API tools faq
paste
paladin316

Purchase_doc_2.json

paladin316
Jun 19th, 2019
2,544
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 247.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Purchase.doc.2"
  7. [*] File Size: 11960
  8. [*] File Type: "Rich Text Format data, unknown version"
  9. [*] SHA256: "23b268b8d7a269760768f30ed66778d50081a953a16ee5a0e61f8327579aef1c"
  10. [*] MD5: "b6812fe0ef8cf0e8758cad842a00213a"
  11. [*] SHA1: "6cc225c4341a970b5f5a015d83426c80f946ea64"
  12. [*] SHA512: "7786ef6d688c2810c6d8051c337a9e0e3f6b4405abf509e1b36a9451b158655d8ee42d8e200bb8ad365f7eec429f1bfa5dd145d19d6b65742b21d80275caef49"
  13. [*] CRC32: "F80F2EC9"
  14. [*] SSDEEP: "192:eDPnC/IHybL/iufs903tn8TSmFvDPrB88DvXiOv6dKf:eDneIHybWui03CrFvzrB88DvXiF4"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 1928"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  31. "Details": [
  32. {
  33. "IP": "52.109.20.4:443"
  34. },
  35. {
  36. "IP": "104.85.240.25:443"
  37. },
  38. {
  39. "IP": "65.52.98.231:443"
  40. },
  41. {
  42. "IP": "66.210.41.17:80"
  43. },
  44. {
  45. "IP": "104.18.25.243:80"
  46. },
  47. {
  48. "IP": "72.21.91.29:80"
  49. },
  50. {
  51. "IP": "52.109.2.14:443"
  52. },
  53. {
  54. "IP": "23.64.189.123:443"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  60. "Details": [
  61. {
  62. "ioc": "architecture.glox"
  63. },
  64. {
  65. "ioc": "ontent.inf"
  66. },
  67. {
  68. "ioc": "quations.dotx"
  69. },
  70. {
  71. "ioc": "iso690.xsl"
  72. },
  73. {
  74. "ioc": "ist.glox"
  75. },
  76. {
  77. "ioc": "ext.glox"
  78. },
  79. {
  80. "ioc": "gb.xsl"
  81. },
  82. {
  83. "ioc": "rocess.glox"
  84. },
  85. {
  86. "ioc": "turabian.xsl"
  87. },
  88. {
  89. "ioc": "nline.xsl"
  90. },
  91. {
  92. "ioc": "mlaseventheditionofficeonline.xsl"
  93. },
  94. {
  95. "ioc": "harvardanglia2008officeonline.xsl"
  96. },
  97. {
  98. "ioc": "chevronaccent.glox"
  99. },
  100. {
  101. "ioc": "anded.thmx"
  102. },
  103. {
  104. "ioc": "content.inf"
  105. },
  106. {
  107. "ioc": "iso690nmerical.xsl"
  108. },
  109. {
  110. "ioc": "ieee2006officeonline.xsl"
  111. },
  112. {
  113. "ioc": "e.gu"
  114. },
  115. {
  116. "ioc": "gosttitle.xsl"
  117. },
  118. {
  119. "ioc": "chicago.xsl"
  120. },
  121. {
  122. "ioc": "sist02.xsl"
  123. },
  124. {
  125. "ioc": "gostname.xsl"
  126. },
  127. {
  128. "ioc": "adial.glox"
  129. },
  130. {
  131. "ioc": "ype.thmx"
  132. },
  133. {
  134. "ioc": "rings.glox"
  135. },
  136. {
  137. "ioc": "rc.glox"
  138. },
  139. {
  140. "ioc": "pictureorgchart.glox"
  141. },
  142. {
  143. "ioc": "set.dotx"
  144. },
  145. {
  146. "ioc": "rame.glox"
  147. },
  148. {
  149. "ioc": "rid.glox"
  150. },
  151. {
  152. "ioc": "..3b"
  153. },
  154. {
  155. "ioc": "rame.thmx"
  156. },
  157. {
  158. "ioc": "iew.thmx"
  159. },
  160. {
  161. "ioc": "ccent.glox"
  162. },
  163. {
  164. "ioc": "eadlines.thmx"
  165. },
  166. {
  167. "ioc": "ividend.thmx"
  168. },
  169. {
  170. "ioc": "etropolitan.thmx"
  171. },
  172. {
  173. "ioc": "adge.thmx"
  174. },
  175. {
  176. "ioc": "arallax.thmx"
  177. },
  178. {
  179. "ioc": "erlin.thmx"
  180. },
  181. {
  182. "ioc": "asis.thmx"
  183. },
  184. {
  185. "ioc": "avon.thmx"
  186. },
  187. {
  188. "ioc": "eathered.thmx"
  189. },
  190. {
  191. "ioc": "rop.thmx"
  192. },
  193. {
  194. "ioc": "roplet.thmx"
  195. },
  196. {
  197. "ioc": "ircuit.thmx"
  198. },
  199. {
  200. "ioc": "g.n9"
  201. },
  202. {
  203. "ioc": "amask.thmx"
  204. },
  205. {
  206. "ioc": "uotable.thmx"
  207. },
  208. {
  209. "ioc": "late.thmx"
  210. },
  211. {
  212. "ioc": "rail.thmx"
  213. },
  214. {
  215. "ioc": "esh.thmx"
  216. },
  217. {
  218. "ioc": "vent.thmx"
  219. }
  220. ]
  221. },
  222. {
  223. "Description": "Performs some HTTP requests",
  224. "Details": [
  225. {
  226. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  227. },
  228. {
  229. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  230. },
  231. {
  232. "url": "http://sripipat.com/onazy/PurchaseOrder.exe"
  233. }
  234. ]
  235. },
  236. {
  237. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  238. "Details": [
  239. {
  240. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xcck'\\xfea\\xe8\\x8d\\xda\\x0ff\\xdez\\xc0\\x96\\x84#\\xd0ns\\x83\\xacc/\\xbbm\\xebv\\xc8\\xbe^\\x02\\x87\\xab\\xdc4\\x99\\x1c\\xd7j<\\x8a\\xf8y\\xb6^6\\xf7\\xb7t\\x8c\\x8d7\\x95\\x00\\xc8\\xaa\\xa8\n\\x11\\x1c#i\\xe9\\xda\\xaa7|`\\x06w\\xe2\\xd5\\x9c\\x96\rc\\x91\\xb9:\\x83\\xe0\\x03?%\\xe4\\x19\\xdb\\xf4o\\x8f\\xce\\x89\\xeab\\xe9\\xb4\"0zj:{\\x97\\xfc$\\xe14\\x93\\x9e\\x94t\\xa7>\\x18\\x9b*\\xf3\\xcc\\xb7\\x93uw\\xb77g\\xc3fk\\x1c\n)\\xabs\\x80\\x03~\\xdb{\\xe1|\\xaeyq\\x90\\xff\\xbd\\xb4\\xb9gd\\xde\\x8f|\\xe1h\\xa5\\xce^\\x16vd\t\\xa0e\\xb1\\x02:\\xcc!#e\\xa7\\x88\\xaa\r\\xa5\\x96\\xff\\x81\\xd4\\x1as\\x1b\\xcdv\\xa4\\xb5!\"l\\xda\\x16k\\xe7z-v\\xc6c\\x88\\x9e\\xb1\\xed>0n\\xef*\\xe0d\\x80.\\x0ev\\xbe\\xa5c\\xea1\\xef[}2pq\\xa9\\xc3\\x92\\x0e\\x901n\\xa9\\xd2\\x83+\\x8b!\\xd7\\x13u\\x0c\\x11\\xf2ti\\xc7\\xffu\\x98\\x12"
  241. },
  242. {
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x01\\xafv\\xd8n\\x06\\x7f0o\\xc5\\x892\\x06\\x9b\\x1d\\x1f\\xa8y\\x1bw\\xca2\\xa0y>\\xeb\\xaew\\xb8m+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244. },
  245. {
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044\\u\\xe3\\xa5\\x04a\\x98\\xa6\\x84y\\xe8\\x01pj\\x07s0\\xdb\\xc7\\xca\\xc6\\x04\\xbc\\xd6\\xe1\\xd6/\\xb4\\x00\\xb1\\xdf.\\xba\\xe4\\xdb\\hlx\\xcf*\\xf8^\\xc4\\x98tn\\x8bz\\xc0\\x15\\xea/\\xd0ox\\x15 \\xa6\\x7f\\xb1\\x99@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)@?\\xccq\\x18v\\xc8\\xb8\\xba\\xb2\\x17qpw\\xbfai#5\\x1d\\x8df\\xa2\\xb9\\xa0\\xb8\\xda\\xce^7\\x9bb\\xed~\\xa4\\x8bk\\xd1\\xfc*\\xe1\\x99\\xff\\xcc\\\\xffd"
  247. },
  248. {
  249. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  250. },
  251. {
  252. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  253. },
  254. {
  255. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8d&1\"\\xecg\\x16&\\x85!\\x95[\\xcfo.\\x1d\n\\x1ej3\\xe5\\xda\\x9b\"b\\xd5\\x8a\\xcd\\x92\\xfc%\\x177nu\\x9e\\x12\\xee\\x10\\xc5% bzl\\xe6\\x81\\x0b\\x08\\xa8m\\xd8m\\xcc\"y(\\x05l\\xd2-\\x7fv\\x12\r\\xe5\\xa9\\xe9\\x8d\\x7f\\xba\\xbd'h$\\x92\nm\\xbfk\\xfa\\x1ea!a\\x82\\xe4\\x8d&g\\xb4\ng\\xf5\\xc5\\x8e\\x07]\\xfao\\x83\\x99{/\\x01\\x856\\xcc9\\xd7\\x08\\x93im\\xfc\\xaf'\\xbc\\xe0\\x86\\x8a\\x8d\\x16\\xf4za\\xbc+\r-~\\x11 _\\xa5\\x8a\\xc6\\xfc\\x00\\xc1\\xfb\\x9e\r[\\x8a\\xd1\\x0e\\x03-\\xfcf\\xc1x\\xed\\xec\\x82\\xcd\\xe4z\\x0feu\\x8crw\\x87g;\\xcc\\x15\\xdfu\\x13\\x11\\xd0\\x14\\x87h\\x838djd\\xfb\\xdc\\x0f\\x9a\\xe8\\xf6\\x8a\\x10\\xfe_\\x05\\xa8\\x93#\\xdc\\xad\\x8cd\\xd0\\xed\\x15\\x01\\xdc\\x0c\\x06}1\\xb7\\xdb\\x05\n\\x95\\x1bz\\x87\\xb5,\\x17\\x1b\\x00\\xd6\\xbb0<\\xf4\\xf7&\\x0c\\x0f\\x99d\\x1a\\xc9zu\\xc9\\xfc\\x96\\xe3\\xf3\\xbe\\x81\\x8c\\xd4lhyn"
  256. },
  257. {
  258. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 w\\xb4\tv'\\x89vl\\x01-x\\xd9\\xce%\\xd2\\x91\\x91p\\xb0\\x92\\xe0\\xc9js\\xd4\\x94\\x18\\x03\\xc2\"\\xca3\\xd1\\xe8\\xfa\\x85k\\x90\\xbd\\x87y\\x8c\\x001y\\xc08g\\xd2x\\xbc\\xfd@\\xb8\\x0ergt\\x19m\\x14\\xc1\\x9dy#\\xce\\xe5\\xe4\\x11\\x94\\x9b\\xeb?\\\\xa7\\xc5\\xfe\\x90\\xc6\\x04\\x16}4\\x1d\\xb4\\xfdf\r\\xde\\x19w\\x98$%u\\xe5y\\xd9\\x1c\\xd8\\x00}\\xa2\\x9f\\x05\\xa2p\\xfdc\\x15\\x91.l\\xf3\\xb8\\x0ff,\\xc1+\\xf2!zvj\\xf5s\\xdc:\\x8bv_#]3/\\xa93\\xe6(\\xbc\\x94d\\xf3\\x04\\x90\\xe1i2\\xa8\\xfc\\xf5^\\x14\\xa6r\\xc64i\\x9e\\xee\\x96\\x0f5\\xf6t\\xf4w\\x12\\x8e\\xe9\\xaa\\xf8w\\x83\\x9eu\\xfe{\\xd2\\x18\\x1c\\xeb\\x1dw\\xca\\xe1\\xdfot\\x87\\xb5l\\x88y\\xab\\xc5\\x87\\xc0\n+\\x04\\x9d+t\\xe1+\\xc2k\\x85\\x97<f:\\xf6\\xa0\\x15\\xec=\\x06\\x0f\\x94\\xae\\xbc\\xe9\\xfb\\xb7\\xae\\xdd?\r=\\xee^\\x83(m\\xacqp~\\x1c\\xfcv\\xf1;\\x9cz%b\\x8f"
  259. },
  260. {
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xafxn\\x1c\\x0f\\xd8\\xea\\xb4\\xe1\\xe4\\xdb\\xb3\\xd8\\xda\\xb1\\xc4\\x1e8\\xed\\x956\\x0f\\xf8,w\\x19\\xa5\\\\x02\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262. },
  263. {
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97{4\\x95\\xe6c\\xf1\\x8e\\xc8gc31gb\\x04\\x17\\xa5n[\\x17~st\\xd7\\x00\\xa7n\\xc5\\x96\\xe7\\xe90\\x83\\xabf\\x1f~\\xec\\xd8h?\\x12*\\xbc\\xf2\\xf0\\x9b\\xc0f\\xcf\\xfc\\xf3\\xdc\\x18=]\\xa8/\\xfb\\xdf\\x94\\xb3?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n\\xe5n \\xa7\\x1c\\x13\\xd5h\\xfd\\xadn\\xfe6\\h\\x15\\xd1\\xa6\\x86ny\\x1c\\x11\\x88a\\xcc\\xe4\\x89\\xd0u\\xaf\\x04\\x81p\\x86\\xfd$\\xc1\\xaf\\xa4\\xf3\\x85\\xad\r\\x18\\xe0|"
  265. },
  266. {
  267. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x94c\\xfa\\x94\\x97\\x84\\xda\\x10\\xe5\\xa1\\x1d\\x12\\\\x95\\xb2\\x0c\\x18\\xd7\\x89\\x91\\xc2\\xfd\\xf3\\xdc\\g\\x8a\\xe7\\xc3\\xfe90\\x8c\\xe3d\\x05l'+o\\xb3\\x11\\x95\\xc3q^)n8e(\\x84\\x11\\xbb.f\\xe4\\xff|\\x1d\\x97\\x15\\x8c\\xb0\\xd1\\x08)\\xe5\\x87\\x1c\\x9fm\\xa2\\xbb\\xeb\\xfe\\x95y\\xc6\\xfaa?\\xbf\\xcf\\xa5\\x8d\\x0b\\x1el\\x9b\\xd41\\x82\\x0fu\\xc9\\x85\\xb1\\xd0u\\x08\\xeb\\xc2\\xf6\\xad\\x92\\x11\\xef\\xf1\\x14\\xbd\\xa1mygl\\x02\\xab[n\\xc37oh\\xebq\\x7f\\xe4\\x99zh\\x1ep,\\xc20\\x90p\\x87bvs\\xc1_\\xee\\xb1\\x00\\xd6\\x86.au\\xee\\xf61\\x1d\\xb1\\xf0\\xe9\\xb0\\xd6\\xc7\\xca-?\\x9a\\x0e\\x92n]\\xc2d\\xed\\xde\\xe2\\xdeq\\xcd\\x9f\\xa8\\xc48%\\x16\\xa0\\x87y\\xdc\\x10\\xf6v\\x89\\x99(\rn\\x99\\xf0\\xc9\\x81e\\x89\\xea\"m'e\\xe0\\x7fi\\x83\\x1f\\xe7y\\xe2\\xb3\\xd5\\x0b\\xe9n\\x98\\x19k\\xe9\\xf8\\xb7?t\\x8e\\xe5v\\xe1$.(]\\xbd[\\x81\\xe4\\xca\\xc0\\xf1%k\\xb6{3v!\\xb9"
  268. },
  269. {
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xafy\\x96\\x14e\\x92kj\\x14\\xea\\x01l\\xc6\\x83\\xa1\\xaeex\\xca\\x88\\xfe\\xd7\\x01e_\\xdat\\xdew.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271. },
  272. {
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04oh\\x8dw\\xbe][wly\\xcc\\xda\\xdf\r\\x9f\\x06\\xdb\\x128k\\xcd\\xb2\\xdd\\xce4\\xccjj\\xc9\\xa0\\xa2\\xacb\\xc5\\xac\\x01\\x08s4\\xf9\\xe4\\x1ard\\xa2\\xd5\\v\\xe1t=u\\x99\\x0e\\xcd\\xb0wn\\xd7\\xb7 \\xad\\xd0\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfd5x3\\xcf\\x95\t\\x11fr\n\\x9ck\\xc2f\\x05\\x13\\x85\\x03j\\xcd\\x95\\xa5\\xd8\\x8b\\xf9\\xe1c\\x94\\x874\\xdb\\x966\\xfb\\xb7\\x9e\\x1aj\\xaa\\xce\\x99\\x9e6\\x95$\\x8d\\x8c"
  274. },
  275. {
  276. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x10\\xf5\\xea\\xe0axn\\x19\\xd2\\xd7\\xe0\\xb0\\xec\\x08\\xdb\\xa0\r\\x84\\x9eg\\xde\\xce\\x11\\x9f`l\\xae\\xdec\\xbd\\x1d\\xfb6\\x8fx\\xbf\\x07d\\x96\\x0c\\xb3a\\xc6\\x88\\x7f\\xbc\\xa6|\\x89\\xd6\\x16\\xf5\\xf1)&\\xfdv\\x19\\xed\\x02\\x9a\\xb8\\xa5\\xddk\\xf1b\\x03^\\xd9\\xca\\xcf\\x8b\\x0cm\\xb7\\xd8+\\xb1&z\\x02\\x07\\xb3\\x0f\\xd8\\xf4\\xb0\\xb7j\\x83\\x9b\\xce\\xf1\\x11\\xc2~\\xdb\\x83 l\\x0e\\xb3\\xc7\\x14c\\xc3\\x86\\x83\\xef\\x94\\xfe{*\\xa6\\x92\\xbc\\xb8\\xa0\\x8cb\\x99$w\\xf9\\xbd\\xa7\\xaek\\x16v,\\x13\\x9fwa\\x9a\\xe0\\xd6'n\\x9c\\xdeha\\xa4\\x8f\\xfb\\xcb&>-\\xfd8[\\xc0j\\xf1\\x1e\\xc8)0zs\\xb5@\\xde\\xa8\\xda\\xa5\\xf2\\xf3+kw\\xb5\n\\x0bh\\xaebf\\x97w\\xd1\\xd6\\xfb\\x9dmao9\\x85\\xb4(\\xefv)\\xe7\\xc3\\xbc\\x06>7\\xc5\\xcc\\xf9\\x13\\xe3\\x15z\\xd3\\xb1\\x9bvj\\xdbw\\x97@2\\xf5^\\x1f#\\x13\\x9cc3\\xcem\\xb4a\\xce;\\x07%\\xdb\\xce\\xc8vak\\x8dy\\x84\\xf6\\x19?\\x1d\\x1a"
  277. },
  278. {
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafyg4-\\xc7\\x8b\\xb35*\\xea*\\xd7h)z\\xf0\\xca\\xaa\\x9b\\x1cl\\x0b\\xb1y\\x08ch\\x7f\\x94\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280. },
  281. {
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\x80\\xe8\\x90\\xd6\\xaf\\x04\\xcfy\\xcd\\xc3\\x18\\x17\\x83?z)\\xce\t\\xc8\\x10<'h\\xf1@\\x04\\xc5&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283. },
  284. {
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy[\\x88:1\\xfc\\x98\\xd3\\xcb\\xf154\\xfb\\xeas\\x93y(\\xca=}\\x1a^vi\\xbd9rm\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286. },
  287. {
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy,\t\\xc1v\\x11\\x05\\xc9\\x0c\\xc2\\xb9\\xde\\xeb\\xa2x\\xb0:\\x13\\xb3\\x01r\\xfd\\x17jf\\xe7,\\xa0t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289. },
  290. {
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy&y\\xe1\\xed\\x0f>(\\x98\\xdc\\xa9\\x11a\\xfau]h$\\xf4t\\x83\\x88\\xe1\\x15\\xb5s\\xb4\\xa9\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292. },
  293. {
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xa5\\xa5f\\xba\\xa3\\x91\\x88n\\x98+pd\\x93<\\xe5\\x0epju\\xa6\\x99\\x8cy\\xce\\xa5j4\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295. },
  296. {
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy_\\xa4\\xc5)z,\\x90\\x8b\\xb8\\x97v\\x85\\xd7\\xa4\\\\xdf\\o\\xd1\\xa7>\\xcd`\\xa6}\\x85+\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298. },
  299. {
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy`\\x96w\\xb4\\xbc\\x8f)\\xf2\\xc4\\x1b\\xa0-\\xe3\\x90\\xcd\\xd6ln\\x07\\xd4[\\x92\\xa1\\xd2\\xf5\\xe2j\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301. },
  302. {
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafyq1o\\x03\\xb6\\x1f\\xb5\\xe8&s\\x86\\x13#b\\x13\\x83\\xf1\\x15\\x81\\xb4je?\\xdem\\xfa#\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304. },
  305. {
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xf4\\xebx\\xa1`\\xb2?\\x8d\\xc8\\xa0\\xaa:\\xe41\\x85\\x10c\\x16qg\\x9a\\xd7\\xeaq\\xa3\\xc9%\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307. },
  308. {
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xb2\\xcb\\x8a\\x9c\\xca\\x15c\\xde\\xed\\x83\\xd3\\xac6*|\\xd7\\xb9\\xf6i\\xb6\\xa1[y\\x82\\xf8im\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310. },
  311. {
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy^oiv\\xbf\\x15\\x9euj|\\xc4`\\xb0l\\x10]\\xeds\\xc4\\xbasp\\xd2\\xfb\\xa2\\xb2\\x04\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  313. },
  314. {
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4\\xde8r\\xccd\\xa6\\xba\\xb5}e\\xa9\\\\x10\\xac\\xc2\\xe9\\x9fj/$p\\x90\\xc0\\x06\\xf6\\x1fv\\xb5\\xde\\x8f\\xb9|\\xe5n\\xf0-m\\xc9\\x07s\\xf5\\x91\\xae\\xfe\\xd4\\xee\\xf5\\xebv\\xa3\\xd5l\\xb4\\xacd\\x93\\xd3\\xf8u\\xa2y\\x9f\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002o\\xab\\xcd\\xa0$\"\\xed0i.,i\\xb8\\xae\\xf3\\x98h\\x8ez\\x1a\\xb8-\\xd0\\xf1&\\x01\\xb8\\xe1u?\\x81c\\x06p\\xee\\xa8d\\xb4\\xb1\\x83u\\x1ew\\xc8\\x1d\\xa3m"
  316. },
  317. {
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\x08\\xa9\\xf7te\\x03\\xa8\\xbe\\xd9l\\x96b\\x08qm\\x1f\\xdcn\\xa6z\\x11\"\\xfc\\xd1{a\\xc6\\xee\\xe7-\\xb1\\x08\\xf6g\\xd5x\\x02\\x9cpc\\xb2\\x14\\xad\\x95h\\x8b=4\\xbf\\x13\\xca\\xcf\\x90\\xf5ew\\x06\\x0bc>\\x935$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x87\\xb1lk\n\\xbb\\xcb\t\\x90y\\xd4\\xf5\\x8e\\x10\\xbf\\xdd\\xdc\\xe1u\\xebit\\x17\\xa41\\x92t\\xb3/kov\\xcf9\\xae\\x96\\xf0m\\xb9\\xd9\\x11;k>\\xb4\\x95\\x1f"
  319. },
  320. {
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\xbd\\xc1s.-@3\\xad\\xff]w\\xaa,\\x1dm2\\x89i\\xe3\\xc2\\xa8\\x81\\x86\\xdc\\xd6g\\x03\\x00e\\xae\\xc7?f\\xd2\r\\xdd\\xcc&\\xf5-\n\\xf83\\xfbg0\\xd407\\x07\\xde8\\xf9\\xd1\\x85\\xa1i6ik\\x0f\\q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\x82$\\xcej*p\\x14\\xc3\\x83\\x08p~*r\\x90\\xa9?\\x99\\x7f\\xd2\\xb9\\xc0el\\x16*(\\xe8z\\x11\n\\x85f\\xec\\xbf\\x02\\xa5yf\\xc8\\x91\\xd1\\x9e\\xd9e\\xa0\\xbe"
  322. },
  323. {
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafyf\\x1f\\xedh\\xc1\\xe9\\xee\\xfc\\x03\\x8b\\xf4\\x81\\xecw\\xf9&qt\\xab\r\\xdf\\xff\\xfb\\xcf\\x96\\xeco\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  325. },
  326. {
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x03uov\\x05\\x80\\xfcj\\xe4 \\xb3]\\xa5\t\\x95g\\xc5\\xa9\\xb7kcn\\xe7\\xa1h.\\xda@\\x07\\xe0\\xedt\\xb9t\\xbf[!\\xd6@\\xf1%\\x91\\x8fp\\xa2>\\xec:\\x04a\\x82r\\x98.n)\\x8d\\xe7{\\xbd\\xb9\\x9c4\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f]`\\xc3\\x0f\\x1a\\xf2x\\x85\\xb32:\\x83\\xb4\\x13\\x1b\t\\xe0\\xe7\\x94<\\xec\\x83\\xfen\\xf8\\xc8[\\xc0\\x85\\xfd\\x05\\x16\\xce\\x84\\xbc<2sz\\x1d\\xa7\\x95=\\x05x\\xe6\\xaa"
  328. },
  329. {
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa1\\xc6\\xfe\\xaf\\xca\\xdfe*9f@n$}\\xa4\\xfd\\xca\\xfc\\x1e]\\x19\\xd4:\\x1a\\x9d\\xa4\\x82\\xcd\\xad$\\xa2\\x81f\\x10w\\xb9i0a@()\\xcdx\\xac\\xf6\\xa3?n\\xffr\\xda\\xef\\xaa>\\x1bb\\xeb\\xde\\x035\\x06\\x8f(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xdb\\x05\\xac#\\x88\\x85\\xff\\x1e\\x92\\x90\\xcee\\xe9\\xc9\\xd3\\x03\\x9a\\xd4\\xea\\x0f\t\\xe8\\xcdib\\x8e\\x01i\"\\x92js\\xc9w\\x7f\\xec\\xd6\\xa6\\x156\\xdczr}\\xf7\\x1a\\x1d"
  331. },
  332. {
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafynzb\\xce{c\\be\\xec\\xa8\\x193\\xd1\\xd1\\xd4\\xcb\\xc0\\x04\\xd0\\xf3y\\x14`\\xe2\\x1f\n\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334. },
  335. {
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xefi{b\\xa6\\xa2\n\\xc9\\xde|b\\xd3\\xc3#\\x06a<\\x1e\r\\xf04\\xdfg8\\xd2\\xdd\\x10 \\xa07\\x8f\\xe4\\x01\\x8fa\\xdd8i\\xd6\\x1b\\x02\\xf3`7*\\xc6\\x8d\\xaa\\x00\\x9bl\\x9dt\\xa5\\x02kh\\xda\\xa4\\xd8\\xf7\\x06\\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\xb8<\\xfc\\xe0\\x84q(\\xb9\\x06s\\xcc\\xc4\\x0b~\\xa7\t&4n\\x88\\xf3\\xc2i `\"\\x9f\\xd6\\x00\\x02\\x82ol\\xd4\\x18\\xbf^~>r\\xe0+\\xf1\\x17\\xe0#'"
  337. },
  338. {
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\x98\\xd4\\x85\\xbe\\x040~\\xda\\x9eg\\x08\\xfd\\xce\\xd8\\xf9o{`\\xe3\\xaep\\xe0v\\x89\\xaf^\\xf2\\x9d\\xf9l5\\x10\\x01a\\xdd\\xe8\\x87#\\x19r\\x02a\\xc8\\x1f\\xbd{j\\x1d=\\x10[\\xef\\xbb\\x198\\x91\\x06\\x0b\\x90\\xee\\xd2\\x98\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\x9b(9\\xcc\\x82\\\\x8b\\xf9\\xc3\\xd8\\x0e\\xf7\\xb64l\\xa8\\x8f+\\x87\\xcb\\x807\\xd2[\\xad\\xa84\\xab\\x01o\\xb4r;\\x90x\\x9b\\xd1\"?pd\\xbb\"q(r\\x83"
  340. },
  341. {
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xb2\\xd7\\x151\\x96\\xca^\\xb7\\xc5yk{\\xfa\\xbc\\xe5\\xc9|\\xdaj\\xdf07h\\xecfqd\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343. },
  344. {
  345. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c4\\xccu\\x04\t\\xc7\\xd0\\x05i\\xe34\\x05\\xf5:kt\\xc2|\\x8c\\xc8n\\xf5\\xbb\\x9a\\xa3\\xa3>e\\xd6\\xbd'\\xd5\t\\xe7\\x96i\\xd9\\xbam*im\\x93\\x97\\x15hh\\xf9j\\x12\\xd8\\x14\\xa6\\xc1;\\x12o\\x12\\xa2\\x93\\x051\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e8\\xae\\x97\\xd3\\x97\\x1c\\x00\\x16\\xff\\x8e\\xe3\\x19y\\x142\\xf8\\x1d\\xf52\\xbbr\\x99\\x84a\\xcb\\xf4im\\x1fb\\xa5\\xcd\\xd0y$\\xbf\\xf9\\x81\\xb7\\xf3\\xaa\\xe5\\x90?4g["
  346. },
  347. {
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x02\\xf4g\\x8d\\xb4}q\\x89]\\x1fzz\\xacv)o\\x9ff+rk\\xfb\\xaf\\xa2\\\\xff\\x83\\xd8\\xcdj\\x03\\x01r&\\xd3\\x08'\\x91<\\xb6\\x82\\xb7b\\x14\\xc2\\xccnu\\x11'\\xd7y&,d8\\xf3\\xd5\\xcfw\\x18\\xeao\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xe0\\xaa\\xa5\\xe6\\x9f\\xb1\\x05*\\x85#a\\xec\\xc3\\xbd\\xbb\\xee[\\x07\\xb7\\xc1\\xac7,ls\\x00\\x7fi\\xd9\\xa6\\xce:]ww\\xc8s\\xc9<\\x16\\x17\\xdfr\\xa7y\\xb9\\xc2"
  349. },
  350. {
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17\\xe1\\xf1\\x98\\xde\\xb6\\x8cgi\\x9bw\\xdb\\xd8\\x1f\\xb6\\xc3\\x7ff\\x84\\x01q-\\x8b\\x91s\\xb8t\\x84\\xb1=w\\x19\\x15iv\\x10r_(d\\xa8\\xf5\\x86\\x85\\xc9g\\xcbm-\\xb0j\\x0c\\xea\\xa0|\\xc5\\xa1g\\xe2\\xb0%mph\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81n\\xf1\nm\\xb0\\x83\\xc7\\xb8 [\\xcd\\xb0\\xa5f\\x04q\\xae\\xafd@\\x98fc0\\x9e8\\x1cif\\xb4\\xb5p\\x17\\xd0\\x07\\x12\\xa6\\xa5\\xda#<\\xb7.\\xe3\\x00o!"
  352. },
  353. {
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy6\\x0f\\xd6t;\\xac\\x96u\\x1c\\xfd\\x80\\xcd\\xc0[[\\x96o\\x80]\\\\x81\\xa5\\xf4\\x8f\\xe8\\x01.\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  355. },
  356. {
  357. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1\\xa2s\\x19/\\x1b\\xdau\\xca\\x96\\xebx\\x00\\x9f\\xd7x\\x9f8\\x92\\x08?\\xdc\\xb6\\xfct\\xbc\\x03p\\xde\\xfcx!\\xcf\\xe5\\x05f,\\x8dko\\xdd~\\\\x10\\xee\\xf3\\x91x\\x9e\\xbcb-h\\x80\\xf4\\xa5\\x1a\\x97\\x83\\xd64\\xcb\\x8d\\xda\\z*\\x0c\\xb5\\x90h\\xa3\\xac\\x80]?|\\x8d\"\\x1d\rfr\\xaf\\xd2;~\\xe5\\xd5,\\xcfm\\xbf\\x7f\\xa7\\xec\\x816\\xef\\x0c\\xec\\x11\\xc3\\xf6\\x968n\\x9d\\xc6\\x078o\\xac\\x8dp\\xbd\\x1fc\\x8d\\x027\\xd0\\xa9\\xc6\\xb3\\xc2j\\xc5\\x13\\xe8\\xf7\\x93\\x01{\\x13\\xa4\\xbff}\\x92b\\xc9\\xa7\\xbacg\t\\xcar\\xd1\\x82mj\\xc3\\xde'f\\xbf\\x15\\xa0\\x1e\\xf0p\\x0csa'\\xb4z3\\xa9\\xf8\\xd1s\\x87\\x8a\\x9d\\x87\\xe2z\\xf5\\xf4\\x96p\\x8fio\\xd3\\xa1\\x18\\xa3\\xf7\\x14\\xaa\\xf4\\xe5j>\\xc6pk\\xd0f\\xb5\\x0c\\xe8\\xc6\\x8c\\xb6\\xb1\\x14\\xd8g\\xefk!v~n\\xc8\"l\\x10i\\xf7jpz\\xec\\xca^u\\x8d6|\t\n\\xbb\\x8e\\xa7\\xef\\xf8\\xcc\\\\xd3dj\\xad\\x9d\\x90}"
  358. },
  359. {
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\xa7q\\xc1wugm\\x11\\xee\\xbc\\xb7\\xd3\\x96\\xbbfy\\x06\\x96\\x80\\xd6n\\xb5\\xa8\\xf0\\x99,\\xaf\\xc1(\\xf8\"\\xce\\x1c\\xf2m\\x03\\x02e\\x97@\\xb3e)\\x97\\xb0\\xb7\\x87\\xf3\\xc0\\xc7s\\xcdr\\x0c\\xcd\\xe7\\x0b\\xbb\r\\x0e\\xdd2-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1ffc\\xcf \\xc7\\x10\\xc1\\xa3\\xc0a\\x0c\\x1e\\x86\\xf8\\x02_\\xd2\\x99u\\xa9\\xeb`a\\x0f\\xd5`\\x0f^\\xd2\\xfa\\x91,\\xdf\rr\\xb6k\\xc2\\x08j\\xa0\\xd0\\x8d\\x8c:\\x0f"
  361. },
  362. {
  363. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x119\\xba\\x81v=\\x98\\x04\\xa8\\x80\\xcf\t\\xb4\\x06\\x93\\xd8\\xcf\\xf7\\xb0\\xd9\\x01\\x1e ke\\xaaq(a\\xd3^\\xee\\x16\\x06\\xba\\x7f\\xecd\\x02b v>\\xb7\\xb0\\x02\\xca\\xd8\\x10\\xeb\\xa4\\xd4\\xb6=\\xbe\\x15\\xacg\\xe7\\xba\\xfb\\x81\\xd7\\xba\\xc9\\x8d\\xd0\\xb5\\x9c\\x08\\xb2\\xce\\xafwtb\\x06\\x1e\\xba\\x19\\x1e\\xb2=\\x17\\xc8y\\x16@\\xe0\\xac\\xbc\\xad\\x81#\\x88a\\x8a\\x13\\xad\\xf3\\xb8\\xb9\\xae\\xc5\\xba2\\xc5\\x1d\\x9b\\xef\\x98_c \\x98\\x99m\\x8f\\xbb';'\\xb3`\\xa9\\x16\\xaaz\\x80z\\x82\\x8dd\\x02\\xaa3u;%m\\xdb\\xeb\\\\x88\\xb7x\\xbb\\xf2\\x94\\x1d\\xf1\\xf3\\xf4\\xf7{\\x14\\x89>\\xf9\\xee\\x19\\xea9\\xf1\\x87w0\\x8f`\\c\\x7f.*t[m\\x149\\x08u\\xf8g\\xc3\\xda\\x85\\xa7\\xc1b5\\x0e\\x02`t\\xdf\\xdc}\\x9bp\\xadnui\\xcfm\\xc3\\x80\\xa0\\x9e\\xa5`\\x06\\xef\\xfaw\\x04\\x16\\xed\\x89\\xd6\\xf6\\xc0\\xadvn\\xee\\xe9b(\\xbd\\xbc\\xc7\\xf3#`\\xe9\\x8b\\xfe\\x86[+\\xb8i\\x10\\xe2-\\xf4\\x1b\\x06z/"
  364. },
  365. {
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafygi[a\\xe6\\xf2\\x04\\xd9$\\x90=\\xde\\xc9\\xa4o\\xd3\\xf8]*#\\xa4\\xa2\\xc1\\xe7\\x08't\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367. },
  368. {
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xd7\\xbbv\\xf16\\xd9\\xf8\\xc9\\x9b@\\x95bg\\xec\\x99\\xd0\\xc6\\xcb\\x19\\xd0{\\x99\\x8b\\x0cu\\xeb\\xef\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370. },
  371. {
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xdf\\xc7d\\xef\\xda\\xaf9\\xd7\\xd7ng\\xdd\\{e\\x07\\xf3\\xf3\\x93\\x0f,r\\x98<j\\xb6_\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373. },
  374. {
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xbf:\\xd7\\x0f\\x01\\x0f\\x94,adz\\xaa8q\\xfdu\\x15\\xc8\\x9c\\xb4x\\xec_\\x13\\xa3\\xe9t\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376. },
  377. {
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\x91\\xb5\\xd8\\xf1~l]u\\x8dbq7l\\xba\\xb4\\xcf\\x86 z\\x0fy%\\xfa\\xc8\\x02\\xd1\\x0f\\x07\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379. },
  380. {
  381. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010/\\xe9\\x94\\x93\\xca\\x8b\\x13\\x88\\xfb\\xd3\\xa3\\xb7\\xbf\\xed\r\\xbb\\xc1l:\\xb2\\x9e>\\xf38\\x92\\xe3\\x9cx\\x0f\\x99\\x95\\xad}\\x17\\x11\\x16\\x9f\\xbb\\xe7&%\\x06\\xb7\\x8e@\\xb6\\x06\\x99\\xd4\\x9c\\xe6\\x16-\\x13&w\\x8e0w~\n\\x1e3wg\\xc0\\xb5\\x19\\x17\\x8by\\x1b\\xab2e\\x97?8\\xbd\\xae\\xb9{\"\\xe3\\x86\\xaf\\x8d\\xf7d\\x8f\\x83`h\\xd6\\xdb:\t\\xbd\\x17\\xa1\\xb7(\\xde\\xa3\\xe4\\x0eb\\xaa\\x1b0\\x0e\\x99\\xd1\\xce#\\xb1q\\xaa\\xab\\xbb\\x80+z7\\xfa\\xe9y\\x8d\\x92\\x8e*\\x9dk\"\\xdaj~\\x9b\\x955]y?\\x9f\\xa4\\xabr\\xc8cp\\xd6]\\x0f<d\\xbe\\x076e\\xba\\x03\\xffry\\x1b\\xb9\\x13\\xa3\\x89\\xd1d[\\x04\\xe2\\xc0\\xc7\\x85\\x01w\\xa4r\\x9e\\xec\\xde6\\xe7\\x14\\xe9\\x02\\xe7\\xe17\\x18\\xe0\\x93\\xfe\\x8a\\xe0v\\xf5u\\xa6k2\\x7f\\xcdq\\xe1i\\xe9\\x13\\xa4\\xae\\x9cb\\xec`bj\\xecl~\\xfe}[!\\x14\\xc0\\x9a\\xe5rh\\xce\\xa8\\x08\\x1dp\\xee\\xd3\\x02\\xb7p''\\xf5\\xc1\\xc8\\xa5i=\\x8b"
  382. },
  383. {
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p^\\xbfv5!\\x1b\\x03\\x80\\xa2\\xce\\xf0'\\xc4\\x1847]f\\x80f9\\xb98\\xa9.\\xa56\\x85x\\x15\\xecn\\xff\\xd2\\x01\\xd1\\x05\\xe7\\xb6\\xc7h\\x892yk\\x95\\x8a\\x17\\xf5u\\xbde\\xb5$u\"\\xfd~r61\\xb5@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\xf62\\x83\\x19\\xe9da\\xc5\\xa8v\\xca\\x05\\x05t\\xef\\x99\\xdap\\xece \\xc0\\xc01\\xd7\\xbcwb\\xc8\\x9b\\xc3\\x05]\\xdb\\xef\\x88^\\xd7\\xd7j\\x16+\\x83\\x14\\xd3\\x92t"
  385. },
  386. {
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafy\\xc5\\xa3\\xe2\\xe6\\xb1rhsh\\x9dk\\x0f@x=v\\xeb\\xd3k\\x9b\\x16-\\xc6\\x1f\\xfd\\xeb\\xdf\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388. },
  389. {
  390. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08-\\x17\\x80\\x15\\xddn\\xd8y\\x17\\xde[9\\x83\\xe2\\xce}b$\\x96\\x8bj\\xb0\\x15\t\\xcay\\xa5v\\xe5\\xbe\\xd0(\\xd9\\xa6\\x13o\\x8d\\x19\\x91>m\\x87\\t\\x04\t\\xba\\xe1\\xa8\\xb5\\xb7[\\xe3yy\\xe5\\xcc\\xeb\\xbb\\xccb\\xf1\\xa5b%\\xabg\\xe2\\x80\\xad\\xafx\\xd8}r\\xef\\x9b\\xd0\\x92\\xd2\\x10\t\\x9b\\xd6\\x91\\xb9\\x1bq\\xcb,\\x89p[\"\\x13\\xd4+\\xdf\\xf4tq\\xb2\\x9c\\x1b\\x9f\\xa4\\xe7(\\xd2l\\xc9\\xcb\\x9cg\\xc7\\xcc{\\xfbqh\\x8e2\\x1egn\\xe5\\xe3\\x10\\x83f\\xdcu\\x86ljb>!fb\t=\\x15\\xdf\\x06\\xb72\\xa8-\\xb8\\x01@*q\\xb2\\xbfm\\x15\\x123\\x85\\x168\\x0e\\xd2>w\\xe4\\x05b\\x07|\\x02\\xff\\x92j\\xb7\\x82\\x9d\\x91\\xfc\\xb4y^\\xd3\\x0b5f\\xb6\\x07\\x8f\\xbd\\xcc\\xa8\\xb0\\xedn\\x06\\xae\\xce[h\\xafc\\x07\\xffj-\\xde?\\xad\\xaf\\xa8\\xa6\\xf2\\xd4p^\\xd310\\xa8\\xf2`\\x7fi\\xaac(\\xfd{1bpfh\\xebhe2t\\x98o\\xe4j\\xa3q\\xe8uj"
  391. },
  392. {
  393. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\ng\\x92\t\\x86\\xc1\\x0cio\\xee~n\\x80\\x86\r\\xf82\\xc9\\xcbh\\xcfd\\xbdvf\\x00\\xfe\\xa5\\xeb3\\x1dx;brm\\xdf\\xd6\\xea\\x18--\\x16s\\xd0\\x8d[;\t\\x06\\xcb\\x0e\\x9cp\\xceq\\x11\\x8c\\xcd\\xb5\\x91l+/'&\\x93\\\r\\xc1;\\x1fn\\xae\\x91\\xea\\xa8h\\xfc8>\\x00\\x8e\\x0br\\xac\\x7fr\\xfb\\xb6\\x8a\\xac\\xa4\\x89g\\xb4d\\x0c7c\rc\\xe0\\x0e\\x08\\xc7\\xcf\\xbd\\x10\\x13\\x8e\\xba\\x80\\x9b@\\xc1\\xff\\x84\\x84\\xf6\\x16\\x9c~y\\x8d\\xb1\\xe1\r,\\x91\\xeah\\x04\\x8f>:e[\\xba[h\\xed\\x97\\xa9\\xc2s-\\x83\\xa3\\xe2\\xe9,\\xd9\\x89m(\\xc7m\\xc3[\\x83:\\xed\\xd1c\\xfd\t\\xc8\\xde\\xba\\xa6\\xb7y\\xc6h_\\xefr!\\xd5w\\x82\\x1a\r,\\xb1\\xed\\x86.\\x92\\xefh\\xad\\xc6n\\x19p\\xf7\\x08\\x88* \t\\xf3\\x00g\\x98\\xd5\\xd9\\x16:\\x97\\xa3\\xe6\\x06q&\\xbf\\xe1k\\xe2n\\xc9\\xec\\xdc^25j\\x1axr\\xe4e\\x8b\\x94\\xf3\\xf4\\xa1l\\xc6r\\x9f\\xc7\\xc9\\x94\\xba<\\x8b\\x92\\x00"
  394. },
  395. {
  396. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xed\\xb9d\\xa7g\\xe4\\xd63\\xa7\\x04d\\xa1\\xd4\\x0e\\x19+f\\xec\\xfc\\xf45\\xee\\x009k`\\xb5\\xdd\\xf7y\\x97_\\xad\\x88\\x9d*\\x07mn\\x1f\\xf3\\x08\\x1ct\\xb2]\"-\\x9b\\xcc\\xa5v\\xf4\\xb6o4\\xd5\\x96\\xa0\\x8e&d\\x15s\\xd2sxl\\xe9\\xda\\x87\\x1d\\xfb\t\\xd8\\xac\\x99\\xc3\\x17~\\xf0\\xa5`\\xb8r\\x90\\xc8sa\\l\\xf2>\\xb86\\x7f.\\x9f\\x90\\x12\\xd0\\xd7d\\xc3\\xb0[\\xb2ssn\\x19n\\xd8\\x95{k\\xe4\\xa4\\xd6\\xe1\\xf4/7g\\x97a+\\xf40}/)\\xbcr\\x86\\\\xb8\\x1b\\xd1\\xac\\x8c\\xbf9\\x0c\\xcb\\xef7\\xe0\\x8e\\x88\\xf1?l*f\\xb9q\\xe7\\xb3-r\\xe6\\xe4]5\\xb1o\\x10\\xfe\\xd79\\x85\\xa9]|.\\xa8\\xc0\\x00\\xb3\\x14\\xf4z\\x8c\\xe2\\xe0\\x01\\x07\\xbe\\xbc\\xef\\xf3c\\x90\\xa5\\x8c\\x87\\x99,\\xf9n\\x84\\xf2\\x7f\\x8e\\x93swvf`f\\x14i\\x1d\\xd8\\xfddm\\xc4\\x91v\\x0be,n b\\xba\\xfc\\x04\\x88\\x0c\\xd4?\\xf7\\xe8!\\x14\\x92:\\xaa\\xb1\\x9c\\xe4\\xab\\xe1\\x0f\\x1f\\xbb"
  397. },
  398. {
  399. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16r\\xc9\\x9df\\x8d\\xc8e\\x88\\xad;pd\\x1ev\\x84zs3~eg\\xc6>\\x88_6\\xea\\xc9\\x14\\xbfi`\\xfcs\\xb5\\x87,\\xc1\\xbf\\xb7k~gb[\\xd6jwd>8\\x0fz\\xea\\x82\\xcen_\\xa3\\x94\\x0e\\xae\\xf0\\x89\\xc6\\xc0\\xfd9z\\xaf\\xd5zkq\\x96\\xe7\\x8dc\\xf1\\x90\\xbe\\xb4.j\\xb0\\xd4x\\xf7\\x97\\x9c\\x88\\xdf\\xc5\\x8d\\xd3b\\xb7\\xf3\\xc6y\\xac\\xea\\xab]\\xe1\\xff\\x138\\xb6'\\xab&\\xf2kt.;\r\\x07\\x06\\x05%%p5\\xf8\rd\\xd4\\xdf\\x9c\\x86&\\xd9\\xaf\\xf6\\x95\\x88\\xc1\\xc3\\xff\\xd4\\x9d\\xb1\\xdf\\xa9\\xbd!`nbw\\xd7\\x85m\\xf2y*^\\x07z\\xa4\\x19\\x02\\xe6eb\\xea\\xdfz\\x9b\\xf2<\\x96z\\x84`b\\x98\\x88\\xea\\x0e\\xca5\\xd2\\x05\\x18\\x18s\\x11\\x1b\\xb0c\n \n\\xc1{\\xc0\\x1b\\x8f\\x80*a\\xe5ual[g\\xfdg\t\\xcf\\xab\\x11@^\\xa7y\\xf6\\xa8\\x94\\x84\\x83\\xe0~\\xf8\\xd8k\\x1e\\xea\\xa7\\x80t\\x11\\x0b\\x8a\\x93\\xbc\\x86\\x15\\xf3\\x19c\\xb9\n\\xcch4"
  400. },
  401. {
  402. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x84lh/\\xe2-\\xda\\xc8\\xf1\\xa1%\\xdfphr\\xf1\\x9f]\\xcd\\x89\\xac=/qv\\xc8iba=\\xc81\\xb9\\x12u\\xfa\\x8a\\xec\\x83\\xfd\\x8f\\xb7]\\x1c\\xb2q\\x05\\x84x\\x8a\\xfe\\x03\\xef\\x19\\x8d*\\xef\\xc7\\xe0^\\xcd1\\xf6*\\xbd7\"\\xed\\x12\\xa8th\\xc8u\\xfa\\x1c\\x9e\\x18\\xf7s\\x85#\\x9c\\x90\\xcf2c\\xd1\\xbcdu'=\\xccj\\xe9\\xb5\\xda\\xaa\\xect\\x98w\\x97\\x97a\\x90.\\xe9\\xea`\\xbd\\x97\\xee]\\xe5\\xbb6k\\x96u\\xd4\\x9elh\\xaf\\x7fj7x\\x8e\\x9bv\\xb9\\xb4\\x0b\\x84}8_0\\xb1<\\x0c\\x19&+\\x92\\xbc\\x8ejv\\x84\\xa3\\xee[\\x14\\xe0\\xdb\\x01\\x03\\xb7\\xd6\\xe6g\\x18\\x18\\xf2b\\x0c\\x89\\xeb]-\\x86\\xe5\\xa93b\\x90s\\x12\\xd0i1\\x04\\x9c%\\x83\\x00'\\xa5\\x7fi\\x05\\xff\\x07|y\\xf1\\xb8\\xbd\\x82\\x17\\x96a@\\x99f6g+\\x94\\xc9\\xe3\\xf8o\\xb0tg2[\\x8a\\x86\\xe7\\x83\\xe0\\xa3\\xaf\\x18\\x06~\\x80\\xa7\\xb8\\x98^\\xf0\\x87\\xff\\xc9u\\xcf\t\\x1e\\xcf~\ner3"
  403. },
  404. {
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04 \\xf3f[\\x98v\\x03}\\x9f\\1\\x1e\\x9f\\xe1\\xaab\\xeb\\xc9\\xa7\\xf1\\xc4\\x9bl\\xf7fu\\x82#\\xc0\\x8bk\\xd75y\\xa4\\xa0p\\x8a\\xac\\xf2\\x071-f]\\xf33\\xf6;[i\\x9eo\\xcc>n\\xbf%\\xbc\\x8d\\x1bh\"\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\"gxc\\x122\\xf41j\\xc4\\xd5w\\xa9\\xeaqn\\x8da0r\\xe0\\x93\\xe9\\x13g\\xb0\\xad\\xca\\xba\\xbc\\x85\\xdb\\xd9[\\xbec\\xce\\x8f\\x8e\\xd1=(\\x95\\x90\\xeb\\xe4\\x11"
  406. },
  407. {
  408. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101%\\x85|\\xca\\xcf\\xe0\\xa0\\xc3~p\\xef~\\xbf\\xf1\\xa5\\x96\\xd9\\x95#\te\\x93h;j\\xe2)\\xcb\\xee\\x94\\xe4\\x88\\xe7\\xa4\\xc3(xs\\xac\\x1d\\xb4\\xddf\\xd2$\\xa4\\x9c\\x01\\xc0\\x97g\\x17d\\xf28\\x14l\\xc0j=\\x97h\\x94\\xa9\\xafzp\\xc3\\x12\\xc2o\\x9e\\xb4\\xf5\\x9f\\xe3\\x93\\xf2\\xca\\xb9\\x1d\\x06\\xc0\\x15o\\x14u\\xc0\\x0b\\xe7o[\\xfc\\xcexc\\xd0\\x00\\xfb^\\x0bbh\\x0c\\x90~\\xe44<\\xcdndi\\x86+\\xda\\xacvnn\\x7f\\xb6\\xba\\xb9a\\x0e%\\xa5\\xad;\\xff\\xfd\\x1e5u\\xa2]\\xef\\x8fu\\xdeo\\x1c\\xc5\\x98\\xb6\\xb9|\\x19\\xfa\\xfbn\\x10!\\xc0\\x9bdg\\xf0\\x7f\\xc4wr\\xae\\xa1p0z\\xbe\\x96\\x8f\\xc6x\\xc1c\\xff!\\x1f\\x94\\xb6x\\xe2o\\x94\\x04\\xf4\\x15b\\xe3/\\x95\\x9dzg\\xe6\\xd0n\\x1a\\xdb21\\xcax\\xb7=\\xb8>a\\xff\\xe6\\xa4\\xf8\\xf9\\x9e\\xba7(\\xf0\\xfa\\x81mt\\xe1\\xaf\\x05\\x05\\xb8\\x1b\\xcdx<\\x08o\n\\xefx\\x07m|>\\xa8f \\x9a\\xfa\\x1e\\xdb\\xf9\\xcd\\xd7"
  409. },
  410. {
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x87?%o\\xa8\\xa5\\xca\\xf4z\\xaa\\x92v\nx\\x91\\xc2\\xa8\\xb0\\xb0\\xd6\\x17wp\\x7fb\\xcd\\xaby\\xb1|\\xfc7\\x19\\x91\\xfbm\\x9a\\xc9}\\xe7z\\xde\\x8dt4;~i\\xc6\\xa1\\xa1gc\\x05\\xe3\\xcd+\\xd5g\\x16_\\x8f`\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12\\xc6\\xd0+\\x1c:5\\xa2\\xc6w85/l\\xad\\xee\\xc0\\x7fja7br\\xee\\xa2!\\x9cm 13\\x8f\\xa5^\\xd0\\x02lp\\xef\\x93\\x0b\\x0b\\x93\\xcef\\x15oa"
  412. },
  413. {
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07\\xd7n\\xa1\\x12\\xea\\xa0\\xc4{\\xe6\\xc5\\xaa\\x16n\\xde1\\x14+6\\xealq\\xfd\\x95\\x9d\\xb5\\x05\\x1b f\\x96\\xcbze\\xfcl\\xaa;\\x80+k)\\xd6t\\x9e'\\xb3\\x10\\xa7l\\xf5g\\xbas\\x13\\xcf\\x0e\\xca\\xb6\\xcc.\\xd8j\\x14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8\\x94/\\xf9\\xe1\\xa6\\x85p\\x988d\\x85q\\x1c\\x1e\\xf4\\xde)\\xf9\\xd4!\\x1ay\\xfa/\\xa4\\xb0\\xaec\\x00\\x91\\xde\\x08o\\x89\\xd2\\x14\\xea\\xe2\\xab\\x87\\xa8\\xa5if\\xa9\\x08@"
  415. },
  416. {
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|w|h\\xa6#\\x08r\\x99\\x99\\xf3l\\xa5)\\xe6\\x95\\xc0\\x87\\xc9:o\\x94\\x8c^\\x92\\x8e\\x8a\\xa4\\x17f\\xad\\xb4\\xb7\\x03\\xcc\\xd7x\\xc8\\xab\\xef\\x94\\x87*f\\x8dc\\xc1\\xe5n\\xf7\\xb8.\\x9fh{\\\\xf3u\\xa0\\x91\\xebh\\xec7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\xf2\\x92g~\\xee\\x15\\xe8\\xdf\\xdey\\xeb\\xf1\\xa0l2\\xa3w'5\\xa3^\\x90\\xbd\\x11\\x02\\x1b\\x99\\xe4\\xbb\\x83\\x0b\\x03p\\xfd\\x08\\xd1f;\\xe2d\\x1d%\\x9d\\xd5\\xc6\\x04\\xbd"
  418. },
  419. {
  420. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdcx2b\\xd61\\x16\\xbc\\xe9s\\xa7`(\\xa4\\x8co\\xe0\\x9b\\x89\\x94\\x04\\xd3\\xa4\\x92/_7~37>\\xe8k\\xd0\\xdc\\x84?\\x19qf\\xb5\\x16\\x8c\\x8d\\xb4(\\xc6a\\x1c\\x03\\x89:x\\xdd\\xb8n!y\\xce\\xba\\xec\\x9a:\\x16\\x0f\\x0c\\xd9tg\\xcd#\\xa1v\\xde\\xfb\\xf5\\x1c5\\xa5\\x08\\xbd\\xd96\\xdb4]\t\\xcc^\\xcd|\\xb7\\xa9\\xf3\\x99\\xf3!gyzl\\xa4@\\xc7a\\x8d\\xba\\xd9\\x1d\\x1do<i\\xc1\\xe5\\xde\\xa8t\\xc5\\xa8[8w\\x0f\\xfa\\b+\\xf5\\x97u@b\\xbeu\\xd0\\x86\\xe2s\\x94\\xd3\\xb2\\x9f$\\xfav\\x17\\\\xb2\\xf7\\xeb\\xb7\\xcdk\\xe0\\x90\\x9d(weg\\xaf\\xe1\\xdcsc\\xb2\\x8cm\\x020\\xe7q\\x17-\\x86\\xf8\\x1b5<%\\xb3\\x9c\\x03y\\xb9\\xe5y\\xfd\\xc8!\\x87,;h3\\xd3x\\x07\\x10\\x89y\\x07\\x8a\\x8a\\x1f\\x8b\\x02\\x85\\xa3x\\x1a\\x8f\\x8d\\xf4\\x9dc\\xad\\xd7\\xa1cy\\xc4\\xac\\x07b\\x99z\\xd0\\xf3\\x9a\\x11\\x1c\\x8b\\x8e\\x85b>\\x0c\\xca\\x10!\\xf3\\x13\\x07\\xb5[)1\\xcfq"
  421. },
  422. {
  423. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xfbg\\xae\\xc8>\\xb1\\xa3t\\x07\\x95\\x05\\x80\\xbd\\xcd\\xf7[\\xb6\\x9ar\\xa2\\xfe\\x95\\xf8\\xd3\\xf6u\\x08x\\xc3,\\xd8\\xeec<\\x98\\xfdv\\xd0\\xc8\\x1cz&ut\\x8e\\x8d\\xa6\\x03\\xf3\\xf5\\xa6\\x8a\\x89dz6d\\xe6*v\\xe3\\xdc\\x97\\x1em\\x89\\xf1w\\xf5\\x80\\xc0<\\x14\\xb5%\\xcd~\\xc8\\x14\\xe6\\xba\\xb9\\x1e\\xb2nqes1\\xa9\\x95b\\x81:\\xf03\\xd7\\\\xd0\\xc0\\xfcs?\\xc9\\xf2f\\x92\\xdee\\x8c\\xe3:)&\\x1cdd\\x12tn\\xc5!\\x9bv\\xa6\\x0b\\x0b\\xe4\\xd2w\\xdfq8\\xf8\\xe1 <-\\x17\\xedh\\xf8\\x18\\x91\\x85\\x8a\\x10\\x8b\\x0bz+c\nd\\x8f\\xf6`\\xed\\xd5\\x94\\xfd\\xac3\\xa3\\x07\\x18;\\xe6`\\x98\\x8e\\xfd\\x01me\\x12\\xdc\\x87\\x8a+\\x80\\xc9\\xb5\\xc3\\xd5\\xc6\\x8fi\\xcc7\\x01k\\xd6d)\\xcb\\x04`\\x00\\xe4\\x10\\xcac\\x80\\xd8u]\\xbb\\xf4e\\xf3\\x8d2\\x1c\\xe2z\\xf0\\xa8\\xf3>\\x00\\xeb\\xda\\xee\\x82\\xc6\\x18t%\\\\x96a\\xee\\x15}\\xfc\\xc5\\xdf\\xfe\\x9ba\\x03\\xe7\\x9f\\x04*p@\\x8d\\x9e"
  424. },
  425. {
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14m$\\x12!\\xc8l\\x12\\x0f\\xdc3\\xa0\\xf1;\\x97u}`e\\xc6\\xa2^\\xe5r\\x0e$\\xd7\\xc0t\\xba\\xf1\\xaa?\\xd4\\x809\na\\x9d}d,s\\xd0u\\xae\\xa9;\\xd5\\xe2\\x845\\x9f\\x17\\xb9z\\xce4\\x80\\xcc\\xa9\\x1b\\xb7\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\x7fab\\xcfo5r\\xe6\\xf4\\xf5\\xaf\\xf5z\\xf1\\xd2\\xfd\\x8c}\\xcd\\x8bv\\xf1\\x93\\xaf\\xa1\\xcc\\x95\\xcb\\x1c\\xb7v\\xc1\\x14o\\x05\\x85\\xc7\\xef\\xea\\xc0\\xeb\\x06\\xaf\\x0e'\\xceb"
  427. },
  428. {
  429. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a;w\\xfc\\xde\\xc5%\\x90k`g\\x05\\x86\\xf6\\xe1\\x9d\\x9c(h\\x98\\x11\\xc1\\x10\\x07\\x8e):\\x95ap\\xde\\xaa\\xa1:\\xa1\\xd8\\xf9\\x02\\x8d-\\xfd\\x06\\x92vq\\xa4\\xaa,y\\x99\\xf7dxy\\xeb\\x87\\x17\\xdb\\x81\\x88q\\x14\\x92zax\\x87\\x04\\xf05\\xaa\\xcdm\\x0b\\xeef2\\x08\\x89f\\xac\\xb5&k\\x0e\\x148\\xdf58\\xa2l\\x9acu\\x02\\xac\\xef\\x9f\\x97\\xb51\\xd2\\x05\\xb3\\xe5\\xbc\\xff\\xf3\\xcf\\x87y2rt)\\xb1\\xaf\\x14_r\\xde\\x90 \\xde:\\xfe\\xf7\\x8f\\xb4\\x15bk\\xad\\xfc\\xac)u\\xdbr\\xc0\\xae\\xe7u\\x921\\x14\\xf6\\xad\\xa1\\xfe+\\x10dh\\xbd>\\xa8\\xfe\\x98\\xb9\\x1b\\xc7\\x19\\x1a\\x99i\\xa1w\\xfb\\x0ep\\x0f?2/\\x84i\\x86\\xbe5tm:]\\x1f\\xb3{\\x9fx\\xa5z!)(d\\xd8\\xbc\\x15e\\xdc]\\x0b$y==o\\xdb\\x8b\\xafx\\x1b\\xbe!\\xd3\\xed\\xban+\\x95\\x89a\\x9a\\x94z\\xd4o\\x01\\xb9\\x91w\\xa6\\xc6\\x98?[\\xc4\\x93\\x8b\\x15i\\x06\\xd7\\xa8\\x8f\\x1a\\xcd\\x07\\x13\\x05"
  430. },
  431. {
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89!\\xa65\\xf9|!\\x93z\\xb0\\xc8\\xfc\\xc8\\xeb\\xc1\\x89\\xa5\\xb8f\\x9e#o\\x19\\xf4\\xdb\\xf9\\x84\\x8e\\x026\\x9ah\\xfd\\x14\\xb0\\xba\\x026\\xf8]a\\x00\\xab\\x1a\\xffn\\x8c\\x9a\\x19\\xe5\\x02\\xadp\\x97\\xc5\\x84\\xf7g\\xe1a7g\\x89e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000,<\\xa63\\xb9\\x7f\\xd0\\xd3\\xef\\xa9\\x02f\n\\x06c|\\xf5\\xc5\\xee\\xd2,m\\x11\\x1a\\xeb\\x000\\xe7&\\x14\\x08\\xb0\\xff$\\x13@\\xc1\\xf5\\xe6\\x7f`bu\\xb4m\\x12~a"
  433. },
  434. {
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5d\\xd2\\x98\\x198\\xb2\\x99\\x16l\\xcai+.\\xb9\\xb7\\x05\\x9e7\\xd8\\xe6\\xc0\\xa4b9\\xa5s\\x17\\xaa\\xa6\\xde\\x8f\\x87\\x96\\xff\\x07\\xab\\x08_\\x7fre\\xe2q\\x05\\xbdc\\xf8\\xefr\\x95?xi\\x85\\x17y\\xd2fx2\\x9b\\xd3r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\xd7\\xa7n=\\xb0\\x9f!\\x04\\xcdk\\x9er\\xd8&@\\xeev\\xcb\\xb8\\xbdd\\x84\\x01r/\\xc0|`'\\xe2ae_\\xaa\\xb6_j0\\x1f2\\x119h\\xdb\\xaej\\x18"
  436. },
  437. {
  438. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\\x15h\\x0c\\xf6\\x97\\xa8z'\\xfbe\\xd7\\x17\\xc4\\xf1\\xfcw\\xf57\\xf2%\\xd8\\xa3\\xe9\\x810]\\xa9\\xed\\x83y\\xf0~m\\xa9n|fu\\xee&\\x84b?2,\\x1ai\\x8e\\xef\\x11\\x171\\x0f\\xcb#\\x85f%\\xc37\\x16quu\r\\xad\\x02=\\xfan&yh\\xbac\\x7f\\xd3!\\xe2og\\xcfpf,\\xbc.\\xb5\\xf2b\\x1c\\x16x\\x1c\\xaf+>a\\xc2\\xf6\\x9a\\xe0\"wp\\xa8(\\xc9\\x03s}>\\xfed\\xbf\\x89\\xc5\\x0c\\x03^\\x16b\\xf92\\xfcf\\xd0\\xc8*f\\xc6\\xeb\\xb1\\xfa\\xf5e\\x16\\xf1\\x86to\\xd9\\x9cj?\\xe5`\\xbcx\\x8a\\xce\\x81\\xd2c%\n\\xda>\\xb2\\x8c\\xb7\\xd4k~\\xfd\\x89\\x11\\xfd\\xd3j\\xc5\\x87b\\xcb\\xdba\\x90:\\xcf\\x81\\xc1\\x1d\\xe5uo\\x8c\\xc26\\xf2\\xa5k\\xbaz$\\xf6\\xcc\r\\x92\\xfd2\\xd5\\x8e!\\x0c\r\\x8f2\\xe4cf8\\xaf\\xab\\x06\\xce\\x84a.\\xfdr\\x86\\xd5\r\\xb4*\\x8e\\xbd9u\\xcai\\xdcs\\xd0\\xd9!\\xdfu6'k\\xf1\\xd8\\xafb\\x9b\\xf0\\x96\\xcc\\x1c"
  439. },
  440. {
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;\\xa8\\xbd\\xfe\\x1e\\xde\\xfe\\xc6}w\\x8b\\xa5\\x88\\xd1\\x88\\x90\\xb6\\x1a\\x99i\\x95\\x8c\\xe1-\\x17\\xec1'\\xa2c\\xa2\\x8a\\xf2t\\xc6\\xbfh</\\xbaf\\x04k\\x08\\xc1^\\xb4(e,\\x1d\\xe1\\xd8fy9yn[\\x8dwk\\x9f>\\xac\\xf4\\x00\\x03\\x17ft\\xca\\x1e\\xe1w\\x1a\\x1b\\x82\\xca\\xe8z\\xcf\\xde\\xbc\\x98\\xa1\\x06\\x9e^|}$\\xf5\\xf7\"\\x98\\xfey$\\x85u^#\n\\x82rw\\xb3\\x93p\\xe4\t\\x1c\\x1f\\x01%[(\\x82\\x98:\\xb0\\xa6\\x82\\x94s\\xd7\\xfe\\xbbg\\x92\\xec\\x87fx\\x80\\x97\\xb6\\xad8\\x18\\x80j>\\xbd\\xe1\\x81p\\xf9\\x93w?\\x1b%\\x04,\\xe8 ze\\x83o\\x90\\xefng\\x17o\\xc3\\x04\\x92!\\x1a\\x0e\\xc5al\\xbc\\m\\xb9a\\xefg\\xc1r\\x0e5x\\x84}s3\\x9ai\\x99j\\x0f\\x1b\\x9c\\xdc\\xf3\\xf4\\xbc%\\xf9h\\xe8\\xb0u\\xe1\\x12cdn\r\\x87_\\x96\\xce\\xa4\\xc5\\xe3\\xcb'\\xd4\\xb6\\x89\\xb2\\x9f\\xbd\\x02\\xb2\\x8c\\xfe\\xb6?\\xd9\\xcd\\x92[g5?\\x82q\\x84\\xd6*\\x08\\x0b"
  442. },
  443. {
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z0\\xb2r\\xe0)\\xe8\\xc9ds\\xb9\\x86\\x1f\\xc3\\xb4\\x80\\xec\\xc9wj\\xcea\\xc8\\xab8c\\xc7\\xebn\\x9fl\\x031\"t\\x19\\xac\\xd5\\xb9\\xdf\\xf4\\xa1v-ig\\xb9tw,\\xd4\\xd2\n:\\x89\\xbb\\xbe\\x88\\xdb\\xf1\t\\x92w\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x9f\\x01\\xb8\\xafb\\xab\\xf0\\xab9\\x01q>'\\xdb'\\x06c\\xd0dz\\xb1\\x86\\x10\\xb7i\\xd4\\xae\\x99\\x95\\xb5\\x9b\\x9b\\xa8\\xcf@9y\\xfea\\x0cd\\x98\\xc4\\xed\\x07\\x80i"
  445. },
  446. {
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6z\\xf9i\\xed2\\x9fj\\x0bu\\xd4\\x0f\\x80\\x8d\\x98)\\xecg4y\\x84w\\xd4~\\xdc\\x05\\xb10\\xf2mur\\x07q\\x94\\x99i\\x896w-\\x8f\\x86\\xf1\\xf6z\\xbe\\xd0\\x81rv\\xf0\\x0f\\x7f\\xfd\\x99\\xaa3s\\x85\\xdb\\xa9\\xe1\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7x\\x11\\xc5\\x95\\x96_\\xd3\\xcf\\xe9\\x9d\\xeb\\xdc\\xc9<\\x82\\xa4\\xcbb\\x9e\\xfet\\x08}\\x81\\xdc\\x1ce\\xa6r\\xacm%q,\n_\\x12\\xa8\\xf2\\x84b\\xf2\\xff\\xa7*\\xbe\\xaa"
  448. },
  449. {
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xd3v\\xf0\\xa4\\xf0\\xdfeo\\x0bpuyd\\x96){+d\\xbd\\xbf\\xceh];\\x94\\x19\\xbf\\xb8\\xa5\\xd1\\xf1\\xcfq\\xae\\xcd\\xe4\\xa5xax\\x9f\\xe7\\xcb\\xbe\\xbf\\xde\\xe9\\xc2\\x08\\xb2(r1\\xe2*t\\x0f\\xbb\\xee\\x8b\\xd4\\x8c\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\x1d\\xa8\\xf3\\xdar\\xca&\\xf6+\\x97\\x1e\\xe8\\xf5\\x18\\x11ys\\x07(\\xbcs\\x05\\xa4:\\x06\\xa8v\\x80\\x07q\\x86k\\x1f\\x84\\xbd\\xb0\\xc8f\\xcf\\x0b\\xf0\\xf0\\x9e(\\xe9j\\xbf"
  451. },
  452. {
  453. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87%\\xc3\\x95\\xd8\\xe5\\x0b\\xc1^\\xe5\\xcc\\xb3n e\\xc3\\xb7%\\x13\\xf3\\xfai+\t\\x87~/\\x9f\\x0c=\\xbc\"\\xe9\\x85\\xc4f}\\xa8\\xf3\\xa9\\x90\\xae\\xd8\\x8ei\\xd5!\\xadep\\xb72\\xc8\\xa1<\\xb2:\\xf4\\xd9(cfz\\x85\\x19\\xae)\\x83\\x93\\x04\\xb7z\\xbd^e\\xa2q9)u\\xa8w\t\\xdf\\xd6\\xbf\\xcf\",\\xd1+\\xbf\\x19y\\x1f\\xea\\x18\\xec<\\x89b\\x01\\x1b\\xa7n\\x83\\xe0\\xd6\\xfa\\x80\\xa0ss2\\x0b\\xa6sy\\x9d\\xbbu\\xe8y\\xacno\\v\\xf0\\xaf*\\x8bwmi\\xd1`\\xbd\\x00\\x98\\xc5\\xdd\\xfb\\xe9\t\\x97%\tyb\\xa6d\\xa5xi\\xd1m\\x9a\\x15\\xab\\x95\\xd0[\\xd6\\xcc\\x1f\\xc9\\x83\\xa9\\xe8.\\x97*nu\\x99\\xa6\\x89+\\xbf\\x17\\xfa(\\xdc\\xeb\\x03\\xd5,%\\xbf\\xac\\x8a9 \n\":z\\xcb\\x0f\\x98\\xe6p=\\x99\\xa0p\\x9a\\x1e\\xeb\\xa9\\xa68\\x91\\x05s\\xd5fb\\x13\\xf8\\xb8\\x82\\xdd\\x98\\x0bo\\xd8\\x89\\xe1\\xfe\\x16\\x85\\xb0w\\xd1\\x0f\\xf1>\\xba\\xdd\\x0e2\\x1d\\xc3\\x19\\xed\\xc2\\xe6\\x18\\x97"
  454. },
  455. {
  456. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfasb\\xce\\xdb\\x85\no\\x9dzb\\x95\\x90\\x0c\\xaam\\x00d \\x8ff\\xc2h3\\xfcw\\xae\\x8b\\x9a\\x98\\xda\\x19;\\x12\\x9fa\\xb7\\x8f\\x8d\\x00\\xba{x\\x93\\x9fr\\xd9_mb\\xa7\\xe7\\x07\\xc1\\x806y\\xc6\\x90z\\x9d\\xf2\\x15v\\xc6\\x94/\\xb7\\x19\\xf1o\\x15\\xa5 d\\xe9\\x1egql\\x9a\\xe05\\x08\\xab%\\xcc\\xf51\\xa7\\x1d^\\xde\r\\xf4#?\\xc1i\\xfd\\x1fm\\xa9\\x00\\xe3\\xb02\\xa5\\xf6\\x95y_g\\xf5n\\x93\\x07|\\xb0_\\x18\\xa6k{\\xf1z\n*h\\x85\\xec\"m\\x0f\\xcc/\\xccpd\\x9d4<s\\xe7\\x16\nl\\x07\\xa9\\x16\\xcal\\xeb\\xa7z\\xd6\\xc1.\\xc5\\x06\\x93\\xfc\\xf4\\x12[o\\x85z\\x19\\x85\\x14p\\xc8o\\xf6_\\xfd\\x17\\xc9\\xcd\\x90\t\\xd0k\\xf3s\\x02\\x16\\xeb\r\\x11@\\x98\\xe7j\\x90\\x944f\\x14)f\\xcb\\xc3\\xc1i\\x90\\xef\\xa4sw\\xc9\\xb3da\\xc5\\xb3^4\\xcb\\xb4\\xbd\\x859p\\x90\\xab\\xf8\\x13\\xc8,p\\xe2\\xea\t\\xd9\\xfd\\xc3\\x0e\\x16\\xd3\\xc8o\\xb9\\xc0&\\xf4v\\x96k;"
  457. },
  458. {
  459. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\r\\xce\\xb4\\xc9\\x0c7zd1\\x8a\\x16\\x19_\\x08\\xfa\\x8a\\xf5\\xc6\\xb8\\xc9\\x12\\x95\\x1b!t\\xd6\\xaa\\x9c\\xa0\\x83\\x03:\\x81\\xf3v\\x84\\x9f\\x99\\xa8uh\\xaea\\xec\\x1d\\x04\\x03e\\xdevz\\xca&\\x12f\\x10bz\\xdb\\xb4\\xd72/\\xbadaw\\x80\\xcfh\\x94)\\x86v\\xa4\\xc3d\\x80\\x03\\xdb~\ne|\\xe6\\xee\\x81\\xd4\\x9eli\\x03j\\xce\\xc28ub\\x9ftp\\xcb\\xf5g\\xebmy\\x10w\\xda\\x0f\\xdc\\xaf\\x12?'\\x1dm\\xe7\\xbch\\xf4}`3{\\x9cs\\xfb\\x02\\xd7)\\xf2\\x18\\xd8cr\\xdc4hb`\\xff\\xd3\\xc4{\\xc3\\x8ay\\x85?%\\xfdq0(\\x1e\\xf5>\\xfdc\\xce=d\\xdd\\xad\\xb3\\xd3\\xa6\\x16zfet\\xd2\\xf9e\\x8cvzo>\\xb28\\xe3\\x9c\\\\x18q\\xdf7a\\xd2\\x9e\\xc1\\x10\\xf0\\xf2\\xb8\\x7fa\\xea\\xe3\\x91\\xedbl\\xfc)\\xe3t\\xb5\\xbb\\x84nj\\xc2\\xef\\xc2\\xef\\x02mv\\x11l:'\\xfb(\\xb6@u\\xb3(\\xde\\xdabz!\\x02\\xe3\\x0f\\xc8\\x02z\\xcea\\\\xcc\\x8c"
  460. },
  461. {
  462. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010oj\\x87\\xa2\\xd9\\xf1\\xe4\\xf5\\xc1\\xc1;(\\xc5\\xa2n\\xb3\\x174\\xa3\\x11\\xfe\\x9eg\\x0b\\\\xb2\\xbd{\\xd7\\xcf\\x14\\x8ek`\\x029\\x06@\\xa5\\x9a\\xf9\\x08fa@\\x98\\x81!\\xc4t|\\xfc\\x98\\xc56\\x8f\\xfe\\xa8fl\\xc9`\\x98n\n)t\\xa9\\xe9\\xf3\\xd5\\xd1\\x8b\\xf1\\x1f\\x08x\\x101\\x81\\xb7\\x8a~\\xdfq!j\\x93.\\x1c\\x9f+\\xdfv@>0es6\\xda\\xb4a\\xb9\\xea\\x153\\x88\\xd9#\\x11\\xfe\\xa0\\x03j\\x81g\\x8e\\x00\\xb8bcl\\xbe \\x81\\x94s\\x8e\\x9e\\x7f[mc\\x82\\xc8\\xdd\\xdew!\\xaf\\xfe\\x0bha\\x94nb!\\x7f\\xb4\\xb8\\x13\\xeb\\xa0\\x89h\\x9c\\xd6\\x96\\x87\\xb4\\x96\\xde/\\x11\\xe1\\xdf\\x80p\\x99\\x8an\\xc6\\xc2\\x8dvffj\\xed\\xfa\\xbc\\x81z&\\xdc\\xbe\\xed\\x00`\\xd9\\xe6z\\xe3\\xe4\\x0b\\x0cn\\umj\\xc4pr\\xc3\\x80vu\\x0e\\x92\\xf2\\xd5e1\\xb6\\xf3\\x1ft\\xaa\\x83\\xda\\\\xa7\\xbd6p\\x06\\xd9\\x14t<\\xe5&-\\xc4\\xaa\\xd7\\xb9;\\x91\\x9e)\\xde4\\xd1\\xef1\\xc9,"
  463. },
  464. {
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010h.\\xa2\\x86\\xb1\\xcbx\\x15)\\xef1,\\x11\\xb9\\x1f\\x93\\x1d\\x06;\\xfcpvnf\\xc7\\xd6g\\xf3n\\x8c\r\\xd7&\\xbd\\xa8c_\\xec\t\\x9e\\xe2)bx\\xd0a\\x81\\xd1\\x81\\x05\\x14\\xf0|\\x1f\\xdf\\xfd\\xb0\\xc0\\xb8\\xcb\\x9d\\xa2\\xf2\\xab\\xa9\\xed\\x12\\xe4*\\xf4\\x01\\xb8\\xb8@a\\xe4\\xc5\\xd6\\xd4~+\\x06,\\x88\\xba/\\xa0~\\x9e\\xa70\\x1d\\x7fh `\\x0c\\xbb\\xbe\\xe1\\xc4\\xf4\\x92[\\xca\\x9c\\xc8o\\xe1\\xe5\\xd4p\\x80\\xd9_\\xf7\\xc3r^\\x86\\x11\\xe2$\\xcb\\xd7\\xd8\\xd2\\x9f\\xa7g\\xb2\\xe4ve\\xd9\\x9b\\x9by\\x0e\\xb9j\\x05[\\xf7\\xa1\\xe1\\x03\\xfa\\x18m\\xb8.\\xb6\\xbcd\\xb7y@\\x0ex\\x90`/s\\xea+\\xd0\\xd4\\xa9\\x07\\x8e\\x18#\"a\\xf4\\x1cp\\xa6\\xe7\\x91\\x97g61\\x1ai\\xee\\xc4d\\xf3h(\\xea\\xbd?]k\\x9ec\\x81\\xc1c'\\xc4|\\xa5?\\xd4-\\xac\\xb1\\xd3e\\x9d\\x0e\\xfa\\xba\\xb3\\xcb\r\\x0e\\x90e\\x0b\\x8c\\x7f*p@\\#\\xbe@:_&\\xe0_^m\\x93\\x18\\x13\\xeeya\\xb5\\x08\\x81}"
  466. },
  467. {
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010oix\\x16\\x9d\\xa7*n\\x11\\xce\\xd9<\\x84\\xad\\xa9{\\xa9\\x1c\\xf5 f\\xc5p(\\xff/u\\xd2\\xe5[<\\xe6\\x88\\x9f\\xe9\\xdb\\x8c\\x88\\xa9\\x98hk\\xb1\\xf9\\x8fb\\xdd\\x9f\\xdb\\x8d\\xdb4\\xea\\x84\\xc0,u\\xdf\\x1a\\xb4\\xe7k\\xd52\\xfc\\x9f\\xd2^\\xdd%'\\xd8r6u\\xff\\xc3\\xd62\\xa8\\xd9\\xac\\x18\\x16\\x18s\\xea\\xa7\\xaa\\x89\\xde\\x06\\x95ft\\xca\\x89nk\\x95\\xc9\\x9b\\xa2\\x04#\\xb5]\\x10np\\x94\\x14q\\xe9\\x98 \\xf9\\xa4l\"df`\\xd1\\x14\\xa3\\xe0wsf0\\xdd\\x9d\\xc8\\x07\\xbee\\x98\\xf5\\x88z>m\\x92\\xcf\\x0fsq\\x81q\\xab\\xb5\\xb0*\\x1b\\xb5z\\xb2w\\xa8s\\xadi\\x82\\xd1p\\x185\\xee\\x85\\x0bc\\x7f\\xed\\xbejn\\x11\\x98\\xb1a\\xa8\\x88zzzu\\xab\\xe3p\\x19\\x8c\\xad{y\\xediva\\x113\\xdd\\x7f\\xaa\\x01l\\xddd\\x12\\x90d\\xdd]\\x16\\xe9\\xf3\\x9c\\x8d\\x18&\\xaf\\xeft\\x91e\\xff\\xf7\\xdb\\xf1\\x8fi\\xe6h\\xef\\x9b@\\xc4h\\xb0\\xaf\\xa3m\\x1d\\xdahdm\\xd9\\xb0\\x99\\xad"
  469. },
  470. {
  471. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\x06\\xcda\\x19^\\xba>\\x12\\xc8\\xdfm\\xf3\\x8fv\\xfd\\x00j\\xa3\\xbe\\xe4\\xeerd\\xbc\\xe3\\x8a\\xf1h\\xe7l\\xb8m\\x06\\x00]\\xcc\\xde\\xcc\\xf2\\\\xe1\\xf0\\xa9\\xcc\\x9c\\xd9x\\xd1\\xfb\\xc2r\\xbf\\x96f\\xf4\\x1eax\\x10t\\xcf\\xe1\\x9a\\x8d\\x1av\\x1flt\\x8a\\xbf\\xc0nux\\x83\\xd1\\x80\\xe1\\xca\\x1b\\x88\\x0e~\\xf0f\\xcb\\xe5^\\xdf\\xe5\\xcd\\xac\\x88\\xfd1\\x12\\x84 \\xebm\\xbar\\xe6v\\x11\\xbfycia1u\\xaa\\x9czy2\\xd11\\x17\\x8f\\x1co\\xfe\\xcf\\xb9\\xac\\x07r\\x13\\x8b\\x1c\\x85\\xcd\\xdan\\xb9\\x1a\t\\x16\\x01\\x12\tb\\xf5:\\xdf\\x8fls\\xdb\\xc8\\xef\\x94\\xdb\\xaa\t\\x80\\x1b\\x93\\xec\\xdc\\x01\\x86m&\\x9b\\xa0@\\x87\\xd6\\xa7\\xa9|\\x96r\\xb4\\xd6h_\\xcc19\\xd0\\xb9\\x9f\\x1c\\xe4\\xf2\\xc0\\xe7\\x19r\\x84\\xf8\\xe7\\xcb[\\x06\\xc3\\xbb\\x1c:\\x8f*\\xeb\\xfa8\\xcah\\x81\\x815\\x8bg_w\\x17\\x15\\x0e\\xc1v\\x03\\xc0+\\x1b\\x9b\\xd1\\x17\\xd4\\xb9\\xb2\\x183\\xa7\\xac;\\x03\\xb3z>\\x92\\xd5\\x84\\x91\\x05\\xcaf\\xf0"
  472. },
  473. {
  474. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  475. },
  476. {
  477. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\x07\\xddj\\xa0\\xb52\\xed\\x04b]\\xb1\"\\x82\\x99\\xda6\\xe8\\xf1\\xdbdk],]\\xdfu\\xffw\\x96r\\x8d\\xde\\xee\\x96\\xd8*7:\\x1a\\xf2\\x08\\xd4\\x9d\\x0c\\xac\\xcat\\x01|\\xe1+jbo\\xd8\\x85&\\x16\\xa4\\x85\\xcb\\x00tn\\xe9\\x81\\x05\\xa1hf][k\\x1c\\xc5\\xbd~l\\xcc\\x8f\\x1b\\xbab\\xd5\\xd5\\x8e[\\xcb\\xa0r7\\xd0\\x0eh+\\x9dl?\\x071\\xc47\\xfdu\\x8d\\xa4\\x05\\xbc\\xff&b\\x8bep*\\xb8\\xf2;v\\xaf\\x07\\xe1q\\xb4\\x07\\xe0]\\xbf\\x8brt$\\x94\\x97h9\\xc4@\\xd2s\\xc4z\\x19\\xe4\\x95\\xacv-%\\xbcw\\x15\\x90v\\x99r[\\xfb\\xb6\\x90\\xc0*\\xf4\\x85\\xf8\\x05\\x92d\\x16\\xda{\\xbfz\\xe0\\x92\\xdc\\x9fs\\x0c\\xf5\\xf0\\x99\\x84\\xca\\xc1\\xcf\\x99\\x89\\x91\\xae\\xb1+\\xdca\\x13\\x80\\xef\\x89\\xf8\\xf9\\xcd\\\\xd3\\x10\\x00\\xc3\\xdf\\xcaj\\xee\\x8ah\\xeep\\x0b\\x11t\\x94+\\x9d\\xb5\\xf5m\\xb9h\\x1c\\x91^\\xeb\\xb6\\x01\\xfcd\\xf6\\xcc\\xa0\\xff\\xa1\\x19\\xedi\\xf9\\xb6(\\x80'\\xf3\\xd3)\\x9d"
  478. },
  479. {
  480. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  481. },
  482. {
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xe0a\\xf1y\\xca\\x12\\xfa\\x9d\\xf4\\x86n\\x15h\\xfab\\xa5hr\\xd3\\xb1#\\xd2\\xf7\\xc3\\x1e7\\xb5\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  484. },
  485. {
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xaf1\\\\xc5\\x0e6\\xe5\\xbc\\xa1\\x7f\\x1dp\\xb0n\\xdbo\\x8c\\xc3c+\\xabi\\xba\\xdd\\xbe\\x0f\\xbee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  487. },
  488. {
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xea\\xef\\xe3\\xc0q-\\xfa\\xd0\\x95&\\xc9\\xaf\\xe3c\\xf5mt\\x87\"\\x1a/i\\xa2t\\xc8ib+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  490. },
  491. {
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xae\\x06\\xbb\\xd1\\xa5\\xe6\\xcesc\\xcbh\\xbf~\\xb3oi\\x0f\\xbe\\xf20\\xfd\\x96\\xc0\\xdb\\xbf<#\r\\x0b\\xbfj \\x94\\xb7c\\x1c\\x1d\\xbe\\xc6\\xa5\\xbf\\xa6\\x81`\\xea\\xe0&rh'\\xf8\\xdf\\xffdv,\\xb3\\xa4!\\x8e$\\x06\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8b\\xa4\\xd5.[\\xb0\\x89\\xce\\xfdt\\xf6\\xbe3!x4=c\\x84:</\\x87c\\xc3r\\x96\\xaa'\\xfc\\xa4\\xf4\\x14\\xa5\\xe8\\x8fj8\\x852\\xca7n\\xd6h\\x8c\\xcc\\xdc"
  493. },
  494. {
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19c\\xf6\\xb2\\xfc\\xb6n!\\xd2\\x1brv\\x14\\xda5\\x9c\\xa9\\x12\\xcb6\\xa81e\\x1e\\x19-\\xc4\\xb4\\x0b\\xd9\\xf16oi@\n\\xcb\\xcd\\xce!,r\\x04c\\xeeh\\xdbv\\xc4\\xb6\\x82\\xfb\\xf7\\xf8c\\xed1b.\\x07\\x0f\\xc8\\xfa\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x01u\\xaf\\x1f\\xbc\\xc3\\x84\\xcep?\\xb2\\x0e\\xbf\\xf5\\xca\\xf9a\\x1f`\\x9e0\\xda\\x15h\\xf9\\x06)v\\xc8\\x05\\xe8tz\\x10+\\xed\\xe6\\xefl\\x97\\xe9\\x1cq(t\\xa3\\x92|"
  496. },
  497. {
  498. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xf8\\x03b\\x99_}\\xf1{ \t*9\\x96\\xe9u\\xcat\\x90b9}\\xd1\\xa5\\xf6\\xfarkl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  499. },
  500. {
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04[\\xe9\\xdc\\x9a\\x18_\\xa8\t\\xdfg\\xaa\\x9b\\xe6\\xbb\\x03\\x15\\x99\\x12\\xbe\\xac0h\\xd5+\\x83\\xdc\\x04\\xa3\\xa4\\xbe\\x1457\\xf3\\xa6\\x03\\xc9\\xa2\\xeb\\xd4\\xf5\\xcc\\xf3\\xcdr\\xb9\\x07f\\xd1zm\\x99\\xbcy\\x1e@b\\x9ed<x\\x80n\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf93w\\xb6\\x94\\x0c\\xcf\\xb1\\x18h\\xb67\\xce\\xc2(\\xe0\\x9b,\\xd8\\xf5q\\xdb \\xc2az\\xcf\\xba%\\x12\\x94\\xd3?x\\x82\\xb3^\\xdd\\xbfy\\xa0\\x9a\\xf7\\xaexd2\\xda"
  502. },
  503. {
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\x8a0\\xe5\\xf6\\xd5\\xea\\xaa\\xcc\\xc2\\x11@\\xfbq{\\xc3\\xe8\\xde\\x87\\xbd\\xa5bv\\x08\\x8a\\x17c\\x84\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  505. },
  506. {
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\g\\x10\\xb0\\x80\\x12\\x9a\\xca\\xdd\\xdd\\xd7\\x85\\x16e*\\x89\\xe2\\x05\\x9f\\xf5c\t)\\xeap\\xaf\\xbcls\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  508. },
  509. {
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\ng\n\\xa17\\xbf4\\xa6\\x80\\xd4\\xaa\\xdc\\x9d[\\x02cu3\\xd8\\xde\\m\\xf1\\xa9\\x99\\xc8\\xfa\\xc4\\xf5\\x1be{g\\xf2c\\xe5\\x98\\x06\\xcf\\x8c\\x10z\\xab\\xbc\\x8d-\\xe4\\x89\\xd5\"\\xb8\\xc1\\xaau\\x96\\x05<\\xc2y\\xa1r\\xac\\x1d.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xa1\\xc3\\xa5\\xca\\x1f\\x8b\\xe8\\x0fx\\x8f\\xdal\\x85\\xa9\\x12q\\x11\\xe0\\xbe\\xf1\\xdc\\xd8\\xf5\\x15\\xb5c\\xf5\\x80\\xda)\\x12\\xb9.\\xcc\\xc7wja5\\xef&\\xc2\\xd0\\xb4\\x1fx="
  511. },
  512. {
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x07\\x12z\\x9dow\\x8e\\xa8\\x941\\x0e\\xab5\\xc8\\x86\\x83\\x88\\x97\\x0b\\xb3\\xc5b\\xe8e\\xa0(\\x8a)3q\\xa5\\x06\\x1c\\x0e\\x1d\\xca\\xdd\\x95\\x87l\\xc5\\xc0\\x8c\\xb1/\\x13\\x90\\xe1[\\xdds\\x88\\xf7\\xfe\\x1d\\xec\\xb0\\xfe\\xa4\\xea\\x1f\\xdf\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12g\\xca\\xa7j\\xd5^\\xfa\\xd2v\\x89kk\\x9b\\x93+\\xc8<\\xe2v}\\xca@_\\x1a\\xed\\xccz]\\xbab\\xdfo\\xae\\xcc\\xfe\\xb4\\xca\\x9b\\xb8pk\\xab.\\xc3\\xf6\\xb8\\xe4"
  514. },
  515. {
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05\\x17h\\xbc\\x06\\xf7\\xc1\\xde\\x8b\\\\xd2\\xb7gxs\\x9f\\xe4\\xcb\\xccn\\x90\\xeen@\\xdc\\xe1\\xd86\\x97m\\xf4\\x1esto\\x05\n+\\x1e\\xe4\\xd2\\x8f\\xa4\\xe5\\x9dx00\\x11o\\xcd\\x14\\x1b\\x90\\xa8\\xe2\\xdde#\\x96\\xb0\\xd3m\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xd6\\xb3p4\\xee\\xc9\\x99c\\xc0%w\\x02\\x8d`\t\\xa8\\x12g'`\\xa8\\xb1\\x8f\\xd4>\\xbe.e1\\x18\\xc8+\\xc3kf.fzd\\xb8#\\x8e+k\\x19@-"
  517. },
  518. {
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xf4\\xa5w\\x81\\xbe\\x06\\x07\\x1f\\xae5\"\\x86$\\xf9\\xfd^\\xa8\\x1c\\x9f9i8\\xd4\\xe2\\xb6\\x1d\\xe0\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  520. },
  521. {
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xe7\\xfa\"\\xde\\xa4cm.\\xb7\\xf1\\x82\\x8b\\xc5d\r\\x84m~\\x88\\xedx\\x0e\\x14s\\x89\\xf6z4h[\\xaa'\\xe37\\xc9\\xe1]wh\\xee\\x1e&\\x97*\\x81\\x81\\xd6?!\\xd5\\x15x\\xf2-_\\x8c\\xad\\x1e\\x18\\xd0p\\xeb\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\x1a\\xed\\xb7\\xb2x\\xe7\\x94q\\xb2\\x97\\xcb\\xc9\\x97\\xd8\\xee\\xcdj\\xca\\xc9m\\xefke\\x7f\\x19{\n\\x94v\\x80\\xee\\xce\\xabn 4h&=\\xceu\\xb0\\xe0\\xe7\\x14\\xcb\\x83"
  523. },
  524. {
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xfb\\x15\\x1bpy&`\\xdd\\xfe\\x87z\\xf6\\x89\\xaf\\x1e\\x04\\xb0z\\xb0\\xe3\\xbfcf\\x10\\x8e\\xf7\\x0f\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  526. },
  527. {
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\x80w\\xa6[`\\xc3\\x178\\x98\\x87\\xb9\\x9d<67\\x85\\xd8\\xd6\\x94?\\xc4\\xcc\\xb0\\xe5\\xbdc^\\x98\\x8f%\\x04\"\\xe9\\xbc\\xf5\\x13\\x91\\x03\\xf4#\\x1b\\x8e\\xb9f\\x7fk\rl\\xe9a\\xe2<\\x10\\x8a\\xa7x\\xa6\\xf8{\\x8c\\xc9\\xa8\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1c\\xce,\\xf3\\x9c\\x13\\x04q\\x0ft\\xc3\t)=\\xb5\\xafjyw\\x1dp\\x88\\xa4f(8[bp\\x89\"\\x08\\xd8ngom1\\xabu\\xd97\\xf0\\xce\\xe8\\xc9=\\xfd"
  529. },
  530. {
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\`\\xfe`v\\xfc\\xa1w\\xb8yd\\x02y*lf\\x944\\xacf\\x03u\\xc2\\xd4\\xca\\xa0\\xac\\xef \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  532. },
  533. {
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\z\\xc8\\xf8\\xdf\\xdd|a\\x1c\\x9by\\xf0\\x99\\xd4\\xa5\\xa0\\x84\\xaelu\\xb6\\xfe\\x16\\xc2\\xab\\x03\\xc7\\x83[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  535. },
  536. {
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\x9a\\xb7$\\xcb\\x07!q\\x16\\x8av\\x96\\xfd\\xf5o\\xd6\\x03i\\xd3\\xd9j\\xec*\\xc0y_l?\\xda\\xf2e\\xb7\\xf6\r\\\\x82\\xb1\\x95\\xfb\\x01*n\\x16u\\xdc\\x96\\x9bc2\r\\x16\\x02c\\xa4q\\x7f3\\xb3\\x0f\\x02\\x10\\x9f-\\x92\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000lb0lpyw\\xca\\xfa\\xce\\x0bh\\xb9\\xc5\\xd6\\xd8\\xf5\\xc4\\x82\\xd3\n\r\\xaa\\x9f\\x81s^\\xbc;$>vb\\x877-\\xed\\xcc\\x06\\xb6\\xe4!\\xeevk\\xc5\\xa6\\xb5"
  538. },
  539. {
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\xd5sprh5\\x9b\\xe9\\xe3r\\xddm\\xe9\\x1b\\xdf\\x82d\\x9f\\xd6\\xdf\\xd2\\x04\\xa8\\xdf\\xf0\\x9c~gno\\xbf\\x07\\xda\\x04\\xd4\\x0c\\xbd\\xd7{m\\x0b\\xa5\tz\\x01p\\xa18\\xa14\\xae\\xe9\\xe7\\xd5\\xf7?a\\xf9\\x85\\x84\\xac\\xefo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009~\\xe3\\x7f\\xb3`\\xcb\\xe6kx\\x88{prl$\\xa2\\xa3\\xc1|kv\\xc5\\xd3*\\xd7\\x02?\\xd1c\\x8a\\x02\\xa6\\xa2\\x8aqy\\xd6!3bg\\xe2\\xfd\\xb3\\x07\\x18\\xd7"
  541. },
  542. {
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\.\\xe1\\xb1=\\x12\\xeb\\xb1\\xe0\\xaf\\xfbjf9\\x04\\x90\\x1a\\x11\\x94\t\\xc7\\xc7\\xcb;\\x97uj\\x82\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  544. },
  545. {
  546. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1a\\x9d#:\\x03\\x08c\\xc4\\x01\\x90\\x90\\x94\\xecsza\\xed\\x8b\\xbc\\xa50*\\xfc!g\\xdc\\x13\\x1bv\\x0cv\\xc5\\x9f\\x8f`\\xe63]9\\xe9\\xa2\\xdc\\x00\\xb0\\xe9\np86\\xc97z\\x92u\\x97\\x0e\\xe3\\xf1\\xfa\\xb5\\x0fx\\x8a%\\x84\\xc5\\xf7\\xfc0\\x92\\xde\\x07\\xc7'\\x7f\\xe7[\\xdbn\\xe8\\xd7\\x082\\x1c\\xf9\\xe3\\x17\\x82\\x05\\xfe\\x80\\x13\\xf3vzw\\xc0\\x98\\xcf'\\x87kq\\x0b\\xea\\xc3`\\xf9\\xa4z\\xed-\\x8f\"\\xe0\\xd9?\\\\x85\\xd0&4\\xf9\\xc1\\xbfm:\"q\\xbdx\\x15q1\\x1f\\xfc\\xb0\\x85rw\\xaa\\xcdb/\\xf5#\\xeca\\xfc\\xedv\\xcc?.\\xb3\\xe3a+\\xd3\\xd6\\x18\\xfdpcva:)\\xda\\x1f\\xe8\\xd7\\x136\\xd5m\\xcc\\xacki\\xed\\xd7p\\xd0\\xb7h\\xdcb\\x14\\xc5~o@0\\xc6\\x06\\xd5\\xbcxq\\xcc@\\xfa\\x08\\xb4f\\xab\\x94_\\xcb\\xa0\\xaf&y\\xc7h\\xb6\\x97\\x94\\xbd\\x0c\\x13de=\\xceyy\\x8b\\xcb\\xcd\\xb5\\xab\\xd1\\x9ce\\x8f\\xb0\\xcfh\\xdc\\x02o*\\xbd_\\x0egjt\\x05"
  547. },
  548. {
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\x06\\xd3_;\\x1e\\xcec\\x154dk$\\xeb\\xf2\\x1cx\\x88df|_\\xc9!\\x90\\xfb\\xce\\xc2\\x13\\x95\\x8a\\xe2\\x87\\xac1}\\xae\\xb6+\\xe4\\xe9\\xb1\\x96x\\xecx\\xf8\\x12\\x0e\nsr\\xe5\\xac\\xf9\\xdb>^\\x95\\x95\\x0f\\xd62\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\x16}\\x02\\xbb\\x85\\x9b7\\xf2f9\\xa5\\x06\\x10\\xbb\\xcb\"\\x10\\xe1f(\\xba\\x98\\xce\\xb2\\x0f\\xa8o\\xf2]\r\\xc9f\\xa2\\xc2\\xd0\\xd2o<b\\xb6\\x07\\xa0\\xf4oj$\\x05"
  550. },
  551. {
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xc93z\\xb6\\xaf\\x0e\\xc5\\x18m.\\x0c\\x15\\xec\\xdf>\\xfc\\x80\\xb4\\x07\\xe45\\xbb\\xf9iy\\x89\\x817\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  553. },
  554. {
  555. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\x9bbm|\\xf8\\xb7\\x18h\\xa6\\x96\\x87<\\xdb\\xf7\\xb6#\\xe8\\xd2\\xc7\\xf9\\x9aa\\xaf'\\xe3h\\x01k\\xf5#\\x9d\\xf9\\xb2\\xb0\\xe9\\xca\\x15\\x15\\xb0\\xbd\\xef\\xd2\\x88\"\\x1c\\xb3\\xa3\\x1b\\xf6\\x8b\\xcf\\xca\\x1d\\xce\\xd5\\xf9\\xb5\\xc8|\\xa5\\x9b\\xf4l\\xe6@\t\\xa4v\\xa7-5\\x8a\\xd4\\x170\\x9e\\xb0\\xe3~\\xab\\xf9\\xac\\xc4\\xdd\\xe1\\xa7\\xbf\\xdc\\xb2\\x8b\\xaaz\\xff\\xcenz\\xc6\\x99\\xea\\xf7\\xacf\\xa5\\xf1x\\x92\\xe1=\\x8d7'(n\\xa8i\\x1a\\xf2\\xd14@~\\xca\\xcb\\x80\\xfc\\x90\\xeaz\\xb7\\xfc\\x06\\x8a\\xe0\\x99&\\x7f\\xc7\\x92\\x95\\x11azb\\xa1\\xf54\\x94?6\\x14b\\xcch\\x1b/\\x91\\xe7n\\x94\\xf0\\xe9\\xe9\\xfa\\x96(g\\xa3\\x16ziu\\xe1r}\\x0e\\xca\\xd6\\x17+\\x88.&@z\\xa6\\x1365\\xeb4\\x11\\xa6\\xbb \\x8e\\x06\\x84j\\xf3\\xdb\\xe7\\xfa9\\xaa\\xf1\\xc0\n{~o\\x02\\xbf\\xf0u\\xecn\\\\xeb\\xc0\\x16h\\xc2\\xce\\x9e\\xccjn\\xdc\\x12\\xa2#\\x06\\xad\\x07\\xad\\xbc\\xd6\\x91\\x85\\x840-b\\xcf\\x0f\\xbe\\x90=66"
  556. },
  557. {
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04,\\x13\\x86\\x16jr\\x92-\\x9b\\x08\\xf0h[8\\x11\\xa9\\xf8\\xb8y\\x92\\xfamnc\\x92g\\xd3<np\\x16w%\\x03v\\xe9\\x85\\xf8\\x82\\x99]\\x01\\xde\\xee\\xfd\\xdf\nnr0\\x04\\xdb\\x947\\x18u\\xdbj\\xcc\\xf4\\xff\"k\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&2q\\xa6{\rbj\\x8a\\x07_\\xe3j\\xfa\\xf9\\xaf\\xd4;o\\xba\"\\xfd\\xe1\\xd5k2\\xc2|\\xe4\\xe2\\x9d\\xfd\\x9f\\xc0\\xd5\\x9f,\\xd2`\\xe2\\\\xc55\\xde\\x13\\xfexo"
  559. },
  560. {
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\z\\x18u\\xc5\\x88f\\xd0\\x0c\\xff\\xb8\\\\xbf\\xa9\\x1c\\x9au2\\xa2a\tm\\x16dgg&\\xb6\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  562. },
  563. {
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf\\x1b\\xd3{ff\\xf7\\xeep\\xf9\\x19\\xdb\\xe9\\xfd\\x00<c\\x08\\xc3i\\x8c\\x1f\\xa3\\x1fre\\x95\\xbf\\x89\\xec\\xac6\\x1d\\xbe\\xe2\\#\\xaa\\xee|\\xee\\xb7`\\x81\\xbe\\xc1\\xf3*\\x04\\xd6\\x04\\x17|h\\x9b\\xd7\\xe5\\x0f\\xa4\\xea\\xc8e]6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\xd9\\x9f\\xfb\\xaa\\xe3\\xb5a\\xd75!uf\\x9f\\xeb\\xaf\\xc0\\x8a\\xe6z\\x9c\\x9ak\\xc5\\xcaq\\xf7\\xf5m\\x0e\\x16s\\x11\\x89\\x11\\x8b\\x8e:>\\xf7\\xd8jy\\x8f\\x8b\\xcf*\\xf4"
  565. },
  566. {
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xbb\\x8f]&\\xe1_\\x03\\xb4$6\\x17\\x82i\\xf3\\xdcaz\\x9fl\\xba\\xebfef\\xff\\xf5\\xbc0\\x16\\xef\\x0e\\x874]hd\\x1emc\\x88n,\\x9a+\\xab\\x135\\xe3\\x8b\\x91h\\x92v\\xaa\\xf9\"<h\\xb4\\xc36\\xcb\\xe3\\xa3\\xb0\\x97\\xb1a\\xdd\\xd4\\xfc6t:2\\xb9\\x15\\x17\\xd2\\xe6@\\x16d\\x91o\\xde^\\x18d\\xdc:\\x87br\\x81\\x02r\\x12\\x8b^\\xa8\\x86\\xd4\\x98\\x0b{;\\xcax\\xcf\\xf8\\xa3\\x0e,\\xcd\\xaf{u\\xfe\\xc0[\\x90\\x92n\\xe3d\n\\xa5\\xbdh1\\x99x\\xec'`\\xeci\\x15:\\x87_\\xc6\\x83\\x82\\xd5\\xb1\\xb4\\xfef\\xbd\\xebq\\x86\\x93\\x96\\xb4\\xbb@\\x8e6\\xbd\\x15\\xc3f\\xc4\\xb7o#r\\x0e<\\xdc\\x7f\\x11\\x99d\\xadl\\xcd\\xc9\\x86\\x13j\\xf5\\xe8;\\xde4/l\\xd0\\xfa\\xed\\xf8v\\xa5\\xf8,6\\xe5\\x91\\xa7\\xa0l\\x0e.\\xe6w\\xc8\\xda\\xc9o(\\x13n\\x16\\x08\\x0f\\xbd\\x96\\x1ch\\xff\\xe7\\x8b\\x1ft\\x02\\xe0\\xc1mz$\\x05!q\\xae\\xf3\\xd2\\xc8x\\xd1\\x0fw1\\xb8b\\xb0\\xe5"
  568. },
  569. {
  570. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010(z,\\xbd\\x17u1c\\xf0a^g\\x12\\xdd\\x9c\\x1a\\xcf\\xe2@5\\xea\\x97\\xe3t\\xbf\\x954\\xfe\\x06\\xa3\\xf8\\x8d\\xa8\\x969\\x7fp\\\\xa9k!w\\x1e\\xb5/f\\x80(\\x82\\xbf\\xbf\\x9f\\xb1\\xe4\\xe2\\xc3\\xab\\x17\\x1c:t}\\x9ftr\\xec\\xea\\x86\\xa4\\x1c\\xf9y\\x19\\xb2\\xa3\\x18\\xfd\\xa6t\\x1czu9\\\\x15_\\x0e\\xe9\\xdd\\xdc\\xda\\x0b\\xb00\\x81im\\xc725'\\x1dp/\\xd3\\x85\\xdeyb\\x85}\\x10\\xb9\\xda\\x87a\\xd8uyj0\\xe6k\\xc2\\x8a\\x82\\x19\\xc2\\xa8\\xf8_e\\x01,k\\xba\\x94\\x80t%+\\x10\\xb1\\x82xfs\\xa4s\\xa1\\x01\\x94\\xcfc\\xd7\\xf5.d\\x9a\\x818e\\xc9\\xc7m\\xb6\\xe0h\\x1b\\x83\\xd8\\x9f\\x1ar\\xc8h\\xbev\\xf3(\\x91\\xcb\\x073\\xbd\\x95c[\\x12\\x7f\\xee`\\x94\\x8d\r\\xe1+u\\<x\\x95\\x87\\xa7\\xbdo\\x9f\\xeb\\x0e\\xa9\\x94\\x86#\\xbdo!\\xfc\\6\\x83\\x95\\xe8\n\\x87\\xd5d\\xac\\x00\\xa0ay\\xaf\\x85\\xce(\\xa6w1\\xc9\\\\x87\\xfd\\x8c\\x13\\x9aw\\xc8\\x00}\\xf9\\x15"
  571. },
  572. {
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xd9\\xcc\\xf1\\x1f\\xa5`\\xa9;\\xf3z\\xe5\\xc7=\r\\xf5\\xea\tch,b\\xa9f\\x02\\x17qo1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  574. },
  575. {
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xd5'\\xdf\\xcb\\xc8\\xc7\\xd0\\xac\\x1e/?q\\xd8\\xed-\\x9byo\\x1d\\x1bh\\x05\\xdck\\xb0\r!d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  577. },
  578. {
  579. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa4\\xf3;\\x02\\x041\\xe6\\xc7\\xa4\\x9e\\xf4$*\\\\xe5\t\\x03\\xbd\\xc0\\x04h\\x99r\\x8a\\x0b\r5\\xd5\\xa8;\\x8a\\xfa\\xf8\\x06\\x1e\\x1e\\x9a\\x08~:/\\xc5\\x03\\xd2c-!\\xe5\\xb4\\x1f\\x1dv]q7\\x19\\x84\\xf7*\\xe1\\xf0\\x891\\xcb\\x9fvc\\xdc\\x90f\\xdf`s\\xe0bo\\xa2\\xee\\xbfy\\xdb\\x1eu\\xe1\\xb8jh\\xc5\\xf5\\xd4\"\\x1en\\xf2h\\xb9\\xa9\\x05\\x87-\\x12\\xc8\\x99\\xaf\\x95p\\xb8z\\xc2\r\\xc43z\\xa26\\xc1bk%\\x97\\xa5p\\xf0(\\x8b>\\x00\\xbeb\\x10\\x18\\xbd\\xe2h\\x9d\\x7f\\xa7\\x9a\\x19\\xbd\\x81\\xd5o\\xa18\\xe7\\xda\\x9e\\xdb\\xdd}\\xb5jy3<\\xf6\\xb8\\x01/h\\x02\\xf8\\xfa\\x1cz\\xf6\\x18\\xbd9\\xe7\\xa1.\\x12\\x94z\\xb1?\\x83>\\xf6\\x90l\\xad\\x95\\xcf\\x13\\x1a\\x17\\xaf\\xfau\\xe5\\x92\t>\\xa6wz\\xca_\\xac0\\xbfz*k\\xf0\\xa1b\\xb3t\\xeb\tv\\x9e\\xe8\\xa4\\x03\\xcf\\x95\\xfa\\x12\\xe5tgg\\xd7\\x99\\xa0r#\\x16\\xb9k-siy\\xd3\\xa1\\xd3\\xc3jz}z\\x1dy\\xc8z"
  580. },
  581. {
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!\\xfe\\x97\\xe6\\xc3\\x8e\\x18\\xe5\\x8f\\x8a\\x99c\\xc2\\xf33\\x1a\\x9da\\xe7>\\xbb3\n\\xdc\\x9c\\xd1ou\\x9c\\xa4\\xf5\\x06e\\xe3q0\\x80h\\xca\\xfd\\x8cax\\xd52\\x06\\xfbh>cj\\x9a\\xfc\\xae\\x1e\\xd2\\xd4,1a\\xe3\\xa7\\xe4\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89\\xe541\\xf6lb5\\xde\\xea\\xc47st\\xfa0\\xbd\\xf8\\xff\\xe4\\xfe\\x84\\x01\\xf4\\x06\\xfb]\\x891\\xc5\\xa8\\x07\\xe4\\xaee'\\xe7\\x8eu\\x08\\x87c\\xc4u<%\\x07#"
  583. },
  584. {
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\\xa2\\xd6r$\\xcd\\x12\\xb2\\xeb\\xa9ku\\x7f\\xdc\\xbd\\xd0\\x04\"\\xc8\\xd8h\\xbfd\\xe6n\\x87wl)\\xfd\\xe1\\x9c\\x82\\xe4\\xb6\\xf5\\xcc\\xcf\\xed\\xe5w\\+a\\xack&\\xa4\\x89t\\x863'\\xe1r&\\x98\\x1f\\xd2\\xffm\\x8f>\\xcd+\\x93\\x90f\\xb8t?\\xdbb\\x85,\\x12\\x1fqk\\xb7h\\x0fp+\\xdfb\\xd8\\x80\\xb5(5ws/\\xbe3r\\x84\\x8b\\xbe\r\\xba{\\x17\\x96\\x82\\x1eo\\x0cc\\x84\\xfb\r;\\xaep\\xff\\xceo\\xee}\\x0c\\x8bl\\xdd\n\\xc1\\xe9\\xc2\\xddv\\xb2\\xd5\\&`\\x98`\\x12\\xd5-o\\xe4\\x16\\x1f\\x8f\\x1e8\\xafi$:\\xeeoh*\\x0e>\\xd7\\xc2x\\xf3\\xc6\\xca\\xb1\\x92\\xedn\\xde\\xcaz\\xd7)\\xbc<\\x97'\\xb1k\\x06\\xe6\\x17\\xe4q\\xba\\x05\\x15\\xfd\\xab.\\x96:\\x05\\xbe\\x83\\x132\\xf1\\xb9$\\x8d\\x0bvj\\x83\\x8f2gq9\\x0ba\\x99\\x94\\x17\\x0c\\xcf\\xc1\\x01y\\x1d\\xa7\\xb8\\xf7\\xad\\xdb\\xcfva\\xba\t\\xa2#\\xdc\\xf6\\x03\\x8d\\x87c,\\x03\\xe5'\\x10\\x12\\xc5\\x0e\\x15'\\x82\\x18"
  586. },
  587. {
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(\\xe9\\xdc\\xef\\xda\\xb9i\\x8e\"o\\xf7p-\\xabl/~\\x83c/\\x16\\xf1\\x89}aw\\xf8\\xeat\ni\\x9fm%.\\x00\\x9c{\\x96\\x10>wf\\x9fz\\xd7\\x8bx\\xe5\\xc6\\xb3\\xfc\\xd6\\xfb\\xd5]|\\xfc\\x01\\x06\\xcf\\xa0\\x12\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n,\\xd4\\xea\\xdc\\xd4-\\xb0\\xff0+\\x94\\xe4\\xf3,\"\\xf7k\\xad\\x8d\\xb3.g\\xd9\\x8e2\\xe4\\xaa\\xde\\x00\\xa3xh\\xdf/\\x9bz\\xc1:\\xdc\\xf2\"}\\xf6{\\x169\\xa1"
  589. },
  590. {
  591. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010z0n\\xf8`\\x1a\\x1a\\x97\\xf4\\x9cq3q\\xad]\n\\xdd\\xa3\\x91;\\xbff\\x88\\xf6c\\xae\\xb7{\\x10y5m\\x89\\xd8$%-\\xa8\\x90\\xe5\\xeb\\x01\\x01=\\xd6\\xa7*\\xae\\x1f\\xaf\\xb3\\xa0\\x95m\\x8c,;[\\xa6\\xc8zw\\x06\\xe20\\x98\n\\xca\\xc7\\xf5d\\x07\\x915\\xb40+\\xdfp\\xf2\\x99\\x9ee\\x8cm\\xe6=o\\x85(\\x10\\xc9\\x0b\\xf729\\x18\\xde\\xae,\\xbb,\\x82\\x0c{\\xa4\\xd6\\x06\\x9c\\xb8\\xf0\\xf0m\\xe6\\xf2\\xf7\\xf0#\nn\\xe5t\\xe2<\\x89b[\\x08\\xc9\\xfb\\xfa\\xb5\\x80\\xe5\\x97:n\\xbf=\\xbd\\xf9\\xc5\\xcd\\x8a\\xd3\\x1c\\x9b\\x8a\\xba\n@\\x16?\\xe9\\x05\\xa5\\xc9\\x19b\\xdb]\\x9e\\xf6\\xbdb\\xe6k\\xd9p\\x83\\x95\\x03\\xbc9\\xfb\\x99\\x07ug\\x0f=2\\xf8\\xdd)in/%~\\x85\\xb0<\\x8f\\x93\\xb1\\xfcd\\xa3\\xf8/\\xec\\xa9+\\xb3\\x886\\xe7>cj\\x18z\\xf4\\xe0\\xa1\\x0e\\xac\\x0c\\xdc\\x80\\xaf\\x9b\\xd9\\x06z\\xfbs\\xfa\\x9e\\xf5\\xcet\\x8e2\\x96mq\\xee\\x1a\\xa6\\x1c\\xdfy\\x11\\xd1\\xf7\\xc8\\x069\\x9d"
  592. },
  593. {
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xacj\\xa43\\xe9\\xf1}\\x12\\xf3\\x13\\x16\\x13\\xf5\\xab\\xb5\\xdb\\x87?\\xc2\\x0fo\\xf05\\xf0\\xd7x-\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  595. },
  596. {
  597. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x1d-\\x14\\xe0k\\x90\\xef\\xc8\\xc5\\xb8\\xb3\\xe6\\xd5\\xe5\\x8flj\\xe1!\\xeabjp|>j\\xb04\\x19\\x9d\\xca\\x82;\\x88|\\xd4c\\xfd\\x91\\x08-\\x08d\\x8bj\\x96\\x85-\\x9ab\\xde81\\xc0\\x91\\xad\\xd1\\xc5\\xe0\\x9e\\xc9\\x94\\x84\\xc8/p\\xe9h\\x84\\xed\\x89ebmx\\x96\\xa24\\xea\\xe7\n\\x1e\\xeb\\xc8~a6\\x03\\x9f\\x01g\\x17\\xb2`4\\xf9\\xfc\\xde\\xd5\\x97v\\x01\\x05\\xc5\\xf3b\\x1eb\\xa1[zd\\xcf\\xba\\xd8\\xa4nx\\x85o\\x13\\xda+\\xb2d\\x9f-a0\\x9e\\xa9\\x16\\x15\\xf6\\x05&e\\xca;m\\xd3&e\\xafu\\x84\\xae\\x82\\xbd\\xe3q\\xc9g|\\xe5\\x7f\\xce\\xe6s\\x1e\\xee\\x1c\\\\xc0{\\xf3o\\xff\\x01\\xd8\\x00\\\\xf7\\x8a\\xf0o\\xcc\\x86\\x0c\\x80\\xf2'\\xaba#\\xd8\\xba\\x84\\x80gu\\xec>.\\xc7\\xe6\\xf2_[dy\\x9e\\xa9o\\xa8\\x17\\x04\\x85\\xa1\\xfae\\xca\\x0e\\xf6\\x8f\\xeb\\xf7\\x10\\x08\\xab\\x13\\xb2s\\x06\\xc6\\xd7\\xb4\\xaa:\\x8fp\\xdettd5\\x1a7f\\xe0j\\xa9\\xd71o\t\\xe3m-\\x8a"
  598. },
  599. {
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xbb\\x0f|t\\xf2\\xb0\\xe4\\xff\\xe1\\xaa\\xef\\xadw\\xc3\\x1f\\x8a\\xe0]\\x98z\\x15r\\xf1e\\xa5\\xcd\\x9b\\xb0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  601. },
  602. {
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\"\\x17\\xa7\\xd2|\\xb22\\xc4m\\x8b\\xd5\\xaa\\x0ch\\x1b\\xc3\\x92\\x06\\x05t\\xab*\\x85\\xa0\\xc1\\x16\\xb0'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  604. },
  605. {
  606. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb#n\\x91\\x95\\x93\\xe9\\xa8\\x8b,\\xb5f~\\xe1\\x1b\\x13\\x93\\xd0\\xfa\\x85\t\\xc4foj\\xd7z\\xce\\x8b\\x10p\\xfc}p\\xf2_`\\xe7s\\xadt\\x11\\xbb:\\x18x\\xb1\\xe4\\xab\n\\x02\\x8co\\xd5\\xdd\\xcd\\x0f9av\\x87\\xe7\\x19\\x08\\xf0\t\\x1f7x)\\xe7\\xea\"~:k\\xd1\\x8ab\\x1em\\xa0\\xb2\\x90\\xd5\\x872w:\\xacs\\xf2\\x8c\\x88 \\x16\\xab\\xf3p-\\xfb\\xea$p\\xdeb\\xea'\\xcf\\xe5\\x99\\x1a\\xb0>\\xc4\\*\\x1d4\\xe9\\x96\\xbe\\x9c\\xf9dvf\\xb822kp\\xf7\\x19\\xdb\\xb3\\x9c\\x9cjhd\\xbe%j\\x8ed\\xc8b\\xf2o\\x1aw\\xc9\\xec\\x7f\\xf6\\xc8 \\xa9~\\x9fq;\\xcf\\x95\\xf5\\x11\\xee^\\xf5d\\xd9\\xcayq^\\xed[\\xba\\xe9\\xa9y\\x87b\\x07\\x87\\x1a[\\xc1t\\xc0\\xdfw\\x9bw(\\xb2 9\\x0f\\x1d\\x0em\\x05\\xda8\\xaa\\xf1\\x00\\xf7r=\\x00\\xbc\\xc2\\x84\\xf2\\x90\\xdfbl2o\\x91{\\x8e!\\xf4\\x12vv}\\xfc\\xdc`4\\x8b\\xc9]\\xfc\\xbag\\xe2\\x17\\x0f\\xe5w\\x81\\x01,\\x12"
  607. },
  608. {
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xee&}3sti\\xbc'\\xd2\\x9d\\x9b\\x11w\\xcf\\xbc\\xa3\t\\x16\\xc2b\\xe7\\x11s\\xce\\x12k4>\\xee\\x01u\\xcc)\\xd1`\\x05\\x07\\xe1\\x08\\xc9\\xe43\\x14\\xe6\\xa2-3\\xb0i\\x92w\\x07p\\xba=\\xa1\\x96\\x1a\\x1e\\xb0w/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\x08\"\"^\\x86\\xd0\\xd8\\xf7^.=\\xac\\x9f\\xf1\\xb2\\xf0qp\\xdd\\xba\\xfb\\x96h\\xa2o=\\xd4\t6_\\xca8\\xa0\\xd5u\\xab:\\xcd>@u\\xc29n\\xb6;\\xbb"
  610. },
  611. {
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85j@\tc9.\\x17\\xf2g\\xef\\x15\\xdao\\xd2\\xbc\\x0b\\x14q\\xe4\\xdf\\xf9\\xb7\\x19\\xe5\\xff\\xfaheh)w\\xa3\\xc1\\x8ct\\xaa\\xc5\\xea\\x86\\x19`r0w`9n\\x90l\\xe6sx\\xc6\\x97\\x99\\x1el\\xa8\\xd0\\x8e(=\\xd7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xb0\\x14\\xc3\\xf5f\\x15\\x03\\x93u\\xb6\\x07#ob\\xff\\x11]\\xe5n\\xc8\\x01\\x8c\\xa5\\xa3hj\\x1c\\x8b\\x1c\\xfb\\xf3 \\xe6\\x9c\\x13\\x01\\x87\\xf20s\\\\xd9\\x91\\xa5'j\r"
  613. },
  614. {
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\te\\xe5\\xbd\\x7f\\x12\\xd2\\x9er1\\x0et1\\xcf\\xf4\\xea>\\xfd:\\x89\\x1c\\x84h\n\\xfb\\xf3\\xb7\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  616. },
  617. {
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3kr\\xe5\\x8c#\\xfa\\xfe\\xa7c\\xce(\\xdd\\x02\\xb9\\xd7@>\\xb3\\xa9\\xc0r\\x16\\xdf\\xacm\\x81\\xe7l5\\xd3p\r\\x08\\xf0h$\\xae_\\x95m]&\\xf9\\xa8`\\xcao\\xc4&\\xce\\xfb\\xeco\\x9b&*\\xf9\\x1b\\x7f\\xc4k\\x88\\x1c'v2+eyil\\xd9\\xfc,\\x7fz\\x96\\xc6\\x80\\x80d^*\\x8a3\\xc3\\x12a\\xc8\\xe5\\x0e\\x0cl\\xc0\\x9c\\xbd\\x0e\\xa5&\\x04j\\xe0\\xab\\x86\\\\xcd\\xeew\\x8e\\xeb\\xb91!>\\x13\\x9f\\x85\\xb4\\xf9m\\x9bv \\xfa\\xbf\r\\x7f\\xe2\\xd6v\\xe7\\xfd\\xa0u\\x84n\\xe9v\\xafym'~\\n\\x03\\xda\\xe6z\\xf4y]\\x84r\\x95a\\xb9\\xe8\\xbeuz\\x82\\xc8e\\x1b\\x14\\x97\\xf4\\xcc\\xa0\\x17\\xb2\\x029hu\\xe8\\x81\\xac\\xbf\\xf7\\xb5\\xf0\\x10 \\xe1_\\xdbadq<n6\\xa5\\xadl\\xae\\xb4\\xcc\\x80?\\xf8\\xb8\\x1f\\x93\\x91t\\xa1\\xe3\\xa0\\xf1,w@\\xa2\\xde\\x83!\n\\x14a\\x05\\xb9\\x8d\\xfd7\\x0c\\xa1\\x8c\"z2\\xf0\\xad\\x93\\x14\\x15\\x14\\x98\\xe4\\x1a\\xde\\xf7\\xe2\\xa0\\x9e\\xa5\\xf6\\xfb"
  619. },
  620. {
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\xdcgar\\x88\n\\xa99\\xf9\\xf5\\xd0\\xe6&\\xc3\\xa5\\xc5e\\xcbx\\x8f\\xa8#\\xc4xm[d2\\xfav\\x9a.\\xa4\\xde!c=kv\\xd1=9\\xd2%\"\\x8ci\\xb1ppl#\\xe3\\xaf\\x1b1\\xcc\\xf8\\x8c!y\\x9a\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5s\\x8e\\xd5\\xaa\\x0b\\x85i\\xfa\\xfa\\x8fm\\x1b\\x87-&`e\\xd04e%3\\x91$\\x1a\\xd1\\x9cq\\x14\\xa5\\x9c\\xb2\\x99\\x8b\\xbb\"\\x07\\xe1\\xd2\\xdd8\\x05\\x9f\\xa8\\xb9-\\xcb"
  622. },
  623. {
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xfb-\\xf4t;s\\x8cp\\x8c\\x8b\\xcb\\x019\\xc7\\x18\\x16\\x88\\xcfq\\xb7\"y\\xb5$\\x88\\xe5\\x06s\\xf5e\\xd6\\xa5r\\xbd\\xdd\\x8e{;\\xed\\xb1\\xfdv\\x8f\\xff\\x9a\\x92\\xde\\x8b@\\xb06\\xcby\\xa3\\x8a\\x1ev/\\x04u3\\x85\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000da\\x82\\xed{\\xa0\\x17p\\;f\\x03\\xc7\\xde\\xb0c\\x95g\\x19h\\xfb\\xba+l+\\xf3\\x9f]\\x89\\x88\\x9f\\xb8s\\x89^r\\xa3:\\xd2#\\x0f\\xab\\xcb\\xbe\\xae\\xf5\\x15\\xf6"
  625. },
  626. {
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\r\\x11%\\x91\\x9a\\x9b\\x1c\\x057\\x17\\x8c\\xba\\x93va\\xfd\\x84\\xe8\\x8e-\\xc4\\xad\\xd1\\xa1\\x0c\\x08\\xb3\\xc9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  628. },
  629. {
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w~]r\\x9dg\\x88\\x9b\\x96ehx:\\xf1\\xc5\\xdd\\xcf\\x06\\x93\r\\x8d}\\xd6x\\x1c\\x1ax\\xd4c\\x9f\nd\\x19\\x83xe\\x1c\\x9c\\x91d\\xd7\\x08\\xce&z\\x8da\\xd8\\xa7~\\xae\\xbd\\x04\\x1bf\\xaf\\x15z\\xca\\xeb\\xff\\xa1\\x02\\xb8\\xfa\\xe3\\xec\\x8dw:2\\x7f\\xc9\\xb5\\xb7\\x06\\xa2de\\xbe\\xce\\x9b!:\\xeen=\\xa7e\\x93l\\xc4\\x08\\x1c\\xc5i\\x11h\\x02\\xdau\\x99nu\r\\x9f\\x86\\xa0sw\\xef\\xb7\\x0eh0\\x1bnt\\xa4<\\xda*\\x9f\\xc2\\x08x,}\\xc1r\\xa7\"2\\xe2\\xa6\\x13.\\x92\\xc6\\xd4\\xc9\\x1ed1\\x935\\x06\\xee\\x94\\x96\\xaao\\x88:\\xb2pc\\x07,\\xbe\\xca\\xef\\xac\\xd3\\xab%\\xb0\\x0e\"\\xb1a\\x04lf\\x06\\xfaz\\x9d\\xe5\\x15h\\xe0vgbr\\xbd\\xc7rg\\xea\\xf5\\x01\\xb3qtk\\xdb\\xc0t{^z\\xf9\\xb6niu\\xda\\xc7\\x1a\\x1f\\xb8\\xa6\\xc1\\xec\\xd1\\x8av{u\\x9f\\xa8\n\\xaaw2\rp\\xfd\\x99%\\x02\\xc8m\\x06\\x99x\\x96xt\\x01\\x1f\\xfbcj\\xc5\\xcc\\x9fr6"
  631. },
  632. {
  633. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\q\\xdc(\\x9a8q\\xfb\\x9cx/\\xdc\\xc74\\x82\\xcd+\\x9e\\xbe\\xe8qr=\\xbc\t\\xa3\\xf1\\xdc\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  634. },
  635. {
  636. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\xbb\\xa1h\\xd1\\x153\\x89m\\xb4\\xd5\\x86\\xe5\\x91\\xfd\\xd1y\\x83\\xb4@bm\"+\\x86\\xc60\\x16)\\x84\\xbap?\\xc5e\\xef\\xac}\\xd0\\xfe\\xe9\\xfa\\x83\\xad\\xae\\xa5\\xfb86\\xf0\\xf0w\\x13\\x15\\xf2\\x18\\xe4a@\\xd2n\\xdao\\xb8\t\\x1f\\x1f\\xc6z\\xee=\\xa8\\xedw\\x07\\xc2x9\\xbf\\xb8\\xe8hy|s\\xb5zl\\x10\\xe9\\xd5\\x07\\xe0t\\xa4\\xb08l\\x02i\\xed\\xfb\\x10o\\x0ej\\x85\\xcc\\xf3\\xb9\\xe9\\xfc-\\x16\\xc3\\x04q>iar\\x0ct\\xc1\\xd3\\xdc=@v\\xc9\\x0e9\\xb6\\x8a\\xc0t&\\x9chn\\x99\\xc7\\x03\\xf8\\xd0\\xb2\\xb5\\x02\\xa5\\x9aw\\x12wv\\xfe\\x92\\xca@\\x00\\x01\\x02\\xd51\\x91\\x81\\xd6u\\x0b&\\xb1\\xa2\\xa3\\xa8\\xa6\\xa4d\\xa8!\\xf0_\\x02 \\xb0\\xdd\\x89\\xcd\\xad\\xda\\x8e\\xa5\\x9b\\xf8\\xd3\\xc1\\xce\\xd40b\\xce\\x9bg\\xcb\\xdf#_\\x0f\\x86\\x02\\xf4\\x05p\\x12o\\xe2\\xb3\\xe2\\xbe\\x9ffnl\\xbfx\\xa5md\\xcf\\xb0w5\\x82\r\\xb5\\x94\\x80\\xec\\x9fsm\\xcfw\\xcfd\\xc5\\xa3p\\xae\\x8b\\xd27#"
  637. },
  638. {
  639. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010gy\\xfbi \\x013\\xc4n\\xea\\xce\\xf4\\xfco\\x91\\x96\\x8e\\xfd\\xbf\\xa2\\xaa\\x06)x\\xeaz\\xf0\\x13q\\xdb\\x1d\\xcb\\xc6\\x94\\xe1r\\xcd6\\xd08\\xa4\\xe5\\xa0\\x1f\n\\xd4h\\xfd6y\\x96\\x93nj\"\\x82u\\xd1+e\\x00,?\\x1b:%\\xcf\\xca\\xa7`%b\\x0f\t\\x1b\\x1a\\xedd\\xde\\x85t\\x0b\\xff\\x8fyj\\x85\\xdf\\xfd\\xba\\xb6\\xf9\\x10y,y\\xd9k\\x13\\xfbk\\x12\\xc9b\\xbd\\x1az\\xa1j\\x03\\xa1}\\x9e\\xc1\r\\x19\\x06!\\x9c\\xd5\\x02\\x99\\x11\\x99\\xd5\\xc5\\xealp$\\x03\\x10q6\\xb4v\\xf9\\xba\\xe7k\\xd1\\xb4\\xfd#\\xb1v\\xdd%s\\x17\\x8b[\\x03\\xd5\\xad\\x06\\x8e\\x91\\xc0\\x0fz\\xa4\\xb3\\xb8s\\x11\\xe1\\x88\\xb1\\x1c'>\\x9c'\\x1cea\\x94\\xb5\\x0el\\xc4\\x1d,<\\xe0\\x1d\\x98\\x95\\x9dh\\xff\\xed\\x1d]\\x83\rn%hp\\x80k\\xf1e\"\\x141\\xdc\\x0b\\xdf|\\xee\\x90l\\xdc\\x97\\xb0\\xe9\\x04\\x03\\x0b\\x83\\x01_\\x14\\xf6$ \\xd9\\xef\\x101\\x124\\x13\\xe7f\\x16^n\\x17\\x1c\\x05\\xa7\\xcb*\\x87(\\xbc\\xc6"
  640. },
  641. {
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\x99'\\xc1k\\xe6\\x17j'\\xcf\\xf0l\\xb7\\xabj\\xa9\\x98\\xbe,\\x9d\\xcej\\x9a\\xb2\\x90\\x93(\\x88*k\\x13\\x9fc\\xcc\\xaeaf-s\t\\xaa(6\\x9e\\xd0\\x06n6\\x8d\\x10\\xaf\\xf8^\\x8f\\x03\\xb96n\\xe9\\x07f'\\xd58:-\\x1f/\\xf6\\x90\\xeb\\x01\\x1ai\\xf9\\xef\\xf5\\xb8y\\xa8\\x0cbi\\xa1x\\xc0_l\\xd3\r;\\xa8\\x9e\\x14\\xb34|\n1\\xab\\xf4\\xadb\\xd4\\xdac5\\xbb\\x96\\xa3\\x11\\xf1l\\xc3\\xa6u\\xff\\xeb\\xc2\\x1eef\\xe1\\xea\r\\xf2\\xdb\\xee9\\xf9k\\x7fh\\xed\\xccs\\x82\\xde\\x05h`\\xe0\\xfduz\\x0f\\x05\\xe3'\\x07\\x1e[w\\xe0a\\x9a\\xd6\\xc9\\xc9\\xbbr\\x95bv\\xe7\\xb0\\xdf\\xfe\\xd8\\x043\\xde\\x9b\\x0f\\x82u\\x07^0\\xf0\\x1cq\\x101\\x80~~\\xacjy\\x16}-8\\x05t\\x88eq\\x1f\\x9a\\xb0w\\x16\\x17\\x1c\\xba$\\xa8\\xf4t{\\x05){\\x1f\\xff\\xfc\\x98\\x85\\x89\\x1e\\xdb\\xfd<\\xd4\\x19\\xdf\\xfb\\x87\\xc6\\x97\\xdd$\\xc3\\x1dx#\\xdb?\\x88\\x06/\n\\xdb\\xb4_\\xfd$v\\xe0"
  643. },
  644. {
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa\\xd1(pd\\xcfa9,p\\x9b\\xaew\\xf3\\xfd\\x9d\\xf0t\\xae\\x7ff\\x12\\xd3\\x83\\x03t\\xe1\\x0b2\\xe3r\\xc9j^\\x93\\x9ffi\\xf8\\xea\\x81b#\\xb6>\\xd2)\\xa3/+z-x\\x89\\xc3\\xd3\\x8a\\xa7&\\x15\\x9a\\xed\\xec\\xae`]\\xf4\\xe4\\x15\\xa3\\xb3s\\x0elxk|dm4\\xfe\\xe5g\\xad\\xd7\\xee\\xcde\\x98\\x8e\\x97\\xf2\\xc1\\xb4\\x19\\x9dl\\xda\\x10:.>\\x97\\xac\\xb6<\\xf8c+\\xa8\\xdc)\\x8a2in\\x17\\xfc\\xf9\\x889@\\x82\\x1b\\xab\\x10b\\xf1}\\xb2\\xa7jy\\xb5;u\\xd8\\xf0+\\x86\\xe8c\\xf8\\xd7\\xd8\\x14qh\\xee\\xea\\xa4o\\xa9o\\x91\\xb7\\x1d\\xca*o\\x8a\\x1e\\x17\\x8a\\xe7\\x0ep\\xae7\\x16\\xda\\xa0\\xc6\\x83\\x88\\xe5\\xb27(d\\xdee\\xe2\\xec\\xa0\\x03$\\xf7\\xd3\\xbft\\xfc[\\x11\\xf7ga%mdvd\\x19\\xfd)\\xae\\x0e7x\\x91\\x93j\\xe8~\\x08\\xcb\\xcf\\xd6\\xd6t\rzh\\xfaz\\xa0facc\\xe2ngw\\xcf&\\x07\\xe3\\xc8a\\xd5x\\x7f\\xcd\\xb4m\\xe6\\xb1\\xe6\\x1c\\xb2"
  646. },
  647. {
  648. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\x9ec\\xbb\\x95\\xc6\\xf3bs#@r\\xce\\xce\\xa5\\xf6y\\xfdb`k\\xd3g\\xf5\\x14b\\x0f\\x02d,\\xef\\x9a+\\xe6:9\\xdc\\x91p\\xdekiz\\x18\\xf7\\xc9\\xc5d}?\\x9d@#69\\xeay\\xcf\\xbe\\x89\"f\\xc3\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\x91\\x08\\xbeh5ds\\xff\\,xc\\xa9\\xc4\\xbf\\xba/!\\x05\\xf0t\\xe7\\xca\\xf9\\xc9q\\x00\\xfec\\xcfv\\x98)\\xbe\\xa5[\\x1a\\xad#\\xeb\\xe23\\xd2q\\x18\\x80 "
  649. },
  650. {
  651. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaf\\\\xf2m\\xb4\\xf8\\x9e=~z\\xbc&\\xedh%q\\xf7w\\xabe'\\xf7\\x94e,u\\xf1n)\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  652. },
  653. {
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\xfd\\x1b\\xb2\\xad\\x07e\\x8d\\xbb\\x1f\\xa8w\\xaftep\\x1f\\xcb:\\xe8\\xc2\\xc3b\\x1b\\xd7\\x10^\\xbbgc\\x89\\xac\\xf1\\x97\\x13\\xf6ni\\xf5\\xc2$\\xf6a~\\x0cm\\x88;\\x1f\\xe7\\xd8n\\x8c\\xf3\\x9bqk\"\\2\\xae\\x81\\xdf\\x13ai#\\xa3\\xc9\\x00rd\\x1c\\x02\\xef$\\xf0.fm':\\xc1(f\\x86\\x1f\\xfb\\x16i\\xbd\\x04_\\x82\\xdc\\xe4s\\xfe \\x1d\\xa9\\x89q:\\x87\\x04\\xa3 \\xe8\\x94\t\\xcc\n\\x05!k?h\\xc3\\xa7\\x08\\xcf\\xf7\\xf1g\\x80\\xb0y\\xae\\xdc8\\x01\\x8e\\xf6\\x14#\\x8b\\xb7\\x8b\\xd9pn\\xfd_\\x1b\\xca\\x13\\x13\\xaaj\\x8e\\x19\\xecf\\xae\\x9cm \\xae\\xb1lx\\xfer\\x06\\xd0\\xf8i\\xf3\\xee\\x1b\\xa1\\xcdg\\x0525\\x0e\\xb0\\x86)u-\\xd1\\x86\\x9f\\xe6\\xb9\\xb1\\x1b&\\xf7\\xdf\\x82\\xef\\xca}6g\\x00\\x9dd\\x8e\\xe2*\\xa0\\x83\\xe6\\xceq%\\xc1b\\xe3n\\xb3\\x19a\\xf0\\x93\\x12t<\\xec\\x05\\xddh\\xe0\\xc5^\\xcb@\\x1ec\\xcd\\xf8\\x88\\x9b\\x80\\xe6\\x93\\xe0\\xad\\\\xa8:#\\x19\\x98\\x0f\\xbd"
  655. },
  656. {
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0c\\x85(\\x96i\\xbe\\xdd\\x01\\x1a<\\xfa\\xc9\\x9ev\\x85\\x06g\\xe5by\\xe1\\x8c6\\x08\\x9br4\\x86\\xf2\\xdbh\\xdc\\xb3\\x87\\x81\\xa5\\x88\\x7f\\x8d\\xba\\xf2\"\\x11[\\x84\\xeal\\xfc\\x954x\\xe2v\\x85wh\\xff\\xb2\\\\xc5\\x19\\xd0\\xe5\\xd0\\x93\\xb10\\xb5\\x16\\xea\\xc4\\x18a\\xc12\\xcd\\x99\\xa7\\xb9\\xc59\\xfc\\xcf.h\\x1f6\r1[\\x19\\xc3k\\xce\\x84\\xb5\\xb4\\x14\\xd3\\xe5\\xc6\\x97\\xc9\\x1bx{\\xa1\\x1a\\xe1\\x8c\\xd9\\xbe\\xa4\\xcb\\xa5f3\\xaa\\xb6o\\x158&\\x84){\\x8e\\x06x\\x81)\\x9a\\x17\\x03j#8\\xe6\\x89\\xb1@\\x8dv:\\x15\\xf8\\x11\\x93\\x1c\\xc0\\xe0d\\xbd\\xc6\\xa5\\x01\\x13\\xe9\\xc4p#*28\\xbb\\x9da\\xdc\\x03<o\"\\x99i\\xd2\\xc0\\xf332\\x92\\x8c\\xd9\\x81\n\\x92,]\\x9e\\x0c\\xcc\\xca\\xc1\\xca\\xbf\\x07\\xd6\\x96\\x88c\\xf3\\xdf\\xbc\\x82\\xa0\\xbbq$k\\xc1|\\x11\\x1b2rf@\\x0f\\xd8\\xdf\\xb4\\x0b\\x13.\\xd2\\x16\\xab\\x14\\x1c\\x17\\xe3\\x19\\xecb j\\x9f\\x03\\xafz\\xe4\\x93\\xf6\\x8f\\xf20\\xc1\\x9fy\\xcf\\xca"
  658. },
  659. {
  660. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x0c\\x15nx\\xec\\xcdh\\xb4\\x10\\xbe;\\xa54\\x89'77\\x12uk\\x85\\xb4c\\xf2\\x84\\xef\\x14.\\xc0kg\\xce\\xf2{y\\x92\r\\x80\\x81\\xd5cb\\xa6\\x90\\xfe\\xf2\\x86\\xd0\\xa6\\x04p\\xe0oybsa\\xd0\\xba\\x9cy\\xc3\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000kc\r\\xc6\\x19\\x9f\\x1b\\xd5\\x9c\\xe0\\x87&r\\xe5\\xf7\\xc8$\r\\xd5\\xc0\\x8cz\\x1d^\\x1c/\\xda\\xd3\\xafv\\x80\\xcc\n,\\xf9p\\x14l7\\xf9\\x9f\\xb9\\x16\\x06\\xe8j\\x9a\\xac"
  661. },
  662. {
  663. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$\\xc3\\x8d\\xf6\\xef\\xff=\twf\\xdb\\x08\\x16\\x8cxd\\x1a\\xb2c\\xdc\\xc0\\x18]\\x1e\\x88:\\xda~\\xbem\\x97\\x1e!\\xf8\\x10\\xef\\xd9\\xa1\\x02u\\x05w\\xa1w\\x9d\\xc4\\xa2\\x80r\\xb2g4{a\\x022\\xa4\\xb2\\x94b\\x15\\xd2\\x84\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000i\\xf2\\xe0\\xbe\\x86z\\xa4\\xfa\\x03\\xca\\xa3\\x13x\\xf3\\xef\\xc0?\\xca\\x9f\\xf3\\xb5\\xd8\\xd5&\\xa3\\x10\\x88\\x08\\xd3\\xd4f\\x08\\x01\\x1f\\x1e\\xbc\\xb8%\\x82\\xa7\\xd0\\xcc\\xed\\xb6\\x9b(\\xb7x"
  664. },
  665. {
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c.\\xab\\x98\\xb0\\xdf\\xee\\xfc\\xb9`2b\\xa4\\xdf)m3\\xcf[?,\\xcb\\xf7-\\x8db&\\xc3>\\xdd\\x8e\\x86t\\xea\\xc9\\x8fr\\xf9*w\\xa3\\x99\\xae*\\xf6\\x81}\\x1f}\\xc7\\xc2\\xc3\\xda\\xa8v\\xf0\\x7f[&]\"nv\\xf9\\xfc\\xc1f{\\x84\\x81\\x92\\x12\\xbc\\xfa\\x1f\\x00\\xa2?\\xb5\\xc4'\\xec\\x0c\\xacbk\\x1a\\xf0\\xbf\\x93\\xb8\\xf2y\\xdav\\xec4\\xe1y\\xean\\xc5\\xbe\\x9c\\xab\\x9f\\xa2\\xda\\xdf2<\\x1bg~\\x81\\xcd\\xf2\\xe7\\xd34\\xe2\\x82\\xaa\\x0eh\\xccl\\x8fm\\xe9\\xa57\\xa0\n\\xd2izp\\xcb\\xbf<\\xa10d\\xde\\xe7q\\xf1\\x11\\xdc\\xd8\\x82\\xac\\xe5\\x1f\\xb1kn\\x05\\xe61\\xd3\\xfb\\xac\\x0b\\xea\\xf9\\xb3\\x1a{3\\xbbm5\\xa3\\xecbq\\xba\\xbb*\r\"q$\\xe3\\x87uym)\\xe4\\xb1[m\\x06]\\x91\\x94\\xdc\\x8e\\xbfs\\xa4\\x1a\\x01$\\xbf\\x9a\\x1d\\xac\\xda\\xceq\\x9fjsn\\xe1\\xd9\\xc9a}}\\xf1\\x86\\x90>j\\xc2\\x0ba\\x17?\\xd0\\x9f\\xcb\\x1d-\\x7f\\xd9\\x0b\\xbb\\xb0\\x82>\\xe6\\xcb\\x04\\xbc\\x05"
  667. },
  668. {
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\xf5~=\\xe6\\x91\\xda9\\xb2j\\xa22\\xbf8\\x14@\\x0b\\x95\\xa5\\x839b\\xb0~\\xb1}4\\xa1\\x81\\x86\\x8bg\\x89\\xdc8rm\\xc2x\\xb32%we\\x94\\xea\\xc2\\x88\\xae\\x80\\x08\\x148\\xda\\xb8\\x04\\xd2l\\xb1m`\\x93\\xad\\x10[\\xbd\\x8a\\xb6\\xf1\\xf4\\xd3o\\x9d0\\xe4\\xdb\\x96%\\xce\\xea\\x8b\\x9f\\x14\\x0b<\\xe9px\\xfb\\xcag\\x81y\\xca}v\n\\xee\\xd0r\\xf7.\\xdf\\x01.'\\x1b\\x1f\\xe8\\x9ej\\x0b\\x17\\xc8v\\x95?\\x90\\x1f\\xdcp\\xcar\\x85\\xecr\\xec\\xbf\\x8e\\xf6\\xe5\\xdb\\x92\\xc0\\x9cc\\xb8\\xb7\\xb9\\xcc\\xde\\xbe\\xedu\\xc80a\\xe5\\x19uz1+\\xe2p\\xfd\\xc9i_\\x0c\\xae\\x08\\xbdd\\xe3\\x84\\x97\\xbb\\xecs\\x8c7\\x17/@\ru?zo]\\x01v\\xcd\\xb0:\\x13c$u\\x8a31h]\\x0b\\x8eq<@\\xbfdw\\x12\\xaf\\xfe[\\x9dz!\\xc5\\xdf.\\x9bx\\xcd p\\xb9gn\\xdbw\\xb2\\xb5hu\\xf5s\\x9e\\xb7\\\\xdb\\xbe\\x0bahga\\x1f\\x1e'5~\ts\\x91\\x9ao\\x90:"
  670. },
  671. {
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\x04<\\xd0\\xb35z\\xcd\\xc4+\\xdbs\\x14#\\xe3`\\x8c\\xab\\xe9r\\xdd\\x80r\\xd1\\x149\\xfd?g\\x95\\xfd\\xf32\\xb0\\x1a\"\\x11-\\xd6\\xcblj\\x8f\\xed\\x81\\x8c\\x1e\\x17\\x171\\x91j\\x06\\x03na=fw\\xfb\\xfb{\\x82\\x9a\\xac\\x17\\x1ar\\xeev\\x98\\x9d\\xb7wx l\\x1d\\x07\\xc9b$\\xf9\\xeb\\x1d\\x93\\x01/\\x96\\xc9\\xc9\\x05 \\xd6\\xd5<izg\\xaeab\\xeab\n\\xc7.k\\xa7\\xca\\xd7\\xe4\\xd6\t2\\xb5/\\x01\\xef-\\x16j\\xef\\xbb\\x0b\\xc5\\x1e\\xc9l\\x9a\\xa0\\x08@\\x12\\xca\\x13\\xaa\\xf7g\\x8d\\x86\\xb06@z\\x1e~\\x86\\x89\\xc1g\\xb9gb\\x9a\\xbf\\xf5\\xe7a\\x97(\\x8e$\\x15\\xbd\\xd4\\xb3\\xa4\\x95\\x07w\\x02\\x14d\\x93l\\x1b\\xabb\\x02\\xa8\\xcblt\\x99m\\xd4v\\x16\\x8akl}\\xef\\x1dv\\xf9%7\\xd0\\x90\\xb8\\x10q\\x08\\x94\\xf7y\\xec\\xd2%\\xa4\\x18\\xc4\\xdc!\\x17\\x85\\xdf\\x8e\\x06\\x8b\\xf7\\xd2$\\xb7\\xb9m\\xd1\\x91\\xd3\\x04c\\x15uv:\\x11\\xc5x\\xfb\\xb8\\x9b\\xc2\\xd2\\xb4\\x92|<\\x1di"
  673. },
  674. {
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91\\x00\\xcb2\\xa3+\\xd5\\x86\\xa7\\xf5\\xf8\\x04\\xe5\\xb2\\x01\\xb9\\x97\\xf6e\\xf9\\x1f\\xd6\\xc0e\\x84\\xc8\\xdf\\xed\\xe0\\x91\\x8fi1!qn\\x8e\\xf1\\x96g\\x13@\\x14\\xe41\\xa2\\xb5e'\\x12x\\xa5\\x12\\xffx\\x88\\xf0d\\xd5`)\\xf3\\x8b\\xa7\\xd89\\x8c]\\xca^\\x95\\xd5/\\xbb\\xb0\\xa7\\x97\\xfc\tj\\xa4^!\\x9f\\xad\\xccw\\xdbww\\x06\\x82\\xf7\\xad\\x173\\x1d\\xaf~{\\x85m\\xe7\\xa3\\xeej\\x12kg\\xe9\\x8e\\xa4\\xe9\\xcc\\xda\\\\xe3:}2\\xe0\\xec\\xed>\\xc8\\xd8y\\x15y&2\\x88\\x83\\x08\\x9b\\xe7\\x83\\xack?\\x16\\xfb4\\x8by\\x92\\xbe\\xeav\\x9b\\x90`%\\xe6\\xabm\\x91\\xde\\xaf\\xa2\\xfe\\xdcryq5mx\\xaeq(\\xa0\\x946l\\x02\\xcb&\\xdc\\xa4\\xe1\\x82o\\xd1\\x8e\\xa6v\\xad\\xe0\\xfd\\x84\\xa9\\x7fm\\xce\\x8e\\x84\\xd1v,\\x82\\x87g\\xa3\\xc4\\x91\\xa1\n\\xfe\\x81\\x04\\xc2\\x03k\\xa7\\x91m\\xc0\\xf1.b\\x08bw\\xfe\\xd3\\x92\\xac\\xa7(r\\x8e\\xff\r\\x11b\\xdd`\\xed0\\xa1\\x0b\\x92\\x1bn\\x9a2\\xea\\x8b\\xe5\\xdb"
  676. },
  677. {
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5q9\\xe5~\\x16-l\\xf0\\xf7\\xb1\\xd7v\\xabv\\x9f\na\\xa3\\xe7\\xc3\\xfe\\xfc\\x8a\\x8doy1\\x1e\\x1eq\\xa5b-\\xc1\\xfb\\x842\\xf2\\xd2b\\x86:_\\xea\\xc3\\xabb?\\xe5m\\xa3\\x0b\\x91\\x8f\\x9a<\\xd5\\xbe\\x01\\xa5m\\x96\\x8c\\xf0\\xcao\\xec\\xed\\x19\\xf1\\xa9v\\x02\\xca\\x8d\\x9e\\xe6f4ow\\x84\\xfc@#vo\\x16\\xfa[\\x9a\\x15u\\x17\\xd9ge\\xa9\\xe6e\\x05p\\x94\\xfd\\xbb\\xc2\\x88\\xbadl\\xf5\\xab\\x1br\\x16\\xaeh\\xf6q\\x05\\x92\\xf0\\xe3\\xabn\\xca\\x9a\\xde^p\t\\xa3`\\xac*3\\xe6\\xb5\\xfc\\xd6\\xf4v\\x1a\\xd8\\xa3\\x98k\\xae\\xc7v\\xb4\\xef\\xfd\\x90\\xdb\\xa9\\xbes\\x05\\xf8s3\\xb7`\\xe6;\\xb9#\\xf0~\\x0c?]wl\\xa4\\xc9\\xee\\xf3\\xe6.\\xd0\\x13t\\xb0\\x89\\xa9\\xed\\xdf\\xe10\\xd9d\\xc8\\xa7 /&\\xf6y6\\x01t#\\xd1j\\xf9%\\x07*\\x95!;\\xf9\\x9d\\xc7t\\xa9\\xef\\x94:\\xa6\\x83\\xaf\\x9b\\x8f\\xb3\\x83\\xa0l\\xedcg\\x95\\x13\\xcf\\x12\\xe5\\x9b\\x8a\\xe1\\xe2s\\xce7a\\xef\\\\xb1o"
  679. },
  680. {
  681. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x01\\xafaph\\x8b(\\xbe\\x00\\xb3xq\\xb1\\x88{*;p|\\x19\\x1a&gd\\xd8\\xb8\\x9d\\xa0\\xc7l\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  682. },
  683. {
  684. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00|8\\x90c,7\\x0cee\\xe5\\xaem\\xd6\\xfa\\x12\\xfb#@\\xc1\\x1e\\x9a\\xd2\\x0cq\\x9f\\x8c\\xc5\\xb70jk\\xcc\\x9cp\\xa8e\\x13~:j\\xa9\\x8bh\\x07\\xd7e;*\\x02\\xadas\\xd9o\\x1a\\x00\\x9dj\\x8d8\\xd8g=+\\xc6\\xf2;\\xc2\\x88+\\xf3s\\xf0\\x83^\\x99\\xaa\\xe4\\xe0\\xea\\x0c\\x8a\\x1e2j@\\xce\\x0fk\\xf5\\x16\\x1e\\xd4\\xfd\\x19\\xc7\\xe2\\xc2c^z\\xa3]w\\xcez\\xdc\\x9azd\\x809r\\x94\\x1a\\xd1\\xde\\xc4)\\xeb\\xe7\\xa87,r\\x10\\xd7\\xcey\\x17m\\x83\\x11\\xbd]f\\x11n\\x8bt\\xce\\x11\\x80\\xdbw\\xc3\\xa7\\xc6y\\xe8\\xb1j\\x92\\x1e\\xa7\\xb3\\x0f\\xc6\\xb4ng#\\x0c3$>b4%\\xcc\\x80.\\xbce\\x1a:\\xad\\x01\\xea\\x00b)\\xfa\\xffq\\x06\\x14+\\x9a\\xbd\\xdc\\xe9e\\xd5\\xd7\\x8f\\x88\n\\xbc\\xdf\\x1es\\xb1\\x08~\\x04?\\x86\\x0e\\xa2\\x9f1\\xf0\\x05\\xb2\\xdf0p\\xfd4,\\xc2*]l\\xcfq\\xd6\\xa7sd\\xd0\\xb1\\xeb\\x9a\\x021~\\xcdp{\\xeb7\\xc7\\x15"
  685. },
  686. {
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x07\\xf3&\\x99\\x04\\x14l\\x0f\\xd3\\xdc\\x89\\xb6\\xa2\\x8f2\\x9e\\x05hyv\\xfb\\x08\\xeb\\xd2\\x04\\xbf\\xbb\\x01\\x83a\\xf5\\x1b~\\xea\\xe5\\x84\\xb8\\xe3<\\xa9q\\x9f\\xd5\\x023h\\xecke\\x7f\\xd4j\\xc1\\xa8.dj\\x92\\xc1\\xe2\\xa3\\x05\\x1d\\xbb\\x98\\x15\\x9b\\xad\\xbcg\\xa3\\xc5\\xa4\\xb8`g\\x85jqn\\x9d\\xe6\\x94\\xfd)w<\\xf8\\xfc?\\xb2\\xfecz\\x9ak\\x11r\\x12\\xb9\\x9f\\xfclg1v\\xc8o\\xe0\\xfbiu@l\\x00[lsp\\x8a\\x8dt\n\\xda=?w\\x88\\x84\\xa2\\xc2\\xdd\\x04\\xbe\\xd1\\xe0z\\xb3\\x9b\\x84\"\\xd6\\xb7\\xa7\\xc3\\xc9n\\xce$\\xb7\\xe7\\xa0\\xa0\\x99\\xe0$\\x18\\x9dz\t\\xc8\\x063\\xfbcv\\x88\\xf15\\x87\\xc3\\\\xe1q\\xfc\\xd6\\xa1i>\\xb8\\6\\xc09alk(_\\xd1=5\r\\xdd<\\xb6\\xc9\\xdcl\\xb5\\xe9\\xe7m\\xe7v\\x93\\xc8u8hwb\\x1b'\\x99\\x86\\x1e\\xc70\\xec.\\xce0\\xf6a\\x0e\\xect\\xb3m!\\xc2,k\\xcef\\x1f?\\x10v\r\\xfe\\xc3:\\x9b{\\x7f\\xd1\\xfb9p"
  688. },
  689. {
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x1ab\\xb1qn*\\x0b\\x96\\x9e\\x96u\\xce\\x9d\\x85\\xa5\\xda\\xa4\\x9cw\\x8a\\x96-\\xcb\\x9b=\\xeb\\xa1y\\xd9\\x92\\x06\\x02\\x7f\\xce\\xc9 \\xad\\xef9\\x84\\xe3j\\xe4y\\x90~w\\x9e\\xd9\\x7f\\xd2\\x9by\\xdf\\xc2\\x8fk{2\\x8d\\x10s\\x1d5\\xd5\\xd4\\xb7g\\x00\\xabx\\x854l:\\xf9$-<l\\xaa\\xe0#\\x90\\xa8\\xe0\\xef\\xd0\\xec\\xd3\\xb2$w,\\x9c\\x91\\xb1\\x08\\xed\\x82\\xf7[\\xc6\\x1b\\x1c\\xed\\xac*\\xd9l\\x9b\\x90h\\xacy&\\xc8j\\xdbz\\xdf\\x9d\\xd2\\x08\\x98n\\xe0\\x08\\xcf8\\xc6\\x84f\\xe5\\x0e\\xa3\\xde\\xfdjy\\xfe\\xd9\\xd1\\xb9@\\xe7\\xb2\\xb5\\xed\\xca\\xf1\\xef\\xa5\\xe6l\\xcd\\xd7\\x1bc\\xe6\\xed\\xe9\\xdc\\x19\\xd0\\xc8\\xc5\\x02\\xf0\\xa0\\xb7in\\xd77\\x7f\\xd3\\x83\\xaf\\xcatb\\xca\\x03\\xf9\\xacw\\xa9v\\xcc\\xcc6\\x865}_t\\x01\\x0b\\xc6,\\x05\\xa4\\xaf\\x80\\xdd<\\xc6[2\\x7f\\xc7\\xb5zps\\xce\\xd5\\xe2\\x98\\xe8\\xbd\\x04\\xc6ov\\xd9a\\xf7ur\\xa6\\xb7\\xdam\\xd7g\\xc8v\\\\x9c\\x88\\x0c\\xb5\\xb5\\xeao\\xa7f'x"
  691. }
  692. ]
  693. },
  694. {
  695. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  696. "Details": [
  697. {
  698. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  699. },
  700. {
  701. "FireEye": "Exploit.RTF-OLE.Gen"
  702. },
  703. {
  704. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  705. },
  706. {
  707. "McAfee": "Exploit-CVE2017-11882.yx"
  708. },
  709. {
  710. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  711. },
  712. {
  713. "NANO-Antivirus": "Exploit.Rtf.Heuristic-rtf.dinbqn"
  714. },
  715. {
  716. "Symantec": "Bloodhound.RTF.12"
  717. },
  718. {
  719. "Avast": "Win32:ShellCode [Expl]"
  720. },
  721. {
  722. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  723. },
  724. {
  725. "BitDefender": "Exploit.RTF-OLE.Gen"
  726. },
  727. {
  728. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  729. },
  730. {
  731. "Emsisoft": "Exploit.RTF-OLE.Gen (B)"
  732. },
  733. {
  734. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  735. },
  736. {
  737. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  738. },
  739. {
  740. "TrendMicro": "HEUR_RTFMALFORM"
  741. },
  742. {
  743. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  744. },
  745. {
  746. "Sophos": "Troj/RtfExp-EQ"
  747. },
  748. {
  749. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  750. },
  751. {
  752. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.C"
  753. },
  754. {
  755. "MAX": "malware (ai score=80)"
  756. },
  757. {
  758. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  759. },
  760. {
  761. "GData": "Exploit.CVE-2017-11882.Gen"
  762. },
  763. {
  764. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  765. },
  766. {
  767. "ALYac": "Exploit.CVE-2017-11882.Gen"
  768. },
  769. {
  770. "Zoner": "Probably RTFObfuscationD"
  771. },
  772. {
  773. "AVG": "Win32:ShellCode [Expl]"
  774. },
  775. {
  776. "Qihoo-360": "virus.exp.21711882.d"
  777. }
  778. ]
  779. }
  780. ]
  781.  
  782. [*] Started Service: [
  783. "osppsvc"
  784. ]
  785.  
  786. [*] Executed Commands: []
  787.  
  788. [*] Mutexes: [
  789. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  790. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  791. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  792. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  793. "CicLoadWinStaWinSta0",
  794. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  795. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  796. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  797. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  798. ]
  799.  
  800. [*] Modified Files: [
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\Purchase.doc.2",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc.2",
  803. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  804. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{A044B261-7747-41A9-89CF-F39CE8E0CCAB}.tmp",
  805. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  806. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  807. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  808. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24A6.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24A7.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{54A015A6-FA9C-4893-9949-2288EF4E836D}.tmp",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F56.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F86.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F87.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F98.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FA8.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FA9.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAA.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAB.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBC.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FCC.tmp",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FED.tmp",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FEE.tmp",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\cab301E.tmp",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\cab302F.tmp",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\cab302E.tmp",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\cab304F.tmp",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3062.tmp",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3061.tmp",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3050.tmp",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\cab30FF.tmp",
  833. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  834. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31AC.tmp",
  836. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  837. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3372.tmp",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3374.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3373.tmp",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3386.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3375.tmp",
  843. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  844. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3405.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar33B6.tmp",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3483.tmp\\chicago.xsl",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3484.tmp\\BracketList.glox",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A4.tmp\\mlaseventheditionofficeonline.xsl",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3483.tmp\\Content.inf",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34C4.tmp\\chevronaccent.glox",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3484.tmp\\Content.inf",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A4.tmp\\Content.inf",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34C4.tmp\\Content.inf",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3525.tmp\\Banded.thmx",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3524.tmp\\gostname.xsl",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3504.tmp\\iso690.xsl",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3524.tmp\\Content.inf",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3525.tmp\\content.inf",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F1.tmp\\content.inf",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3504.tmp\\Content.inf",
  863. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36EC.tmp",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F1.tmp\\Wood_Type.thmx",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cab373C.tmp",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370D.tmp\\Equations.dotx",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cab375E.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD375D.tmp\\turabian.xsl",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379E.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370D.tmp\\Content.inf",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD377E.tmp\\gosttitle.xsl",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379F.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD377E.tmp\\Content.inf",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab387C.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD375D.tmp\\Content.inf",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD384C.tmp\\HexagonRadial.glox",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD384C.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A05.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3987.tmp\\architecture.glox",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A34.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A45.tmp",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A65.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AB5.tmp",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3987.tmp\\Content.inf",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A76.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AD7.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AD6.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B64.tmp\\ieee2006officeonline.xsl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C71.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B64.tmp\\Content.inf",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C72.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B85.tmp\\sist02.xsl",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C12.tmp\\TabList.glox",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CD1.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C12.tmp\\Content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D42.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D31.tmp\\iso690nmerical.xsl",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF2.tmp\\rings.glox",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B85.tmp\\Content.inf",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF1.tmp\\APASixthEditionOfficeOnline.xsl",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D31.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3DEF.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF2.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E7F.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E00.tmp\\InterconnectedBlockProcess.glox",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E10.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF1.tmp\\Content.inf",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E00.tmp\\Content.inf",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E80.tmp\\Element design set.dotx",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FCC.tmp",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E10.tmp\\Content.inf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F0E.tmp\\ThemePictureGrid.glox",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E80.tmp\\Content.inf",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FDC.tmp\\content.inf",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F2E.tmp\\pictureorgchart.glox",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EEE.tmp\\TabbedArc.glox",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F0E.tmp\\Content.inf",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\cab406A.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FDC.tmp\\Frame.thmx",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F2E.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EEE.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4118.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\content.inf",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\View.thmx",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41E7.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4128.tmp\\ThemePictureAccent.glox",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD414A.tmp\\RadialPictureList.glox",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4128.tmp\\Content.inf",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41F8.tmp\\Headlines.thmx",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4139.tmp\\PictureFrame.glox",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4227.tmp\\content.inf",
  948. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42B5.tmp",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD414A.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4227.tmp\\Dividend.thmx",
  953. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4139.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4381.tmp",
  956. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4392.tmp",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  960. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cab448F.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41F8.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44C0.tmp\\VaryingWidthList.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44E0.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449F.tmp\\content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD447E.tmp\\Badge.thmx",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44C0.tmp\\Content.inf",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449F.tmp\\Parallax.thmx",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43C2.tmp\\content.inf",
  971. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  972. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43C2.tmp\\Metropolitan.thmx",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD454E.tmp\\ThemePictureAlternatingAccent.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD45CC.tmp\\Berlin.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD447E.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD454E.tmp\\Content.inf",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C1.tmp\\content.inf",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C1.tmp\\Savon.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD45CC.tmp\\content.inf",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4810.tmp\\Basis.thmx",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48BD.tmp\\Feathered.thmx",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48FE.tmp\\content.inf",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48FE.tmp\\Droplet.thmx",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48CE.tmp\\Crop.thmx",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  994. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A66.tmp\\Circuit.thmx",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A96.tmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4AD6.tmp",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AF6.tmp\\content.inf",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AF6.tmp\\Damask.thmx",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4810.tmp\\content.inf",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A66.tmp\\content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B64.tmp\\content.inf",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48BD.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B64.tmp\\Slate.thmx",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C11.tmp\\content.inf",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48CE.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C11.tmp\\Quotable.thmx",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D0C.tmp",
  1011. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DD8.tmp\\gb.xsl",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F02.tmp\\ConvergingText.glox",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F42.tmp\\CircleProcess.glox",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DD8.tmp\\Content.inf",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F42.tmp\\Content.inf",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F02.tmp\\Content.inf",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1023. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50C9.tmp",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1028. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1029. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5159.tmp\\content.inf",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5128.tmp\\Insight design set.dotx",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5158.tmp\\harvardanglia2008officeonline.xsl",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51B8.tmp\\content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5159.tmp\\Vapor_Trail.thmx",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5158.tmp\\Content.inf",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51B8.tmp\\Mesh.thmx",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5274.tmp\\content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5274.tmp\\Main_Event.thmx",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1040. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1041. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1042. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1045. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C9413D9E-3750-43EE-925A-A8FBA0028A14}.tmp"
  1046. ]
  1047.  
  1048. [*] Deleted Files: [
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab24A6.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar24A7.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3374.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3372.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3375.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3373.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3386.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3483.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar33B6.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3484.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A4.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34C4.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3524.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3504.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3525.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3484.tmp\\BracketList.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F1.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F87.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34C4.tmp\\chevronaccent.glox",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAA.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3483.tmp\\chicago.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370D.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FEE.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD34A4.tmp\\mlaseventheditionofficeonline.xsl",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD375D.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FA8.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD377E.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3525.tmp\\Banded.thmx",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FCC.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3524.tmp\\gostname.xsl",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD384C.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\cab30FF.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD370D.tmp\\Equations.dotx",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD375D.tmp\\turabian.xsl",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD35F1.tmp\\Wood_Type.thmx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3061.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3987.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\cab304F.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3405.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3504.tmp\\iso690.xsl",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD377E.tmp\\gosttitle.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31AC.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cab302E.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B64.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B85.tmp",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C12.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF1.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF2.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D31.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3987.tmp\\architecture.glox",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F56.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E00.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E10.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E80.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3C12.tmp\\TabList.glox",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379E.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EEE.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F0E.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B64.tmp\\ieee2006officeonline.xsl",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3050.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F2E.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF2.tmp\\rings.glox",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AB5.tmp",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4128.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD414A.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D31.tmp\\iso690nmerical.xsl",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4139.tmp",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B85.tmp\\sist02.xsl",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3062.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\cab302F.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41F8.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4227.tmp",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3CF1.tmp\\APASixthEditionOfficeOnline.xsl",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F0E.tmp\\ThemePictureGrid.glox",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD384C.tmp\\HexagonRadial.glox",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AD6.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBC.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E80.tmp\\Element design set.dotx",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4227.tmp\\Dividend.thmx",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FDC.tmp\\Frame.thmx",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4107.tmp\\View.thmx",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43C2.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD447E.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449F.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44C0.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A45.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CD1.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A65.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD414A.tmp\\RadialPictureList.glox",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C71.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cab379F.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD454E.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD45CC.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E00.tmp\\InterconnectedBlockProcess.glox",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F2E.tmp\\pictureorgchart.glox",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\cab375E.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\cab36EC.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EEE.tmp\\TabbedArc.glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A34.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41F8.tmp\\Headlines.thmx",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C72.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E10.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FA9.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4139.tmp\\PictureFrame.glox",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4128.tmp\\ThemePictureAccent.glox",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab373C.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD447E.tmp\\Badge.thmx",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48BD.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\cab387C.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48CE.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E7F.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48FE.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD449F.tmp\\Parallax.thmx",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3DEF.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD45CC.tmp\\Berlin.thmx",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A66.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD454E.tmp\\ThemePictureAlternatingAccent.glox",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FCC.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3AD7.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44C0.tmp\\VaryingWidthList.glox",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AF6.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A05.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B64.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C11.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD47C1.tmp\\Savon.thmx",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4118.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43C2.tmp\\Metropolitan.thmx",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48CE.tmp\\Crop.thmx",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48BD.tmp\\Feathered.thmx",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4A66.tmp\\Circuit.thmx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DD8.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48FE.tmp\\Droplet.thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A76.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4392.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41E7.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44E0.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab406A.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F02.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F42.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AF6.tmp\\Damask.thmx",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab448F.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4B64.tmp\\Slate.thmx",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DD8.tmp\\gb.xsl",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F02.tmp\\ConvergingText.glox",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4F42.tmp\\CircleProcess.glox",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4810.tmp\\Basis.thmx",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C11.tmp\\Quotable.thmx",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4381.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FED.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5128.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5159.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAB.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D42.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5158.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51B8.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F98.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cab42B5.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5274.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5159.tmp\\Vapor_Trail.thmx",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5158.tmp\\harvardanglia2008officeonline.xsl",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5128.tmp\\Insight design set.dotx",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4AD6.tmp",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\cab301E.tmp",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4A96.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5274.tmp\\Main_Event.thmx",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51B8.tmp\\Mesh.thmx",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cab50C9.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4D0C.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc.2",
  1221. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{54A015A6-FA9C-4893-9949-2288EF4E836D}.tmp",
  1222. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1223. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C9413D9E-3750-43EE-925A-A8FBA0028A14}.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1EE8.tmp.cvr"
  1225. ]
  1226.  
  1227. [*] Modified Registry Keys: [
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\v{{",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2AE45",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2AE45\\F2AE45",
  1251. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1493. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1494. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1495. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1553. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1862. ]
  1863.  
  1864. [*] Deleted Registry Keys: [
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\v{{",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\h z",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\F2AE45\\F2AE45",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1873. ]
  1874.  
  1875. [*] DNS Communications: [
  1876. {
  1877. "type": "A",
  1878. "request": "sripipat.com",
  1879. "answers": [
  1880. {
  1881. "data": "68.65.120.144",
  1882. "type": "A"
  1883. }
  1884. ]
  1885. }
  1886. ]
  1887.  
  1888. [*] Domains: [
  1889. {
  1890. "ip": "68.65.120.144",
  1891. "domain": "sripipat.com"
  1892. }
  1893. ]
  1894.  
  1895. [*] Network Communication - ICMP: []
  1896.  
  1897. [*] Network Communication - HTTP: [
  1898. {
  1899. "count": 1,
  1900. "body": "",
  1901. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1902. "user-agent": "Microsoft-CryptoAPI/6.1",
  1903. "method": "GET",
  1904. "host": "ocsp.digicert.com",
  1905. "version": "1.1",
  1906. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1907. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1908. "port": 80
  1909. },
  1910. {
  1911. "count": 1,
  1912. "body": "",
  1913. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1914. "user-agent": "Microsoft-CryptoAPI/6.1",
  1915. "method": "GET",
  1916. "host": "ocsp.msocsp.com",
  1917. "version": "1.1",
  1918. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1919. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1920. "port": 80
  1921. },
  1922. {
  1923. "count": 1,
  1924. "body": "",
  1925. "uri": "http://sripipat.com/onazy/PurchaseOrder.exe",
  1926. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1927. "method": "GET",
  1928. "host": "sripipat.com",
  1929. "version": "1.1",
  1930. "path": "/onazy/PurchaseOrder.exe",
  1931. "data": "GET /onazy/PurchaseOrder.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: sripipat.com\r\nConnection: Keep-Alive\r\n\r\n",
  1932. "port": 80
  1933. },
  1934. {
  1935. "count": 2,
  1936. "body": "",
  1937. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1938. "user-agent": "Microsoft-CryptoAPI/6.1",
  1939. "method": "GET",
  1940. "host": "crl.microsoft.com",
  1941. "version": "1.1",
  1942. "path": "/pki/crl/products/microsoftrootcert.crl",
  1943. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1944. "port": 80
  1945. },
  1946. {
  1947. "count": 6,
  1948. "body": "",
  1949. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1950. "user-agent": "Microsoft-CryptoAPI/6.1",
  1951. "method": "GET",
  1952. "host": "crl.microsoft.com",
  1953. "version": "1.1",
  1954. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1955. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1956. "port": 80
  1957. },
  1958. {
  1959. "count": 7,
  1960. "body": "",
  1961. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1962. "user-agent": "Microsoft-CryptoAPI/6.1",
  1963. "method": "GET",
  1964. "host": "crl.microsoft.com",
  1965. "version": "1.1",
  1966. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1967. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 01 May 2019 05:01:31 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1968. "port": 80
  1969. },
  1970. {
  1971. "count": 1,
  1972. "body": "",
  1973. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1974. "user-agent": "Microsoft-CryptoAPI/6.1",
  1975. "method": "GET",
  1976. "host": "crl.microsoft.com",
  1977. "version": "1.1",
  1978. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1979. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1980. "port": 80
  1981. },
  1982. {
  1983. "count": 2,
  1984. "body": "",
  1985. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1986. "user-agent": "Microsoft-CryptoAPI/6.1",
  1987. "method": "GET",
  1988. "host": "crl.microsoft.com",
  1989. "version": "1.1",
  1990. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1991. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1992. "port": 80
  1993. }
  1994. ]
  1995.  
  1996. [*] Network Communication - SMTP: []
  1997.  
  1998. [*] Network Communication - Hosts: []
  1999.  
  2000. [*] Network Communication - IRC: []
  2001.  
  2002. [*] Static Analysis: {}
  2003.  
  2004. [*] Resolved APIs: [
  2005. "userenv.dll.RegisterGPNotification",
  2006. "gpapi.dll.RegisterGPNotificationInternal",
  2007. "sechost.dll.OpenSCManagerW",
  2008. "sechost.dll.OpenServiceW",
  2009. "sechost.dll.CloseServiceHandle",
  2010. "mso.dll.#1443",
  2011. "mso.dll.#9214",
  2012. "sechost.dll.QueryServiceConfigW",
  2013. "mso.dll.#199",
  2014. "mso.dll.#1073",
  2015. "mso.dll.#4255",
  2016. "sechost.dll.ConvertSidToStringSidW",
  2017. "mso.dll.#7762",
  2018. "mso.dll.#3459",
  2019. "mso.dll.#1262",
  2020. "mso.dll.#5709",
  2021. "cryptsp.dll.CryptAcquireContextA",
  2022. "cryptsp.dll.CryptCreateHash",
  2023. "cryptsp.dll.CryptHashData",
  2024. "cryptsp.dll.CryptVerifySignatureA",
  2025. "cryptsp.dll.CryptDestroyKey",
  2026. "cryptsp.dll.CryptDestroyHash",
  2027. "mso.dll.#7353",
  2028. "mso.dll.#5228",
  2029. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2030. "ncrypt.dll.BCryptImportKeyPair",
  2031. "ncrypt.dll.BCryptVerifySignature",
  2032. "bcryptprimitives.dll.GetHashInterface",
  2033. "ncrypt.dll.BCryptDestroyKey",
  2034. "mso.dll.#2155",
  2035. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2036. "crypt32.dll.CertFreeCertificateChain",
  2037. "crypt32.dll.CertDuplicateCertificateContext",
  2038. "ncrypt.dll.SslEncryptPacket",
  2039. "mso.dll.#1725",
  2040. "user32.dll.RegisterWindowMessageW",
  2041. "ncrypt.dll.SslDecryptPacket",
  2042. "winhttp.dll.WinHttpReceiveResponse",
  2043. "winhttp.dll.WinHttpQueryHeaders",
  2044. "winhttp.dll.WinHttpQueryDataAvailable",
  2045. "winhttp.dll.WinHttpReadData",
  2046. "webservices.dll.WsCreateError",
  2047. "ntdll.dll.EtwEventWrite",
  2048. "ntdll.dll.EtwEventRegister",
  2049. "ntdll.dll.EtwEventUnregister",
  2050. "webservices.dll.WsCreateHeap",
  2051. "webservices.dll.WsCreateReader",
  2052. "webservices.dll.WsSetInput",
  2053. "webservices.dll.WsFillReader",
  2054. "webservices.dll.WsReadToStartElement",
  2055. "webservices.dll.WsReadStartElement",
  2056. "webservices.dll.WsReadType",
  2057. "winhttp.dll.WinHttpCloseHandle",
  2058. "crypt32.dll.CertFreeCertificateContext",
  2059. "rpcrt4.dll.RpcBindingFree",
  2060. "webservices.dll.WsFreeReader",
  2061. "webservices.dll.WsFreeError",
  2062. "webservices.dll.WsFreeHeap",
  2063. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2064. "winhttp.dll.WinHttpOpenRequest",
  2065. "winhttp.dll.WinHttpAddRequestHeaders",
  2066. "winhttp.dll.WinHttpSendRequest",
  2067. "winhttp.dll.WinHttpConnect",
  2068. "winhttp.dll.WinHttpCrackUrl",
  2069. "winhttp.dll.WinHttpSetStatusCallback",
  2070. "winhttp.dll.WinHttpOpen",
  2071. "winhttp.dll.WinHttpSetOption",
  2072. "winhttp.dll.WinHttpWriteData",
  2073. "winhttp.dll.WinHttpSetCredentials",
  2074. "winhttp.dll.WinHttpQueryAuthSchemes",
  2075. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2076. "winhttp.dll.WinHttpGetProxyForUrl",
  2077. "winhttp.dll.WinHttpQueryOption",
  2078. "webservices.dll.WsOpenServiceProxy",
  2079. "webservices.dll.WsCall",
  2080. "webservices.dll.WsAddCustomHeader",
  2081. "shlwapi.dll.StrStrA",
  2082. "shlwapi.dll.UrlUnescapeA",
  2083. "mso.dll.#4314",
  2084. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2085. "mso.dll.#6484",
  2086. "mso.dll.#8499",
  2087. "mso.dll.#9871",
  2088. "mso.dll.#4743",
  2089. "mso.dll.#5452",
  2090. "mso.dll.#8165",
  2091. "mso.dll.#9175",
  2092. "mso.dll.#5315",
  2093. "mso.dll.#8140",
  2094. "user32.dll.IsWindowEnabled",
  2095. "ole32.dll.CoGetCallState",
  2096. "ole32.dll.CoGetActivationState",
  2097. "advapi32.dll.RegisterWaitChainCOMCallback",
  2098. "cryptnet.dll.CertDllVerifyRevocation",
  2099. "profapi.dll.#104",
  2100. "sensapi.dll.IsNetworkAlive",
  2101. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2102. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2103. "rpcrt4.dll.NdrClientCall2",
  2104. "winhttp.dll.WinHttpSetTimeouts",
  2105. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2106. "winhttp.dll.WinHttpTimeFromSystemTime",
  2107. "shlwapi.dll.StrStrIW",
  2108. "cryptnet.dll.I_CryptNetGetConnectivity",
  2109. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2110. "setupapi.dll.SetupIterateCabinetW",
  2111. "kernel32.dll.RegOpenKeyExW",
  2112. "kernel32.dll.RegCloseKey",
  2113. "cabinet.dll.#20",
  2114. "cabinet.dll.#22",
  2115. "devrtl.dll.DevRtlGetThreadLogToken",
  2116. "cryptsp.dll.CryptSetHashParam",
  2117. "sechost.dll.QueryServiceConfigA",
  2118. "sechost.dll.QueryServiceStatus",
  2119. "rpcrt4.dll.RpcStringBindingComposeA",
  2120. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2121. "rpcrt4.dll.RpcEpResolveBinding",
  2122. "sechost.dll.LookupAccountSidLocalW",
  2123. "rpcrt4.dll.RpcStringFreeA",
  2124. "webservices.dll.WsResetHeap",
  2125. "webservices.dll.WsCloseServiceProxy",
  2126. "ws2_32.dll.#3",
  2127. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2128. "ncrypt.dll.SslFreeObject",
  2129. "webservices.dll.WsFreeServiceProxy",
  2130. "mso.dll.#25",
  2131. "mso.dll.#1056",
  2132. "mso.dll.#8136",
  2133. "mso.dll.#8931",
  2134. "shell32.dll.SHGetFileInfoW",
  2135. "mso.dll.#5362",
  2136. "mso.dll.#6044",
  2137. "mso.dll.#6516",
  2138. "mso.dll.#6221",
  2139. "mso.dll.#5780",
  2140. "mso.dll.#4870",
  2141. "mso.dll.#6046",
  2142. "mso.dll.#1241",
  2143. "mso.dll.#2821",
  2144. "mso.dll.#2340",
  2145. "mso.dll.#7287",
  2146. "mso.dll.#5290",
  2147. "mso.dll.#1508",
  2148. "user32.dll.IsZoomed",
  2149. "user32.dll.GetWindowPlacement",
  2150. "user32.dll.GetWindowRect",
  2151. "mso.dll.#821",
  2152. "user32.dll.GetSystemMetrics",
  2153. "user32.dll.MonitorFromWindow",
  2154. "user32.dll.MonitorFromRect",
  2155. "user32.dll.MonitorFromPoint",
  2156. "user32.dll.EnumDisplayMonitors",
  2157. "user32.dll.GetMonitorInfoA",
  2158. "user32.dll.EnumDisplayDevicesA",
  2159. "mso.dll.#2378",
  2160. "user32.dll.SetWindowPos",
  2161. "user32.dll.AdjustWindowRect",
  2162. "mso.dll.#5912",
  2163. "mso.dll.#9719",
  2164. "mso.dll.#8824",
  2165. "mso.dll.#6117",
  2166. "mso.dll.#3307",
  2167. "user32.dll.SendMessageW",
  2168. "user32.dll.DestroyIcon",
  2169. "mso.dll.#3813",
  2170. "mso.dll.#1815",
  2171. "user32.dll.PtInRect",
  2172. "mso.dll.#1613",
  2173. "user32.dll.SetWindowTextW",
  2174. "user32.dll.GetClassLongW",
  2175. "mso.dll.#8572",
  2176. "gdi32.dll.CreateDIBSection",
  2177. "gdi32.dll.CreateCompatibleDC",
  2178. "gdi32.dll.GetViewportOrgEx",
  2179. "gdi32.dll.SetViewportOrgEx",
  2180. "gdi32.dll.SetBkColor",
  2181. "gdi32.dll.ExtTextOutA",
  2182. "mso.dll.#1573",
  2183. "mso.dll.#8612",
  2184. "user32.dll.SetScrollRange",
  2185. "gdi32.dll.DeleteDC",
  2186. "mso.dll.#2509",
  2187. "user32.dll.BeginDeferWindowPos",
  2188. "user32.dll.DeferWindowPos",
  2189. "user32.dll.EndDeferWindowPos",
  2190. "user32.dll.OffsetRect",
  2191. "user32.dll.EnumChildWindows",
  2192. "user32.dll.GetScrollInfo",
  2193. "user32.dll.MapWindowPoints",
  2194. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2195. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2196. "mso.dll.#6126",
  2197. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2198. "gdi32.dll.GetFontRealizationInfo",
  2199. "gdi32.dll.GetFontFileInfo",
  2200. "gdi32.dll.GetFontFileData",
  2201. "mso.dll.#7261",
  2202. "mso.dll.#9540",
  2203. "usp10.dll.ScriptGetFontScriptTags",
  2204. "usp10.dll.ScriptGetFontLanguageTags",
  2205. "usp10.dll.ScriptGetFontFeatureTags",
  2206. "mso.dll.#6330",
  2207. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2208. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2209. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2210. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2211. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2212. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2213. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2214. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2215. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2216. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2217. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2218. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2219. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2220. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2221. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2222. "user32.dll.SetRectEmpty",
  2223. "user32.dll.InflateRect",
  2224. "mso.dll.#1100",
  2225. "mso.dll.#7047",
  2226. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2227. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2228. "user32.dll.GetCursor",
  2229. "user32.dll.GetClientRect",
  2230. "user32.dll.SetScrollInfo",
  2231. "user32.dll.SetScrollPos",
  2232. "mso.dll.#3747",
  2233. "mso.dll.#5394",
  2234. "mso.dll.#331",
  2235. "mso.dll.#6829",
  2236. "mso.dll.#539",
  2237. "mso.dll.#4959",
  2238. "mso.dll.#6463",
  2239. "mso.dll.#4987",
  2240. "user32.dll.GetWindow",
  2241. "mso.dll.#7195",
  2242. "mso.dll.#7573",
  2243. "mso.dll.#445",
  2244. "user32.dll.GetCaretBlinkTime",
  2245. "user32.dll.CreateCaret",
  2246. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2247. "user32.dll.IntersectRect",
  2248. "user32.dll.DestroyCaret",
  2249. "user32.dll.GetCaretPos",
  2250. "user32.dll.SetCaretPos",
  2251. "mso.dll.#5932",
  2252. "mso.dll.#2071",
  2253. "mso.dll.#1024",
  2254. "mso.dll.#6245",
  2255. "mso.dll.#9041",
  2256. "mso.dll.#1767",
  2257. "mso.dll.#9369",
  2258. "mso.dll.#4617",
  2259. "user32.dll.FillRect",
  2260. "mso.dll.#343",
  2261. "mso.dll.#9636",
  2262. "mso.dll.#2022",
  2263. "mso.dll.#4750",
  2264. "mso.dll.#4577",
  2265. "mso.dll.#850",
  2266. "shell32.dll.SHAddToRecentDocs",
  2267. "mso.dll.#1776",
  2268. "mso.dll.#9026",
  2269. "mso.dll.#4497",
  2270. "mso.dll.#8926",
  2271. "mso.dll.#7212",
  2272. "mso.dll.#5407",
  2273. "mso.dll.#5152",
  2274. "mso.dll.#3327",
  2275. "mso.dll.#6333",
  2276. "mso.dll.#420",
  2277. "mso.dll.#1335",
  2278. "mso.dll.#2041",
  2279. "mso.dll.#7834",
  2280. "mso.dll.#239",
  2281. "mso.dll.#6357",
  2282. "mso.dll.#7026",
  2283. "mso.dll.#1671",
  2284. "mso.dll.#8263",
  2285. "mso.dll.#9307",
  2286. "mso.dll.#1441",
  2287. "mso.dll.#9223",
  2288. "mso.dll.#6453",
  2289. "mso.dll.#8044",
  2290. "mso.dll.#3698",
  2291. "mso.dll.#8565",
  2292. "oleaut32.dll.#7",
  2293. "mso.dll.#8373",
  2294. "mso.dll.#9741",
  2295. "mso.dll.#478",
  2296. "mso.dll.#479",
  2297. "mso.dll.#340",
  2298. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2299. "bcrypt.dll.BCryptGetProperty",
  2300. "bcrypt.dll.BCryptCreateHash",
  2301. "bcrypt.dll.BCryptHashData",
  2302. "bcrypt.dll.BCryptFinishHash",
  2303. "bcrypt.dll.BCryptDestroyHash",
  2304. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2305. "mso.dll.#8633",
  2306. "mso.dll.#5213",
  2307. "mso.dll.#6163",
  2308. "mso.dll.#552",
  2309. "mso.dll.#5630",
  2310. "mso.dll.#1607",
  2311. "mso.dll.#791",
  2312. "mso.dll.#1848",
  2313. "mso.dll.#8735",
  2314. "mso.dll.#9374",
  2315. "mso.dll.#5286",
  2316. "mso.dll.#6368",
  2317. "mso.dll.#4262",
  2318. "mso.dll.#1010",
  2319. "mso.dll.#7979",
  2320. "mso.dll.#8549",
  2321. "ole32.dll.PropVariantClear",
  2322. "oleaut32.dll.#9",
  2323. "mso.dll.#8970",
  2324. "mso.dll.#9198",
  2325. "mso.dll.#4795",
  2326. "mso.dll.#1865",
  2327. "mso.dll.#9688",
  2328. "mso.dll.#320",
  2329. "advapi32.dll.RegDeleteKeyA",
  2330. "user32.dll.DestroyCursor",
  2331. "mso.dll.#7173",
  2332. "mso.dll.#8511",
  2333. "mso.dll.#3299",
  2334. "mso.dll.#7001",
  2335. "mso.dll.#3913",
  2336. "user32.dll.PeekMessageA",
  2337. "mso.dll.#1380",
  2338. "mso.dll.#9500",
  2339. "user32.dll.TranslateMessage",
  2340. "user32.dll.IsWindowUnicode",
  2341. "user32.dll.DispatchMessageA",
  2342. "user32.dll.DispatchMessageW",
  2343. "user32.dll.UpdateWindow",
  2344. "mso.dll.#999",
  2345. "mso.dll.#287",
  2346. "dwmapi.dll.DwmIsCompositionEnabled",
  2347. "mso.dll.#1575",
  2348. "mso.dll.#5034",
  2349. "mso.dll.#1517",
  2350. "mso.dll.#718",
  2351. "mso.dll.#4708",
  2352. "mso.dll.#8046",
  2353. "mso.dll.#4175",
  2354. "mso.dll.#8672",
  2355. "mso.dll.#1990",
  2356. "mso.dll.#3051",
  2357. "mso.dll.#1819",
  2358. "mso.dll.#1419",
  2359. "oleaut32.dll.#147",
  2360. "kernel32.dll.WerRegisterMemoryBlock",
  2361. "dwrite.dll.DWriteCreateFactory",
  2362. "advapi32.dll.RegQueryValueW",
  2363. "apphelp.dll.ApphelpCheckShellObject",
  2364. "gdi32.dll.GetCurrentObject",
  2365. "gdi32.dll.BitBlt",
  2366. "gdi32.dll.GetClipBox",
  2367. "gdi32.dll.StretchDIBits",
  2368. "riched20.dll.REExtendedRegisterClass",
  2369. "user32.dll.GetWindowLongW",
  2370. "user32.dll.GetSysColor",
  2371. "user32.dll.SetWindowLongW",
  2372. "user32.dll.RegisterWindowMessageA",
  2373. "user32.dll.RegisterClipboardFormatW",
  2374. "user32.dll.GetDoubleClickTime",
  2375. "user32.dll.SetCaretBlinkTime",
  2376. "user32.dll.SystemParametersInfoW",
  2377. "user32.dll.GetKeyboardLayoutList",
  2378. "mso.dll._MsoGetFidUspDll@0",
  2379. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2380. "usp10.dll.ScriptGetProperties",
  2381. "usp10.dll.ScriptItemize",
  2382. "user32.dll.LoadCursorW",
  2383. "user32.dll.IsWindowVisible",
  2384. "user32.dll.GetKeyboardLayout",
  2385. "user32.dll.PostMessageW",
  2386. "user32.dll.DefWindowProcW",
  2387. "uxtheme.dll.IsThemeActive",
  2388. "uxtheme.dll.IsAppThemed",
  2389. "uxtheme.dll.OpenThemeData",
  2390. "user32.dll.GetDC",
  2391. "user32.dll.ReleaseDC",
  2392. "user32.dll.IsIconic",
  2393. "user32.dll.GetParent",
  2394. "usp10.dll.ScriptGetCMap",
  2395. "user32.dll.InvalidateRect",
  2396. "user32.dll.HideCaret",
  2397. "user32.dll.ShowCaret",
  2398. "advapi32.dll.RegDeleteTreeW",
  2399. "user32.dll.NotifyWinEvent",
  2400. "user32.dll.GetWindowTextLengthW",
  2401. "user32.dll.EnableWindow",
  2402. "msctf.dll.SetInputScope",
  2403. "user32.dll.GetWindowRgn",
  2404. "gdi32.dll.CreateCompatibleBitmap",
  2405. "gdi32.dll.SaveDC",
  2406. "gdi32.dll.SetPixel",
  2407. "gdi32.dll.GetPixel",
  2408. "xmllite.dll.CreateXmlReader",
  2409. "gdi32.dll.RestoreDC",
  2410. "imm32.dll.ImmAssociateContext",
  2411. "ole32.dll.CoRevokeInitializeSpy",
  2412. "comctl32.dll.#388",
  2413. "mso.dll.#806",
  2414. "mso.dll.#4908",
  2415. "user32.dll.SetRect",
  2416. "mso.dll.#8439",
  2417. "mso.dll.#2736",
  2418. "gdi32.dll.GetTextAlign",
  2419. "gdi32.dll.ExtTextOutW",
  2420. "mso.dll.#8122",
  2421. "mso.dll.#2114",
  2422. "mso.dll.#6558",
  2423. "gdi32.dll.GetFontData",
  2424. "usp10.dll.ScriptItemizeOpenType",
  2425. "usp10.dll.ScriptShapeOpenType",
  2426. "usp10.dll.ScriptPlaceOpenType",
  2427. "mso.dll.#8395",
  2428. "mso.dll.#379",
  2429. "mso.dll.#6338",
  2430. "mso.dll.#7964",
  2431. "mso.dll.#1437",
  2432. "mso.dll.#1427",
  2433. "mso.dll.#6137",
  2434. "winmm.dll.timeGetTime",
  2435. "mso.dll.#5940",
  2436. "usp10.dll.ScriptPlace",
  2437. "usp10.dll.ScriptShape",
  2438. "usp10.dll.ScriptJustify",
  2439. "usp10.dll.ScriptTextOut",
  2440. "usp10.dll.ScriptCPtoX",
  2441. "usp10.dll.ScriptXtoCP",
  2442. "usp10.dll.ScriptFreeCache",
  2443. "usp10.dll.ScriptCacheGetHeight",
  2444. "usp10.dll.ScriptLayout",
  2445. "usp10.dll.ScriptBreak",
  2446. "usp10.dll.ScriptIsComplex",
  2447. "usp10.dll.ScriptGetLogicalWidths",
  2448. "usp10.dll.ScriptApplyLogicalWidth",
  2449. "usp10.dll.ScriptGetGlyphABCWidth",
  2450. "usp10.dll.ScriptGetFontProperties",
  2451. "usp10.dll.ScriptApplyDigitSubstitution",
  2452. "usp10.dll.ScriptRecordDigitSubstitution",
  2453. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2454. "mso.dll.#7578",
  2455. "mso.dll.#8483",
  2456. "mso.dll.#2613",
  2457. "gdi32.dll.GdiIsMetaPrintDC",
  2458. "mso.dll.#7848",
  2459. "user32.dll.GetForegroundWindow",
  2460. "user32.dll.GetFocus",
  2461. "user32.dll.GetClassNameA",
  2462. "user32.dll.IsWindowRedirectedForPrint",
  2463. "gdi32.dll.CreateRectRgnIndirect",
  2464. "user32.dll.GetUpdateRgn",
  2465. "gdi32.dll.GetRgnBox",
  2466. "user32.dll.ValidateRect",
  2467. "user32.dll.GetUpdateRect",
  2468. "user32.dll.BeginPaint",
  2469. "user32.dll.EndPaint",
  2470. "mso.dll.#3624",
  2471. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2472. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2473. "gdi32.dll.TranslateCharsetInfo",
  2474. "mso.dll.#3300",
  2475. "mso.dll.#7465",
  2476. "mso.dll.#6247",
  2477. "gdi32.dll.SetWindowOrgEx",
  2478. "mso.dll.#732",
  2479. "mso.dll.#5804",
  2480. "ole32.dll.CoCreateInstance",
  2481. "user32.dll.ScreenToClient",
  2482. "mso.dll.#434",
  2483. "user32.dll.GetMessageExtraInfo",
  2484. "user32.dll.GetCursorInfo",
  2485. "user32.dll.GetCapture",
  2486. "user32.dll.TrackMouseEvent",
  2487. "user32.dll.GetInputState",
  2488. "mso.dll.#8461",
  2489. "user32.dll.GetClipboardOwner",
  2490. "user32.dll.SendNotifyMessageW",
  2491. "user32.dll.GetActiveWindow",
  2492. "user32.dll.GetAncestor",
  2493. "mso.dll.#3544",
  2494. "mso.dll.#900",
  2495. "mso.dll.#1422",
  2496. "user32.dll.MsgWaitForMultipleObjectsEx",
  2497. "user32.dll.WindowFromPoint",
  2498. "user32.dll.GetDesktopWindow",
  2499. "user32.dll.FindWindowExW",
  2500. "user32.dll.IsClipboardFormatAvailable",
  2501. "advapi32.dll.NotifyServiceStatusChangeW",
  2502. "user32.dll.GetWindowDC",
  2503. "gdi32.dll.SetLayout",
  2504. "gdi32.dll.RectVisible",
  2505. "gdi32.dll.GetClipRgn",
  2506. "gdi32.dll.ExcludeClipRect",
  2507. "gdi32.dll.SelectClipRgn",
  2508. "user32.dll.GetMessagePos",
  2509. "user32.dll.SetFocus",
  2510. "mso.dll.#9465",
  2511. "mso.dll.#8662",
  2512. "mso.dll.#4746",
  2513. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2514. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2515. "mso.dll.#1885",
  2516. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2517. "mso.dll.#832",
  2518. "mso.dll.#3702",
  2519. "mso.dll.#3484",
  2520. "mso.dll.#1966",
  2521. "mso.dll.#6960",
  2522. "mso.dll.#7892",
  2523. "msi.dll.#111",
  2524. "mso.dll.#7931",
  2525. "mso.dll.#3837",
  2526. "mso.dll.#8398",
  2527. "user32.dll.GetScrollPos",
  2528. "mso.dll.#629",
  2529. "mso.dll.#2477",
  2530. "msproof7.dll.DllGetClassObject",
  2531. "msproof7.dll.DllCanUnloadNow",
  2532. "mso.dll.#4172",
  2533. "mso.dll.#1439",
  2534. "mso.dll.#9566",
  2535. "mso.dll.#111",
  2536. "mso.dll.#4191",
  2537. "mso.dll.#3802",
  2538. "mso.dll.#6982",
  2539. "mso.dll.#8800",
  2540. "mso.dll.#3572",
  2541. "mso.dll.#167",
  2542. "mso.dll.#5737",
  2543. "mso.dll.#590",
  2544. "mso.dll.#3758",
  2545. "kernel32.dll.FlsAlloc",
  2546. "kernel32.dll.FlsGetValue",
  2547. "kernel32.dll.FlsSetValue",
  2548. "kernel32.dll.FlsFree",
  2549. "msgr3en.dll.CheckVersion",
  2550. "msgr3en.dll.#29",
  2551. "msgr3en.dll.#30",
  2552. "msgr3en.dll.#31",
  2553. "msgr3en.dll.#32",
  2554. "msgr3en.dll.#33",
  2555. "msgr3en.dll.#34",
  2556. "msgr3en.dll.#35",
  2557. "msgr3en.dll.#45",
  2558. "msgr3en.dll.#46",
  2559. "msgr3en.dll.#47",
  2560. "msgr3en.dll.#48",
  2561. "msgr3en.dll.#51",
  2562. "msgr3en.dll.#50",
  2563. "msgr3en.dll.#49",
  2564. "msgr3en.dll.#43",
  2565. "msgr3en.dll.#41",
  2566. "msgr3en.dll.#42",
  2567. "msgr3en.dll.#44",
  2568. "msgr3en.dll.#39",
  2569. "msgr3en.dll.#40",
  2570. "msgr3en.dll.#36",
  2571. "msgr3en.dll.#38",
  2572. "msgr3en.dll.#37",
  2573. "msgr3en.dll.#56",
  2574. "msgr3en.dll.#52",
  2575. "msgr3en.dll.#53",
  2576. "msgr3en.dll.#57",
  2577. "msgr3en.dll.#58",
  2578. "msgr3en.dll.#59",
  2579. "user32.dll.LoadStringA",
  2580. "mso.dll.#2561",
  2581. "ieawsdc.dll.HrExtractTemplateToPath",
  2582. "advapi32.dll.CryptAcquireContextA",
  2583. "advapi32.dll.CryptGenKey",
  2584. "cryptsp.dll.CryptGenKey",
  2585. "advapi32.dll.CryptImportKey",
  2586. "cryptsp.dll.CryptImportKey",
  2587. "advapi32.dll.CryptExportKey",
  2588. "cryptsp.dll.CryptExportKey",
  2589. "advapi32.dll.CryptDestroyKey",
  2590. "crypt32.dll.CryptQueryObject",
  2591. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2592. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2593. "cryptsp.dll.CryptGetDefaultProviderW",
  2594. "cryptsp.dll.CryptAcquireContextW",
  2595. "crypt32.dll.CertEnumCertificatesInStore",
  2596. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2597. "cryptsp.dll.CryptReleaseContext",
  2598. "wintrust.dll.WinVerifyTrust",
  2599. "wintrust.dll.WintrustCertificateTrust",
  2600. "wintrust.dll.SoftpubAuthenticode",
  2601. "wintrust.dll.SoftpubInitialize",
  2602. "wintrust.dll.SoftpubLoadMessage",
  2603. "wintrust.dll.SoftpubLoadSignature",
  2604. "wintrust.dll.SoftpubCheckCert",
  2605. "wintrust.dll.SoftpubCleanup",
  2606. "wintrust.dll.CryptSIPVerifyIndirectData",
  2607. "cryptsp.dll.CryptGetHashParam",
  2608. "advapi32.dll.CryptCreateHash",
  2609. "advapi32.dll.CryptSetHashParam",
  2610. "advapi32.dll.CryptHashData",
  2611. "advapi32.dll.CryptGetHashParam",
  2612. "advapi32.dll.CryptDestroyHash",
  2613. "user32.dll.RegisterPowerSettingNotification",
  2614. "powrprof.dll.PowerSettingRegisterNotification",
  2615. "user32.dll.GetWindowThreadProcessId",
  2616. "user32.dll.GetWindowTextW",
  2617. "msi.dll.#90",
  2618. "advapi32.dll.SaferiSearchMatchingHashRules",
  2619. "wintrust.dll.WTHelperProvDataFromStateData",
  2620. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2621. "crypt32.dll.CertCloseStore",
  2622. "mso.dll.#8837",
  2623. "advapi32.dll.ConvertSidToStringSidW",
  2624. "msi.dll.DllGetVersion",
  2625. "cabinet.dll.#23",
  2626. "mso.dll.#1455",
  2627. "user32.dll.LoadImageW",
  2628. "user32.dll.CreateWindowExW",
  2629. "comctl32.dll.HIMAGELIST_QueryInterface",
  2630. "comctl32.dll.DrawShadowText",
  2631. "comctl32.dll.DrawSizeBox",
  2632. "comctl32.dll.DrawScrollBar",
  2633. "comctl32.dll.SizeBoxHwnd",
  2634. "comctl32.dll.ScrollBar_MouseMove",
  2635. "comctl32.dll.ScrollBar_Menu",
  2636. "comctl32.dll.HandleScrollCmd",
  2637. "comctl32.dll.DetachScrollBars",
  2638. "comctl32.dll.AttachScrollBars",
  2639. "comctl32.dll.CCSetScrollInfo",
  2640. "comctl32.dll.CCGetScrollInfo",
  2641. "comctl32.dll.CCEnableScrollBar",
  2642. "comctl32.dll.QuerySystemGestureStatus",
  2643. "uxtheme.dll.#49",
  2644. "user32.dll.EnableScrollBar",
  2645. "user32.dll.ShowScrollBar",
  2646. "user32.dll.ShowWindow",
  2647. "user32.dll.SetParent",
  2648. "user32.dll.KillTimer",
  2649. "user32.dll.ClientToScreen",
  2650. "user32.dll.MoveWindow",
  2651. "user32.dll.DestroyWindow",
  2652. "gdi32.dll.GetViewportExtEx",
  2653. "gdi32.dll.GetWindowExtEx",
  2654. "gdi32.dll.GetTextCharset",
  2655. "gdi32.dll.GetMapMode",
  2656. "gdi32.dll.GetLayout",
  2657. "oleaut32.dll.SysAllocString",
  2658. "oleaut32.dll.SysStringLen",
  2659. "oleaut32.dll.SysAllocStringLen",
  2660. "oleaut32.dll.SysFreeString",
  2661. "uxtheme.dll.GetThemePartSize",
  2662. "user32.dll.GetMessageW",
  2663. "gdi32.dll.IntersectClipRect",
  2664. "gdi32.dll.SetTextColor",
  2665. "gdi32.dll.SetBkMode",
  2666. "gdi32.dll.SetTextAlign",
  2667. "gdi32.dll.ExtSelectClipRgn",
  2668. "gdi32.dll.GetTextColor",
  2669. "uxtheme.dll.DrawThemeBackground",
  2670. "user32.dll.WaitMessage",
  2671. "wininet.dll.InternetGetConnectedState",
  2672. "osppcext.dll.SLActivateProduct",
  2673. "osppcext.dll.SLGetTokenActivationGrants",
  2674. "osppcext.dll.SLGetTokenActivationCertificates",
  2675. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2676. "osppcext.dll.SLSignTokenActivationChallenge",
  2677. "osppcext.dll.SLDepositTokenActivationResponse",
  2678. "osppcext.dll.SLFreeTokenActivationGrants",
  2679. "osppcext.dll.SLFreeTokenActivationCertificates",
  2680. "gdi32.dll.GdiFlush",
  2681. "rasapi32.dll.RasConnectionNotificationW",
  2682. "sechost.dll.NotifyServiceStatusChangeA",
  2683. "user32.dll.IsHungAppWindow",
  2684. "gdi32.dll.CombineRgn",
  2685. "user32.dll.CopyRect",
  2686. "gdi32.dll.SetStretchBltMode",
  2687. "user32.dll.UpdateLayeredWindow",
  2688. "user32.dll.RemovePropW",
  2689. "mso.dll.#4702",
  2690. "mso.dll.#1266",
  2691. "gdi32.dll.GetStockObject",
  2692. "mso.dll.#6501",
  2693. "riched20.dll.REMSOHInst",
  2694. "mso.dll.#511",
  2695. "mso.dll.#8118",
  2696. "gdi32.dll.GetGlyphIndicesW",
  2697. "mso.dll.#8060",
  2698. "mso.dll.#844",
  2699. "mso.dll.#7531",
  2700. "mso.dll.#6420",
  2701. "user32.dll.GetClassNameW",
  2702. "user32.dll.SetCursor",
  2703. "mso.dll.#1414",
  2704. "mso.dll.#8202",
  2705. "mso.dll.#7189",
  2706. "mso.dll.#2738",
  2707. "mso.dll.#8691",
  2708. "mso.dll.#6079",
  2709. "mso.dll.#7167",
  2710. "mso.dll.#7163",
  2711. "mso.dll.#333",
  2712. "mso.dll.#1785",
  2713. "mso.dll.#5919",
  2714. "mso.dll.#5973",
  2715. "mso.dll.#2014",
  2716. "mso.dll.#9668",
  2717. "mso.dll.#8472",
  2718. "mso.dll.#2294",
  2719. "mso.dll.#2968",
  2720. "mso.dll.#2281",
  2721. "mso.dll.#2628",
  2722. "mso.dll.#1401",
  2723. "mso.dll.#3425",
  2724. "mso.dll.#5291",
  2725. "mso.dll.#1718",
  2726. "mso.dll.#4777",
  2727. "mso.dll.#1914",
  2728. "advapi32.dll.RegDeleteKeyW",
  2729. "mso.dll.#235",
  2730. "mso.dll.#4416",
  2731. "mso.dll.#9398",
  2732. "mso.dll.#1442",
  2733. "mso.dll.#4388",
  2734. "mso.dll.#8022",
  2735. "mso.dll.#8757",
  2736. "mso.dll.#237",
  2737. "mso.dll.#4214",
  2738. "mso.dll.#884",
  2739. "mso.dll.#121",
  2740. "mso.dll.#1712",
  2741. "mso.dll.#9344",
  2742. "mso.dll.#4203",
  2743. "mso.dll.#3974",
  2744. "mso.dll.#4882",
  2745. "mso.dll.#2449",
  2746. "mso.dll.#2767",
  2747. "mso.dll.#9199",
  2748. "mso.dll.#7948",
  2749. "mso.dll.#3209",
  2750. "mso.dll.#4083",
  2751. "mso.dll.#292",
  2752. "mso.dll.#795",
  2753. "mso.dll.#8349",
  2754. "mso.dll.#8796",
  2755. "mso.dll.#3930",
  2756. "mso.dll.#9105",
  2757. "mso.dll.#2427",
  2758. "mso.dll.#8116",
  2759. "mso.dll.#6156",
  2760. "uxtheme.dll.CloseThemeData",
  2761. "user32.dll.UnregisterClassW",
  2762. "user32.dll.UnhookWindowsHookEx",
  2763. "mso.dll.#7002",
  2764. "mso.dll.#186",
  2765. "user32.dll.PostQuitMessage",
  2766. "mso.dll.#591",
  2767. "mso.dll.#2272",
  2768. "mso.dll.#4284",
  2769. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  2770. "mso.dll.#4426",
  2771. "mso.dll.#8473",
  2772. "mso.dll.#8106",
  2773. "mso.dll.#8876",
  2774. "advapi32.dll.CryptReleaseContext",
  2775. "mso.dll.#4210",
  2776. "mso.dll.#8586",
  2777. "mso.dll.#8004",
  2778. "mso.dll.#6078",
  2779. "mso.dll.#815",
  2780. "mso.dll.#187",
  2781. "mso.dll.#5625",
  2782. "mso.dll.#8316",
  2783. "mso.dll.#7598",
  2784. "ws2_32.dll.#116",
  2785. "user32.dll.RemoveClipboardFormatListener",
  2786. "user32.dll.UnregisterPowerSettingNotification",
  2787. "powrprof.dll.PowerSettingUnregisterNotification",
  2788. "shell32.dll.#155",
  2789. "advapi32.dll.EventUnregister",
  2790. "user32.dll.UnregisterClassA",
  2791. "gdiplus.dll.GdiplusShutdown",
  2792. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  2793. "winsta.dll.WinStationUnRegisterConsoleNotification",
  2794. "advapi32.dll.RegDeleteValueW",
  2795. "mso.dll.#2482",
  2796. "mso.dll.#5458",
  2797. "advapi32.dll.UnregisterTraceGuids",
  2798. "comctl32.dll.#321"
  2799. ]
  2800.  
  2801. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!