xb2\\xcc\\x8c\\xf2\\x8d\\xea\\xd9\\xb08b\\xd3\\xc4\\x92!\\x838\\xa0\\xec\\x11\\xd0\\x1a\\xc2\\xfbt"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xc6t\\xf4\\xc0^\\xba5p\\xfcf\\xb5\\x895\\x0e\\xa6b\\x0ba_2\\xa1\\xcc\\x88\\\\x8e\\x94t6\\xb8u=\\xe1\\x19\\x97~\\xe4o\\x05w\\x7f\\x1e\\x85l\\xa7\\xc7z\\x88\\x9c\\x88+\\x18g\\x0b\\x84\\xf3\\xb3\\xe0\\x8e\\xca\\xd1\\x82v\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xbe\\xb0\\xea\\xcf\\x04j#+\\xf8\\x1b\\x12v$'\\xdb\\xad\\xe5_z\\x92\\x1d\\x18!g\\x15\\xe39\\xc2y\\xca\\xfe\\x07\\xf9i\\xaf\\xbe\\xee\\xdb\\x8f\\xbd\\x1b4\\x04ff/\\xbd"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\xc7\\xc2\\x86l\\xac\\xa5\\xe0\\xf1\\xdd\\xd3\\x80\\xad1i\\xba\\xaa\\xd71m\\x1b\\xa3\\x0ba\\xd8\\xd6h\\xce\\x87\\xb2\\x19u\\xea\r\\xf8l\\x1d#2\\xc4a\\xd0\\x91\\x050\\x03\\xf9\\x12gn\\xb6\\xef\\x14\\xa2\\xca\\x87\\x01&\\x99c\\x9e\\xb2\\x01\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcac\\x084z\\xb6\\x87\\xe9e\\xe3y\\x06.\\x9a\\x06:_\\x19\\xb7m\\xd2\\xa0\\x0f\\xb7eb\\xbe\\xd8\\xb6\\xf4b0-\\x159\\xb9\\xd5\\xd0k\\xbcj\\xf5o\\x12\\xcam\\xa9\\xd7"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10j\\xdb\\xc4\\xbb\\xd8\\x93\\x9d\\xed\\x06\\xde\\xf14\\x94\\xe4se\\x04\\xd8\\xb2\\xd9\\x19\"r\\x98r\\xb5\\x17\\x87\\xfel\\xad\\x13\\xfb~\\x97tc\\x9a\r\\xf3\\x82u\\xdf\\x01\\x01\\x13\\xe2\\xce=\\xf16\\xe5\\x7f(\\xbf\\x19\\xd7\\xc1\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xe8f\\x85\\x84\\x15\\xc3\\x10\\x89\\x82\\xee\\x0f\\xeef\\xba\\xd5\\x99:\n\\xab\n\\xc8\\xec\\x03\\xb0\\x968\"\\xacp\n\\x7f\\x9c\\x04\\xbe\\xfb\\xeaf\\xf1f1s\\x12#7\\xb7_"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc.\\xbb\\xdc\\x18y\\xf1\\x85\\xcb~\\xc2\\x13.\\xd9\\x94\\xd4f\\xaf\\xc4\\x15\\xf0<\\x19aef\\xc1scy\\x0b\\x8a\\x90k\\xe8\\x16\\xfc\\xc5\\xc5s\\xad7lo\\x01\\xf5gq\\x88\\x19\\xe3\\xe1`f_o\\xe2\\x8e\\x07@m\\xa3@\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xe9\\x0e\\x9b\\xf0\\x12l;<\\x89\tfy\\x97\\xdc\\xe6\\xc00\\x8a^%\\xef\\xf0\\x99\\xfd\\xf7\\xb2c\\x1b\\x84\\xd5\\x02\\xb2e\\xe8_\\x97\\xa3\\x07\\xa7\\x0f\\x9d:|\\x93"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\xe1\\x83\t\\x84\\xe55i\\x15\\xa0\\xbc1\\x8a\\xda\\xfa\\xb6%\\xf7$e\\x9et'%s\\xd5\\xa3w,*\\xac*\\xc3`\\x80\\xedsp;\\x11w\\x8f\\xfe\\xf7\\x1dm\\xfd\\x90\\xb4\\xd4\\xb6\\xa5~\\x82l\\xb4e\\x12\\x92\\xb5?=\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002\"\\x9df\\xd4\\x8cy3q\\xbf\\xba\t\\x9ec\\x90\\xfc\\x99i\\x17\\x83\\xb4\\xfa\\x11lt^)\\xc4\\x95\\x16\\xb47k2.:`\\x9b\\xcb'\\xd4\\xa29\\x14\\x99\\x1d\\xc2"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j,c\\xef\\xdck\\x0e\\xcd84\\xb2w\\xec\\x80t\tr\\x85\\x7f\\x04\\x90@'\\xd3\\x9d\\xa2l\\xdf\\x06\\x07\\xfd\\xd2\\xed.\\x82\\xfa\\x04c\\xea\\xb4=\\x05\\xebt\\xf0\\xe3;\\x05\\xbdj\\xe38;7#'-\\xbe\\xd8p\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000rkq\\xbf\\xa8h\\xb3>?\t0\\x08\\xc9\\x0e\\xe7#j\\x17\\xbb\\x13\\xea\\xbcgy\\xa5\\x81\\x93\\xdb\\x04mr\\xe1g\\\\x9f\\xd2\\xab\\x9f6cj\\xe1t\\xe5\\x17x"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!~\\xb31\\xeb\\xdc\\x82\\x90\\x9c\\x94o\\xc5\\xfd\\xd0c\\x0f\\xf7k^\\x13\"`l\\x0e\\xbd\\xef\\xf7l\\x12\\xb0\\x8f\\x91\\xfa\\xd1\\xc0`\\xfa\\x0e-\\x02\\xdc\\x80\\xa6\\xee\\xae\\xf37r\\xff\\xc6\\xc9\\xd2h\\xa9\\xef\\xed\\x12v\\xa1\\xde\\xcc\\x0bt\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\x81\\xae4\\xd6\\x9e\\x0e\\xba'\\xfc\\xbc\\xe0\\xb7\\xd0:e\\x8c8\\xa2\\x83\\xba\\xfe(l\\x8dt\\x84\\x9e\\xd7fw9\\xcf\\xf3)e\\x0c\\xcb:\\xf7\\x8ak\\xd0\\xa3a\\x97\\xbe"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\xaa\\x1b\\xa8\\x19\\xe2r\\xa9\\x17)\\xda\\xee\\xf5\\xa0\\xfa\\x1c\\xb8\\xd2\\x99\\x1b\\x0e\\xb70\\x8f\\xa9\\x8c\\xdc\\xa24\\xc9\rrri\\xc5-vn\\xed\\xf9,~\\x94\\x9f\\x8ao\\x8c\\xed\\x8e\\x9d\\xf8\\xeag\\x109\\xb7c\\xc9\\xde\\x90-m\\x8d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000xq\\xd1x*w\\xfe\\xaf\\x84g\\x80\\x8d\\xc6\\xf2z\\xde\\x92\\x99j\\xc83\\x80\\xc1e\\xfa7\\x8e\\xb3h\\x8fi%\\xd1_bf\\xc5\\x89\\x84\\xefw\\x04\\xeb\\xbe\\x1a\\xdf5"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\x88 \\xa8\\x84e\\xcf\\xe1\\xcd_\\x8b\\xe2!\\x012\\x924\\x8au6\\x01\\x16<\\xbc\\x19\\x8f\\xab\\xeez\\x99\\xd9_9\\xc1\\x8bd\\x9e\\xf05a\\x94\\x94\\x80/\\xd7\\xed\\x89&\\x98\\xaa\\xee\\xd5)bw#\\xed\\xc6|\\x9e\\xb1\\xe9\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xaf\\xfb\\xe5\\x1f\\xcd\\xea\\xe7m\\x93~\\x1f\\xd0\\x1e`\\x98i\\xc8 \\x8c\\xd3\\xff\\x91\\xbd\\x98\\x14\\x0b\\x14\\xb1\\xd1d\\xd9\\x94\\x9d\\xbdn\\xbd3\\xaa.\\x0b\\xa0\\xb0x\\xef\\xff"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0j\\x82\\x9e\\x07\t\\xc5\\xf5y\\xb2y)dp\\x882v%\\xbd?5\\xd0:\\x1a\\x8f\\xa4\\xebg\\xde~d*\\x07\\xd0\\x95+\\xd2v\\)6\\xb7sx\\xdf\\xb6vi\\x12\\n~\\x8a\\xd0\\xc5\\xef\\x90\\xb9l0\\xb4\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=\\xc3\\x84\\x9b\\xa8\\xda\\xa7\\xc9q6>\\x96a\\xd1w\\xa4\\x92a\\xcce\\xd1\\xb7\\xbc\\xe0q\t\\x9a.\\xf4\\xca\\xab\\xc9\\xef>j\\x95\\xa1\\xacs\\x99\\xb0\\xcaibj\\xda\\x88"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12\\xb9!\\x1d\\xbb\\x94v$\\xa9 j\\x87\\xcf\\x16h<\\x82\\x8e\\x14-ux2p\\x98\\xe2\\x85\\x00\\xc6\\x08lr\\x80\\x9cl#\\xf5\\x8d\\x13\\x94\\xe3\\x1e\\xfc\\x9a\\xef\\xdc\\xd1\\xda\\xe7o\\xb1\\xe6\\xdeb\\xb6\r\\xa6\\x10\\xcb\\x96g\tr7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\x7f\\xb3\\xde\\xe2|\\xf6\\xf1\\x9b\\xb2\\x80\\x1b\\x90\\xbc\\xe9ly\\xef\\x8a\\xee\\xe8w@\\xfa*\\xf5r\\xdb<\\x8c\\x8e\\xf4\\xa6\\xdd\\xa1\\x97c\\xb1*\\xfdh\\xf7&\\xbb\\xa6\\xc1\\x10"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc\\xcc1\\xd4\\xaf+\\x87\\xc1w\\xe1\\xa55\\x99\\xdd\\x90\\xc0n\\xcat8@\\xa0\\x18\\xad\\xeb\\x7f\\xf0!\\x01hb\\xe3\\xba\\xb2\\xd6w\\xee\\xce\\x1d\\xd5\"m\\x03\\xed\\x80\\xc5\\xf3\\x98\\xacj\\xaf\\xdf'\\xcf&l0\\x91\\x18\\xeb\\xa1\\xe2\\x9f\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000oe\\x80\\x8d\\xf7\\xa9\\xc6\\xc1\\xe6nk\\x93\\xff\\x87<\r8\\xa7\\xc3\\xcc.1\\xde\\xdf\\xaa\\x8c\\xd1r\\x11\\xd4\\xe3 \\x16\\x9d\\x97xi\\xc0\\xb9b\\xd10(:\\xc8\\xf5\\x9b3"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\x91\\xbc\\x9da\\x0b\\xd7\\x02\\x01\\x13\\xcc\\x86\\x11\\xcby\\x87\\xcd\\xc6e\\xc1\\xd6;\\xb6?\\xb7u\\xd9ai\\xa7ky\\xf8\\xc7v\\xaa\\x0f\\xefr\\x8c\\xdaq\\x01j\\x12\\x08nl\\xf3 \\xbe\\xf9=\\x99\\x7f#r\\xa0\\x96\\xa9\\xc2r\\x05\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003q\\xa8\\xc5q\\xdf\\xe4$0\\xe5e\\xc4\\xc7^\\xa1\\xc0rql\\x82sm\\xd4\\xda\\xb2\\xa4\\x8c5\\xc0\\xca#\\xe4\\xf3\\x00\\xf4(\\x19\\x97v\\x0b\\x87\\xe5\\xc7\\x0bb\\xd5\\xce\\x8e"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xb1\\xaf\\xd5\\xcc\\xbdw\\x7f\\x91\\x9b\\xea\\xac\\xf3z\\xbc\\xb0\\x17\\xf2\\xad4\\x04%c\\j\\x90\\x06\\xee\\x81\\x984\\xe5\\x9b__\\xd7\\xf5\\x0f?\\xcb\\xdd\\x8e\\xa3\\x87 \\x95\\x86\\xe6\\xff0\\x00v\\xfb\\xd2\\x9b)a\\xb9\\x1bd\\xd0\\xe4\\xd9\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*dn\\x12\\x9er\\xd9\\xf9s\\xfd\\xe0ja\\xb1\\xafj*7\\xd16\\xf0r\\xe5\\xe1\\xff\\xea\\x9b\\xee\\xa6@\\xffl\\xfb\\x0f\\xb8\\xb4\\x13e \\xb1(\\x90\\xd1\\xf61b\\xa3"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z*\\xdd*\\xb2\\x95\\xe1\\xe3\\x9esp\\x99\\xd6\\xadq\\xad\\xf4\\xf7`\\x8bq\\x86\\xee\\x03u\\xf9\\xe0q\\x8f\\xbd\\xe7o<\\xc8\\xd5;\\xba\\xcf\\xbd=\\xf1%\\x7f\\xdfk\\xd6(#\\xd6\\xd2\\\\x91\\xad\\x83\\x8c\\x1c7\\x02\\xa2\\x0e\\x02\\x83\\xf7\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7#w;*'.\\x1d\\x85\\xb2\\x7f\\xad\\xe3\\xd3\\xe7\\xf4\\xcd:d5ez\\x08\\x0f\\x04\\xf5\\x19\\xa7\\xbc\\xc3\\x94\\xc8\\xe4\\xac+\\xa6&\\xbd\\x9c\\xfd\\xd2c\\xce\\xf6p(mh"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\x85\\xe3\\x80\\xa6n\\xfe\\xccb\\xef8\\x16\\xa5m\\xa7\\xab:\\xaa\\xb8\\x9f@\\xcc\\xa0q\\x04\\x1b\\xd2\\xf3\\x96o\\xcc\\xf3<w\\xd7\\xd7\\xdf\\xbf\\xc7\\x1b\\xbambt\\xb1\\xa9/w#h=\\x85`\\xed)\\x8d\\xfbt\\x94\\xa3w\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xd4>\\xaf\\x85\\xd5t0yzp\\xfb\\x9fc2\\xa0\\xf6\\x06\\x19\noz6\\xeb\n\\xdf.\\x85\\x0e\\xb5\\x11:\\x0c\\xae\\xb7\\xa1xv\\xea\\xf4\\xa3\\xd5<\\x02b\\xab"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x87\\x11f\\x96\\xfa\\xce\\xe0\\x02\\x03k\\xddr\\xf1\\xf9\\x8e2\\x8a\\xd9\\x1a\\x91\\xf9= z\\x12n3zf\\xd9\\bkhy\\xee\\xea\\xde\\xe6\\x17w\\x0f61\\xd9\\x89\n\\xbbh\\x8d\\xde-\\xcd\\xd1%e\\x91 \\xf3<\\x01i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\x8d4\\xde:\\x0e_\\xb9cwq\\x9e\\xae\\x81o\\xad\\x12\\xeb\\xb1\\x8c\\xb0\\xf7\\xc9n\\xcan\\xc9\\x96\\xd09\\x1fn2h\\a\\x8a\\xb4\\x02\\x88\\x0e\\xc0\\xae\\xea\\x99\\x14\\xbd"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93q\\xf6\\xc7\\xd8\\x8csfsg\\xd6\\xbb\\xd1*\\xbb\\xba\\x08(\\x9c\\xcf\\xf7=g\\xf9\\x8f\\xdb\\x8em\\xa3\\xf2\\xcbe\\x8di\\x80 %6g\\xbe\\xc5\\xfd\\xd6b\\xcdz\\x02\\xcb\\x0bvo\\xcdra\\xb0\\xcf\\xad\\xeb\\xb9,\\x96\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\x00\\x05\\xec\\xd3\\xc4\\xdb\\xed\\xc1\\xd0\\x94\\xcf\\x89w\\xd1\\xe9\\xbb\\xf5u\\xcb\\x9ci\\x03o/\\xc6\\xfb\\x06$\\xd22\\xb4x.x7\\xc8\\xcf\\xfb\\x0er\\xf8\\x8fe\\xfe\\x04\\xbf\\x80"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p/\\xabw*yt\\xc7\\xd7\\x1e@\\xebr\\xb2t\"j\\xe1qa\\xded\\xd2%yp\\xa1x\\x1a\\xd2'm\\x10w\\xe8\\xad\\x82\\xfdwf\\xc6\\x05\\xaa\\xbef\\xd8u\\xf6\\x9c\\xa2\\x8b\\xab3\\xeb$\\x05l\\x87)\\xa3\\xc9n\\xa6\\xd6s\\xfe\\xf9\ri\\xa4\\xc7a.\\xd40\\xd1\\x1et\\x04\\xf2d\\xa8z\\x9a\n\\xc5\\x85\\xa0\\xf3\\x05\\xf5z\\xd2\\xc9\\x1647n\\xd6\\x1c\\xa2\r\\xba\\xbc\\xd9\\xdb\\xc0l\\x02\\x13\\x04\\x10y\\x7fj\\xd7x9\\xef\\xda\\xfe\\xecx/\\xec\\xadl\\xa45\\x89\\x8b\\x9d\\x9e\\xfd\\xdb8\\xa00\\x00!\\x9e\\xdc\\xbc'\\xf3k\\xbab\\xde\\xf06n\\x8b\\xd1+3\\xbf\\x11\\x8dg\\xf22a\\x9f| \\xb0.\\x85\\xdc\\xb1\\xe5\\xcf\\xdd8a\\xf2\\xca\\xbf\\xf0o\\x15|o\\xdd\\xd2\\xe4\\xa3m\\x80@\\x98\\x9f\\x96y\\xe3!\\xcbt\\x08\\x03\\xabj2\\x93\r\\xd94\\x12\\xa1@oy4n,\\xae\\x99\\xff\\xdf\\xee2\\xe4\\x17\\xd8\\xcdpl\\xb9x\\x1a?\\xd5\\xb2u\\x87\\xc3.<\\x00\\xcd\\xc4\\xd4"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x1d\\xb6|\\x93vm\\xc2#q\\xb0\\xe1\\x0c\\xaa\\xa6\\x81\\x959\\xbe\\x1cbx\\xb0uc\\xd78\\xcb\\x97\\x13\\xe1\\xd5\\x81gk\\x14 \\xcaq\\xe8\\xc5\\x8a\\xc3\\xfb\\x11>,\\xa3\\xadj\\xdd\\xa8\\x94\\xad*\\x11i\\xe6\\x90\\x911\\xcf\\x8a\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb\\xf9\\xe3\\xa7\\xef\\xb8\\xe0^\\x18k(r\\xf8:\\x17\\x0b\\xf1\\xfb\\x7f\\xa8^\\xc9\\xf9\\xb2\\xb1\\x10\\xf2\\xdd:=qh\\xa3\\x01\\x00)\\xff\\xf2\\xeb\\xcd\\x1eh\\xcf\\xd1\\xff\\xc8\\x1d"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\x93\\xfa\"\\x15svpnwq1\\xb5\\xb5\\xaa\\xe8\\xf7>\\xd2+e\\xa5y\\xc5\\xca\\x96y\\xda\\xa6h\\xab\\xe3\\xbe\\x02\\x1ew\\x0e\\x84\\x8c\\xb5\\x02\\xd8\ta\\xc01f\\x08\\x92\\xd0\\x87\\xc4\\x9e\\xfe\\x98j\\xb4\\xf0\\xc9\\x9d\rpo\\xc0\\x9d\\xcfsat\\x9e\\x80\\x0f\\x08\\xac\\xea\\xd37\\x0bc.\\xa8\\xa8d\\xaf9\\xa3\\x85|\\xe1d\\xd8\\xed|\\x9cvpey\\xd3.\\xd9$\\xc1\\xe2\\xc0\\x18\\x18g\\xbf\t\\xc3\\x07\\xef\\x82i\\x0b\\xed>>.\\xa2\\x12o\\xba\\xc6\\x03\\x89\\xc8~7\\x8c(2\r&7\\xd6\\xda/(\\xe2m\\x8b\\x98\\xd1\\x17\\x1b(\\x19\\x04a\r\\x10\\x04n\\x06\\x89\\xa3\\xd2\\xb5\\xack\\x92\\xaf\\x99x/\\x1d`o\\xd1#\\xc3\\xc098j4\\xeby\\xdbw\\xd9\\x11\\xe5%\\xb6#d\\xe7\\xd3\\x13i\\x1a\\x00m\\xa4\\xac\\xc4\\xfb_h\\xb2~\\x05m\\xdb\\x00\\x8b\\xaaks\\x1b\\xaa\\xe5\"\\x1e\\xbd\\xa3\\x03\\x0b\\xfe|\\xbay\\x0fx\\xa0\\x11\\xce@\\x12\\x82\\xaf\\xa6-\\xbc\\x0613\\xd6\\x9c\\xb6\\xe4b\\xa0\\xaa\\xb3"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91\t4\\x86&\\xa3\\xd0\\x1d_1-mr\\x12)\\xd8^\\xfb\\x15\\x12x\\x16\\xfd\\xfa\\xad,\\xf1x\\x15:\\x10\\x19'\n#\\x1a\\x92\r\\xc2\\x0ci\\x9fu\\x85\\x95\\xc1&\\xe3\\xbc\\xabp\\x08x\\xbc_\\xc8\\x9e\\xe9\\xf2\\xa4@\\xbe\\x96\\x7f=z\\xc3\\x9c\\xe0\\x98\\x01m\\xae`0\\xbc\\xff\\\\x19\\x80\\xda\\x9b\\x9e)m`\\xc1sax\\x8b\\x19/\\x7f`q\\xdc\\xfb\\x9e\\xc6$\\xe6\\xda\\xe7\\xc0li\\xd9\\xa7\\xf1\\x1d2y\\xce9\\x13#\\xf5\\xa9v\\x99\\x10\\x8ag\\xe8\\x08'i|\\x93\\x9b\\x14as-\\xa7\\x81\\x89\\xfa\\xeb\\x93\\xb9\\xed6\\xf3\\x13\\xa9\\xa0a\\x9dn\"\\xa4*\\xd1\\x036i\\xda\\x11t\\xb0\\xb3^\\xb6\\xb5l*:\\xd9\\x9d\\xa6\\xae\\xfdy\\x84\\x11\\x9d\\xb6\\x10du\\x13r\\xec\\x17\\x18\\xb5\\xa0j\\xe3\\xdaur\\x08\\xe2c\\x12\r\\x18\\xdc\\xe8\\xba\\xfa9\\xc4\\x8b\\xe9;\\xc5\\xbb\\xb6\\xc4\\xb5)\\xc8ll\\x929\\xa8p|u\\xd5\\xe9\\x84m\\xf7lz\\xd4\\x11\\xe5jzw#%\\x12\\x94\\xa2c0\\xef\\xe0\\xbe\\x85"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81r\\xfcgx\\xbf\\xfdu\\x9fa\\x98%4na\\xc8$\\x94\\xc3\\xfb\\x99u\\xf4/\\xcf\\x9b\\x8eu\\xde\\xe5\\xafp=\\xce\\x85gh\\xbb\\x91w%\\xe3\\x10ny\\xde&\\xac8`\\xde\\x98v\\x911`\\x82\\x02\\xb4\\xa3@\\x16wmw\\xa6\\xab/\\xd9\\x05\\x94\\x04\\xa1\\xae8!\\xa7\\x1bp\\x85\\x04\\x857\\xfdj\\xca\\xa7e\\xf6\\xd8tq|\\x86\\xe6\\x0fk\\xf8'\\x17l2|\\xee\\xfc\\x19\\x87+\\xc3\\xa0\\xae\\x84zz\\xaf\\x9c\\xc6sk\\xff\\x14\\xcb\\x02\\xcf\\xec\\xb9\\xe4\\xa2\\xd1:u\\x1f\\xca\\xa5\\xdda\\x9e\\xae\\xc6xp+\\xaers3g\t\\xb3\\x97\\x07\\x1cb\n(u\\x95\\xbd\\x83t\\xd2\\x82\\xda\\xc0\\xcd\\x19?\\x87\\xff\\xbc\r\\xa5\\xc0\\x03\\x08\\xaeiow\\x8c\\xfd\\xd7\\xb1m\\xdb:\\x97\\x17\\x01\\xfcn\\xc1\"\\xb9\\xcc\\xdfo\\xeej\\x86\\x8b\\x07\\xf3ta@\\x1a\\xd9\\x8a)u+\\xb4\\xfe\\x0f\\xbb\\xfc\\xf4+\\xd5xy\\xbc\\xf5\\xed\\x02a&\\xa6\\xd2\\xe4\\x98+x\\xd6\\xb9\\xddg\\x05\\x03\\xdb\\xe0\\x05a\\xb1ai?y"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010qrh\\x14;@e\\xf4\\xca\\x13\\x1e\\xf4i\\x922x\\xa6\\xd6v\\xc1\\x0e\\x006\\xdd\\xeaf\\x1e\\xb3\\x01\\x17\\x85\\xb8\\x10\\x8bpxg\ty\\x85\\x01\\xb6;\\x0fj\\xe0\\x06\\xee\\xd2\\xcc\\xe3\\x9d(o\\xf1c\\x0b\\x0e\\xab\\x0b\\x98\\xd3/\\xc7\\xcb\\xa7\\xd1\\x18(<\\xa1\\xa6\\x8f\\xf2td\\x88va\\x89\\x12\\x1a\\x05\\xf8w\\xd5\n\\xb7y(\\xb6t\\xc3\\x82\\xa9u\\xca\\x8e\r\\xb2~\\x10\\x8cy\\xd7\\xd2i)\\xd1\\x8b\\xf6v\\xb8\\xa6\\xea(\\xb5\\xf8\\xfap\\x1d\\x80=d\\xe9\\x00qr\\xe7\\x04\\xd2(\\xa2b\\x01\\xa2\\xafz\\x88\\xfb(\\x82\\x85\\xe7\\xfa;\\x86\\xd8\\x92\\xe9\\xear\\x94$v\\xb2\\xd4\\xc9\\x18\\x19\\xda\\xb3p\\xab\\xf9\\xae\\xc0\\xd1.b/\\xfb\\x12\\xbc\\xc0\\xf9\\xfa#\\x1d9 m\\x92\\x1d\\xc1\\xa8q\\xd8\\x9e9\\x19v\\xce\\xc8x\\x9a\\x02\ru\\xc7\\xfe\\xb4z\\x83\\xc3\\xf3c\\xb6\\xcc\\xa3\\xbd8$ver#\\x7f\\xb9\\x17urqe\\x89~\\x89\\x00\\xac\\xcc`k \\x08\\xaa\\xbf\\xe0n@\\xf7b\\x86\\xef\\x91\\x15mo"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\xc5|y\\x05^\\x06\\x07rq\\xfdox\\xa6\\xed\\xf6&2\\xb2\\xbam_\\xeay6\\xac\\xd6\\x84\\x8c,+?0m\\xee\\x9f\\x846\\x06\\x84\\xefl4\\x01\\x81\\xf9\\x18\\x93\r/\\xd0\\xacj\\xb0\\xf5k\\x0b\\x81q=\\xa43\\x03\\x11+i\\xa33h\\x03\\xfb\\xcd\\xa6\\x86\\xd1\\x85\\xf9:\\xc0\\xeb,ph\\xafvl\\xc3\\xf3\\xb5\\x80\\x84\\x0c\\xc7\\x16c\\x01\\\\x17\\x86$lt/\\xf9\\x8a2\\xbc'y\\xb1\\xd3\\x9fw\\xd0\\xa8\\xedf\\xb8\\x8f\\x1bu\\xbfk\\x07\\x1f\\xc3d\\x12\\xb0v|\\xb0s/<\\x03\\xa6\\x02\\x15jax\\xbbb\\x97\\xc0\\x04\\xdb<^\\xb6\\xa9\\xa2\\xe5\\xa5\\x959\\xf0\\xd7=r\\xa4ej\\xbe\\x96\\xbe\\xb8\\xed\\x9an^\\x17\\x99\\x1d`d\\xc3\\x0b\\x9f\\x82\\x98\\xe2*o\\xce\\xf6\\xaa#\\xd7\\x0e\\xcb\\x0f\\xd5\\xc3\\xb4\\x90\\xe6:\\xd7y\\x87\\xd5\\xf3\\x10\\xdb\\xfa\\xeao\\xab\\xe5\\xf2\\xe8l\\xea\\x17\\xf2\\x089\\xa7\\x0f\\x00\\xff\\x9c\\xb8\\x0c84t\\xd4\\xe1\\x91\\x16w\\xc0\\xcde\\xed2t\\xc0q\\xcbe"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l>\\xf3\\xb4\\x01'l\\xe1\\xbd2\\x82x\n+\\x94\\x9e\\xd8\\xb4_\\x86q\\xd5'\\x80s\\xcb\\x8d\\xcd\\xf1\\xe9\\xae0o\\xe3\\x95\\x96k\\x10h\\xb5&kx\\x10\\x0c=\\xbc\\x17\\xbcr\\xe7o\\xbc\\xc0\\xbd\\xe4.~a\\xc2\\xfb\\xe8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c4m\\xb2!\\x8c\\xcc5d|\\xec\\xa9\\x8d\\x9f\\xca\\xa87\\xcd;\\x94\\xe9\\xbc\\x7f\\xe2\\x88t\\xec\\xc9\\xe0\\x14\\xfe\\xe3t\\x03\\xfe\\x8b\\xc5\\x9c\\x1e\\xcbv\\x87\\xec\\x8e\\xa8\\xcd\\xddb"
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef\\xd3\\xae\\x03?\\x90e\\x041*\\x03a\\xe6ztw\\xca\r\\xa1\\x0c\\xbd\\x98\\x0e~\\x08|jn7\\x86hz1\\x15\\x95\\xa36\\x19\\x0e\\x83\\x96\\x9a\\xe1\\\\x1cp\\xe7\\xd4r\\xc1\\x18@\\xa5xf\\xcd\\x97\\x82~\\x89p\\xff\\x94\\xaf\\x85f\\xc3\\xb1\\x12\\xd7ey\\xfc|\\x0cr_c\\x91r\\xac\\x0b\\xd6\\xa4\\x1c\\x0b\\x1a\\x0cj\\x85\\xf8\\xcc\\x90\\x88\\xbfoy\\xb7\\xe1\\xf5\\xd1ax\\x04\\xf6\\xc4\\x9e(\\xdez\nk\\x86\\xb8h\\\\xc2@qa\\xb5w\\xc9\\x9e\\xfd\\x97\\x06\n\\xe2,\\xabw\\xcb\\x00\\x0f\\xd4\\x80\\xc4\\xd9\\x11\\xe9\\x1esr\\xba\\xc9\\x94\\x10\n\\xb0\\x8a\r\\x90e6\\xb7\\xcal\\xb1zfs\\x9e\\x1f\\x11\\x08\\xf5\\xcbx\\xae\\x98\\xeebd|9l\\xae\\xe6v/q\\xd7\\xc8\\xf5o\\xe5\\xd9\\x90t\\xa53r\\xd6\\x16\\xe7c\\xaf\\x92=u>\\x05!s,t\\xc7\\x11\\xd3m\\x9b\\xa6\\x04\\xb5re\\x84\\xdc\\x83\\x9df\\xaa\\x0bdgi\t>:\\xfb3\\xd9\\x9b\\x17t\\xf8y\\x81\\x81\\xb5f\\xc7h\\xd1hn\\xa4"
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05b\\xdb\\xac\\x10w\\xaaa1&\\xfc\\xf8i\\xd4\\xdc\\xa4\\xc1n|=\\xb1\\x9d\\xa6vd\\xc8\\xe3\\xef`\\xdd\\xcd^z6$\\xae\\xb6\\x8be\\x9brh\\xbb\\xb1h\\xe7\\xfap&\\xd3\\xe3\\x10rq\\x96\\xdc\\xe1\\xf5\\x13\\xbc\\xd7a\\xe0!\\x13\\x11\\x80\\x18\\xa1\\x85\\x1c\\x9fa\t\\xa1vlzl^\"\\xa4\\xdd\\xbf3_(\\x11\\xe6\\xa0\\x9eh\r\\x05\\xa0\\x7f\\xfb\\x02\\xfb\\xe2\\x8d\" <\\x97\\xb4\\xfa\\x0c\\x87\\xd71\\x83\\xe2\\x94\\xe2\\x96\\xa8\\x9e\\xc1#\\x1b\\x15\\xe2o\\xa8u\\xd3\\xdf\\x016x-\\xfa>:\\x01\\xe8\\xda\\x01o\\x80\\x89\\x88\\xe7\\x0eq\\xc4\\x8c,.\\x0b?\\x95w\\xbb\\xbd\\x11\\xd6\\x13\\xbc\\x02\\xac_%\\xf31\\xb8\\x9f\\xcduc\\xff\\xd7c\\xad\\x9a\\xef\\x9a\\xca\\xca\\xe8\\xc0\\xec\\x90\\x13\\xaep\\x99|\\x8e\\x97\\xaa\\x03\\xbe\\xd5\\xf7w\\xa5\\x86\\xe66\\xc1up\\xb9<\\x00=\\x8b$\\x03`\\x80x\\x8f\\xb7\\xcc\n4\\x9av\\xef\\xc8u!\\xb9)v\\xe9k\\x19=+\tk3\\xa60\\xc5e\\xe4\\xd7\\x87\\x00\\x88\\x05\\xe1m"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1 \\xdc2\\x8c\\xf3-\\xde\\xbc\n\\x9f\\xe33j\\x84\\xbc\\xb4\\x83\\x1ay\\x8e\\xa4r\\xc5f6\\x02\\xcdr\\xe0#\\xcea\\x07v6\\xcb\\xf7p\\xed)\\xeb\\xac\\xe1\\x9em\\x8bc\\x07\\xad\\x12-x\\xdeu\\x90\\xae^w\\x8f\\xe2\\xfa\\xb2j\\xd6\\x8e\\x98\\xff \\x01w\\x8f\\xeb\\xd9\\x1c\\x0ft\\x88\\xa9kf6+^ff-\\xc1\\xca=k\\xe9\"\\xed\\xd9h\\x9be\\xf3\\xf2\\x06\\x14\\x95\n&\\x11\\x8e\\xc3\\xae\\xdc\\x12\\xa4\\x91\\x8a%~\\xfa\\x88\\xbc\\xd2\\x8a\\x18|\\xe0v-4\\x01zf\\xa7\\xe8:\\xcf\\x9e.#\\x86mp\\x82w\\xa9\\xfe\\xdc\\xba\"\\xf2\\x8fx_x;\\xb5\\x14\\x01\\xc8\\x8b\\xbe\\xf7a$\\x05\\xfd,\\xadb\\xa5\\xee\\x17\\x88\\xf6c\\xdc1!_\\x19v\\x9b\\x82m\\xb2\\xecvk\\x86\\xb7q\\x85p\\x7fj\\x84d\\xac\\xc7\\xff1l\\xdb\\xfcz\\xcb\\x8d\\xedw\\xde\\x97\\x18\\xaeit\\x9d\\xad)\\xdf\\x85\\x0f%m\\xb2\\x18\\x9c\\x1e\\\\xcb\\xd5g\\xceo\\xb7t\\xf1\\xf04\\xab~\\x8a\\x86#\\xf4\\xeb+\\x9e\n"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbb\\xf9i2\\xed\\x1f\\xc6\\xfa\\x10\\xa8\\x06i\\x85:\\x19\\x82\\xeci\\xcc\\x01\\xe5j\\xc9\\xc3b\\xdb\\x17\\xcb\\xec\\xb0\\x7f&\\xd2\\x8f\\xadwk\\xcf$\\xc8_\\x8e\\x9e\\xa7\\xb6\\x92k\\xabu\\xe1\\x95\\xaa\\xeb\\xf9\\xa1\\xa0\\xec\\x99\\xf2'\r7\\xf5\\xee\\xea\\xd7y/\\x17\\x02\\xa4\\xd3\\xe0\\xfa\\x91?\\xe0_\\xce\\xce\\xed\\xadno\\xca\\xcd\\xdek\t\\xde\\x8an\\x8e\\x071v\\xa64\\xcf\\xbcc\\xa8\\xe6\\x13\\xa6\\x0f-^\\xd2\\xb4aa\\x80\\xf5\\x8di\\xa9\\xcb\\xd0u\\x90y\\x9c1\\x9b\\xb7\\x86\\x85\\xfb\n\\x8ene_\\x1c\\x0e\\xbdar\\xf0\\xa4\\xe6\\xf8(\\xaf\\xe8x\\xd9\\xc09\\xb7\\xc3\\xf3\\xa9\\xd4\\xafho\\x15\\x05\\xcdj6d*m\\xe8x\\x86\\xa6\\xf5\\xa3x\\xcd\\x99\\xd5d\\xa4k\\xd6\\x96\\xe1\\xff>:\\xa3\\xa5\\x07\\xd0s\\x8d(\\x13\\x87\\xe5yy\\xb2\\x15=.\\xc77f\\x80\\xefw\\xf4y`\\xa5\\x97\nw\\xeb\\xca\\x14o\\x1c|e\\s\\xde#\\xf4\\x98\\xea\\x85\\xfd\\x195:eu&\\x8ezo\\xa5\\x049\\xfe\\x94\\"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010yf\\x1c\\xb5yg\\x00k\\xbe\\xfa\\x010ja\\x0bimrm.^\\x8c\\xfe\\xe6\\xef\\x13\\xe5m\\xf4\\xe2k\\xaac\\xfc\\xbc\\x12\\x14\\xa5\\x03\\xec\\x0fz\\xcc\\x98\\xff\\xd2f\\x8a\\xd1q\\x9ad\\x81yi~\\xb8\\xe7\\x89\\x0f\\xd0\\xc7\\xdd\\xb5ab\\xbf\\x9f\\xbf.\\xbd\\x9f\\x9d\\x11\\x01\\xdeb\\x87fhv\\xf9\\xd4<\ri\\x06\\xe4\\x13\\xee\\xb2g\\x9f\\x86?\\xd2\\xbd\\xa92~\\xc5\\x18\\xbdp\\x03n\\xd6\\xd1\n,\\x0f-\\xdc&d\\x99>\\xc6.\\xb9\\x19w\\x8a\\xa1\\xf8c\\xd1\\xc2`\\x89\\xf2\\x0f\\x86\\xe9s\\x0f\\x8e(\\xbe2\\xb6\\x18\\x04*\\x95ms\\x86\\x9b|`\\xb4\\xb4\"\nzt\\x96\\xe3a\\xaa\\xc6\\xf3j\\x92a\\xc5\\xd0\\xb4cv\\x04\\xab\\xba5\\x8b\\xad\\xea\\xb8\\xeblxd\\x92\\xa4\\x81\\x0e1\\xb7\\x94\\xe6\\x81i\\xf9y\\xe2\\xb9\\xabj(\\xd8\\x9ck\\xc2$\\xe2\\xe4r\\x03m-\\x07\\xd2\\xa9v8c\\xe4\\xc3-\\x13\\x00f\\x8es\\xedj\\x91+o->;g \\xff\\(\\xd9y\\xa9f\\x9e\\x80\\xb1\\x7f"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80p\\xc9\t\\xbb2\\xd3\\x85\\xb2\\xc5\\x89\\xc7avvi\\xde\\xc2qw|\\xec\\x04\\x9d\\xcf\\xeb\\xc4\\x81\\xc5a?4_.#x\\x10\\xd9\\x95\\x16\\x9dh 2\\xe4u(\\xd9\\x9d\\xaa\\x002y\\xec\r\\xb5\\xb8\\xeew\\xb7\\xc5\\xc6r\\x81\\xfc\\x902/\\x9au\\x19`o\\x9b47\\x92_\r7\\x02\\xe9\\x9e\\x14\\xb0=\\xc2\\x04\\x15\\xcf9\\xec\\xa7\\xd9\\xa4\\x1b\\xe4\\xd0\\x0bt\\x83\\x8a\\xaee\\xf1\\xd5v\\x8ex\\x90\\x91f/\\xff3q\\x85s\\xce7\\x9efo\\xf4\\xb3\\xd9r\\x8d\\xf9\\x0bzy:\\xee.\\xf3b\\x99l.\\x84\\xa7\\x0b\\xe1\\xc4=fx\\xd3z106\\x8e\\x97,\\xc9\\x9a\\xf3ny\\x98\\xa2\\xa4\\xe9a\\xbfq\\x10\\xb2\\xef1x\\xf3\t\\xe0b\\xc1r\\xd3\\x86\\xe3\\xa8c\\x9b\\xee;\\xefp>\\xb8\\xfe\\xee\\x87g\\xc1u,\\xfbp\\x15.y\\x8f\\xd1\\x13\\x7f\\x8ei\\x03\\j\\xd9j\n_\\xd2\\xf3~+!\\xb1\\xd1\\xe9\\xd6\\x8b\\x11g\\xd51\\xfdr\\x99\\xba\\x93\\x8d \\xa8\\xf8cp\\xdf\\xb6~\n\\xd5"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\x82ix\\x80\\x16\\x1de\\xb6\\x9f\\x8a\\xa6g\\x7f\\xeb#u\"\\x15\\xe1\\xcb\\xfcm=\\x08\\xa1\\x1b\\xf6\\x06\\xabo\\x16\\xe0\\xb5\\xa5\\xd2\\x9b\\x16*w\\x03\\xb1\\xe4=\\xc3\\x92\\xf1\\xcf\\x98\\xc2\\x9a\\xa7n|\\x91\\xf3h\\xa0\\xcc\\x8b\\x13\\xdd7\\xaf\\x04e\\xb8\\x82\\xdc\\xb3\\xd5\\xf3\\x83\\xfe\\xeb-\\xf5\\xe0qc\\xeaw\\xa0@\\xccaw\\x18\\xf1i\\xc4\\xc9\\xd9/\\x95\\x80\\xdb\\xcd\\x15q\\xf0zs\\xe1\\xa4&m\\xf3\\xa1\\xfeb\\xab/b:\\x19\\x8d\\x8c\\xe9\\xe5\\xe9j<\\xb6\\xca\\xafj\\x0b\\xef?\\xff\\x8a\\x8e;\\xa6\\x1a\\xf8\\xcb\\x182\\xcc\\xbb\\xb86%\\xcbv\\xaf\\xa6\\x0f\\xdch\\xc5gg\\x89\\x1f\\x8c\\x9b\\xc3\\xbe\\x08\\xef\\x8f5 \\x8b7f3\\xd8\\x8a\\x1c\\xcf0\\xf9z\\xa2\\x162\\x00+f\\xd32\\x08!)p\\xddu\\x19\\x9a\\xc1\\x13\\x8e\\xff\\xc08\\x7f*5\\x9b\"\\xf8\\xf0\\xfc\\xb4\\xc1q\\xf7 \\x8bg\\x91\\xe0&\\xfe\\xed\\xe8f\\x8b!\\x1d@'\\x90(\\x14\\xf1~b\\xad\\xa7\\x1f/\\x99\\xe3)\\xec\\xce\\x9f\\x014\\x18j\\x9a+"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88got\\x97\\xe1\\xc1\\x84\\xb8\\xe2n\\xa1\\xb4\\x8d>\\x18\\xa9\\xab\\xe6v>\\xde\\x18\\xb0,\\\\x17\\xd2\\xec.\\x1dr,rp9\\xbcas\\xfe\\xe6\\xb2'\\xe9\\xdcj\\x9f\\xb0\\x90_^\\x8a\\xbfne\\xa1\\x9f\\x83\\x80\\x98\\xec\\xc7\\xd5\\xbak\\x0b\\xaa\\xcb\\x07s\\xe6_\\xd2\\x84\\xba\\xf3`:e\\xcb\\xda\\xb5^+\\xed\\x8e\\xfe\\xe5\\x94\\xdb\\xe7'!\\xcb\\x0e/\\xae\\x17o\\xd1\\xb7l\\xd1\\xd2\\x7fd\\xe6\\xe50)\\x9bp&\\xf9\\xb3\\xec/)\\xbcq\\x1d\\xc7\\xa3n\\x86\\x0c\\xd6\\x15\n\\xe9+g4f\\xab\\x0e\\xa2\\xe2a\\x84\\x0e\\xab\\xb6.#g\\xc6(\\xa6\\x85\\x7fz\\\\x02\\x19\\xc8\\x9c\\xa8\\x12\\x80?\\x19\\x17\\x82\\xf1\\xab&\\xd0n<f\\xa2\\xcc\\x88\\xf0/\\xa0\\xc3\\xe7\\x11@\\xee\\xef\\x83\\xa4\\xfau\\xa2\\xb0'\\x19pa\"\\x06\\xd2\n\\xe56\\x8b\\xd94\\xa33\\x15\\xf3t\\xe7\\&wh\\xad\\xcd\\xc9\\xe4e\\x8fir\\x87\\x0c|\\xd8\\x03n\\xd1\\x84\\xd7\\xe6&`klo\\xecpy#\\xad\\xe6\\x88\\xe6\\xcap<\\x1a"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9\\x12 \\xdd\\xae\\x80\\xafjy\\xb9j\\x10\\xcb\\xf9\\xa3\\xda\\xa8\\xc6\\xbc-\\x0e|\\xbe\\xb9\\xf6\\xd7&z\\x88\\xaczua+\n?\\xc0\\xd7\\x8c\\x19\\x0b\\xa8fd\t\\xedn\\xaf\\xb3\\xca\\xfck\\x83\\x02\\x84\\xc0\\x9e\\xb4\\x87ov&\\xe5\\xf4\\xe0\\xc8\\x14\\xc1e\\xf6u|ok\\x0e\\xc1\\xb0\\x1a2\\xf9g\\s\\xd6\\x8ebz\\x8f\\k\\x96\\xff\\x1b\\xadl7\\xdd>\\x95\\xd4\\xe0 f\\xf10\\xc0)\\xa1!\\xce7s\\x10\\x84`\\xd7\\x17\\xe4>\\xd3x\\xdeg\\xb1?f\\x89g\\xe7\\xe3,\\xfa@\\xaf\\xf1\\x10\\xba\\xbf\\x06uq\\x14=\\x08i\\xd2#`b\\xbey\\xdc\\x7f\\xa0\\x12g\\xcf zo\\x06j$\\xec\\x0e\\xa9\\x04\\xa9\\xa7\\x16\\x85\\xd9\\x87@\\x86\\x91\\x0b\\xdd\\xb4\\xe5s\\xee\\xef\\x13\\xf6\\xbf)\\xcc-\\xd5%\\x18\\xe4\\x01\"\\xd1y\\x18\\xe1\\x15on\\x81\\xb8\\xfd5\\x1e\\xb1\\x1b\\x14yr\\x87\\xc4\\x15_\\x8fts\\xed\\x96\\x10\\xd3\\x8a\\xdd\\xfa\\xac\\xb8\\x15\\xc42\\xf0f\\xf3\\x81\\x16\\xb6\\xa4gi\\xcbf\\x16\\xd5\\xed\\x1e\\x06\\xd5"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85~r\\xa2\\xf4\\x07\\x8f\\xeb4h\\xb0;\\x90\\x03d\\xed\\x7fp\\xb6\\x90*\\xe4\\x93l\\x07'\\x91\\x9d\\xa6c4\\xaegym\\xb4\\xd2>\\xed\\xa0rml\\xbbe\\xcf\\x14\\xb6\t\\xc3\\x1c\\x0c@f)\\xe5\\xefj\\xc7jh\\xc4\\xf4\\x05\\x08\\x17\\x8d\\b*\\xabi1\\xd3,\\xc1p\\x1c,\\xe64\\x9f\\xbc\\x9c5\\xef\\xcb3\\x14\r\\x88z\\x88\\x95\\x0ed\\xba\\xd8n\\xfe\\xb6\\xc0\\xad\\x93.\\x05>@\\x96u\\xb0wt\\xea#c\\xb6\"s\\x10m\\x17\\xb0\\xa0\\xa4\\x91\\x9a\\x1b\\xec\\xbe\\xe9\\xefc\\xbex\\xcd\nz\\xf7\\xbc\\xfd'b\nd\\xad\\xd0\\x0b!\\xeb\\xb0\\xa3\\x99\\xe4e\\xc8\\x83\\xb7\\xcf\\x96\\xf5\\xe9\\x1d\\x9d\\xee\\x18\\xf6\\x1d\\x03\\x81k67q\\x8f&`\\xf3\\x82\\x95.\\xdf\\x87<\r\\x01\\xcd\\x94h\\xd3\\xef/m\\x17\\xee\\xf1\\x8cn\\x18tz'\\x91:\\x02\\x9c\\xc3\\x19\\xf4\\xd6wm\\xc66r\\xfe\\xb8\\x9d_\\xbb\\x0bn\\\t\\xcc\\xf2\\xea\\x1a\\xa1\\xa5\\x88\\xdc\\x1d\\xbc\\xca<\\xd7\\x0c\\x18\\xc5\\xf8y\nfw\\xcc3."
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xac&`\\x11\t\\xe1\\xfb8\\x18y\\xb4\\xaa\\x8b\\x13\\xd8\\xa2\\xe1\\x1b<a\\xd0\\x91\\x15t\\xf1hxd\\x0f\\x1d\\x95\\x8a\\xed\\x17\\xe4\\xe4jx%7\\x85\\x8a\\xf4\\xc5\\x03@p\\xf9v\\xa8\\xc1\\xddnr\\x9c1\\x98\n\\xec\\x0cmm\\xc6i\\xd2m\\x80a@\\x87h\\x17s\\xd3c\\x1c\"x\\x1a\\x90<\\x83+\\xcc\\xff\\xa7\\x13\\x98\\xcf!\\xa3\rr\\x13\\x8a\\xd4=:\\xb73\\xe1!\\xd6\\x96tq\\xacxd\\xf6\\x9b\\x82\\xd1(\\xa5\\x97\"\\xed0\\x10\\x11\\xf7\\xa3a\\x0f\\x1a\\xfd\\x97\\xc5\\xed\\x94\\x8c5\\xff\\xa1\\x83\\x1a\\x7f|\\xddsu\\x83o\\x07 \\xd5\\x8fv\\xdc\\xcd\\x81\\xc9\n\\xb0i\\xe1\\xb9\\xda\\x90a \\x18j\\x9c\\xfa\\xf9<a\\xf2\\x1cg\\x953e\\x1f\\x9an\\x05oy\r\\xa0\\x84 \\x0c\\xa4psw\\xf7\\x1e\\x0e\\xaa\\xde^dkge\\xdbr\\xf4\\xfb\\x0e\\xfc\\xcb(\\xa4\\xa4*\\xa0\\xee\\xdc)\\xb14\\xb0|\\xa8sl\\xcd\\x97\\xbd\\xc4\\xd52\\x08\\xe3\\x1b\\xc8o+\\xea\\xfe\r\\xa4\\xd8n*&\\x9e\\xb0\\xafo\t"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\xc7\\x1f\\xe3gos\\xb4\\x89u\\xed\\xc3\\xb4\\xb10\r\\xda\\xfe\\xbaqh| \\xc6\\xd35\\x8en8s&\\x0c\\xd3\\x1ar\\xb5o6\\xb6\\x17\\x86\\x8e\\x15\\xa2\\xdd\\xf5\\xdb\\xe1\\x91m\\x91\\xc1\\x02r\\xa3~\\xa9\\xdf\\xd8\\xff\\xad\\xcc\\xed0aq\\x1f\\xa5ea$?l1\\xaa_v\\xf8u\\x1c\\xfc\\xac\\x0cl\\x91\\x98f\\x1f\\xa7\\x1a\\xde&\\x9a\\x02\\xd6\\xac\\x98\\xe8\\x93\\xc4g\\xe1\\xb8\\x10\rr\\xa2&f\\x94\\xe7`\r\\x88\\x1f\\xcb|_\\x8bw\\xd9\\xc0\\xd5\\x95m2\\xdeur0\n9\\x8bw\\xa4\\x7fe\\xd1\\x89\\xe1\\xef\\xe2\\xfa\\x01\\x9b\\x8e(%\\xb60u \r\\x94da\\xae~w;\\x08z\\xf4u\\x06\\xf5\\xa3\\xf5\\x84\\x19\\x9c\\xce~-)\\x0c\\x15f\\xd1\\xd1u\\xb7\\xd4\\xc1+\\xf8q\\x99\\xc4\\xca\\x1d\\x12$4\\x05a\\xcc\\xed\\xdd\\xba\\x89\\xa1\\xa9\\xc1\\x0b1n\\x1f+\\xed\\xdb\\x05\\xf0\\x0e\\xbb\\x0b|\\x13gi\\xdb\\x98\\xf9\ttc'\\x10\\xf1\\xf3\\xe9y.q\\xc7s\\x04\\xcf\\xea0z0\\xa9hn\\xe0\\xd5"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xb1\\x93\\x8dy,\\x19\\x07\\xea'\\x0b\\x07\\x1c7\\x8e\\xe8fg\\xf6\\x9a8\\xa1\\x05p\\x1f\\x0f\\xbd\\xdd\\xab\\xe2\\xb3na\\xcf\\xa9\\xaa\\xca\\xff\\xc7\\x1b\\x11\\x11>\t\\xff\\xf9\\xebz\\x05\\x9b;\\xa2\\xeb\\xd5c\\x95\\x00\\xa7\\xcf\\xb8\\x8en'l,\\xb0\\xa14=>\\x14\\xfc\\x10\\xc7f9e\\x9cf=\\xfb\\xf5\\xc8v\\x81\\xc0\\x8d\\x96\\xa4\\xfa\\xab||m\\xb6d\\x05\\x12-\\xfdy\\x9f\\xb7<\\xdav\\x1e\\xe4\\x9b1\\xdc\\xd1\\xb9\\x13\\x91n\\x1e\\x0c\\xa7\\xe3m\\xa6\\x8c\\xfee\\xf5~\\xe6w\\x15\r\\xfb\\xa1\\xac3\\xca=\\xe8\\x1a\\xa9o\\x05\\x1d\\xc5\\x87\\x95\\xa4\\x9b\\x9f\\x7f\\x88\\x92sq\\x03\\xf8\\xf4\\x84y\\x8e\\xca\\xc8+q-j\\x8e\\x1c\\xfajly\\x89&\\xd7\\x15t$\\x06\\xaa`\\x1d\\xab\\xf7\\xea\\x17\\xd6\\xf2\\x9e@<\\xcc\\x14\\x13p\\x12\\xca\\xefl\\xe5\\xd2\\xda\\xfa\\xea\\xec\\xa5\\xe8\\x87\\xfak\\xd6:yk$\\xbbf\\xa0\\x10\\xeda\\t3\\x8c\\x85\\xdf\\xceu\\xdf\\\\xfa\\xeb\\xea\\xcck\\x98\\x8a\\xfa\\xe4\r8\\xdb\\xc2"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\x0ch\\xbf\\x9e\\xa6\\x95m\\xee\\x8f\\xa2\\xc57\\x0c\\x1ao\\xf4\\xd5\\x10\\xc8\\xd3\\x10z\\x04\\x9f4\\x15\\x0c\\xf4=\\x8a\\xadj\\xadeq\\xd02\\xb6\t\\x9f\"3\\x06;d\\x83\\xe8\\x89\\xc1\\xfa\\xea\\xf6\\xd2hgdb\\x14\\x8f.=\\xcdl\\x01\\x04\\xb8\\x0b\\xbac\\xa7\\x0bu\\x9ax\\x00\\xe05\\xa1\\x19\n-\\x0e~e~u\\xf3d\\xe9m\\xc7~\\x00\\xee\\x08t\\xbcg\\xb3j\\xe1m\tt\\xf6\\x06\\xec\\xf7\\xec\\x15\\xf6r\\xc1\\xc0\\xab@2jk\\xf6\\x11l7\\xeep\\xe7 \\xac%m\\x88\\x88>qyh\\x8fm\\xc2\\xd0\\xf4\\xbfx\\xb3@d\\\\xb1zm\\x07\\xde~\\xe7\\x15\\x05,\\xcf\\x0b\\x10\\xc6\\xfc\\x0f\\xd5u\\xa2\\xf4\\x8e\\xfc\\xea\\xe9\\xd3\\xc9\\x17\\xf4g\\x00\"rr\\xe5i\\x1ef~\\x8f\\xf4\\xf4:da8\\xb2\\xae\\xda\\xd2\\x8c\\xef=\\xb3;\\x00\\x12\\xff|u\\x19v;m\\x17*\\xf4\\xcb\\x954w\\x03v:\\x08\\x13on$c\\xf5!\\x82ohd\\xf5b\\x08\\xcd\\xed\\xd2\\xbd\\xd3\\xbaj\\x10\\x8c\\xc7\\x13\\xde"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ujk\\xfay\\xa8\\xb1q#.\\xa3\\xafy\\x14@\\xd3\\xe1\\xe2f\\xfd>\\xf2\\xb3:\\xe4\\xf8k\\x04i\\x8cy\\xdc\\x98*\\x81\\xfc\\xf8\\xf9\\xd0\\x9a4\\x12\\x92i\\xb1\\x10\\xfb\\xd3j|\r\\x044\\x93\\xc1\\x1bm\\xa3\\xa9m\\xa5\\xc91* \\x88q\\x07\\xc4\\xb2\\x93\\x80\\xd8p\\xe3\\xa5g+jm\\x91\\xed\\xb6m\\xee\\x9d\\xcc\\xfeovs\\xd4a\\x92\\x08f\\xea\\xa4\\xed\\xd2yi\\xf6\\x9b1\\xd5-\\x81\\x8b\\xe0\\xc7\\x9a\\xe2\\xa2,t\\xc2\\xe2\\x8f\\xd8vk\\xe8c\\xd8\\xfb.g\\xd5\\x8e\\xcd\\xf3\\x82\\xad\\xd4\\xbevkn\\xffpxz \\x9cb\\x04qst\\x8a\\x9dk\\xfephk\\xf5\\xb3m\\xf4r\\x94\\xc6\\xd1\\xbf\\xeb\\x19\\xc3\\xf1\\x0b\\xcd\\xc3\\xde\\xa8\\xa17\\x8f\\x8d\\xb7$l\\x95\\x05\\xff`\\xd1j\\x87*\\x8e\\x95\\xcc\\xfc\\xcb\\xb9$\\xb1\\xf0\\x8f\\x93s4\\x8b\t\\xcf\\xcf\\x91\"y\\xf1\\xa4\\xf56^0\\x8f\n\\x16\\xa6\\\\xd7\\xed\\xcfp\\xe4\\xa4\\xe4\\x1br\\x82%\\xfb\\xf7a~\\x89\\xaa\\x06d\\xc8\\xc0\rc\\xe6\\x02\\xd3p"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaey\\xfeo\\xaa9\\x04\\xc9\\xce\\x9f\\xcd\\x9f\\xb1\\xc8\\xde\\x07\\x02\\xf4\\xe4j\\x92a(\\xf9\\xa4)\\xab\\xd4\\x15eb\\xd3\\x8e+vb \\x08+\\xad!\\xb0\\xfd\\xbd\\xec\\xa3\\xdd\\xb5\\xf2.\\xf5\\x94\\xafmzw\\xce\\xb9d\\xc6\\x1d3e\\xfds\\xd8)\\x0fp\\xfc\\xc6\\xa2a\\xa8fhn\\xc8/5 p/\\xcc!\\x06\\x11\\xf9\\x0b\\x1aa\\xbf\\xcd\\xa2\\xea\\xad\\x04\\xa1\\xfb\\xd1=\\x07n\\xbd|\\x92\\xe9`\\xae\\x96r\\xf9\\x02\\x11\\xbc\\xd0\\x14\\x14\\x7f\\x05:v\\x02\"\\x03\\xbe\\xc4g\\x7f@\\xeb\\x07g2\\x1ap\\xf2\\x87\\xf8\\xe6(\\xc3p\\x16\\xa2\\xed\\xbf\\xbf5hn\\x05\\x92-b\\xed?\\x92q\\xa2<p$ez.\\xe7\\xeem\\x0e\\xb1u+\\xfb\\x1c\\xb1z\\xb4\\x80\\xb1b\\xb8\\xa7\\xa6w\\xb0\\x15\\xd4\t\\xef\\xc3\\x97\\xd2\\xab\\x96\\xf2t\\x9c\\x8c\\xa8\\xad\\xac\\xd1\\xa0a\\xcdkk\\x96\\xf5\\x0e\\x8f9:\\x05\\x8a\\xc0-\\xd0hq\\xcb=4t\\x13\\xe7:\\xcds\\xcd\\xdb3\\xbdq\\xe0\\xab\\xf6>\\x02\\x00\\xf5p\\x14"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x9a=\\x87\\x12\\x0f\\xd7\\xc0\\xa9f(#\\xa0`s\\xe1\\xd0j\\xafj\\x93 m\\x88\\x16\\xee\\x0c\\x0e73\\xbex\\xb3\\xb5\\xadr\t\\xfdl\\xa0\\xe4\\x80\\x02\\xd6\\x86\\xda\\x0e\\xc3g\\xee\\xcas\\xb2u\\x03\\x86\\xa5\\x1e\\xcb\\x8d.\\x1ffm#\\xe8\\xf1#\\xd4\\xf3m\t\\xc2\\xdc\\x90\\xbc\\xe6%\\xf3\\xc9lrv\\xf8\\xaf\\x1a\\xcb\\xd4i\\xe5ibc\\xa8>:-\\x94\\x14o\\xf6\\xe1\\x12\\x9du\\xeb\\x1b\\x8c\\xe7\\x06\\x8f\\xed\\xec\\xb5<\\xa5\\x08(\\xb4\\x8fg:\\x1e\\xbb\\xe6\\xf8\\x03\\xf4\\xc7\\xb9r\\xdd\\x9e\\xa1\\x11\\xd44\\xd2\\xad\\x9a\\xea\\x05v\\xdd\\xc5\\xa9\\xcb\\xcck\\xab\\x97\\xfe\\xf2\\xc2\\x9d\\x9e\\xcf\\x9d\\xfc\\xeecfjz\\xd3\\xb5b\\x02\\xeb\\xc4`\\\\xe1\\xa2\\x06\\x91\\xf6\\x95\\x9f)gl\\xd4\\xf2\\xa1\\x9a\\xf8\\xc4\\xdc\\xc0\\xadk\\xdf\\x1e?\\x0b\\xb8r\\xd0@\\xee\\x94\\xad\\xee!\\xbc\\xb7f\\x10\\xa7>\\xe3k\\x98\\xb5\\xc2\\xe8>\\x8bi\\x9c*?\\xb7>\\xd3\\x87\\xe4~\\xa3\\x1d\\xb0+\\xf8\\xa3j\\x99\\xd2\\x90si\\x8aj'\\xae\\x90\\xfa"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\r\\xec\\x8c\\xc9\\xfa\\xc0\\xf2\\xaf\\x0f1\\xbd\\x8c\\xa4u#\\xa4\\xed\\x0ca\\xfc\\xba\r\\xe8s\\xc1\\x80\\xd0a\\xb4\\x8d\\x07a=9ka\\x9ei\\x82\\x00\\xf9&q\\xd2`\\xa1\\x07n7\\xfe\\x0b57\\x02\\x82\\x0e\\xbc\\xd9c\\xb5\\xd0\\xf4\\x1a\\xd7\r<r\\xfbv\\x18\\x18\\xb1\\x05\\xba\\x98\\x07\\xd3d\\xd4\\xb4y\\xea/j5oo\\xc7\\xd5s5\\xc6n\\xba\\xfb\\xe3\\xad\\xc7e)m\\xcc(\\xd5\\xf6\\xa7\\x88nh\\xbf\\xdb:\n\\xad\\xd8\\xb3\\xba2/\\xe88\\xb0k.\\xc6\\xdb\\xbc\\x85\\xe8\\x11\\xb0\\xb6c\\x91b.r\\x9bk\\xc3\\xb7e\\x12\\xd3\\x8dn\\x06:\\x9c\\x16\\x887!fw\\xf8\\x87-\\xddi\\xb0\\xa1\\xcf\\x14\\x90\\xc6\\xd9\\xd3\\xd9\\xbe?\\xe4\\x1b\\x0c#\\xe8\\x8a\\xb9\\xd5\\x8c&-\\x80\\x89\\x1fxol\\xd7#\\xe8q)b\\xc5:>m\\xeb\\xf7\\xb5 p\\xaasq\\x81\\x17\\x03ix\\xe7y\\xda\\xf8:\\x14\\xd2u\\xc2i\\x1d\\x97w\\x9a\\xc6\\xef$\\xa6\\xff\\xd1\\xeb\\x04\\xc8\\xaa\\x1d\\x89\\xc5\n\\xe9\\x8c\\x89\\x12\\xfe\\xaf\\xc2~3i\\xc2"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1c.\\xc7r\\xdd\\x05=\"\\xe60\\x93\\xfe@u\\x8c\\xfb\\xab\\xc4\\x13r\\x88d4\\xa0\\xc6s\\xca*k\\xdb(\\x9cc\\xc3<\\xa0i\\xd7i&\\x8ap5a9\\xb68\\xa7\\x19*\\x01n\\x9f\\x92a#\\xa8o\\x914\\x94\\x18-\\xb8\\xc1\\xef\\xebk\\xc4\\x9e\\x9f\\xb1\\xa0x\\xe6\\xc2\\xe5a\"\\xbc\\xc91\\xe5\\xdd6\\x86n\\x04\\x06\\xd1\\xef\\x90p(5f\\x17\\xdc\\x14\\xca\\x98z\\xday\\xe7\\xeei\\x9f\\x9516~\\x10kk\\x9e\\xf5cc\\x82\"\\x7f\\x9d\\x1e \\x8a,\\x07m\\x84\\xb2!\\x92@nt\\x85?\\xfd\\x16\\xb5lo\\xc4\\xe4\\x94\\xb3i\\x98\\x9fv>\\xb5bs\\xbc\\xf1\\xb1\\xf9\\xfc\\xabn \\xa3\\xfdt\\x15v\\xd1\\x9d\\xfa\\xfa\\xcc\\xf2\\xd7\\xfe4ly\\xa9(t\\xdd0\\xa0\\xd3\\xc4k\\xef\\x8c*\\xa6 \\xd4\\x90\\xc6\\x98\\xa8=\\x018s\\xdf\\xdd\\xf7\\xb2\\xbb\\x12^\\x01\\x8e;^\\xa4\\x07\\xed\\xf5\\x978\\xdc\\x0e\\x91\\x02\\x84&\\xf3\\xb0~ ak\\xffn\\xe3g\\xbc\\x04k\\xfb6\\xbb#\\x8e\\xad"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\x93u\\x96^\\x18~\\xbb\\xad!evr\\xc8\\xa4\\xb5(\\x93\\xa2_\\xe5\\xd3s\\xa7\\x02l\\xeb\\xca\\xe4\\xa9\\x7fo\\xe0j\\xb0\\xc7m\\xd3\\xf7\\x8czz\\xc0\\xf9xz\\x8e\\x92\\x1c\\xfd<&\\xc3\\xb2^\n\\xc7\\xd9!\\x82\\x00s\\xaf$\\xaf\\xd1y\\xc9o>*\\xd0\\xbf\\x88\\x8c\\x91\\xf8\tope\\xe9\\xaf'\\xb8\\x88\\x92\\xb6\\x10jy\\x1b\\xe1\\xf0ps\\xa5y\\xf3\\xd5c\\xb7#j\\x8e\\xc8nt\\x8b\\x9f\\xba\\xaf~\\xdf!\\xfcnb\\xb1?\\xbaf\\xf9\\x9f@\\x8f\\xf4e\\x84\\x12\\x0c*u\\x93yu\\xa5!m\\xe72\\xe2k\\x97f\\xcc\\xa7\\xbd\\x91\\xbe\\xf4\\x12\\xe8\\xd9c\\xbe\\xac1\\x19\\xd2w\\xfd\\xe8\\x9dkb\\xad\\x01\\x96\\xa7\\xe9,\\xd6e\\xbe\\x842\\xc7p\\xbb`v\\xb6\\x03\\x82\\xb9#f\\x9a\\xb4\\x96<\\x06\\xac\\x04&\\xbal\\xd0\\xbf\\xa0\\xd2\\xc7r<\\x11b\\x1e\\x87\\xabz#\\x8a_(\\x02\\xd7\\xff\\xaey\\xa4m%\\xa5\\x95\\xc2\\xedufd\\xf3c6\\xeb^2ir\\x08w\\xcb\\x0f\\xa1<\\xc52\\x07"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x92\\xa6d\\x0e\\x16.\\x9cwck\\x8c\\x10\\x97\\xe3-\\x98\\xd1\\x0c~\\xfc\"6\\xfc\\xdf\\xbe\\x84lp\\x0e\\xc5\\x92\\x07s\\xfc\\xeb-o\\xcbl\\xa1\\xf3\\x11\\xef\\xe3\\xf4\\xca\\xb6)x\\xde\\x85\\xea\\xfe\\x08\\xe9\\xf8\\xf8\\xa8\\x82\\x9f\\x90\\x06j\\xe4?\\x01\\xa8~|(\\xe5\\x82\\x88\\xe3\\x12\\x84\\xc7\\x1f\\x98h\\xa1)\\x9d!+\\xa0-\\x89\\xf8\\x17&\\x0c\\xdb;7t\\xf9\\xa5ax5\\x89\\xb6\\xf4\\xfd\\xc1\\xec\\x8f\\x00f\\xb3\\x13o\\xac\\x8b\\x18\\xa3\\xe4x\\xc1\\xe8xl~%c7h\\x01-\\x0f\\xfa\\xe6\\x8b\\xfa7\\xaex\\xec\\xdc\\xaf\\xb3\\xb5\\xf9\"\\xcb\\xd9\\x1c@\\xaf\\xa9/\\xd2\\x89\\x19>\\xaf\\xa7\\xb7\\xb3\\xccmd\\xa5\\x03\\xaaguch\\x1d\\xbc\\xdd\\xbe\\xdb9z\\x82\\x1d\\xd4\\x1a21\\xb7\\x15\\\\xf3\\xd3\\x13\\xc6\\xdbu\\x88\\xf2\\xedx\\x10k,\\x1f\\x17\\xcd\\x81\\x12\\x8c\\xaa\\xd9f\\xfb\\xa4z\\xb3\\x12\\xe5\\xd7#v7\\x86d;b\n\\xb3$\\xf0:\\xf7\\x84'\\xa8j\\xee\\xee\\xba\\xfa\\xef\\xa8\\xdd%\\xc1\\x0ed\\x11\\xbc\\xb9"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010bb\\xd9;\\xf1\\x86\\x96\\xb0\\xf7\\xab\\x8d\\xe5\\xb5n\\x1f\\xaa\\x91\\x87\\x10#\\xe3\\x17z\\xc4\\xde\\x9a\\x17\\xc4a\\xb7\\xe3\\xd4@0\\xb2\\xeb\\x10y\\xed\\xa0\\x8c*\\xd7\\xb7\\x92\n\\x08.\\xcb\\x1f\\xd6\\xac\\x0f-k\\x11\\x81\\xaa\\x08\\x1a\\xde\\xa6\r'\\xba1\\x03\\xc9v(j?m`4\\xbd\\xcaj\\x89\\xf7a\\xfc1\\xb9\\x8a\\x18\\xd7f\\xe4\\xd4\\xa4ee\\xf4\\x109\\x8f\\x87\\xfbh\\x8d\\xbd\\x1e\\xd6v\\xb4\\xb5\\xa87x\\xb0\\xfbv\\x1e!\\xb8vi\\x04\\xe7\\xbbp\\xa3\\x8c\\xa3fk\\x86q\\x9f\\x9c\\x11\\xb9z\\x87\\x8fyq\\xea\\x96\\xb6*a\\x14\\xa3\\xe2\\xd3q\\xde~\\xc0\\xb8z\\x92\\xc1@\\xf0\\xe7b\\xec\\xd2s2t\\x9d\\xd7\\x86\\x12\\xb9\\xa7\\xa3\\xcdo\\xbc\\xd3e\\x0ek\\x125\\x11tg4x\\x03\\xd7\\xa4\\xa7\\xea\\xa7\\x06g\\x1dim\\xb0?kg\\xf2\\xda\\xdep'\\xae\\x18\\x85\\xc0\\xa7\\xaf\\x7f-\\xec\\xe2\\xe1\\xc0\\x14z\\xd5sz\\x1d=3i\\xc9a\\xc9l\\x06\\x8b\\x0f\\xa2\\xdbyh+~2'4b\\x0b)\\x8f\\x95"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xbc\\xbet\\xc0\\xa69\\x92\\x18\\xd9\\xb5\\xba\\xc4\\xed\\x9d\\x9a\\xe0\\xe0\\xcf`\\xfa\\x8a\\xc3\\x84\\x8c+\\x87\\xa0wi\\xfft\\xb4x\\x078\\xac\\xdf\\x98\\xf5\\xb6\\x8eas\\x1c\\xa8$\\xfa\\xf0r\\x82\\x81\\xa8\\xf9\\x15\\xd3\\xed\\x1el\\x9a\\x8b\\x0e\\x0b\\x06x%y\\x017\\x8af\\xb7\\xcb-\\x05\\xc8\\xd4\\xed\\xd9\\x9fr\r\\xb9i@5\\xec\\xf9ywb\\xc4\\xaa\\xd5\\xdc\\xc0\\xba_\\xe2\\xe8\\xb5\\xff\\x8e\\xda8kd\\xdbi\\x99\\xc5\\x9c@^\\x8b\\x83\\xad\\xe1j\\xed\\x8dw\\xb9\\xa6\\xfef(\\xe2\\xb0\\x89l0\\x9a\\xfb\\x12\\xa0\\xf1\\x00\\x99bv\\x83d\\xde=\\x17f\\xf3\\xe0gk\\xa1r\\x8f\\x82\\xa8\\xaf+\\xd1\t\\xe9\n\\xef\\xdc\\xd4\\xfc\\xdfp\\x00\\xbe\\x93\\xde\\x1f\\xe9\n\\xc6=\\x0fs\\xed\\x15\\xa8\\xc2\\xe6\\x0bhg\\xe0\\xab\"\\xee-\\x80t\\x7f\\xf01\\x06 z\\xee\\x1e\\x9b\\xe2(h\\xc1z\\xdf\\xe2\\x17\\x80b)\\xf6\\xc1\\x1c\\x18\\x83m\\x0e9s$\\xaf\\xbb\\xe8\\xb3p\\x17\\xb2\\xad#\\x99`\\x98\\xa9\\x95\\xf5\\xb5\t\\x99\\xc7*\\xd1"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd55b\\xf3\\x86\\xbf\\xf4\\xc7\\xd7\\x10\\x9a\\xda\\x11\\xdf\\xec\\x9e\\x00\\xf4\\xf0\\x87:\\x9a\\x91-/\\x1f\\x08\\xc1\\x93\\x0b>\\x99q\\x04\\xbe\\x04\\x91\\xaa\\xe3\\xd6$t\\xfa|\\x86s\\x1c!\\x90c\\xbe\\xec\\xab\\x00\\x1b\\xacm\\xd2\\xc6\\xaf(\\xbba&x\\xbe\\x82\\xf5\\xa1\\x85\\xc6x\\x19\\x03&3\\xbb\\x94\\x04ng\\x1c\\xd5\\xd9?\\x14(by\\xb3v\\xc2mx*n\\xdc\\x03\\x00\\x95b))j\\xd2@wq\\xdf\\x90\\x1ct\\x92\\xda\\xa0o\\xa3t\\x9b\\xc1\\x9d\\x8cs\\xca\\x08\\x13\\xef\\xdb\\x1b\\xd9\\xf0t\\xf8\n\\x16x\\xb1\\xdb1\\x8b.\\\\xc4\\x03ty\\x87\\x17b)k\\xfa\\xa9g\\xcc\\x80\\xdeoh\\xa5\\xd4\\xc1l~\\x0f3\\xe7\\x8b\\x92\\xa7\\xfahfp\\xdcy\\x1d\\xe3c\\xa7\\xed\\xc4\\xf3.\\xd1\\x9b\\xfbl@\\xf6\\xd4\\xc2\\xe8k\\xc1\\xe4\\xddr8\\xeenr*km\\x8b\\xe39\\x8e\\xf9\\xe5s\\xd2\\x90\\xbed\\x97^\\xdef\\x91\\xd7\\x14\\x10\\xe03\\xcc.\\xbc\\xf3\\x0b8k\\x94b\\xd2\\xc3\\xbcq\\xc7%\\xd1\\xec\\x84/\\xc5t\\xc2;y"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6$\\xd1\\x96\\x99c\\xcb2\\x94\\xdc\\xee\\x17\\x05/opl\\x0c,\\xc9\\xf7\\x0c\\x91\\xb9$\\x18\\xf9\\xa9\\xb7)\\x17\\x85;d\\x85\\x81k\\xd1\\xd01\n\\xa4\\x07\\xc5\\xf9\\x9d\\x85z\\xd0\\x81\\xd5$\\xf5\\xb5\\xae\\xb8\\xa7\\x17\\x10\\x12=\\xbad5\\x80\\xac\\xc9\\xcb\\x08\\x02i\\x0cg\\x19\\xc7\\x02.\\xa9\\x87t\\x7f\\xc6\\xc7|vt\\x16\\xaf\\xea(\\x88\\x84\\xc1\\x1e\\x11\\xd9\\x08\\xeb\\xdf\\xd6\\xbb\\xf8\\xb3\\xfa\\xd5\\xfa:\\xf4.\\x99\\xca \\x9fa\\xe5\\xe1\\xb6\\xa6\\xcd\\xa9\\xd2\\x90`ll\\x7f\\xe7\\x06\\xa8\\x12\\x87\\x89\\x0b%\\xe83\\x13\\xa5\\xa8\\0 \\xf0\\x00\\xfe\\xd8\\x90q\\x1c\\xf63\\xd6\\xa2\\x1f\\xac?\\x97\r\\xee\\x05\\xb7\\xf8~\\xd5\\x9bw\\x98\\xbd\\x9e\\x11\\xaf\\xbav\\xe32r\\x06k\\xb4\\xc8\\xcbr\\x95\\x87\\xba\\xc94t\\xeaj\\xc6sm\t\\x81?wlz\\xef\\xa1s)\\x80\\xa3u\\x89,\\xa4f\\xf0\\x0b\\xcd^ky\\x04\\x1d\\x99~\\x10\\xcbx\\xb2u\\xe5\\xa0&\\xae\\x01n\\x0c$\\xd0k\\xf7n\\xe6\\x1f\\xa2q\\xe9x\\xc5>"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\x97,\\x90\\xe6\\xb7\\xc4~_\\x985\\xb8.&\\xe1\\xe1gtu\\\\x0f\\x9b\\xbf\\xde\\x82\\x8dc\\xaa\\x8ftn9\\x14+\\x04\\xb9\\x16\\x97f\\x83:\\xe7\\x0f&n30?\\x0f\\x18\\xb2a3i\\xfb\\xaa\\x8b\\xff\\x05~7dck\\xac\\xa2\\xb0#\\x8f\\xf8\\xf6\\x97\\x9c\\x96\\xe2\\xe0n\\xf7\\xe5\\xdf4\\xa1d\\xb5\\xda\\xc6g\\xa0\\xdb\\xf1\\xf6\\xd2a\\xd6\\xabt\\xf1\\xaau\\x11\\x99\\x1c\\x19\\x01\\xe0!s\\x90g\\xe9\\xfd-\\xc2\\xcc\\xc6p(\\x85\\x01\\xeb\\x97a\\x15\\xf3l\\xbf\\x80i\\xd6\\xa5\\x15\\x91\\x935\\xff\\xb2\\x15\\xfb\\xa2\\x82\\xf6\\xd86\\x12b\\x9e`\\xe2\\xab\\xfe\\x00\\x95\\x06\\xd1\\xec\\x0b\\x86\\xa8\\x9fw8\\xe6$\n\\x9d\\x99\\xba\\xa4o(\\xbc~\\x89\\xdci\t\\xf4\\xc5i'\\xd2\\xfb\\x0b\\xce\\xf1\\xaa'\\x18*u\\x16\\x00\\xf2\\x03\\xe2o\\xa2\\xc64\\x92\\x1ch6\\xbd\\xa9\\xf0\\xba\\xbf\\x01\\xd7\\x10b\\xfd\\xdf\\xd3\\x19\\xf3\\xeba\\xe4\\xda\\xe9\\x19\\x82\\xd6\\x06\\xdb\\xac\\xaah\t\\xf7\\x8a\\xcd-\\xa4i\\xf4\\xc9)\\x8c\\x88\\xfam"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa5\\x81\\xe2\\x1a\\x91\\xaf\\xd0\\xc7\\x9a\\x8b\\xc9\\x08\\xb9\\xfc\\xc0\\x98\\x8ca\\x84%\\xe1\\x84\\xa5g)\\xa9\\x94\\xdai\\x12;\\xa0\\xa8\\x19>\\xdancf\\xa6\\x10\\xbe\\xaadf\\x831ac\\xc7~\\xb7\\xbc'yd\\xde\\xeei\t\\x9d\\xc7u\\x1es(\\xd9\\xe2\\xadc\\xa0\\xd8\\xe9\\xa7e\\x0f\\xe4\\xe3n\\xe9in=,d\\xabyg\\xbasb\\x024\\xa1\\xfb\\xcd4ym\\xa6g\\xc7@\\xdc\\xcb\\x93`\\xe2\\xb5\\x06\\xad\\xcb\\xdf>\\x9dn\\xf6h\\xfc\\xfdw\\x92\\xed\\xc4?~\t\\xd9\t\\x1cai\\xcf\\x952\\xc39\\xa0\\x01s\\x94\\x07\\xf2j\\xda\\xc7\\xaf\\x0co\\xbc\\xd3\"v\\x13g\\x1b\\x98i\\xa2\\xc8?\\xff*\\xf7m\\x9c\\xd6\\x86\\x9bsm\\xda\\xe8\\xbe\\xee\\x1c\\x89w\\x1e\\x12y\\x0bv>\\xd2odj\\xb8k\\xd3ig>\\xa9e\\x9a\\xf1/\\xb2\\xccg\\x8d\\xa5\\x01u\\xdc\\x8b\\xee:y\\xc3\\xcb\\xdf^\\x17\\xaf\\xe3\\x8f\\xffn\\x96\\xeb\\xbc\\x924\\xdb\\x8d\\xb45=\\xaa\\xaf\\xf5+\\xb3^\t\\x9akzc+\\xa9\\xa8\\xe5\\xc1\\x8frz"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\xec\\xa3\\x8b\\xa0\\x87\\xf8\\xbc\\xd9\\xcao\\x9c\\xc6\\x19\\x9f\\xa8\\xde\\xads\\x8c\\xd9fvv\\xbf\\xf1\\xe2\\x16\\x14\\x13\\x0b&\\xbfp4\\xacm\\x8a\\xf2\\x80\\xa5\\xe8q\\xc7\\x9d\\xe7o\\x947\\xf1\\xfb\t\\xbd\\xb9\\xab\\xc1\\xbb\\xa8iu\\xd70m\n\\x06\\x1e\\xc3\\x87\\xb3\\xec\\x03\\xfb\\xab\\x8c\\x9e\\xd0\\xed\\xd1\\xfc\\xc0\\xb3\\xd6\\xcd^v\\x16\\x88zqf\\xbe\\xa4\\xb6\\x0cn\\xe9\\x98\\x13\\xa4jzkr\\xf8\\xaf\\x8cc\\x93\\xdfi\\xf7u\\x86\\x86v\\xbb\\xcd\\xf7\\x0f\\x07\n\\xc5\\x14;b\\x85\\x03hd1\\x12\\xf7\\xb6>\\x07\\x91\\xa8\\x86su\\x1a\\x167\\xab\\xc1\\xeav\\xc5\\x12\\xe64\\x8a+\\x9c\\xa9\\xae\\`\\xb7\\x90f\\x99\\x14g6\\x7f.\\xa7@\\x80\\xc6g\\x0b\\xb6w\\xbe\\\tu\\xc0yo\\xbbp\\xb8\\xff\\x92\\xb2\\xf8\\xd4\\x8c\\xacey\\xbch5x\\xec\\xe3=\\x8e\\xc9\\xc0|\\x04w\\xf2'\\x00l\\x04\\xc1g \\x04\\\\xcf\\xb0\\x8d\\x9b/\\x91\\xa2\\x97$l\\xaf'~i\\x8c*c\\xf1u1\\xc7\\xa8\\x92l3\\xb5\n\\xe5"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\xc0\\x9f0\\x8b\\xbe\\xa3\\xb2\\xf9\n;\\xa4\\q\\x82\\x17\\x03\\xf0\\x12\\x8fxp\\x05;\\xf0\\x074\\xb4\\x90\\xef\\x88u@\\x1f\\xcc\\xf7z\\x18\\xee\\xa7\\x03\\x97\\x8c\\xbd3i\\xaej:kd\\xe7j\\xfb\\x90x\\xb7\\xf3q\r\\x1ah\\xcaw\\x074fi\\xce\\xc0\\x08z\\xd9r\\x1b%e\\xb7\\x87nn%\\xee$uy\\xf6\\xdee\\xa4x\\x92\\xa0\\x96\\xd6i\\xf0\\xe4\\xbb\\x80\\xea\\x947c=i\\xd3\\xb2\\x86\\xd2\\xbf5m\\x96c\\x14\\xa6\\xa2\\xf9lc3w\t\\xd7'g\\x9d\\xeb\\x1e\\xff\\x9c\\xf5\\xb4\\xb1\\x01h\\x80>\\x05\\x8b\\x80g%q*+c\\xed'\\xc3\\x99)\\x89\\x8d\\xdb\\xa7\\xc9\\xb9cx\\xb4l\\xc0\\x9a\\x19.b\r\\x1an\\xb1\\xb2\\xc7\\xffg\\x85\\xee\\xf4\\xd2\\x8b.\\x13\\xd4\\xa8\\xc9\\x9di\\xabx\\xd7bl\\xc1x\\xdcw\\x0e\\xf36\\x88\\x94\\xcfu@\\xe7y,\\x92(e\\xff-\\x06\\x85\\x9da\\xcb\\xa4\\xd9\\xfa\\xcc\\x805\\xb6\\xf3j\\xc7~yv\\x9b\\xdd\\xa0\\xa6\n\\xf5\\xbb9\\xbf"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xa9\\xb6\\x99\\x1c\\x9c\\x13\\xc2\\xb2\\xdca\\x96\\xfc\\xd1wz\\xa5\\xc3$\\xdf\\x07l\\x14gfq\\x82\\xa1>\\x00\\xaal\\x9e\\xbff/\\xb8\\xe8\\xd9\\xfdn\\xa6\\x00=\\xf7\\xb7q;\\x00\\x88\\x7fd\\x8b\\xfb\\xb1\\xcc\\xe2\\x02 k\\x87\\xf8y\\x10\\xd7\\x139,v\\x03\\xdao\\x12e\\xe6\\x12\\x9a9\"\\x1ez\\xd6\\x95\"\\x88'1r\\xfc\\xc4\\xfd\\xd0\\xf9\\xd3\\x93n\\xc1\\xc8\\x8d\\xa0g\\x12\\x83\\xa4\\x89\\xce6\\x8e\\x94,\\x07\\xad\\xe7!\\xf1\\x8f\\xc4\\x8f\\xb2t\\xfc\\xb0\\xfbo\\xeb\\xf0ph\\x94\\xe4\\x97o\\xb7\\xc1\\x9d\\xb4x\\xe1\\xf8r\\xa0o#m;m\\xd9\\xdb%\\xb5*\\\\xef\\xc8\\x1a\\xa6\\xbb\\x95\\xee+\\xf0\\x15z\\xff7r\\xdd\\xbc\\x992|\\xb0o\\x12\\x03t\\xe9l\\x8a\\xe4`\n\\xa3\\xad\\xc2\\x87\\xd5c\\xe2\\x1f\\x9d\\xcdi\\xfeg\\xb1?v\\xe0>\\xd4\\xb0\\x95!\\xaclo\\xcex\\xcd\\x0e\\x822f\\x1a\\xac\\xde\n\\xa71\\x81\\xec\\xeeg3\\xb4\\x902zzda\\xa6\\xa5\\xe1\\xdb$\\x06\\x9duuq_\\xa5\\x9c\\xf3\\x80\\xd2"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xeduh\\x8c\\x92\\xce\\x1e\\x1e\\xce\\xa4\\xed\\x0c\"pp\\xa5\\xd6~|\\xc7v\\xa5\\xba\\xbe\\xd5t\\xdb\\x9c\\xe1\\x93\\xa7\\xa0\\xff\\xa4\\e\\x06'/\\x02\\x1b\\xec?\\xfe\\xee2\\xfe\\x12h\\x90b\\x95\\xfe\\xe6\\x1c\\xf4k\\xc9\\xb3\\xb7\\xa6gd\\xf9d_\\x90\\x13 \\xd5\\xe6\\xcdl\\x07>\\xb3su\\x1f\\x89\\xa9f\\xcfs\\xca\\x13\\xa8\\xe5\\xac\\xf9\\xb6@\\xb7;o\rv8\\x04ng'\\xe4\\x81xqn\\x03\\x89\\x84\\x9e\\xc5\\xfbc\\xd8\\x0fj\\xf1\\xb3\\x92\\xf0\\xdc\\xfa\\xda\\x94\\x9d\\xaa\\xa6\\xb1\\xf1\\xe6\\x0c\\x83cs_s\\xbd9\\xa1j\\xc4\\xcd\\xd0\\x8b\\xa5\\xe3\\xc3|4\\xee\\x81j+\\x9d`\\x7f\\x00\\x0c\\x97\\xc9\\xe0\\x15c\\x95\\xac\\\\x87\\xfa\\xd2\\xb4\\xe7\\x82\\x97\\xa8\\x1e\\xbf\\x83\\xca4\\xae\\x0e\\xee\\x88k\\x03`)\\xbc\\xb1pb\\x14\\xae\\xf4x\\x84\\x80\\x01!\\xb0v\\x05\\xfd\\xb3\\x7f\\xa6\\xeb\\x9e\\xf0\\x1ca\\x05$\\xacb6\\x87:\\xf8u\\x03\\x07\\x8b\\xc7?\\xf9\\x00\\xa9(\\xa9\\xb9\\xf0\\xadd\\x19& \\x97\\xe3)\\x87\\x10\\xea\\xa0\\xe90;"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3\\x01 \\x89\\xd8\\xf0\\xa0t\\x14\\xac\\x8ct\\xdcrv\\xc4\\x9f\\xc2\\x97;\\xdd\\xe4\\xf1e\\xd6p\\xe8\\xd2\\xd2\\xb4\\x91f\\xa5\\x0fi\\x9e\\xc4\\x1e\\x88e*\\xc6\\x86q\\xcc\\xa7e\\xbe-\\x97\\x16kj\\x0f\\xd8\\xb4\\xbd\\x0f\\xa5\\xc5\\x97\\x1eb\r'\\xf1\\x9d\\x9f+\\x02\\x14f\\xa5.\\xb0\\xc6\\xfd\\x98+\\x88\\xee9\\x82z\\xca\\xc7ugdr$\\xd4\\xc3\\x9e\\xdf\\xdb\\xc6q\\xce\\r\\x95\\x1ez\\x14i\\x9d\\xb8\\xe9*\\xa7\\xfa\\x0frr)\\x98*\\x06\\xdd\\xcdh\\x1ct\t%\\xbdp\\xe7\\xad\\xfe\\xe0m14\\x8b\\xf3\\x12\\xcdz\\x8d\\xcf\\xe4\\xc0f\\xaa\\xe5w\\x94\\xea<\\x89\\xb1\\xae|z\\xe8\\x83>\\xf0\\xaf\\xf5\\x08\\xb3\\xcc\\xabq\\xa5\\x9c\\x81)\\x17f\\xbf\\xc5\\xdfb\\x18\\xcc\\x1dju\\x87vz\\xd2\\x137\\x18~\\xc5\\xe2\\xd2\\xbf\\x93\\xaev\\xeb`b\\x0f>\\xdex\\xd8\\xd4o\\xe3v:\\xb5\\xdaj\\xa5i\tlx3\\xcck\\xea\\xf0\\xbcu\\xd1\\xbcb\\xc3\\xbc\\xa2\\x83\\x9a\\x89=a\\xaf\\xbawuo\\x88\\x82\\xa9\\x96\\xa6p\\xf6\\x1a"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\xc0\\xfc%\\x07\\x96\\xc5\\x81ru\\xa8\\xba;\ryz\\x0c\\xcb\\x1e\\x17\\xa8k\\x9a\\xe2\\xa0\\xc9\\xc1\\xce\\x15l0\\x80\\x89;\\x1b\\x13e\\xaa\\xb31\\xf9\\xa4\\x07y\\xc4\\x94\\xbd\\xc2\\xc8\\xa0\\xef\\x19c\\xf4\\xc5^\\x7fa\\xd5m\\x88c\\xd9r\\xa8\\x83\\xaf\\x93q\\x8c\\xff\\x88\\xddriy\\xee^\\xe1\\xef\\xe9\\xbf\\xf5\\x86\\xf8~\\x890\\xfb7\\x1c\\x85\\x04\\xb2\\xc4z\\x99(~\\x135\\x1b\\xc0\\xeep\\x1dvdj\\x7f-\\xf8n\\x86c\\x1fd\r\\x16\\xfa\\x08q/\\xd4\\xd5\\xd3\\x0e\\xday\\xee\\xba5p\\xe2g8\\xb9\\xcf\\xe8\\xba.\\xeb\\x9bd\\xa3\\xc8\\x92\\x0fz\\xe9\\xcc\\xb0e\\x86jo\\xf39\\x9ba\\xae\\x81\\x19\\x9e~v*\\x80\\x18\\xae\\x7f\\\\x95\\x0c:\\x9c\\xe5\\x05\\x8a\\x8f\\x0cs\\x17(6/\\xe7y\\xd6k\\xd6fu8\\xbecf\\xb5\\x96\\xef\\xb2\\xa1\\xa7\\xc6^dki\\xcf\\xe9,v\\xe6\\x9dk\\xaa\\\\x0b\\xf7\\x0f\\x0b\\x82|n\\x9e\\xe6\\xa6\\xc8\\x1e$n\\x85g`\\xaa\\x85\\xdf\\xd8\nts\\xe1h\\xe11c"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfb\\xefdx\\xe3\\x91\\xa3\\xa6\\xc2\\xee^7p4_\\xb0\\x04;\\xbc\\xff(aryxuri0s\\xff8\\xd6m\\xd7\"\t\t\\xf5.cy\\xc8\\x10?\\x8fsn\\xd3\\x8az\\xf2_\\xafy\\xe3\\p\\xcf\\x99o`\\xaa\\x12\\xff\\xear\\x0e\\xf1\\xd4\\x99;&\\xc6\\xd6\\x8els\\xf5\\x0e\\m\\x0bf\\x0b09\\xe8\\xc4\\xa5(\\x1cs\"\\x11\\xb1\\x92\\xc2\\xa3p\\xff\\x01\\xc0\\x01j\\x80\\x03\\x1amj\\xbc\\xee\\x1e<\\xc9v\\xb9\\xb1<\\x9de\\xba<\\xb6\\xac\\x93t\\xd8\n\\xa5$\\x0f\\xf4p\\x89o\\xc3\\xf9\\xdb2\\x0f\\x99\\x14\\xa8\\xced\\xba\\xcd\\xc5a\\xa7\\xac\\xa1\\x00 e\\xe1@\\xd3@y\\xda\\xa1yxa\\xc1\\xae\\x981\\x01\\xc4\\xdbd\\xb7g\\xb0z\\xe3\\xc1(\\xb8a\\xc8\\x96\\x9cm#*\\x91\\x1d8\\xbc\\xc5\\xb2w\\xe7\\xd7o\\xe2p\\xfb\\xd0tv\\xae\\xef#\\x9e\\x02ap_\\xd7q/\\x84\\xb7 \\x9el\\xf3\\xef'\\xdcu'\\xa3\\x91khw\\xefh\\xcc\\x90\\xf4\\xa2\\xc9\\xe2\\xd6\\xba\\xe7\\x18\\xf9\\xac\\xd5j"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f3s\\xa4\\x97\\x8fl\\x83~\\xa5k\\xc9\\xf2\\x86\\xf9\\xec\r\\xca\\xcf\\xdd\\\\x0c\\x9a\\x057 ~&\\xc2f\\x04\\xa7\\x87l\\x11e\\xb2\\x01\\xaa\\x89\\x1dlc\\xe0u\\xcb9\\x07;\\x89\\xf7\\x96f\\xb1\\xfe\\xf9\\x16cj\\x08z\\xa8\\xaay\\x08s\\xcc\\x198,\\xf3\\xf0\\xdc/\\xf9k\\x8e6\\xc3\\xf4l\\xd3\\x0e/\\x96\\x84\\xaf\\xd2\\x92\\xad\\xbc\\x11.\\xb3il\\x02e\\x8f\\xbb\\xb4\\xc3\\xf6k\\xf6\\xc5!`,<.\\xec\\xc9\n\\x92\\xcd\\x88\\x13c\\xb6\\x87er9\\x9c\\x01\\xec\\x90\\xa1\\xc9o\\xdfw\\xae\\x9f\\xae\\xa8\\xc5\\xf8\\xf0\\x98s=\\x00\\xb6\\xb8h\\x95lw\\xd7\\xbdf_\\xf1m\"\\xee\\xaa\\xb3\\xael\\x99\\xa0\\xd5\\xdc\\x8eim!\\xc6\\xd1\\x8f'q\\xe8\\xf1\\x07\\x14\\xa5\\xe5l\\xa2_\\x91\\xcb\\xb8\\xa4\\xb6\\x12\\xbf:\\xde\\xa7\\xefu\\x92\\x00\\x93\\x15\\x1a?\\xbb\\x1d\\xa7\\xad\\xd7\\xa6 \\x078v\\xe5\\xc4\\x83\\xdcl\\x1f\\xd2\\xeey\\xcf\\xd0\\xd4\\xf9\n\\x95\\xca\\x80\\xb2\\x8c7\\x98\\xea\\xc4h\\xc0\\x90\\xd5\\x0e\\x95\\x12\\x92\\xbd*\\xd7\\x9f\\xc8~\\x16\\x85"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xda'\\xf44\\x14\\xba\\x98y\\xb4\\xfbf\\xfba0\\xee\\xf6+lb\\x1b\\x86k\\xcd\\x8f\\xa5\\xf8ji,y\\xd7m\\xe47\\x9d\\x8e\\xa3*\\x91\\xcfhnd\\xcd\\x9br\\xf0\\xbepn\\x7f\\xf8\\x05\\xd5\\xdcn\\xd4\\xbdv\\x01o\\xbfz\\xd5\\xddv\\x85\\x90lk\\xbd\\xd2\\xa3\\x8e\\x8d\\xec\\x18\\x1a\\xfaj\\xb3\\x87\\xf2\\x173\\x8d\\xf7\\x94\\xf61\"\\xb7\\x89\\x0e\\x84\\xfb\\xd3k6\\xe0\\xf5\\xb3\\xe0\\xb4h\\x87`\\xbd\\xa6v\\xcc\\x1b\\x841d9\\x13nay\\xba\\x8d\\xe0\\xcd\\x08q\\xb7-\\x99a\\xbf\\x85\\x96\\xaa\\xf5\\xf60p\\xd3\\x11\"z\\xad\\xcc\\x9f\\xc5t\\x9b\\x88v\\x87\\xc0\\xd2\\xc4\\xc2\\x17\\xb1\\xb9i\\x9ff\\xafam\\xe8\\x92&\\xf2\\x89\\xe6d\\x0e\\xed\\xcfid(\\xf6\\xdb\\x1a2\\xa0\\xd8\\x92 \\xd5>4\\xb8\\x06\\xf3j\\x9f\\xf2\\x01\\x91\\x9e#\\xeel\\xbf\\x18h\\xf5n\\xcd\\xec!k\\x8a\\x94?\\x854\\x8c\\xecy\\xa7\\xc3\\xb2v\\xa1\\x88\\xc2\\xbd\\x8dk\\xc0\\x84\\x0b\\x9a\\xee\\xf8\\x17\\x9b?e)\\xdc\\x01\\x9b\\xaes\\xd6|"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xffub1\\xeb\\x06\\x90\\x8c\\xafkw\\xacf\\x92\\xb9\\x8d\\x8a\\xc9yk\\x90g\\x0e\\xa9n\\xa5\\x18\\xc0kn\\x9e\\x1a\\xe0\\xb9a\\x0e\\xe6\\x84\\x06l_p7d\\x04\\x8exx\\x9fe\\xbf\\xa8\\x02(\\x13\\xab\\xff\\xca\\x846\\xb7\\x07\\xb7\\xad\\xf3tn^\\xbb\\x15\\x99\\x1e\\xdc\\x8d\\xba\\x98\\xa4)\\xdc\\xa0\\xdf\\xe7gc\\xef\\xce\\x10s(\\xafi'\\x93\\xb1\\xf5\\xfc\\xe3\\xc81j\\x1d\\xc7\\x97\\x9c\\xac\\xe23\\x02_|\\xb6\\xf6%k\\xccb\\xef\tl\\x0e\\x0c6\\xfc\\xab\\xf4\\xc1\\xb8\\xb9\\xb6\\x1e|8\\x9c\\xd9\\xe6\\xec\\x1b8w8q\\xf5\\x97\\xf9\\xa9*\\x17ip@\\xdat>i\\xdd\\xa9\\xdc\\xbc$\\x9fn\\xdd/\\x9b:?\\x04\\xe8\\x94s\\x1els\\x86w\\x92\\xd65\\xdbw\\x9e4.\\x8f\\x11\\xb1t\\x94\\x99\\xf3\\xc4$d\\x02s\\xb7\\xb5\\x0e\\x1c\\x1d\\xe7d\\xae\\xe35\\xea5(_9v\\xd7\\x9b\\x13|09\\xce\\x1d\\xa4\\xc1 \\xa4\\xcd\\x883\\xec?\\xf3\\x15\\xbb\\xa5vc\\xd9\\x13\\xf2\\xaa\\x14c\\x0b\\xf1\\xf9\\x9a\\x8f\\x90\\x9d\\x87\\xe2\\xc7"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde\\xd6\\xac\\xdb:c\\x86\\x17\\xd5w3\\x9e\\xffqy\\xbb\\x17\\xc4\\xa2e\\xe5\\x01\\xea\\xf2s\\\\x8c\\xd2\\xbf\\xfa\\x0f\\xd6,\\x8ba\\x11t\\xea\\x95\\x10\\x1b=9\\x8f\\xb4\\xeeb\\xc4;\\xc4\\xbb\\x04\\xb4\\x08\\xf9\\xc7~\\x8e-\\x07\\x87\\xd9\\xbc\\x1d\r\\x80\\x8f\\xe0\\x9a\\xe6\\xc0\\xd3\\xc0\\xd2\\x11\\xf4\\xfc\\x03\\xd6\\xc8~q\\xc17\\xb2\\xed!6\\x9b\\x82l\\x1e\\x04:\\xf0\\x88b\\xf9\\xe30k\\xd3\\x16\\xbfw\\xe4mi\\xbd\\xa1\\xd5\\x01\\xac\\\\x8c\\xca s\\x9a \\xa7m\\xbf\\xb0\r83\\x88\\xb1f\\x00\\x93\\x8a\\x984\\xbe\\xdc\\xb1\\x13\\xe0\\xd4\\xfer\\x80\\xaea3a(vc\\x9c \\xd5\\xab\\xfb\\x9f\\x18\\x18\\x19.\\xba\\x8e\\xf4\\x1bq`@\\xd8\\x9c\\xcf\\x94w8|\\xeexa\\xff\\x8e\\xa0\\x0c\\xb8\\xccp`_\\x17\\xa6dy\\xdc^\\x9b\\xe0\\xbf\\x0f_j\ts\\xfcm\\xfd\\x10d\\x160/\\xe0\\x80\\xe2\\x94\\xdd\\xe6\\xa7\\x81lmi\\xa9qi\\xdcap\\x14t\\x1e\\x07\\xa6z\\xd2c\\xe0\\x93b\\xa8\\x8f\\x9b\\x19\\x83\\xd7^\\xe3\\xb7)\\x0f\\x00"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xady\\x90\\xa2\\xcd\tq\\x1az\\x10\\x1b\\x19\\xbcv\\xfc\\x10i1m\\x84n\"\\xc7j\\xbd\\x99$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xe7i\\x9c7\\x8d\\xedaapdu\\x8d\\xf4\\xde\\x87:\\x804\\\\xa2s#\\xff\\x92\\x1e\\xd2l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\xab\\x80\\xcb\\x96\n\\x92n\\xd1\\x0c\\xf0r\\xa7\\xbf\\xdc\\x97l\\xcb\\x7fsy\\x1d\\xa6\\x95\\xe1\\xa6a\\xb7\\x01q\\x93\\x00\\x07\\xf0\\xed\\xe4=bm\\x96#\\xe8\\x88\\xd7\\xc5\\xd0\\xf3\\xda`\\xb2\\x8e\\x06\\xdf\\x13\\x8c\\xcd\\xee\\xc4\\xc0\\xf5\\xf5\\xd8\\x9d\\x97\\xa67\\x07\\x00\\x06\\xf8\\xdd\\xcdy\\xb5\\x85\\x9e<\\xe6=8x\\x1es\\xd4k\\xd1\\xdd\\xbc\\xa2\\x95\\x8b\\xe4\\xa7\\xf4con\\xf7\\x18_h\\xd6\\\\xff\\xcf\\x10&\\xc5)*\\xb8d<\\x03\\xf61a\\xb8|\\xcf\\x8ee\\x01=e\\xe0\\xdc\\x9b\\x83\\x82\\xa9\\xef\\xd8\\xb1\\x89\\xb7\\x88\\x1a\\xba\\xaa\\xe8d\\xe0?)&\\xec\\xf9x\\xd3\\xbe\\x13\\xec\\xd4\\xeb\\xa3:\\xee\\xc9x\\x0e\\xfa\\x98~\\xc98\\xbc\\xea\\xdc\\xee\ra\\xffp\\xdb,\\x86\\x82\\xee\\xbd\\xe7\\xe5\\x00\\x13.m\"\\x16\\xdd\\xa7l\\xfcb!\\xd6&+g\"p\\xfb\t\\x84\\xe9\\xbe\\x9d\\xbf?\\x13\\xb5\\xfav\\xe9\\xc6\\x9dy\\xcd\\x7f\\xeb\\x80i8\\xa6\\xec\\xe5\\xb0\\x0e\\xa0\\x12\"\\xc4\\x0c\\x96\\xf5)z\\xe2\\x00\\x9b\\x93\\x87\\xa0\\xbfjs\\x07c\\xa9"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xbe&\\xa5\\x977\\r\\xe9\\x863\\xd7\\xc2\\x17\\x87\\x1e\\x04j\\xe5<\\xd6c\\xdf\\x92\\x9cl\\xfe\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xad9\\xcdi\\xb0@\\xbf\\xa4x\\xb0\\xfc\\xe7\\xc9\\x02\\x07\\xe1\\x181sp\\xe8\\xfah\\x98\\x02\\xc2\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\x07f\\x1b\\x973\\x11\\xfbru\\xa2\\xa0r\\xcc(\\xda@*\\xb9vp\\xdaf\\xd3yjk\\xa1_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1ez\\xb0\\x8ar_\\xa5_\\xce\\xe2\\xee\\x85\\xa2\\x04\\x88\\xf6\\xcc~\\x17\\xc5\\x84r\\x1d*\\x1f\\x91\\xca3f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xc5r\t>\\xd7\\x89\\x15\\xf5\\x7f\\x15%\\xf7\\x84\\xb9\\xd6\n\\xc7k\\xf9\\xc1ql\\x1a\\xa9=\\xc9&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xa1\\xd5l\\xc1\\xc2\\x01\\x0b\\xb1h\\xa3`\\xe8\\xd5\\xbaz\\x18\\x07\r )j\\\\x8f\\xf9\"\\xbb)v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1eg\\x94q\\x90&7\\xf2\\x1b4\\xbcdn\\xb4u\\x1d\\x9a\\x0ct\\xc6m\\xf9\\xe6;\\xaa\\x02+9m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x016\\xe7\\x1e\\xa9s\\x8a*2%\\x87\\x8eu\\x9f\\x88\\\\x19\\xcbd\\x952\\xcb\\m\\x9f#u\\xd0\\x89\\x06rt\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b#\\x9bfc\\xdcqq_\\xccw\\xd7\\xd3\\xfe\\xcf\\xa4\\x14\\x1d\\xd5\\xf4\\x07*1\\x01i\\xde=9\\x81\\xc9\\x9ff\\xd0\\xf7\\xc6\\xf3\\xcb\\xcdd\r\\xea\\x0e\\x12\\xfa$cr:/n\\x8e\\xeej\\x986\\x14\\x98p$b\\xe3v\\x13k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed1\\x98\\xc3\\xc6\\xc6x\\xb0\\x84\\x91\\xdd\\x17\\xc2-rvi2\\xde%\\xe3i\\xb5\\xe0\\xfe\\x87\\xc6f\\xf3\n\\xfd\\xce\\xc2\\xd0\\xfam\\x97\\x1a\\x7f\\xc9h\\xf8:j\\xbe\\x07\\xbf"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04uy+\\x94ka\\x015z\\xea\\x17\\x83\\x8flw\\xe4t\\x0c\\xc8\\xcc\\xfd\\xf80\\x0b\\x1bab\\xf4`l\\xc1&\\xaf\\x92\\xf5q+\\xb9%\\xeb\\xdfi\\x0f\\x90\\xd1\\xe9\\x04\\xae\\xfb\\x11\\x8d\\xb9\\x9e/bfb4l\\x05\\x8cg\\x1b-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\x064\\x95\\xc7p\\xc2\\x88\\xad1\\x7f\\x87ym\\x8dd\\xff\\xb5oz\\xd1a\\x17=h\\x06\\x8flo)\\x00\\x952=`\\x1d\\x11\\xc2\\xb3\\xcc~\\xff)+\\x12n\\xccr"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04?\\xd5o\\xb5\\x06a\\xe4\\xb9\\xab\\x83p\\xd7\\xc7x-\\xbc\t\\xfd\\x81\\xb5w\\x83\\xccq\\xcdn\\xa7\\xaa\\x1b\\xe0\\x9ez\\xdb\\xf3 \\xa9\\xe0\\xfc\\xfb\\xe6\\x0bl_\\xbf\\x18n\\xce\\x84\\xcd\\x95\\xd1\\x8f\\xad|\\xf0\\xab\\x98j)\\x7f\\xb6u\\x9d\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14\\xcd_\\xc6\\xcd\\x1d\\x11\\xfbx\\xcf+\\x956wi\\xe7y\\x08\\xe9s\\xf8\\x8b?\\xb8\\x93\\xd3\\x17\\x1143q#\\x8b\\x90\\xf4\\xaa\\xd1i\\xebp\\x9f\\x92y\"\\xa3w"
  736.  
  737.  
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xd2=\\xf7\\xe8\\xaf\\xd6\\x91\\x8b\\x91\\xf2\\xa2\\xb1\\xd9\\x00v\\xd6\\xfaz\\x839\\xa8\\xf7rz\\x80\\x7f\\xa0!\\x07\\xfe\\xa1\\xe5,h:\\xf8y\\xa7\\x1c\\xd5\\xd9:1\\x0co*\\xa9\\x00\\xa0y\\x15\\xf2\\xb9\\x95\\xb6\\x97\nz\\xf3\\x7fn\\xf0\\xc1l_\\xf7eu\\x8f\\xc20\\xf9\\xd8k\\x0f\\xe6\\xfc\\xaa\\xb4\\xcef\rx\\xa0\\x0b\\x06u\\xe2ls\\xae\\xa0\\x9fc7>dng\\xdfp\\xa0\\x84`c\\x19x\\xbd\\xab\\xb96\\xc0\\x04\\xcff\\x96\\xd1\\x0c/q\\xdd\\x1bz\\xef>-\\xbb\\xca\\x94o\\xe7\\xdd\\xa5\\xc5\\xa6\\x98\\xedm\\xc7\\x98\\xb8z\\xdd\\x80\\x91!\\x81\\x04\\x08\\x1a\\xb0=u\\xe2\\xa0\\xdc\\xf7$e.z\\xb9=\\xbb\\x95g\\xb0b\\xbd\\x16\\xe7$\\xfau\\xc9d\\x06\\xefw\\xaf\\x9c6\\x07\\xd0\\xec\\xbf\\xdb\\xdf2m\\xc3e\\x14\\xa8\\xb5r\\x89\\xc6r\\xa0\\xb3\\xaf-zi\\x8c\\xb7\\x9b\\x13\\x07\\x14\\x7f`z\\x0e|-\\x90\\xd6b\\xa5\\xc5\\x82_\\xe5\\xc0\\x1c\\x90\\x8f\\xfc\\xda\\x8a\\x18nj\\xaar\\x93\\xd3\\xc3j\\xd7 \\xf5\\xd1\\x1espm"
  739.  
  740.  
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\tk\\xac\\x08\\x1f\\xc6\\xb6\\x98?\\xfb:zonw4\\x04\\xeb\\xe3\\x8f\\xf0#\\xde\\xd1u\\xacb\\xc7\\xcf\\x88\\xcd\\x9d\\xebl\\x16\\xa2\\xd2k\\x99\\xc8c\\xa6b\\x84c0ao\\xb0\\x9e\\xbew\\xb5\\xba\\xd0(\\xcal.t)z\\xf4\\xae\\xb18\\xe9\\xc8\\x99o\\x9f\\x10\\xc6\\xd9\\xe3\\xa2\\x0cj\\xaez\\x0b\\x90e/\\xd5\\xc9\\xfeh\\x89l\\xd9\\xfc=8m>\\x1f\\x06'\\xd31\\xb6\\xb8\\xafk\\xd8\\x9e\\xc80\\xae\\xe5>\\x8d\\xf9\\xe2\\xc5\\xf7\\xc8\\xb1\\xc0xgiq\r'sj\\xd9\\xc7\\x96\\xa1-\\x93\\xa2\\xe1z/\\xd1\\xf6\\xa0t\\xd4\\xeb#\\x1cr\\xd2\\xd7(\\xc8\\x8d\\xd5j\\xb8\\x14aj\\xc5\\xd1\\xc9\\xaa2\\x13\\x97\\x8eta\\x93\\xec\\xa7\\xe00\\xbb\\x16\\x86\\xe5\\xa4\\xfeb\\xb1\\x1ci\\x02&\\x84d@<\\x0f\\xdc\\xd2/i\\xc8\\xc5\\x13tf/r\\x90d\\x9d\\xc7\\xcfje\\xc7\\xb5\\xd6xh\\xcb\\x12\\xca\\xd78j\\xca\\xf9\\x1c\\xd9\\x03\\x12\\xb0l\\x80\\x9d\\xd8\\xf8d\\x9be,\\xe6k\\xe4\\xa0e\\xben\\x82\\x1c\\x85m\\x9b"
  742.  
  743.  
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010qfk$l\\x05\\x01p\\xf9y\\x90\\x8ea\\xc0\\xc0mv\\x15\\x0b\\x950^\"3\\x115@\\x13\\xb6\\x1c\\xef\\xb40\\xfe\\x07\\x99\\xbc\\xda\\xaa\\x91?jm\\xf3\\xbdi\\xee\\xcb\\x95=0\\xb9\\xed\\x07\\x9cd\\x9d\\xd3\\xaaz\\x90\\x9a\\x15\\x93vd\\xfd\\xaf\\x87\\x03k&2\\xa3f\\x96\\x1d\\x81\\xe9\\xbet\\x83\\xceni\\x02\\x19\\x01\\xff\\x9d\\x17\\xe6\\x00\\x89\\x0e\\xda\\xb3@yv\\xf0\\x93k\\xe9y\\xfe\\xe6\\x03\\x8a\\xdbagzu*\\xeb\\xe4\\x98\\xea\\xafg\\x16\\xa75\t\\xc0\\x9a\\x83\\xa1&g\\x97n\\xee\\x05\\x19f\\xcf\\xcf \\xbe\\xe3\rd\\xd3l\\xe9 \\x96\\xed2\"1=\\xf3\\x19h!\\xdf\\xc2\\x81\\x8b\\xa3+>?\\x03u\\x1c\\x02\\xd1\\xdah\\xb0\\xb1hbg\\x1b\\xaa2\\xa4\\x0e)\\xd4p\\x07\\x01\\x03@\\x839\\x029;\\xfe\\x07\\x04\\x13w\\x86$@t\\xf6\\x1d+\\xdc\\xc0c\\xbe\\x91\\x86\\x1du|d\\xfeh\\xf5k\\xba<\\x19\\xa0\\xbc\\xb7pm0\\xa8\\x17\\xa8\\x9d\\xc7\\xbe\\xfe2\\x89\\xb2n\\x83\\xe9\\xd3\\x84\\xa0l\\x13"
  745.  
  746.  
  747. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  748.  
  749.  
  750. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\x99b\\x8ed\\xcd\\x19\\xc6\\xe1l\\xda\\x14k\\x96#<o*\\xe1\\xf3\\xfa\\x96\\x11\\x92z\\xcdei\\xe7\\xcc5k\\xd6e\\xe2a\\xebkxj\\xd4\\x99\\xa0h\\xb3\\xe4*o\\xfb\\xdb\\xa0\\x87\\xac\\xe1\\x0efj\\xeb\\xfa_ \\x02d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!s\\x7f#>\\xac\\xb5(\\xb2f\\xe4\\x16\\xd0bb<u\\xac\\x1d,y0bf\\xb5*u,\\xect\\x05\\xe2\\x9e\\x9emxcd\\xc5\\xd4d\\x08\\x86z\\x02\\x05w"
  751.  
  752.  
  753. "http_request": "winword.exe_WSASend_\\xc4\\x00e\\x00\\x00\\x8a\\x0c\\x124y\"t\\x14.\\x1f'm4\\x85i\\x1e\\xf4\\xe4\\x01p\\xb4#_\\xfen\\xae\\xb6\\x11x\\xfb/o\\x0e\\x8e\\xfb\\xff\\x97\\x9a\\xbc\\xdd\\xa5\\x9d\\x8a\\xb7a\\xff\\x92\\xbfr\\xd0\\xf8\\xb8`ys1\\xb6\\xfa\\xee<\\x0ew\\x1d\\xff\\xe7a h\\xbe\\x08j~\\xc6\\x0f\\xc3\\xed\\x01\\xe6\\x01mg\\x0f\\xd8\\x00\\x12\\xbc\\x81\\xcf\\x17\\xe6v?\\xa6\\x17\\xe6\\x12x\\x8e%\\x1e\\xfc^\\x05\\xce\\xc3ku$\\x1f\\xd6v`\\x96\\x05\\xe7\\xa1\\xf4\\xd5\\x02\\x9d|\\xf9\\xe8\\xbd\\x83\\x9d\\xbe/\\xcd\\xbe>\\xda\\x96c\\x00\\xc0w\\x89b\r\\xb5\\x19ab\\xe2\\xe4o\\x90\\x8b+\\x01\\xc1\\x94\\x0e\\x99\\xae\\x9a\\x8c\\xb1\\xdf6p2\\xb5\\xd3\\xbe\\xed\\x92p\\x90g\\x0f\\xb4\\x94\\xd3d\\x9a\\x11yh\\x84\\x1e$\\xa7\\xd3|\\x82-i.u\\x0fs>\\x02\\xc9&\\xd1\\xf5r\\xcf\\xe0:n\\x8b!\\x07\\x84\\x1f\\x16$\\x1ay\\xf8~\\xa4cbj\\x9dh=_\\xc3nr\\xd3\\xba\\x9f\\x14(\\x0fs\\x91o0\\x97\\xbf6\"\\x9bg\\xa0\\xfbp\\xdfq\\xd8:"
  754.  
  755.  
  756. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04<\\x10\\x1fv\\xa2o\\xf1\\xff\\x93qk\\xb2k\\x9a\\xa5\"z)u\\x02\\xce\\xd0$\\xf3\\xf1\\xc1\\x00\\xdb\\x98\\xe2\\x9d\\x7f\\x80\\xfbr\\xb3\\xa1\\xef<\\xf1\\xd7&\\x93kb\\xa8\\x98\\x84i\\xa1\\xac>\\xcb\\xa6%\\xf4q\\x1f\\x9a#\\x7f=\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\xa1\\xde\\xdfv\\x8a\\x05\\x7f\\xe0\\xc0>\\xb9\\x07\\xb1\\x8e\\x13\\x81b\\xba\\xeb\\x16\\xe6\\xeb\\x9cz-\\xf9\\xa2t_\\x07\\xbeok\\xbf\\xe7y\r~e.\\xc7\\x1d\\x1c\\xca?"
  757.  
  758.  
  759. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\xcd\\xee?b\\xa1\\x03ac\\x9a\\x96s\\xce\\xe9\\xc8wd<\\xe8\\xd2t\\xce$\\x0cb\\x92*\\xe2\\xeb\\xe1v\\xd5\\xca\\x92\\x18((\\xdb1\\\\x85\\x8a\\x86s?;\\x8a\\x8f\\xe1vu\\x91\\x91\\x01\\x04y\\xee\\xc5rxvu\\xe0\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\xd6\\xe4j\\xdb\\xd1\\xf8ac!st^\\xf3xb\\xe7\\xe0\\xae\\x8e\\xa6\\xdd\\xe7z\\xaf\\x03b)rz\\x90?o\\x9d\\5\\xfb\\x15\\xea\\xdct\\x0e\\x086ux2\\x9c"
  760.  
  761.  
  762. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xcdu\\xeces\\x95_=\\xd3\\xc8\\xf3\\x19vosu\\xf2\\xe9ax\\xa2n7\\x992\\x80\\xf4\\x05\\x0b\\x89\\xeea\\xbe;=\\xac\\x1f-!\\x19\\xa6\\xad\\xd8\\x0b\\x0b\\xfb--q\\x9c\\xb4\\xc2\\xf0\\xa7e\\x9c\\x80\\x8b\\xf45\\xd4\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\x0e\\xf5\\xbb\\xd8\\x9c\\xd8\\xfd\\x0e\\xc0nq0\\xde\\xc7\\xc3\\xed\\xe7\\xdb\\x84\\xd3x\\x1b\\x04\\xda\\x1f4\\x81\\x8b0\\xf1\\x19\\x07\\x93b\\xa9\\x7f1\\xff\\xc4eg\\x7fh\\xac\\x0cx"
  763.  
  764.  
  765. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1\\xf4uf\\xa7\\xcb\\xef\\x8de;cl\\xfa\\x18\\xa7=\\x11i\\xf5g\\x18\\xf2\\x0f\\x85\\x10\\x1b\\x8dcwtfh\\x89l\\x166\\xd9\\xe9\\xeeaq=+.\\xffc_x\\x8e,kd\\xff\\x1b\\xcds\\xae\\xf7\\xd6w\\xee_\\xf8\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc1m\\xf5\\xcc\\x1e\\x01\\xaeiwq!\\xe2\\xc4t\\x14q\\xc7\\x92r%\\x0e\\x8a.*\\xd6\\xa1;\\xebv\\xa7kc\\xf4r\\x8fq\\xe5\\xd9e3r\\xb9f.g\\xd9\\x0e"
  766.  
  767.  
  768. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\xc3\\xd8\\xcc\\xc3\\x03\\xb0\\xb6\\xbfge\\xde4\\x84\\xb9s\\xfab\\x8c\\x92\\xfa\\xdboh\"\\xe1\\xc6\\x90@\\x90h.\\x1a\\xec\\xe8p\\x01\\xc3\\x94o\\xf0b/u\\xb3\\xa2\\xa5*\\xbd`\\xd3\\x89\\xf4\\xab\\x96gc\\x94\\x90v\\xda\\x9ci\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\x82~\\x95\\xf7\\xe6mt\\x88\\x93\\xdf\\x8e\\xe9\\xffim\\xbd^\\xf4\\xf8x\\x93yu\\x86\\x84\\xa9u\\xc4z\\xf5h\\x930\\xccm\\x05\\x82\\x12\\xfa\rf\\xe0p$\\x8fi"
  769.  
  770.  
  771. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8t\\x0c\\xf0\\xdc\\xa6s%\\xdc\\xaa\\x87/\\xc5\\xfe\\xb9\\xce\\xe6ea\\xc76.\\x86\\x04\\xc2\\xd3\\x18\\xa0'6\\x00g\\x12\\xa9\\xa0!\\xf1\\xc3\\x19\\xd2\r\\xfd_\\xfe\\xeb\\x04(\\xf7.zq\\xb0\\xe4\\x81\\x07\\x06\\x95\\x8c\\xe6\\xa2w\\xb5\\xb0\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2q\\xb16t\\xd4\\x10\r\\x88(\"\\xb0\\x9ac\\xef>\\x02\\xd1\\x089g\\xfe._\\xa8\\xa1\\xbc\\xa96\\x9f\\xe4\\xa5\\xceu\\x1b\\xa2\\xe9\\xf1rx@e(\\xee\\x8c*a"
  772.  
  773.  
  774. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010aw\\xe6\\xe6gl\\x06d\\xb0k\\xe6\\xc2\\xf6\\xe8x\\xe0\\xden\t\\x8a\\xb0\\x12\\x03\\x99zd\\xf8\\x9e\\xb4r\"\\x87\\xd28rbi\\x83\\x1fq\\xee7_q\\xed\\xdax\\xd6\\xad\\xa8\\x08\\xf4\\xa9\\xb7\\x8a\\xe7\\x9c\\xb3\\x8a<m\\xc7\\xa1\\x8b\\xc2\\xa3\\x06\\xbex\\xa6\\xd7d\\xab\\xfd\\xefk\\xc2\\xd8\\xa8\\xdfa\\xf9 \\xe4\\xf3n)\\x19%\\xa0a\\x12\\xdf0\\x8dbb\\x16\\xfb/\\xd5\\x01\\xd1\\x198\\xd0babrd\\xf9\\xa2h\\x86x\\x18\\x07\\x16\\xca\\xfc\\xcf\\xd4/\\xedo)\\xf8\\xde\\xf5p@\\xb0\\xd3h=\\x95\\x0b\\xaa-\\xba\\xc1ms\\xf7#lo^\\x17\\x18\\xba\\xf1\\x9e@q2\\xbb_g\\x16r\\xd8\\x19\\xd8s\\xcf\\x9e5\\xed\n:\\x82\\xcb%>;\\xdbn\\x992^o\\xe6s\\x14v\\xd7\\x14\\xffb\\xd7\"vur\\x88\\x9e\\xc8\\xb9\\xb3t0\\xe7\\xa1\\xe3\\xd7w\\xd1oa\\x15\\x1b3\\xa7leh\\xcc\\xdd\\x18\\xe6\\xdchi\\xd8\\x84\\xd6<\\xc9+\\x9d\\x05\\xe2!:\\x9035wz,\\xd8\\xd1\\x16\\x9ei"
  775.  
  776.  
  777. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\x97\\xccxo\\x92o\\xa4'\\xa8\\xfe\\x99\\xb4!\\xba=\\x1b\\xd8\\x05\\x94\\xd5@\\xcb\\x80\\x1b\\xf5s\\xb7t\\xa6\\xacu\\xccam\\x0e\\x10\\xf0\\x10\\xc0\\xc1\\xb3\\xad\\x9b\\xa9\\xed\\xdck\\xba\\xcbd\r\\x0eu\\xa7\\xa4\\xfb5\\x03j65c:\\x8er\\x87g\\x16;\\xbb\\xeakpr\\xcf^\\x03\\x8b\\xf8\\xb4\\x8bu\\xccj\\x1f\\xa6s\\xe9y\\xd9\\x83\\xfd/\\xf9~\\xc0\\xd4?\\xa0\\x16!\\xaf\\x1a\\xe8s\\xf0\\xf1\\x86<<+i\\xc0kd\\xab\\xdd;w!\\xdb\\xd7e\\xed\\xd3\\x9a\\xc5?\\xb3\\xf7q\\xad\\xd1l\\xa3\\xb1\\x04\\xe3\\xe4vqxa\\xbf\\x85\\xb5z\\x19t\\xbf\\xe6p\\\\xcb\\xdblerz\\xd7\\xcc\\xd7\\xa3\\xa6\\xa5/\\xfftr\\xe7\\xe6\\x02\\xe9\\xe6\\xb3\\x05\\x01g\\xd1i\\x8di6\\xe2\\xf0\\xc9n\\xd3\\xf0v\\xe90\\xf2j\\xbe\\xeba_\\xd3^\\xcey\\xbd\\x0c=\\x90\\xec$r\\xa5\\xd6\\xdfql\\x9a*\\xa8\\x96\\xb5\\xb0\\xb1\\x08\\xf4!9b\\xd0\\x84=\\xd2\\x86\\xa7\r6 \\x03p\\xe5g\\xd8\\x8c\rd\\x1c'b2~\\xc6"
  778.  
  779.  
  780. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfb\\x08\\xe8\\x10\\x86\\xd0s1q++\ry\\x9cz\\xab\\x984\\xeb~q\\xa9\\x05e\\xd9+\\x02\\xa0\\xf3z\\xfa\\xa8*\\xd2y\\x9fh|\\xbe\\xd9\\x01\\x02\\x04\\xa5\\x98\\xdd\\xeb\\xcc 6\\x10,b\\xc3l\\xc32 \\x02\\xc5wj&9\\x1b\\x85\\xbe\\xee\\xa9\\xe4<:\\xb52\\xbb\\x80e\\xf9xiy\\x941b\\x96\\x08l\\xba\\x0bi\\x9f5\\x93\n_\\x05\\xff\\x8dj\\x10\\xbe\\xa6\\xec\\xa3:\rul\\xb9a\\x80\\xb2\\xcfm\\xe0\\x95\\xf8\\x80fp\\xd1\\xd8\\xdcok\\xa3vm\\xbay\\xf0\\x97k\\x81\\x9b\\xf31\\x07\\x91\\xd9\\xcc\\x8f\\xe0\\xa6\\xf7\\xe5x=\\xff\\x10b\\xb7acy\\x02n\\xeb\\xc9\\xd4hfdl\\x1b\\x0b\\\\xfc\\x96\\xd9vg\\x9b0i\\xc3\\x0b\\xb6dy\\xa2\\x89g\\x02\\xb6\\xd3\\xa3\\x94\\xf5\\x88\\x1e\\x94\\x0f\\x92\\xcf\\x8c/\\xf6\\x93y%\\x04\\xf4\\xae\\xef#\\\\xd4\\xac\\xa1\\x9em\\x03q\\xa2\\xda\\xd0fm\\x9cxgg\\xe8y\\xf0+r\\x80\\xfby\\xadio\\x90\\xd2\\x8dy\\x1c!\\xd5\\xd2\\x00\\xff\\x03\\x19\\xa0"
  781.  
  782.  
  783. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\xce\\x04\\xc7k>\\xbd\\xcb\\x17 kt\\xcd`b\\xc2\\x8d\\x9d\\xa3,\\x9e0\\x97b\\x17\\x9a\\xb3\\xff\\xbej\\xf2\\xf2\\x85\\xb9,h\\x85\\x8a\\x95^*\\x86\\xfa\\x0f\\xbd\\xecs\\x10\\xadq\\x87\\x96<\\xdb\\xa0\\xdb\\xd4h\\xd5h\\x1f\\x92\\x111\\xec\\x86\\xdf\\x15\\x00\\x17\\xa0\\xc30\\xed\\x9c_\\xda\\xd4232&z\\x03\\xf9r\\xfb\\xecz\\xd1\nbf\\xb5&\\x98\\x1c\\\\x9d\\xff\\x1bxr\\xa5\\xf9\\xa4\\xd2\\xa5\\x87qgh\\xe1t>\\xff\\x07\\xbfw\\xc3\\xb6\\xa01\\xc0=\\x81\\xed\\x88zz\\x8a\\xc8\\x06\\xa4\\xe9\\x94\\xd2\\xc3q\\xa6\\xe3\\x98\\x90\\xfd\\xa8\\x18\\x94zx0\\xacu\\xfe\\xcfz\\xa8?t\\x11\\x18\\xf6\\x90\\xf5\\x7f\\xa7h\\xff,h!\\x00\\x02\tt\\xd9\\xa5\\x8ai\\xc4\\xa7\\x87i\\x97tl\\x08\\xa2_\\xe5\\xbc\\xd0ag\\xfd\\\\xdbd\\xdd\\xc3\\x85\\x15\\xf2\\xa7\\xf9/\\x00e\\x1b\\xc9u\\x9c\\x05\\x13rta\\x114z\\xdd\\x12\\x13\\x1b\\xff\\xd6t \\xb3\\x0fy\\x87a\\x87|\\xc6\\xc2)\\xf5; \\xa3\\e\\xb0\\x87=/i"
  784.  
  785.  
  786. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\\xba\\xd6v\\x9c\\xba\\x0evtoh\\xfb\\x1c\\xaf\\xbc\\x03\\xdb\rk\\x12)d\\xd0\n%\\xbfz\\xb1\\x9d=\\x1a\\xfe^\\x0b\\xbe\\xcb\\x00\\\\xc2~\\x01\\x01\\xe4\\xc0\\x02>6\\xf9\\x01\\xf4\\xba\\x9a\\x0e\\x8a\\xd1\nd\\xa3\\x98\\x10g\\x1b\\x9d\\xff\\xfd\\x18\\xbbd\\xb1\\x0c\\xe8z\\xe95e\\xb7\\xc4k\\xd6d\\x848\\xd1b\\x18)>0\\x15\\xcd\\x8e4\\xe4\\xd8b\\xbf=\\xf9b\\x10&m'\\xd8\\xa0\\xa5\\x98\\xeb\\xc4\\xd1\\x00\\xf6\\xd5o\\xd1\\xcd5\rc0q\\x91\\xd6\\xe0\\xe8o\\xf8\\xfa\\x82\\xb6m!\\xe8\\xb4\\x94\\xd0\\xa7-%ns\\x14\\xd1^\\x06\\xbf\\xa0\\xaa\\x8c\\xfe\\xda\\xd2w\\x03\\x07\\xf2dlt\\xe1\\xf3\\xa6\\xa6\\xf3\\xbd\\x05\\x10w\\xee\\x86\\xcf\\x96\\x0e6.\\x82\\x9d\\xb9\"\\x040\\x9d\\x16\\x92u\\x83\\x9a\\x15\\x87\\xbf\\xbd/_\\x06\\x7f\\xbfxj\\x0b\\x00q\\xfc\\xdb\\xecc\\x15yz\\x16\\x0bcbi\\xb3\\xcd\\xfb\rd\\xa0y\\xe1o\\x85i\\xaf\\xcd\\x90\\xcfl\\xc8?,\\xaa\\xff\\x86jb#\\xe3`\\xf0uwvw\\x82\\x92s"
  787.  
  788.  
  789. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x02\\x03\\x03\\xe7\\x1e&\\x0b\\x9d5\\xb2mw&\\xd4\\xd8\\xf2'i\\xa4\\xc6q\\x99\\xc8\\x1e\\x14\\xd9\\xe3\\xf9cm\\xa8e~i\\xc5\\x00\\xda\\x88s\\x0e\\xc8\\xc6\\xcf-\\x9d\\x96\\xedp\\xac\\xc8\\xf9\\xa6\\xeb\\xf6\\xe6\\xc9\\x89h\\xd0\\x80v\\x08q\\xf4\\xb9q\\x00\\xe0s\\x1av\\xef\\xab\\xf6\\x9f1\\x0f\\xd1\\x058x\\xdd\\xbf\\xa45j\\xf0\\xc1\\x15j\\xcf2m\\x86\\x89\\xc4ey\\x0f\\xfbsf\\xda:\\xd6\\xba\\x17\\xef\\xedb~\\xdc\\xc9\\x08\\x03\\xf1\\xeb\\x05\\x06\\x87\\xc4\\xe3\\xb9\\x98\\xf2v\\x06\\xd6\\x9d\\x1c\\x91\\xcdj)\\xaa\\x89\\xd1\\x15'\\xc75r\\xdc\\x07\\x9d)l\\xf6\\xcb\\xe2s\\xf7\\x99\\xf2\\x12\\x8c8lt\\xed\\xf3\\xa0(\\xb6\\x0b2\\xa7\\xdd\\x9f\\xc7\\xd5\\xbe\"\\xea\\xb6\\xb9(@\\xfdns\\x00\\xb3\\x19\\xd5k5\\x911\\x05\\xb1e\\xc5\r\\xbf\\x1e\\xb98e\\xa206\\xd4ow\\xe5\\xebf_npr\\x80p\\x8b<@\to\\xe0k\\x9f\\xf4u\\xafu\\x16\\x05\\xf0\\xeab\\\\xd1\\xc7\\xe4\\xd5\\xf5\\xa9#\\xd2t\\xeab\\xe4\\xa0\\xde\\xeb\\xc8"
  790.  
  791.  
  792. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x016\\xe7 \\xf4\\xf6\\xc3\\xeffu\\x83gi5fn\\x92\\xe3\\xff\\xee\\x9c\\xe9\\xd6z \\xe4\\xce\\xb5@\\xb5\\xc9\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  793.  
  794.  
  795. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00c|\\x1c||5\\xb1\\x92c\\x08\\xef\\x829\\xf6o\\xa8\\x87\\xf7\\xa8\\x90m\\xcd\\x93n\\xe9r\\x13\\x88?\\xa4\\xf9\\xf4\\x8e\\s!o\\xb68\\x01\\xe4f\\xda\\x90-/l\\x95\\xec\\xfb\\xc4\\x99\\xcb\\xd3\\xc4b\\xcei\\x1ew\\xb8\\x87cfd\\x07\\xdf\\xab\\x03\\x96\\xcc\\x8fb\\xbf\\x12k\\xe8\\x7f\\x87q6\\x8aax\\xa6h/\\x1f\\xd1p\\xa5/my`=\\x86\\xde\\xdf\\xb1?\\xa0\\x15h\\x1b\\xc9\\x11%\\x05\\=\\x11\\xcc6;+a\\xfe\\xe6\\xdck\\x1b\\xdc!p\\xfa\\x04\\xe7\\xac\\xf0\\xd9\\x8d\\xa4\\xfd\\x97-.\\xfb\\xf1\\x9a\\x17\\x1b\\x19?b~>\\xe4x\\xe5h\\x9b\\xf8\\xe9\\xae\\xdd\\xcc_\\x15\\x1e\\x85j,\\xef_\\xa1\\@\\xe1azf\\xce\\xa6gl\\xee\\x1f\\xe4=\\x14\\x03\\x0b\\xd9!d\\xe1\ro`\\xbbt^\\xb1\\xc7\\x8c)\\xe8h\\xb7\\x05i\\x1dfp\\xec\\x89;\\xa6<j\\x89\\x86\\x8e\\xd8e\\xd5\\xeb\\xe9\\x81j\\xbezwa\\xfb\\xfb\\x1c\\x18c\\xfeo\\x1a)\\xaei!\\x1b\\x8d\\xe5\\xca\\x16\\x9c>"
  796.  
  797.  
  798. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`h_\\xf0+r\\xd3\\xf4n\\x7fv\\xa1\\xaay'~\\xeav\\xde4\\xaf\\x1cp\\xabt\\xdar\\xc5\\xb1\\x85\\xf6\\xd3\\xca\\xa8\\xce\\x0b\\xce\\xf9\\xaa\\x8d1\\xb8#\\x14\\xa5\"w$\\xde\\x10\\x94:lh\\xaf\\x90n\\xe6\\x12~m^\\xa3l\\xccc\\x90q\\x9f\\xa2,\\xbb!w\\xde\\x00\\xfe\\x94\\xca\\x8d\\xdb\\xc36\\x0c\\xacm\\x80\\xfe\\xc5\\xc4\\xe9\\xc9\\x8bfca?\\x91\\xf2|\\x96\\x98\\xf3\\xa8,\\xb9\\xda\\x03\\xd4kmj\\xf7o\\xc88\\xbc*\\xf2\\xbc\\xd7\"+\\x05\\x03\\x02\\x86?\\xfd\\x15\\xfa\\xe3?r\\xfa\\xc5>\\x92\\xd3y\\xfb\\xb0\\x86\\xae@y\\xf5\\xcf\\x9e\\x90j:c\\xc1p\\xf5\\xc3\\xe7|\\xba\\x1b\\x81\\\\xbed\\xdd\\xdek*\\xd0!\\\\xa9\\xb8-\\x07,\\xdf\\x00\\x85\\xfb\\x997\\x1b\\xbb\\x07\\x93\\x8f\\xbb\\x7ff\\xfd\\x94r\\x1c\\x8a4$\\xd6\\xf9k(\\xf9k//=\\x90\\x01\\xd9\\x81tb@\\xa8/8\\xfe)kz\\x83nyn\\xaei_dx5k\\xf5\\xaf\\x87\\xfdt`.\\xc4\\x087\\x93\\x84exn\\xd5"
  799.  
  800.  
  801. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p3r$\\xcc\\xa0\\xd3\\x9f\\xe5\\xe3\r\\x01r\\xa1d\\x10\\x97\\x8b\\xb7\\xe7@ka\\x88-\\x8cy\\x99\\xc8\\xfa\\xd9\\xe2r\\xbf\\x7f\\x85t\\xf8\\x89\\x0c\\xfa\\xd0\\x8a\\xa98b\\xc5\\xd1\\xa0f\\xef\\x9e7g*c\\xadc\\xfe,\\xb1\\xc5\\xc2u\\xd8a\\xa2\\xe9\\x06\\xfc\\xd08\\xbe\\x90\\x83\\xe8\\x9f\\xbd\"8d\\x02\\xef\\xe4\\xd3\\x15\\xf2:\\xfdu\\x0c\\xcb\\x123\\x9d:\\xb3\\xcb\\xee\\xf2&@$\\x08z\\xcbe\\xca\\xe6\\xfc\\xcdp\\x8f\\x95\\xf8\\xc7\\xa7c&\\x9f\\x01\\xf3\\x8d\\xf4\\xa0z\\xea\\x1e~\\x99\\x00t&\\xc5\\x07)x\\xd0\\xbb\\x95\\xd9d\\x8f\\+\\x8e\\x90m\\xf3\\xb4\\x99\\xe2\\x9f\\xec\\x91w\\x12\\xc7\\xe2\\\\xddg\\xf6f4\\xad\\x96s\\xe72\\xfc4\\x8e3\\x1c\\x0ec\\x1d$\\xde=\\x8e|\\xed\\x8d\\xa8\\xb9\\x10\\x01\\xeb%\\xe0av\\xb9\\xe7\\xc0\\xe5d\\x89\\x87\\xbf\\x04\\xa9\\xc2\\xec\\xd6\\x18'\\xe5|o(\\xb1\\xc8\t\\x0cx\\xde\\xaf\\x96\\x06\\x12j=\\xeaw7i\\xd0bk\\x0e\\x8a\\x85ws\\xbd\\xcf\\xab4\\x9c\\x08\\xd9\\x9a\\xc8"
  802.  
  803.  
  804. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  805.  
  806.  
  807.  
  808.  
  809. "Description": "Creates a hidden or system file",
  810. "Details":
  811.  
  812. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  813.  
  814.  
  815. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  816.  
  817.  
  818.  
  819.  
  820. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  821. "Details":
  822.  
  823. "MicroWorld-eScan": "Trojan.Agent.DWSX"
  824.  
  825.  
  826. "FireEye": "Trojan.Agent.DWSX"
  827.  
  828.  
  829. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  830.  
  831.  
  832. "McAfee": "Exploit-CVE2017-11882.bq"
  833.  
  834.  
  835. "NANO-Antivirus": "Exploit.Rtf.Heuristic-rtf.dinbqn"
  836.  
  837.  
  838. "Symantec": "Exp.CVE-2017-11882!g2"
  839.  
  840.  
  841. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.E"
  842.  
  843.  
  844. "Avast": "Other:Malware-gen Trj"
  845.  
  846.  
  847. "ClamAV": "Rtf.Dropper.Agent-6972810-0"
  848.  
  849.  
  850. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  851.  
  852.  
  853. "BitDefender": "Trojan.Agent.DWSX"
  854.  
  855.  
  856. "AegisLab": "Hacktool.MSOffice.Generic.3!c"
  857.  
  858.  
  859. "Tencent": "Office.Exploit.Generic.Szbm"
  860.  
  861.  
  862. "Ad-Aware": "Trojan.Agent.DWSX"
  863.  
  864.  
  865. "Sophos": "Troj/RtfExp-EP"
  866.  
  867.  
  868. "Comodo": "Malware@#1m7ln6v4yto0m"
  869.  
  870.  
  871. "F-Secure": "Malware.W97M/Abnormal.psxmr"
  872.  
  873.  
  874. "DrWeb": "Exploit.Siggen.20126"
  875.  
  876.  
  877. "TrendMicro": "HEUR_RTFMALFORM"
  878.  
  879.  
  880. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bq"
  881.  
  882.  
  883. "Emsisoft": "Trojan.Agent.DWSX (B)"
  884.  
  885.  
  886. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  887.  
  888.  
  889. "Jiangmin": "heur:Exploit.ShellCode.Gen"
  890.  
  891.  
  892. "Avira": "W97M/Abnormal.psxmr"
  893.  
  894.  
  895. "Antiy-AVL": "TrojanExploit/RTF.Obscure.Gen"
  896.  
  897.  
  898. "Microsoft": "Trojan:O97M/Obfuse.AE"
  899.  
  900.  
  901. "Arcabit": "Trojan.Agent.DWSX"
  902.  
  903.  
  904. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  905.  
  906.  
  907. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  908.  
  909.  
  910. "GData": "Trojan.Agent.DWSX"
  911.  
  912.  
  913. "ALYac": "Trojan.Agent.DWSX"
  914.  
  915.  
  916. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  917.  
  918.  
  919. "Zoner": "Probably RTFBadSpacing"
  920.  
  921.  
  922. "Rising": "Exploit.Generic!1.B843 (CLASSIC)"
  923.  
  924.  
  925. "Ikarus": "Trojan.Doc.Agent"
  926.  
  927.  
  928. "Fortinet": "RTF/CVE_2017_11882.E!exploit"
  929.  
  930.  
  931. "AVG": "Other:Malware-gen Trj"
  932.  
  933.  
  934. "Qihoo-360": "Win32/Trojan.Exploit.ed7"
  935.  
  936.  
  937.  
  938.  
  939. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  940. "Details":
  941.  
  942. "target": "clamav:Rtf.Dropper.Agent-6972810-0, sha256:d20391dfea270f4cadf76493cb818021be7d9cb76d7c8f25efcc2bb3794180ec, type:Rich Text Format data, unknown version"
  943.  
  944.  
  945. "dropped": "clamav:Rtf.Dropper.Agent-6972810-0, sha256:d20391dfea270f4cadf76493cb818021be7d9cb76d7c8f25efcc2bb3794180ec , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp, type:Rich Text Format data, unknown version"
  946.  
  947.  
  948.  
  949.  
  950.  
  951. * Started Service:
  952. "osppsvc"
  953.  
  954.  
  955. * Mutexes:
  956. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  957. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  958. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  959. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  960. "CicLoadWinStaWinSta0",
  961. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  962. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  963. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  964. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  965. "Local\\WinSpl64To32Mutex_1cec0_0_3000"
  966.  
  967.  
  968. * Modified Files:
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_c5aa69e61dc2352feacd760764bf6108.doc",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_c5aa69e61dc2352feacd760764bf6108.doc",
  971. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS51813AD8-4AAD-4D4C-BA69-34E172A5532C.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS58D17137-11BA-426C-A9A0-AF50D5EEE2B9.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF2CE71FBF-1EB6-4B31-80D9-FC6C4E56B66B.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  975. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  976. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  977. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  978. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6E02.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E03.tmp",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_c5aa69e61dc2352feacd760764bf6108.asd",
  982. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  983. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF86933DB26ADE8677.TMP",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E4C.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E8B.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBB.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBC.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBD.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EED.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0E.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F27.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F24.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0F.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F10.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F11.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F26.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F12.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F13.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0D.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F25.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F38.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F37.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F5A.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F59.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FD8.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA008.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA018.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA019.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA124.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA173.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA193.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1A4.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1D4.tmp",
  1015. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1016. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1017. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA484.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA4B5.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA4FB.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA485.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA50B.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C6.tmp\\turabian.xsl",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E8.tmp\\gb.xsl",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FA.tmp\\architecture.glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA59A.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FA.tmp\\Content.inf",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4D7.tmp\\RadialPictureList.glox",
  1029. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4F9.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C7.tmp\\iso690nmerical.xsl",
  1032. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E8.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA61B.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4F9.tmp\\Content.inf",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4D7.tmp\\Content.inf",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA51C.tmp\\iso690.xsl",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5CA.tmp\\HexagonRadial.glox",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\ThemePictureAlternatingAccent.glox",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C6.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C7.tmp\\Content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA62B.tmp\\Element design set.dotx",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA60A.tmp\\APASixthEditionOfficeOnline.xsl",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5CA.tmp\\Content.inf",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6E9.tmp\\PictureFrame.glox",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\VaryingWidthList.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6E9.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA51C.tmp\\Content.inf",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA767.tmp\\harvardanglia2008officeonline.xsl",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA62B.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\Content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7E5.tmp\\ThemePictureGrid.glox",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA60A.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7E5.tmp\\Content.inf",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA767.tmp\\Content.inf",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA893.tmp\\TabbedArc.glox",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA960.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA824.tmp\\pictureorgchart.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA824.tmp\\Content.inf",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA0D.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA893.tmp\\Content.inf",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA95F.tmp\\mlaseventheditionofficeonline.xsl",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAB09.tmp",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAAE9.tmp\\chicago.xsl",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB19.tmp\\CircleProcess.glox",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB19.tmp\\Content.inf",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA95F.tmp\\Content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABA8.tmp\\sist02.xsl",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB3A.tmp\\InterconnectedBlockProcess.glox",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAAE9.tmp\\Content.inf",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC57.tmp\\TabList.glox",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD13.tmp",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB3A.tmp\\Content.inf",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB9.tmp\\ieee2006officeonline.xsl",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABD9.tmp\\gosttitle.xsl",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE5D.tmp",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC57.tmp\\Content.inf",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEFA.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABA8.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5A.tmp\\content.inf",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5A.tmp\\Dividend.thmx",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABD9.tmp\\Content.inf",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF49.tmp\\ThemePictureAccent.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB9.tmp\\Content.inf",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB112.tmp\\Badge.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB123.tmp",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0D2.tmp\\content.inf",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB200.tmp",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF49.tmp\\Content.inf",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0E2.tmp\\Crop.thmx",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0D2.tmp\\Parallax.thmx",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C0.tmp\\rings.glox",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1D1.tmp\\content.inf",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB458.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0E2.tmp\\Content.inf",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB112.tmp\\Content.inf",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB426.tmp\\ConvergingText.glox",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB33A.tmp\\content.inf",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3A8.tmp\\content.inf",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C0.tmp\\Content.inf",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5A2.tmp\\content.inf",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB447.tmp\\Basis.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB563.tmp\\Headlines.thmx",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1D1.tmp\\View.thmx",
  1134. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5A2.tmp\\Quotable.thmx",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3A8.tmp\\Metropolitan.thmx",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB33A.tmp\\Frame.thmx",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB426.tmp\\Content.inf",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB8D0.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB448.tmp\\Banded.thmx",
  1145. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB563.tmp\\Content.inf",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB447.tmp\\content.inf",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB98D.tmp",
  1150. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1151. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB90F.tmp\\content.inf",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB448.tmp\\content.inf",
  1154. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB90F.tmp\\Wood_Type.thmx",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC2E.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC8F.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC3F.tmp\\Berlin.thmx",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\content.inf",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1161. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC3F.tmp\\content.inf",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE07.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\Savon.thmx",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBEE7.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB6.tmp\\content.inf",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE66.tmp\\Equations.dotx",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA5.tmp\\gostname.xsl",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEE6.tmp\\Circuit.thmx",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB6.tmp\\Slate.thmx",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA5.tmp\\Content.inf",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFD2.tmp\\content.inf",
  1173. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1174. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE66.tmp\\Content.inf",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC12B.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC14B.tmp",
  1178. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1179. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFD2.tmp\\Damask.thmx",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEE6.tmp\\content.inf",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC286.tmp\\chevronaccent.glox",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC342.tmp\\content.inf",
  1184. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC275.tmp\\content.inf",
  1186. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1187. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC5F5.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC286.tmp\\Content.inf",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC342.tmp\\Main_Event.thmx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC615.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC275.tmp\\Droplet.thmx",
  1193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E3.tmp\\BracketList.glox",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E4.tmp\\Feathered.thmx",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E3.tmp\\Content.inf",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E4.tmp\\Content.inf",
  1199. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC905.tmp\\content.inf",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC8F4.tmp\\content.inf",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC905.tmp\\Mesh.thmx",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC8F4.tmp\\Vapor_Trail.thmx",
  1204. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1205. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1206. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1207. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD73E.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD80B.tmp\\Insight design set.dotx",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD80B.tmp\\Content.inf",
  1211. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\28759908.cvr",
  1215. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSAB4D3A36-3D8A-45EF-9CF6-871286A6555A.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS17A036AF-28D3-4533-92AF-4CD6F7C1B71E.tmp",
  1217. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1218. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1D61AA81-9315-4E37-A74C-77A1DFB115AA.tmp"
  1219.  
  1220.  
  1221. * Deleted Files:
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6E02.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6E03.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1225. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1226. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_c5aa69e61dc2352feacd760764bf6108.asd",
  1227. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1228. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C6.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C7.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E8.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4D7.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4F9.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FA.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA484.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA485.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA51C.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5CA.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA60A.tmp",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA62B.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6E9.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA767.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7E5.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA824.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E8.tmp\\gb.xsl",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6E9.tmp\\PictureFrame.glox",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA893.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E4C.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA008.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA95F.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C6.tmp\\turabian.xsl",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4FA.tmp\\architecture.glox",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAAE9.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA018.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB19.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB3A.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5CA.tmp\\HexagonRadial.glox",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA62B.tmp\\Element design set.dotx",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABA8.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA193.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F24.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABD9.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB9.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4D7.tmp\\RadialPictureList.glox",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA60A.tmp\\APASixthEditionOfficeOnline.xsl",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA51C.tmp\\iso690.xsl",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA893.tmp\\TabbedArc.glox",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA65B.tmp\\VaryingWidthList.glox",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA767.tmp\\harvardanglia2008officeonline.xsl",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA824.tmp\\pictureorgchart.glox",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E8B.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FD8.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA4B5.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA019.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F27.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F13.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F11.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4F9.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5A.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF49.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA7E5.tmp\\ThemePictureGrid.glox",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA95F.tmp\\mlaseventheditionofficeonline.xsl",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1A4.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA173.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB112.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABA8.tmp\\sist02.xsl",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB19.tmp\\CircleProcess.glox",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0E2.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0D2.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB9.tmp\\ieee2006officeonline.xsl",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAAE9.tmp\\chicago.xsl",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF5A.tmp\\Dividend.thmx",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4C7.tmp\\iso690nmerical.xsl",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F5A.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA609.tmp\\ThemePictureAlternatingAccent.glox",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC57.tmp\\TabList.glox",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABD9.tmp\\gosttitle.xsl",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAB3A.tmp\\InterconnectedBlockProcess.glox",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C0.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1D1.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F38.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF49.tmp\\ThemePictureAccent.glox",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA59A.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBB.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3A8.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA61B.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB112.tmp\\Badge.thmx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB33A.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F10.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB426.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5A2.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F12.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0D.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB447.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F26.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F59.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB563.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0E2.tmp\\Crop.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB0D2.tmp\\Parallax.thmx",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EED.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE5D.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1D1.tmp\\View.thmx",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1C0.tmp\\rings.glox",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3A8.tmp\\Metropolitan.thmx",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB448.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5A2.tmp\\Quotable.thmx",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0E.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB33A.tmp\\Frame.thmx",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB426.tmp\\ConvergingText.glox",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAEFA.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB90F.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F37.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB447.tmp\\Basis.thmx",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA4FB.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD13.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA960.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB448.tmp\\Banded.thmx",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB200.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F0F.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAB09.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA0D.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC3F.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA50B.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB563.tmp\\Headlines.thmx",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB90F.tmp\\Wood_Type.thmx",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB123.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB6.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE66.tmp",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB458.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA5.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEE6.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFD2.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC3F.tmp\\Berlin.thmx",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC7E.tmp\\Savon.thmx",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEA5.tmp\\gostname.xsl",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEB6.tmp\\Slate.thmx",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC275.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC286.tmp",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB8D0.tmp",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC342.tmp",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB98D.tmp",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE66.tmp\\Equations.dotx",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBFD2.tmp\\Damask.thmx",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBEE6.tmp\\Circuit.thmx",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9F25.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC8F.tmp",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E3.tmp",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E4.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC286.tmp\\chevronaccent.glox",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA124.tmp",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC2E.tmp",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE07.tmp",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC342.tmp\\Main_Event.thmx",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBD.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E3.tmp\\BracketList.glox",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC905.tmp",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC14B.tmp",
  1381. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC8F4.tmp",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC5E4.tmp\\Feathered.thmx",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EBC.tmp",
  1384. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC12B.tmp",
  1385. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC8F4.tmp\\Vapor_Trail.thmx",
  1386. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC275.tmp\\Droplet.thmx",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC905.tmp\\Mesh.thmx",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC615.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBEE7.tmp",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC5F5.tmp",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD80B.tmp",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD80B.tmp\\Insight design set.dotx",
  1393. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD73E.tmp",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1395. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS51813AD8-4AAD-4D4C-BA69-34E172A5532C.tmp",
  1396. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_c5aa69e61dc2352feacd760764bf6108.doc",
  1397. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSAB4D3A36-3D8A-45EF-9CF6-871286A6555A.tmp",
  1398. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS17A036AF-28D3-4533-92AF-4CD6F7C1B71E.tmp",
  1399. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1400. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS1D61AA81-9315-4E37-A74C-77A1DFB115AA.tmp",
  1401. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS58D17137-11BA-426C-A9A0-AF50D5EEE2B9.tmp"
  1402.  
  1403.  
  1404. * Modified Registry Keys:
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\tpu",
  1406. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\16AEC94",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\16AEC94\\16AEC94",
  1429. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\16AEC94\\17A1CB1",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1739. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\tcb",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\v,f"
  1751.  
  1752.  
  1753. * Deleted Registry Keys:
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\tpu",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\75s",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\16AEC94\\17A1CB1",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\16AEC94\\16AEC94",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1763.  
  1764.  
  1765. * DNS Communications:
  1766.  
  1767. "type": "A",
  1768. "request": "bit.ly",
  1769. "answers":
  1770.  
  1771. "data": "67.199.248.11",
  1772. "type": "A"
  1773.  
  1774.  
  1775. "data": "67.199.248.10",
  1776. "type": "A"
  1777.  
  1778.  
  1779.  
  1780.  
  1781. "type": "A",
  1782. "request": "www.mectronics.it",
  1783. "answers":
  1784.  
  1785. "data": "mectronics.it",
  1786. "type": "CNAME"
  1787.  
  1788.  
  1789. "data": "80.76.80.170",
  1790. "type": "A"
  1791.  
  1792.  
  1793.  
  1794.  
  1795.  
  1796. * Domains:
  1797.  
  1798. "ip": "80.76.80.170",
  1799. "domain": "www.mectronics.it"
  1800.  
  1801.  
  1802. "ip": "67.199.248.11",
  1803. "domain": "bit.ly"
  1804.  
  1805.  
  1806.  
  1807. * Network Communication - ICMP:
  1808.  
  1809. * Network Communication - HTTP:
  1810.  
  1811. "count": 1,
  1812. "body": "",
  1813. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1814. "user-agent": "Microsoft-CryptoAPI/6.1",
  1815. "method": "GET",
  1816. "host": "ocsp.digicert.com",
  1817. "version": "1.1",
  1818. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1819. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1820. "port": 80
  1821.  
  1822.  
  1823. "count": 1,
  1824. "body": "",
  1825. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D",
  1826. "user-agent": "Microsoft-CryptoAPI/6.1",
  1827. "method": "GET",
  1828. "host": "ocsp.digicert.com",
  1829. "version": "1.1",
  1830. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D",
  1831. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1832. "port": 80
  1833.  
  1834.  
  1835. "count": 1,
  1836. "body": "",
  1837. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D",
  1838. "user-agent": "Microsoft-CryptoAPI/6.1",
  1839. "method": "GET",
  1840. "host": "ocsp.digicert.com",
  1841. "version": "1.1",
  1842. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D",
  1843. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1844. "port": 80
  1845.  
  1846.  
  1847. "count": 1,
  1848. "body": "",
  1849. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1850. "user-agent": "Microsoft-CryptoAPI/6.1",
  1851. "method": "GET",
  1852. "host": "ocsp.msocsp.com",
  1853. "version": "1.1",
  1854. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1855. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1856. "port": 80
  1857.  
  1858.  
  1859. "count": 1,
  1860. "body": "",
  1861. "uri": "http://www.mectronics.it/images/klmy.jpg",
  1862. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1863. "method": "GET",
  1864. "host": "www.mectronics.it",
  1865. "version": "1.1",
  1866. "path": "/images/klmy.jpg",
  1867. "data": "GET /images/klmy.jpg HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nConnection: Keep-Alive\r\nHost: www.mectronics.it\r\n\r\n",
  1868. "port": 80
  1869.  
  1870.  
  1871. "count": 8,
  1872. "body": "",
  1873. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1874. "user-agent": "Microsoft-CryptoAPI/6.1",
  1875. "method": "GET",
  1876. "host": "crl.microsoft.com",
  1877. "version": "1.1",
  1878. "path": "/pki/crl/products/microsoftrootcert.crl",
  1879. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1880. "port": 80
  1881.  
  1882.  
  1883. "count": 3,
  1884. "body": "",
  1885. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1886. "user-agent": "Microsoft-CryptoAPI/6.1",
  1887. "method": "GET",
  1888. "host": "crl.microsoft.com",
  1889. "version": "1.1",
  1890. "path": "/pki/crl/products/microsoftrootcert.crl",
  1891. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1892. "port": 80
  1893.  
  1894.  
  1895. "count": 1,
  1896. "body": "",
  1897. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1898. "user-agent": "Microsoft-CryptoAPI/6.1",
  1899. "method": "GET",
  1900. "host": "crl.microsoft.com",
  1901. "version": "1.1",
  1902. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1903. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1904. "port": 80
  1905.  
  1906.  
  1907. "count": 2,
  1908. "body": "",
  1909. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1910. "user-agent": "Microsoft-CryptoAPI/6.1",
  1911. "method": "GET",
  1912. "host": "crl.microsoft.com",
  1913. "version": "1.1",
  1914. "path": "/pki/crl/products/microsoftrootcert.crl",
  1915. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1916. "port": 80
  1917.  
  1918.  
  1919.  
  1920. * Network Communication - SMTP:
  1921.  
  1922. * Network Communication - Hosts:
  1923.  
  1924. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!