API tools faq
paste
paladin316

Docs_7fea5a654003608c9d89c9a51cf1439f_doc_2019-07-18_07_30.txt

paladin316
Jul 18th, 2019
2,192
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 239.48 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Msoffice-CVE-2017-11882"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_7fea5a654003608c9d89c9a51cf1439f.doc"
  7. * File Size: 7375
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "ea0cee634298f2cc336dbf2ad4bcea5bc25d935ab50e4904f8053e92590536d6"
  10. * MD5: "7fea5a654003608c9d89c9a51cf1439f"
  11. * SHA1: "0f368099f17a2a82ff21c4132f2acf127580c020"
  12. * SHA512: "710738682c1bd2806c01adc17a3617940e1c8288383b85d4cedbb776b3ed125b24a41dd34bef84d05cedca9f511d6910002b24d2a4b2b21eb58e1638fc78503b"
  13. * CRC32: "9BDD79E6"
  14. * SSDEEP: "96:9w3ukvrB4VnkS2ZktpD/ZpV2LbAUbiWUZWuJpatgFL+A:9GprB4nueOLbAUOiu/ugFJ"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  25. "Details":
  26.  
  27. "IP": "52.109.16.5:443"
  28.  
  29.  
  30. "IP": "52.109.6.40:443"
  31.  
  32.  
  33. "IP": "65.52.98.231:443"
  34.  
  35.  
  36. "IP": "104.18.24.243:80"
  37.  
  38.  
  39. "IP": "23.15.4.26:80"
  40.  
  41.  
  42. "IP": "69.192.108.32:443"
  43.  
  44.  
  45. "IP": "72.21.91.29:80"
  46.  
  47.  
  48. "IP": "23.45.34.35:443"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  54. "Details":
  55.  
  56. "ioc": "ist.glox"
  57.  
  58.  
  59. "ioc": "ontent.inf"
  60.  
  61.  
  62. "ioc": "rc.glox"
  63.  
  64.  
  65. "ioc": "rame.glox"
  66.  
  67.  
  68. "ioc": "gb.xsl"
  69.  
  70.  
  71. "ioc": "iso690.xsl"
  72.  
  73.  
  74. "ioc": "pictureorgchart.glox"
  75.  
  76.  
  77. "ioc": "mlaseventheditionofficeonline.xsl"
  78.  
  79.  
  80. "ioc": "quations.dotx"
  81.  
  82.  
  83. "ioc": "rid.glox"
  84.  
  85.  
  86. "ioc": "..3b"
  87.  
  88.  
  89. "ioc": "chevronaccent.glox"
  90.  
  91.  
  92. "ioc": "turabian.xsl"
  93.  
  94.  
  95. "ioc": "rings.glox"
  96.  
  97.  
  98. "ioc": "rocess.glox"
  99.  
  100.  
  101. "ioc": "sist02.xsl"
  102.  
  103.  
  104. "ioc": "architecture.glox"
  105.  
  106.  
  107. "ioc": "iso690nmerical.xsl"
  108.  
  109.  
  110. "ioc": "gosttitle.xsl"
  111.  
  112.  
  113. "ioc": "adial.glox"
  114.  
  115.  
  116. "ioc": "ieee2006officeonline.xsl"
  117.  
  118.  
  119. "ioc": "e.gu"
  120.  
  121.  
  122. "ioc": "content.inf"
  123.  
  124.  
  125. "ioc": "rame.thmx"
  126.  
  127.  
  128. "ioc": "harvardanglia2008officeonline.xsl"
  129.  
  130.  
  131. "ioc": "asis.thmx"
  132.  
  133.  
  134. "ioc": "arallax.thmx"
  135.  
  136.  
  137. "ioc": "ircuit.thmx"
  138.  
  139.  
  140. "ioc": "g.n9"
  141.  
  142.  
  143. "ioc": "erlin.thmx"
  144.  
  145.  
  146. "ioc": "ype.thmx"
  147.  
  148.  
  149. "ioc": "late.thmx"
  150.  
  151.  
  152. "ioc": "set.dotx"
  153.  
  154.  
  155. "ioc": "esh.thmx"
  156.  
  157.  
  158. "ioc": "rail.thmx"
  159.  
  160.  
  161. "ioc": "vent.thmx"
  162.  
  163.  
  164.  
  165.  
  166. "Description": "Performs some HTTP requests",
  167. "Details":
  168.  
  169. "url": "http://sukaponic.com/wp-new/val/vary.exe"
  170.  
  171.  
  172. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  173.  
  174.  
  175. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  176.  
  177.  
  178.  
  179.  
  180. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  181. "Details":
  182.  
  183. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x010\\x17r~\\x0b\\xf6d\\x82\\x91uicv~q\\xffj\\xb9\\xdbu\\xadbf\\xef\\xb8\\x07~\\x89\\xdb\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  184.  
  185.  
  186. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xee\\xe9\\x18\\xfd\\xe1\\xa2o\\xdb\\xe3\\x13\\xe7\\xeas\\x89\\x16\\xc6v\\x9ea\\x04\\xe9\\x1d&\\x96\ni_\\xcew\\x89\\xa5+\\x94z\\xd42\\x1b\\x10\\x17\\xc2\\xbe\\x82\\xa9s7\\x16e\\xa1\\xbc\\xb2\\xea\\xdf\\xb0\\xff!\\xd6\t&*)\\x99c\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2$z\\xdea_\\x00\\x15\\x98tu\\xed\\xba\\xe5\\xcf\\xee\\xb4\\xc5q1p\\xb1\\x8di\\x8a\\x05;@\\xca\\xd5h`\\xe1g\"\\xe7a\\xf6\\xb4\\xb7qq\\xebb-\\x88\\xcc"
  187.  
  188.  
  189. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  190.  
  191.  
  192. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  193.  
  194.  
  195. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x94\\xc4\\x11.3\\xc1x\\xaa\\xb5\\x83\\x96\\x11\\x91\\xeea\\xce\\xb45nc\\x89\\x1c\\x02?\\x91/\\x9a\\x86a\\xd9\\x81\\xf1\\xf0')\\x9f\\xe9\\x9cqqtx^\\x93\\x95\\xaa3h\\xdc\\xac\\xa8;a\\x8d\\x91\\x89\\xe6m\\xffc\\xbb^$*\\x9cn\\x85\\xbb\\x14\\xa3u\\x93\\xc9\\x81\\xf8\\x98\\x7f\\x91\\x12h=\\x03\\xb7l-\\x98\\xf5\\xac~\\x82\\xd0h\\xea\\xc4\\x9d\\xb3\\xcb\\xe2m\\x9da\\xf7\\xca\\x91 \\xcc:\\x01tfrdm\\xd8u\\x9b\\x97@\\xce\\x95@\\xe4\\x08\\x1e\t\\x1b\\x96\\xfd\\x90\\x1b\\x0b\\xef\\x03\\xad\\xe5g\\x04\\x1d\\xfd\\xbe&h\\xd8\\xe9l\\xac\\x13\\x1a\\x0c\\xbb\\xd0\\x90\\xb8\\xbck\\x046\\xe0vf\\xd9\\xdc\\xad\\x99\\x8b\\xb7\\x00\\xd7\\xd6\\x18\\xa0\\xf3\\xf0\\xe6-;t&\\x93\\x10\\xffn\\xa5$#\\xda-h+(\\xab\\x10\\xe2\\xfb\\x91\\xada\\xca\\x82\\xd0\\xcfu<\\xce\\x1a\\xcdmu\\xb3\n\\x1b=\\xac\\x9d\\xd5/\\x95\\xf0\\xe0\\x0e\\xbf\\x99\\xb0f\\xaab\\xc7\\xcb\\xef\\x07\\xe5<q\\xd8\\xf3zq\\x9b\\x02/\\xc1\\xcb,^"
  196.  
  197.  
  198. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xad\\x084\\x02\\x18\\xe4\\xbf\\x84lm\\x11\\xac\\xb6pp\\x04\\xd7q\\x7f\\xe5\\xf7\\xf3\\x9drx\\x10tdi1\\xed\\xdb \\xbersa\\xccx\\xbb\\x14 \\xb57\\xcdv\\xfd\\x0ep\\xa0\\xfe@\\x03l!\\xbe\\xef+t\\xbda\\xfc\\x92|\\x9ej\\xaf\\xeb\t\\x14\\xad9\\xd5\\x95r\\x90\\x83\\xbb\\xec\\x9a\\x06\\xb3\\x83re\\xa4\\xbc\\xd7\\xe7\\x93\\xb3\\x1b\\xc0g\\xbe6\\x86\\xe5\\xc3p\\x95*g9\\xfdz\\x7f+\"\\xcba\\x940\\x8a9\\xaemz\\xf3\\x9c4\\x8d\\xa0k\\xd5\\x99\\x18\\x16\\xebab\\xacf\\xd1\\xee\\xad\\xec\\x19\\xcb\\x04.\\xab\\xec\\xe0ut\\xea\\xfc$\\x938/wa5\\xe1\t\\x01jc\\x8do\\x1a\\xf9\\xf2\\xf1\\xcf\\xc0g\\xb7\\xfd\\xd8x`\\xce6g\\x021\\x00\\xdejq\\x92\\x7f\\xb4+\\xe1\\xe5\\x16\\x83\\x9b\\x9d\\xb4l\\x99\\xb4h\\x88\\xe8\\x0f)\t\\x82lcic\\x04\\xe9\\xebfu\\xfd*q\\xf1np\\xb6d\\x84n\\x9a\\xc7\\x94\\xdc\\x13\\x99\\x11(\\xfa>\\xb5\\x87\\x11\\x80\\xb6q\\xa0\\xeapz\\xef\\x01\\xa5\\xd7"
  199.  
  200.  
  201. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x010\\x17vuu\\xbf\\x04p\\xeb\\xa06\\xd0g\\xf8\\xb5\\x98\\xa4\\x06\\xda%\\x1e\\x94gc\\xd0hl\\x89\nv\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  202.  
  203.  
  204. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x13j\\xea_vz\\x8e\\x04\\x0c4\\x9f+ \\x90rc\\xa7\\x0f_\\xbc\\x8b\\x1a\\x80r\\x88jw b\\xd8\\xee\\xbc\\x01\\xd1\\xac\\xb0\\x16\\x87:w\\x87\\x15zz|\\x8b\\xbc\\x95\\xe7\\x83\\xb6a\\xb9s\\xfe\\x95@\\x92\\xc3\\xd7,x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\x7f\\xe82\\xbd\\xfe^\\xd1\\xc8\\xd3e\\x13c!\\x16\\x14'\\x1b\\xd8\\xbdsj\\x94\\xbd\\xfdt\\x01\\xd8!>\\x16\\x83\\x01\\x0bi \\x96\\x944\\xd0l\\x88fa\\xfb=\\xd1h"
  205.  
  206.  
  207. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p_4;y\\xe53vh\\x8a\\xa1\\xea\\x15\\xe0\\xcb\r\\x03\\xc3vt\\xda\\xe6bj\\xc1x\\x1c!a+\\xf9a\\x8b\\x0c\\xaaav.h\\x95\\xc2\\xb62i\\xcca\\xc9\\x15\\xd6!w\\xd0n\\x8c\\xa1;\\xb8\\x92\\xc8r\\xb7~\\x07\\x12qt\\xe1\\xec\\x8a(5\\x0co\\xa6\\xbecl\\xd9gh\\xb0\\xcd\\x86\\x1d\\xba\\xee\\x0b>\\x93\\xc6\\x1e\\xff\\x86^\\x84\\xebq\\x07\\xdb\\x9d\\xdaee\\xb3i\\xaed\\xb1w\\x98uh\\x86\\x89p\\\\x9d&mr\\xf5\\x1an\\xbb\\xaa\\x03\\x17\\x92\\xeag \\x04\\x9c\\x17(\\xf7'\\x93\\xbdg\\xf3.\\x84\\xff\\xbd\\xbf\\x9fw\\xc3\\x1d\\xcd!\\xfa<\\x91\\xde\\x1a\\x15\\xba\\x05\\x84\\xce_j\\x8d\\x94\\xa6\\x82\\xa7\\x0e\\x0c\\x94\\x0e\\xf4d\\x8f\\x1e\\xaf\\x19\\xae\\x92\\x98\\x81\\x9eqq\\xa8\\xf5\\xfe0n*\\x96\\x02\\xf6bt\\x16\\x1abg\\x80x\\xdb\\x9cv<\\xd8\\xa7\\x9f\\xa4b\\xb3z\\xb2\\x9c\\xac\\xeax\nrxi\\x19y\\x02o\\xfds\\xc3\\xb0zy/\\xfb\\xa0\\x8c\"\\x19e\\x96\\xdd\\xfe\\x85\\xe0m\\xbc\\xe3"
  208.  
  209.  
  210. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xe3q\\x81\\x11\\x8b\\xc8>m$ye\\xb9\\xb7&\\xe5\\x96\\x94\\xc2\\xdb\\x04\\xb0\\xbc\\xa1o\\xc7\n\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  211.  
  212.  
  213. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xbd\\xe6\\xd5\\xf6\\xad(\\xb1\\xbd\\xea\\x9b0*uk\\xba\\xd6ffwc\\x13\\x8d\\xbb\\xb9\\x1ft\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  214.  
  215.  
  216. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xf2\\xcd_8\\xe2n\\x84`\\x9b7\\xd4\\x195x'r\\x8c\\xec\\xee?\\x08\\xb4\\xbb\r\\x0b\r\\xa3\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  217.  
  218.  
  219. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w)+\\x1d\\xb2^\\xb7\\x06ec\\xd6\\xfe\\xb6\\xdd\\xc3\\xde\\xef\\xc1s\\xa3\\xed\\xcb\\xda\\x8c\\xe3\\xc5\\xb9\\x92@\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  220.  
  221.  
  222. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17wd\\xd5a\\x90\\x15\\xdbgs\\x01\\xcb\\x92\\xa0|\\xc0)+\\xb4`\\xf8\"@\\x00\\xad^\\xbe\\xec\\xe7\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  223.  
  224.  
  225. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xdb\\xfc\\xd50\\xdf\\x14\\xf909\\x82\\xe8\\x1d\\x07\\x036,)\\xcbr\\xb0\\xb6\\x04\\x9f%\\xd6a\\xdb\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  226.  
  227.  
  228. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\t\\xd7\\xd1ld\\xd6\\xd2\\xc0o\\xa2\\xb6jx\\xc1\\x16\\x9f\\x06^\\xe9\\x85a\\xd3\\xa6\\x08\\x83\\xdf\\x87w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  229.  
  230.  
  231. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17wf\\x89\\xc6\\x0b\\x19_bm\\xb3\\xe2@\\xd76\\xab;\\xc1\\xe7drq\\x84\\x06e\\xd0\\xaf\\xb1\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  232.  
  233.  
  234. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xfa\\x19\\x88!0\\x1c\\xe8\\xf5\\xc3f4\\xb3a\\x03\\xc0\\xef\\xe9\\x9d\\xd0\\x9355\\xfeic\\xbe&x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  235.  
  236.  
  237. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\x9e*\\xd9yz\\x01\\xae\\xec\\xbbu`\\xf5cm\\x9464\\xb6\\x99l\\xf1\\xdagd\\x1ev\\xedc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  238.  
  239.  
  240. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\x10\\x88z\\xe0\\xbf\\xe53\\xe0\\xe2\\xf3h`\\xb2\\xac\\x07\\xfb\\xd4\\xdctj\\x8e\\x07\\xa2\\xb8\\xbd\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  241.  
  242.  
  243. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\x01\\c\\xae\\\\xc4\\xf6m\\xdb\\xcd*\\x8b\\x06(\\xacj2t\\x94:_2\\xf6\\xcco9\\xb3\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  244.  
  245.  
  246. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\t\\xcef\\x12\\xf9-v\\xef\\xae\\x91:\\xd8\\xd1\\xa7\\xd9\\x9ck\\xc8u\\xc9\\x18\\xcf\\xfc\\x91\\x8d\\x12\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  247.  
  248.  
  249. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xbcu\\xfb$\\xf4ai\\xdd\\x8bl\\xdcs\\xe2\\x0e\\x82\\xc6 \t\\xeere\\x97d_\\x0c1\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  250.  
  251.  
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xbe|g7w\\xc74b\\x9c;\\xb1\\xe8\\xff:b0+?\\xe7\\xfe\\x9b^\\xd7>c\\xed\\x01\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253.  
  254.  
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\x0e9\\x05\\xa7\\x0c\\x07\\xd7\\x8a\\xc4\\x95b\\xde\\xa8\\x9d\\x08f\\x8e\\xb1\\x08\\xad\\x07(\\xc4\\x0cv\\x82\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  256.  
  257.  
  258. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xd2j\\x91m\\xd7\\xd7z\\xe3\\x1a5\\x82\\xa5\\xc8\\x82\\xc8\\xb3\\x10\\xf0\\x88\\xc2;,\\x12\\x0c3\\xed\\xdal\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  259.  
  260.  
  261. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\x10>r\\x0ep\\xc3d+z\\xe0b-\\xaf.\\xc9\\xcb\\x88\\xbc\\xb8\\xc5\\xaf\\xb3z'\\xedn\\xf9\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  262.  
  263.  
  264. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17w\\xb6\\xe8c\\xdfz'\\xf4u\\xc2\\xbc@\\x18j\\x9d\\xa0\\x9b\\xcf\\x94\\xe5j\\x8d\\xe4e\\x8d\\x18\\x9e\\xa8o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  265.  
  266.  
  267. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xab\\xd5\\xab2\\xab,\\x05\\x93u\\xe3ccy\"\\x08\\xb7\t=\\\\xa6\\xe3\\\\xfb\\x94.\\xa1\\xe2\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  268.  
  269.  
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x(cf\\x13u\\xcd\\xd0\\xc5l\\x82\\xe7\\xf5yb8)\\x0f\\xf7\\x1f?\\x96\\xb4n\\x8d\\x149\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271.  
  272.  
  273. "http_request": "winword.exe_WSASend_\\xce\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xe1\\xa3\\xf3k\\x9b\\xb39\\x99g\\xab\\x86\\x06\\xe6\\xcf\\x02\\x8c\\xe7\\xfamd\\x99\\xdb\\xb6\\x1c\\x04\\xb2\\xcct\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  274.  
  275.  
  276. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xb7p;\\xec\\x83!\\xa5\\xf7\\x97e\\xb17\\x8cg;\\xd1\\x0e\\x04\\xa5it\\x0f5\\xd1|<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  277.  
  278.  
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x1c\\xe4\\xe2\\xc5_\\xba\\x8de^fs<\\x83\\x896e\\xe3\\x84\"\\x19\\xd5\\xe8\\xa1\\xd7i \\xa7\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280.  
  281.  
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x98\\x07j\\xed-\\x97\\x9bm\\xca\\xcf\\xd5\\xc4\\xfakt\\xc7?i`yjb\\xe2uc\\xe2\\xc5\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  283.  
  284.  
  285. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x12h\\x9f\\x9e\\x88\\x03b\\x1e\\xe1^wf>\\xc7z\\xd0x'\\xd6\\xfal\\xa9%\\xe8\\x86\\\\x94\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  286.  
  287.  
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17xm\\xc8\\x1c\\x96\\x19\\xbaohl\\xbc|\\x91\\xbf\\xe4\\x81\\xe7\\xc2\\xf6\\xe8&\\xc9xk\\x00i7\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289.  
  290.  
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xef_\\xdd\\xc7\\x14\\xa5\\xc9\\xf1\\x86\\xc21>e\\xd6\\xee\\x0cg;\\xaa\\x17\\xd5_\\xe2\\xe4ec\\xfc\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292.  
  293.  
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x9b\\x19\\x88\\xe7\\xe3h\\xeb\\x01\\xbf\\xacj\\x14\\x1f\\xdf\\xea\\x91b\\xa4\\xb5\\xca\\xc0\\xdef=xku\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295.  
  296.  
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x9e\\x95zj\\xc0hh\\xc6\\xdf\\x00 \\xd3\\xbf\\x8f\\x04\\xe3@\\x84\\xd5\\x18b\\x95\\x00\\xf7vkm\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298.  
  299.  
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x$o\\x825\\x11\\xdc\\x88\\x84\\xe7\\x8f\\xb4\\xc2\\x14\\xa9\\x8b\\xee\")\\xee\\xder):\\xec\\x8a\\xf2\\xa9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301.  
  302.  
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17xj\\xec\\x9b\\xe2s\\xe8\\x98\\xe7\\x06\\xd6@\\xbf\\xc6\\xd3\\xaa\\xd0pbl\\x8d\\x12\\x92\\x9cn\\x10\\xaf\\xc4\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304.  
  305.  
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x90\\x8e\\xf8\\xe0w\\xf0\\xd5\\xd4\\xe6?y<\\x19\\x1cd\\x03\\xdc\\xfcrq)o>\\xa6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307.  
  308.  
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xda\\xa2\\xe9e\\xa6p\\xf8%\\x15\\x9b\\xe1\\xacm\\\\xe8>^\\x13x\\xffe\\x0b\\x86\\xfc\\x93\\xfa\\x1c\\x12\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310.  
  311.  
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\x7fv\\x96\\xfe\\x15\\x14k\\x9f3\\x10\\xc6\\xce\\xbdk\\x1b$\\x0e\\x86\\xac\\xf9\\xb6>l=\\xd9\\x07\tg\\x14\\x035\\xbf\\xa6^\\xcd\\x00\\xf6\\x9cm\\xeb%\\xf35\\x94:0\\x1b\\xd5\\xe5n\\xf1\\x07\\xcd\\x1f4\\xc7f\\x1b.\\xd2u#\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xef\rd^g>\\\\xddtn\\x9b4\\x89\\xe8\\x8a\\xe8c\\x8b|roy\\x0f\\x9dw,\\x9f\\xcb\\x0bv\\xf1l\\x812la\\xb9o\\x9d\\x0e\\x1ahvf\\xa15"
  313.  
  314.  
  315. "http_request": "winword.exe_WSASend_\\xa6\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\"\\xe4\\x11b\\x98d~\\xa2\\x037\\xe0\\xe7\\xf5\\x02xp\\x8e9\\xd2s%\\xcf\\xf9\\x10`\\xf9u\\x9d\t\r\\xfc\\xbc\\xdf\\x9a>\\xce\\xf2-\\x0f\\x91*\\xd9j\\xbcl\\x88\\x15\\x84\\xe3\\xb7\\x9chg\\xcdb\\xcb\\xad\\xc1e\r\\x8f\\x14\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xfe\\xddo\\xcfm8l\\xd6m^x\\xed\\xee8pi\\xdd\\x95qli\\xcc<\\xcc\\xab3\\xb9\\x16h!\\xfb\\xb2\\x87$\\xe8\r@\"\\xear\\xdc\\\\xbfh!\\xbd"
  316.  
  317.  
  318. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7gb\\xdb\\xfd\\xc9$\\xc9\\x8c_h\\x0cx\\x14(d\\xcd\\xfe\\xc3^\\x06m\\xc4\\x8byo\\xbc\\xf8d\r\\x99x\\xf8t\\x0b\\xfb\\x17\\xa4\\xff\\x02\\xd3\\xab,\\x0b\nga\\x02\\x13n\\xce\\xe1?c\\x97\\x96\\x93\\x91j\\xd3\\x9c\\xb3\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06hff\\xa8ee\\x0e)\\xbdbox\\xbc;\\x93\\x940y)\\xbc\\xbd\\xf4uobq\\xe6\\xa1\\xd9\\xff\\xaeii\\xa4_\\x0c\\xf9-\\xa4d\\xc9\\xfc\\x97\\xc7\\xff8\\xd3"
  319.  
  320.  
  321. "http_request": "winword.exe_WSASend_\\xa6\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\xcb\\x0f\\xa8\\xf2<?\\xa7\\xcda\\xee\\x03:\\xf6'\\x86\\x10\\xc2x\\xccn\\xf4+\\xd3\\xdd\\xa4x\\xfd\\xde\\x8bf\\x85|\\x11\\xb4~\\x0bzu\\xe4i\\xac\\x01)\\x15\\xa6l\\xbcirh\\x98\\\\xc5\\xded\\xe6\\x80\\x02\\xf5>\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x064~\\xbb\\xb57\\x16$\\xcfrh^\\xc0o\\xee\\xcb\\xfa \\xcf\\x8ei\"\\xa9a\\x8b\\x14\\x16p\\x17\\xddz\\x82\\x9c\\xcc\\xc3c\\x8b\\xee\\xd7\\xe4\\x01\\xb2\\x97-p\\xd8\\xf7"
  322.  
  323.  
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\xa2w\\x9f\\xb1\\xc5\\xb1h\\x07\\xa5\\x10\\xd2\\xea\\x1b\\xd9\\xa7v\\xeb|f/*\\x08\\xbf3r^m\\xa2i\\xa8?rg6\\xd7\\x8fn@cy\\xfc\\x82\\x1c\\xb5mlu\\xf5r\\xc6\\xce\\x05\\xe1!s\\xa2rs\\x02\\xbdc\\xc9\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\xc6\\xa1\\xfa\\xc0\\x04\\xce\\x12\\xec\\xb16x\\x9a@o\\x9c\\x14)7\\xe5d\\xa6u\\xb2b\\xe8\\xf3*\\xfb\\xd6\\xb8\\xbe\\xaf\\xcc\\xfb/\\x91a@//\\xfcg\\xec\\x8c\\xb9."
  325.  
  326.  
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\x87\\xc8\\xc9\\x0ey\\x17\\xeb\\xdb<b\\xb4\\x1c\\xbc\\xf4$\\xb3\\xded\\x84@\\xe1\\x95\\x05\\xb1u\\xbaxz\\xf7m\\x95i\\x1e\\xf8\\xd2\\xc1\\x90\\x07\\x84\\xc8\\xb0\\xd2\\xe8\\x97-/g\\xae<\\x96m\\xf1\\x03\\xff#2\\xa4\\xf9\\xfc3\\xf7\\x00<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000|\\x85y\\xe8\\x06\\xf59)\\x04b\\x06k\\xd2\n\\x02\\x85\\x85n\\x14g\\xc2\\x98\\xdf\\xa5\\xfa\\x0b\\xd8\\xe9\\x95\\x81\\xe5\\xac\\x91\\xf1\\xe0|\\x02\\x88\\x9a\\x99\\xf1j\\xd3\\xd2\\x1c<<"
  328.  
  329.  
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042d\\x00\\xce\\xde\\xcd\\x06&p\\xa0\\xf6\\xbc\\xcc\\xa4\\x9d\\xf5\\xa5\\xda\\x14h\rze\\xd0\\x1f\\xbf\\xa6ec\\xcds\\xf9\\xa2y\\xb0nu\\xf9i\\xa7v\\x9e\\xe0lf\\xd7\\xaf\\xe24b\\x1b\\x9eg\\x19-\\x9a\\xc4\\x04\\xf8\\xe2\\xd8\\x1a\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\x0cg\\xef\\xb7\\xd6\\xaco\\xf2b\\xfe\\x0f\\x0c/\\xe0\\xc0\\x80qe\\xe4\\x11\\x88&f\\xae\\xed\t\\xa1\\x9f\\xb7ct;\\xa2\\xf9dws\\xa1\\x0ct\t\\xb5++)w\\xc0"
  331.  
  332.  
  333. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8\\xc1/\\xc1i\\xd6\\xf2\\xb4\\xa0k\\xdfg\\x80\\x03\\x9dng\\xe2@9\\xfa\\x0b\\xca\\x1c\\xc8\\xa6\\xc9\\xbdro^\\xf0\\xe9\\xd2\\xbb$\\xf1!\\xbb\\x04\\x93\\xdb\\xa7\\xe9-i\\x9a\\xd3\\xe6)j\\xd2\\x86\\xa8\\x8d\\xd7\\xcc\\x81\\xf8\\xfes\\x91\\x81v\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7\\x14ms\\xf1\\xf8\\xf6*\\xa5\\xe9\\x86><nl\\xc6l\\x90,\\xbd^5\\x17)\\xa9\\xc0\\x11i\\xd4\\xac\\x800>\\x8c@~\\xd1gfv\\xa7j\\x89/&\\xdc\\x86\\xeb"
  334.  
  335.  
  336. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa9\\xd0\\xa6\\xc2\\xed\\x17\\x91\\xb9\\xbf#va\\xe9s\\xac\\x94\\xaf\\x14cd\\xc3\\x1e\\xed\\xb3\\xc7\\x9c\\xc5v\\x0e\\xedxc\\x89\\xfc\\xba\\xbf\\xdfa\\x88\\x1e\\x10s\\x15\\xa8\\xbfo\\xc3^r8~\\xff\\xe0\\x8d\\x00\\x9bo.i\\xeb\\xc4w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2\\x85\\x15\\x84\\xca\\xb3\\xe8\\xf0@\\xae\\xean\\xe2t3\\x86\\x0b\\xee^\\x83yw\\x93\\xb4\\xf1\\xba\\xeep:\\x88\\xe0u\\xf3\\x16\\x9a\\x93\\x14y\\x8f1\\xa6kb\\xf9`\\xf4\\xe7"
  337.  
  338.  
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xf0\\xf1m\\xb1\\xf0(\r&\\x80\\x95\\xdb\\xad\\xd0\\xa1\\x0b\\xc7\\xf7\\xb9;\\x84j\\x01\\xba\\x1b\\x92\\xfc:\\xc2\\x1016\\xc2\\xca\\x98\\xe2\\xfa\\xfe\\xea\\x9f\\xea\\xa4\\xdb\\xc6\\xf6x\\xb9\\xf7\\x95s\\x9a#\\xfe\\x937\\xe0\\x8al\\xbc\\x1e\\xcc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x94\\x89\\xb0\\xbej\\xa2\\x019tch\\xb1\\xba\\xf2\\xdd(j\\xf9\\x15\\xea=gj\\x9f(3z\\xedqb\\xcb\\xf1\\x88j\\xbe\\xc5\\xd5\\xf2e\\xb5\\xd8fo:\\x16\\xdb"
  340.  
  341.  
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaa\\xb8\\xe3n\\x8c\\xe5\\xe0\\xeb4\\xad\\xf5d3\\x00\\x89z\\xfc2ii\\x83\\xfd\\x13\\xb83z\\xc5k\\xdf#wt\\xe0r:\\xc0\\xdf\\x10\\xb5\\x83v_\\xb0\\x04e\\x89\\x8b&\\xa0itt\\xf1i\\xe3\\xc1&p\\xd9\\xa0\\xd3\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87k\\x9f&\\x83\\x7f\\xc2\\xec\\x18\"\\x19\\xe13f\\x8fhf\\x1c\\xb4\\x1cm\\xff\\xab\\x04\\x89d6\\xea\\xd5\\xd0j\\x1c\\xf5cmf\\x92\\x9c\\xb0f\\xf4q\\x1b\\x93zr"
  343.  
  344.  
  345. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1\\xa5m\\x822\\x0c\\x1d3;yp\\xc2\\xcb\\xda\\x99\\x1e\\x85\\x95\\xb5\\xbc\\xca\\x1f\\\\xe0\\xc0\\x95\\xd8ae\\x00p\\x89&q(\\x96\\xab\\xffw\\xb4\\x1f_\\\th;\\xdc\\xba\\x1c\\x93\\xb0<\\x07\\x83\\xbd\\x98\\xbb\\xc0\\xa0a\\xf5o\\xdd\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2\\x91vu8\\xbema\\xc3a/\\xe2\\x92\\xdeof6\\x81\\x13\\x1e\\x98&\\xf6\\xebn\\x84t27\n4\\x00n,\\xb5\\xd4\\xd8\\xe62\"\\xfd\\xd1=\\xf7\\x06q\\xb0\\x14"
  346.  
  347.  
  348. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#g\\xce5\\x89hb\\xaa\\xfa\\xaa\\xae\\xad\\xa4\\x98$\\x97`ak\\x85gy@\\xf18\\xa4?g\\xd2\\x8b\\xec\\xd4\\x9e\\x89\\xc6\\x7f\\xd4\\xbep\\x0b\\xb4\\xf24iod\\xe5\\xca\\xf7:\\xb6\\xec\\xf34\\x8d\\xbdz\\xd8.n\\x0e\\xbdu\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xefcu\\xee\\x12\\xe7\\xc4\\xbb\\xd9>\\x17\\x98+\\xf8\\xaf\\xed\\x9e\r:\\x08\\xa20\\xef\\x7f\n\\x9faa|\\xf8ng4i\\x06\\x0f\\x1b\\xa9\\xd0\\x1e\\xbf8h\\xc6\\xb8\\xa8"
  349.  
  350.  
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7a\\xba\\xaa\\xffb\\x0f\\x86\\xcafo\\xb9\\xe5y \\x0e\\xd9j\\xe6\\x1d\\x1c\t\\x01r!\\xdb\\xe4\\x1c\\xcc2\\x90s?\\x17\\xe4r\\xf1sg<\\xf5%:\\x99d\\xa5\\x85e\\xe3w\\xe4\\xb6\\x92mh\\x9c\n\\x91\\xech\\x8d\\x0b9\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k|\\x9a\\x11\\xb4\\xcd/\\xe3\\xe2\\xc0\\x86\\x17\\x05\\xb5\\xc6\\xda<\\xc0y\r\\x85\\xac\\x86\\xf6\\xcd7(\\xc0\\x90,\\xb3j/g\\xa5h\\xd2m\"\\xb4\\x95\\xe4\\xa9\\xd1\\xa8"
  352.  
  353.  
  354. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\x05\\x04\\xccv\\x14h\\x84d\\x1b\\x93\\x88\\xfd\\xc7\\x93\\xd6\\xd9\\xd3\\x1e\\x9an\\x8c\\xba\\xb7\\xedl\\x9dv\\xae:\\xe0\"@e\\xcf\\xad\\xb8ivb\\x19\\xf6\\xc7\\x9d\\x90\\xf8~\\xeb\\x9c\\xed+b\\x89j\\x86\\xe2\\x9b\\x94\\x84\\xff\\x10\\xb7\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^n7xd\\xf9\\x0f*\\xb6y(4\\xc7\\x15q\\x1e\\xe3\\xf7v3\\xcci8\\xd6\\xf1\\x99\\xcd\\x1b\nl\\xab\\\\xf4\\x80\\xb8\\x0f\\xa2\\xa89yh\\x84x\\xca\\x1daa"
  355.  
  356.  
  357. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0\\xf2\\xd3w\\xe0|\\xef\\xc56rwmbrx\\x9ay9e\\xce\\xbd\\x9b\\x10t\\xbc\\xc8e/h\\x92\\xc7t\\xd920v\\x95\\x1f~z\\xf9\\x05\\xa1@\\xcf\\xa1\\x97\\xaaq\\xc4\\xd5\\xa7\\xb9\\xb0f\\xf9\\xc2\\x8am\\x81je\\x91\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9`=\\x02\\xaf\\xa4\\xf4\\xfa \\x1e\\xa4\\x9d\n\\x80n\\xc0\\xe5p'\\xd9\\x8a\\xef\\xa7)gt'\\xe1\\x80\\x8b_\\xc3\\xf9\\xcd\\xacg\\xff\\xb2?\\x19\n\\xc9\\xc5\\x86\\x87@"
  358.  
  359.  
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\x1f\\x07h\\x8f\\xd6h\\x02\\xc0\\x88\\xc655\\x9bhk\\x13\\xd9\\x17\\x97,e\\x02\\x18dt/b\\xad%\\xaf\\xf3\\x9f\\xbf\\x06\n\\xfa\\xa8\\xf9p\\x1e\\xcc\\xda\\xdb\\x1b\\xdf\\xfa\\x12v\\x19\\x82\\x90_\\xfan\\xcfu\\x13>\\xe3\\x1b9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k<\\xd7o\\xdf\\xc8\\xee\\xd5\\x0f\\xc9e\\x19\\x8a\\xe9\\x1a\\xbe\\xc7\\xd9p;\\xd0\\xdd\\xad`\\\\xfd9p\\xf9b\\xf0\\xcb\\xa7\\xc8\\xdf\\xc9o\\x12s\\xea\\x05:7\\x85\\\\xf2"
  361.  
  362.  
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17xn\\x1fu\\xf1\\x12\\xda\\xaf\\xe2\\xb4\\x9e\t\\x14\\xe6\\x0cp0%\\xdb\\x86\n\\xc3\\xb9\\xa2\\xc4\\xb53\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364.  
  365.  
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x)?\\xef|\\x90\\xa3\\x1b<\\xffk\\x1bw:\\xb5=\\xcb)\\x86*\\x02\\xd8y\\xca^\\x92\\xdc\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367.  
  368.  
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x1e\\x8e\\x1c\\x18\\x80_\\x11\\xc7o`en\\x9e\\xac\\x8b\\x8d\\x1e\\xee\\xcb\\xc4\\xe0e\\x87\\xb0\\xb2\\xe0/\\xe0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370.  
  371.  
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x04w6\\xdda\\xf6\\x8dw\\xd9%\\xbd\\x11\\xaf\\xf6\\xca\\x8b\\xc5\\x81\nwp\\xd8\\x06\\xf6f\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373.  
  374.  
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17xn\\xc9\\xe0\\xc8`\\xed\\xf16\\xa5nnh\\xa4\\xb2\\x87\\xb0\\x91\\xbfo\\x89\\xbb\\x1dm\\xefs\\xbal\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376.  
  377.  
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x89\\xd2a\\xf31\\xd8v7\\x19\\xa7\\xe74\\xe4\\x00r\\xf5\\x1f\\x82\\x04\\x91\\x84\\x14!,\\xf9\\xf7\\xa2h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379.  
  380.  
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x+p\\x95\\xe8\\xea0>e\\xacb\\xee\\xe5\\xfe\\xa2\\x8d \\xbd\\xee\\xf0y^\\xbc\\xad\\x95n\\x8d\\x8e\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  382.  
  383.  
  384. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xc2\\x87:\\x1f\\xee\\xc2\\x92\\x91zp\\x93d/\\xf3\\x03tp?\\xc3\\xa6u\\xc0\\xbe\\xfb\\xff>\\xb6c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  385.  
  386.  
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x18\\x93\\xed\\xc1=e\\xd1\\x00\\xf4\\xff\\xfa\\xde\\x97\\xe16;bxp\\xfai2\\xd9a+\\x1b\\xe7\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388.  
  389.  
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x`k\\xaa\\xa7\\xfa\\xeb~\\x84|\r\\x17\\xbe\\xbd\rv6\\xa1\\xab\\x88\\x8e\\xbd\\xe8\\x16.\\x1ag\\xbe \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  391.  
  392.  
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\x85\\xaf`q\\x88\\xfb\\xf7\\xd4\\xe5 \\xdey\\x16\\x07\\xb2\\xe7j\\xfa\\xff\\x0fmk\\x1f\\xef\\xb3\\xae\\xb7b0~\\xc9\\x9e\\x07\\xed5\\xc2\\xecb\\xcbv\\xed\\xa0\\x8a\\xb6~*\\x87o\\xfb\\xbd\\x0e:\\x8a\\xa3j\\x89nh\\x04\\xebj\\xfe|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x00083\\xaa\\xa2\\xc7(u\\xd5\\xce\\xeb#c\\xee\\xcc\\x9a.\\xbfdn\\xe1\\x1c\\x1e\\xe2)\\xd3\\xf2*\\xc4\\x16\\xce\\x19\\x9ch\\x18\\x91\\xfbf\\xf2\\xeb\\xe9\\xea\\xb4\\xb6 \\x0f\\xaa\\xc6"
  394.  
  395.  
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1+\\x86\r\\x817re\\xc7g\\x82\\xd9\\x91\\xa9\\xea\\xe7\\x8d\\xed\\x8djg\\xbe4\\xca\"_\\x8fd\\xd1l\\x14\\xcd\\xa2\\xc1*\n\\xa04h\\x93\\xd6\\xf7>\\xa9ydo\\xaddz\\x1d\\xdf\\xddj\\x10m\\x8b;\\\\x0e;\"e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xae\\xbf,\\xad\\x95\\xd6x\\x96\\xb3m\\x1c\\x1f)l\\x84\\xba\\x95\\xdec\\x8c\\xceh\\xaaaa~\\xf6\\xeb\\x88\\x90\\xd1\\xf5\\xfdt\\xf1\\xf6<\\xaf\\xb6\\x92a\\xc3\\x13\\xc9\\x0cj"
  397.  
  398.  
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\xf6w\\x98\\xb7h0\\x81\\x0epmn&\\x08\\xe1t\\xfa\\x02\\xa7\\xb2\\xa4\\xb9q)\\x88y\\xf3\\xfd\\x8d\\xafu\\xba\\x96\\x12n\\xf7\\xf8\\x94\\x81vt\\x02\\xf5s\\xe9\\xee\\xbfs!\\xe6>h\\x15\\xb1\\x0c\\x1c\\x08\"\\xd0\\xf04\\xa1\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x1bb\\x92u\\xb2\\x1b\\xb8\\x90e\\xed\\xab\\xb6\\xfd\\x83\\xcb\\xcc\\x168\\xec\\xce\\xfca\\x9e\\xbex\\x81h/\\x1bg\\xa1\\xc1qc\\x87\\xb1\\xce\\xf6\\xa5$\\x14r\\x1cl_\\xaa"
  400.  
  401.  
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93\\xe8\\xde\\xc8!\\xa5@\\xb6\\xde\\xb6\\xde4\\x9d\\x8d\\xa0odpg\\xd2\\x95qh\\xd6s\\xd5\\xe0\\xf0';\\x04\\xd1\\x06+s\\x999\\x02`\\x86\r\\x8e\\xbc\\xd1\\x1f\\xdblvr\\x88\\x1b\\xf2qs\\xc7l\\xdf\\x05\\xfc\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\x17~\\xe5x\\x8b1\\x91u\\xc8_\\xe6\\xee\\xebz\\xab\\xea\\x7f\\xfdg~*\\xb3i\\xb5u\\xa1\\x85\\xd8\\x87??\\x08x\\xc4qivs\\x9f\\x86>\\x83\\x94p"
  403.  
  404.  
  405. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x4\\xd29\\xd6a\\xceo\\xde\\x9c\"\\xb5\\x19h\\x9ai\\x16~,\\xbf\\xd3\\xe5\\xd7\\xddi\\x90\\xbaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  406.  
  407.  
  408. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x8e\\xc88\\xaa,\\xb0\\xc5\\xa3a\\x85\\xd7\\x13x\\xd6d\\x03\\xdf\\xbcz\\x8c\\xaa\\x87\\xf2\\x9fpi\\xdb\\x16\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  409.  
  410.  
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x12\\x99\r\\xc6v\\x19e\\xa8as\\xa0e\\xc8>\\xe9xe\\xc9\\xb2\\x0ec8uc\\xbc\\x84z\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  412.  
  413.  
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\n\t\\xe1em%6\\xca\\xa1x\\xc4nf\\x8b\\xea\\x82\\x13\\xce\\xdd\\x06\\xb0,\\x01\\xc9\\x80\\x0c\\xb9$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415.  
  416.  
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x16\\xd0\\x95a\\x00 \\xa4\\xcar\\xe9=w\\\\xc9\\xde\\xebqo\\xc3\\xd1\\x98\\x16\\x97\\x8e\\x1b-\\x99\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  418.  
  419.  
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x0f9vg\\xf0m\\x0e\\xfa\\x82\\x1f\\xae\\x1ck\\xb6)\\xbe\\xcaz\\|\\x06\\xe1\\x9b\\x1de\\xd2\\xb1\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  421.  
  422.  
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xb8\\x93\\x8c\\xc5\\x9cy\\x00,\\x19\\x12)\\xbd\\xa9g\\x87i\\xf9\\xdah\\xf8\\x04\\xc4j\\xe4\\xfa_w=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424.  
  425.  
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xc8.l\\xde\\x90\\x94\\xb6g\\x9e\\x8f^~\\xaf\\x96\\xb5cvb\\xa2c\\xff\\x84\\xbc\\xcfgh\\xe0z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427.  
  428.  
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7y\\xcer\\xf7\\x03!\\xba)\\x7f\\xdd\\xde\\xf1 g\r\\xb1&\\xa8\\x88\\x0f\\xe7\\xcb%?n\\x94\\xff)\\x159t\\xe6\\xf8m\\xee ;boh\\xfag\\xb7\\xff\\xd2\\x89j\\x92\\xb2\\x02\\xc6\\xd7,v\\x85v\\xdf\\xf2\\xd22\\x18\\x867\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~i\\xe32\\x90ldi\\xe2g\\xdb\\xf0\\x83\\xcd\\x95z\\xbdy\\xf7_\\xb1\\x12\\xe5\\xba\\xff\"\\xe2\\xf9\\xaa3\\x82\\x01\\xa4\\x92'\\x9e\\xb9\\xe5s\\xd7\\xbe\\xde\\xeb.g\\x0c\\xc0"
  430.  
  431.  
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xf7\\x98\\x89x\\x12%g\\xaf=\\x82\\x89\\xdd\\xda\\xf4\\xdd\\xb6\\xc6\\x0f\\x94#aek\\x1e\\xe6\\xeb\\xee\\xd2\\xb6z\\x13uv2\\x00w\\x8d\\xb4\\xefrk\\xb4\\x14\\x15=\\x88\\xcc=\\xb3\\x9b \\xa7\\x8f\\x15 l\\xd9\\x99\\x7ff\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\xe0\\x11j\\xd4^\\xdb`>i8\\xae\\xda\\xa7\\x9d\\xfdp\\xb6\\xaf\\xc6\\x85\\xc5/kw\\x03fn\\xf8\\xa6v\\xde y\\xc6\\x98\\xa1\\x9a:\\xca\\xcct\\x8a6q\\x94\\xc6\\"
  433.  
  434.  
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\x1e\\xd3\\xbe^w&\\x1b\\xe0n\\x93\\x7f\\xa9\\xfd%\\xf0\\x8cpk\\xe4`\\xd0\\xcc\\xdf\\xd5\\xa3\\xe9\\xee\\xba\\xcc\\x9d\\xf0h\\x1d=\\x1b\\xb6\\xdc0u\\x86\\xd1p\\x7f\\x06j>ee\\xbd\\x7fvl\\x18\\x95\\xee\\x16\\xe2\\xa30\\xfe\\x10\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08\\xbf\\x1a\\xfbj.s\\x1d\\xdc\\x17%\\x83,\\xb3+\\x0b\\x96\\xd0\\xe4\\x8d\\xc1(\\xe9/g$\\xa5\\xb4\\xef\\x00\\x80\\x04t\\xa3\\xe1\\xc8\\xab\\xf8i\\xbbe\\xe7j\\xbd\\x01\\x94v"
  436.  
  437.  
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\x95\\xf6p\\x19\\x1f|w\\xdd\\xd3\\x0c\\x8eb\\xbfs\\x85\\xec\t\\xf9\\x84\\x07\\x9c!`\\xd0p@\\xe3w\\xfa\\xc5e\\xa3<\\x1a\\x0f\\x07\\x0f\\xdfu0'\\x10u\n\\xd1\\xd8)6&|\\xff\\xe29\\x9a\\x85\\xb6\\xb2\\xbazx\\x8b\\xbe\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xe3\\xd8\\xe0+\\xee\\xe2`\\xc86v\\\\xa3\\xf7\"|\\xd3\\xd3\\xc2\\x05wzkq\rv\\x84\"oh/\\xf9\\xa7\\xa7vi\\xb1\\x04\\xb3\\x8a\\xfez\\xe5\\x05\\xa1\\xe6\\xf4"
  439.  
  440.  
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d\\xb8yu)\\x01\\x8f\\xcc|\\xc0v\\xaed\\x99y\\xa7\\xcbkb\\x83\\x84\\xc5u\\xcf`\\xe1\\x98\\xb1\\x89@\\xed\\x16\\x18g\\xca\\xe7\\xe3a\\xd8hx4\\x19w\n_\\xed\\xaa\\xbfm2-\\x8b\\xfet\\xc1\\xf6qf\\xc6#l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\xeb\\xe6e\\xb0\\xef`\\xff\\xb7\\x7f\\xad\"\\xc5\\xa8\\xb1\\x05\\x8d\\xc8\\x9aa\\xaa.!p\\x0e\\xac\\xe6nd\\xab3\\x93d\\xad\\xff\":;x2\\xb2\\x84z\\xfek\"\\xa3"
  442.  
  443.  
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0bq\\xf7\\xaa\\x1e\\x9e\\x96\\xbcn\\xad\\x83\\xd9\\x8c|-vlb\\xd2\\xa7vi\\xeb\\xd5,\n\\xf5\\x94h\\xf685\\x05\\x8b\\x8a\\x95\\x8f\\xf3\\xed\\x9b/\\xbb\\x93rz\\x06\\x07\\x0e\\x89\\xbamm\\xa6\\x03\\x1f\\xb9\\xc3\\xd6/\\xce\\xf74\\x05n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\x05\\xd4tn\\xd9\\xe8\"p_\\xechn\\xd2\\x8d\\xae\\x99\\xd2\\x18r\\x83\\xc9\nq\\x07\\xdf\\xfd\\x00\\x02;\\x05\\xf6\\xc2lf\\x9a\\x9f\\xd3\\xcf0\\x80\\xf9b\\xe8\\x96\\xc5\\x9a\\x03"
  445.  
  446.  
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\xed\\xff\\xe2\\xe6;\\x93t\\x950\\xb2\\x83\n\\xc3n\\xe7\\x9f\\x9a\\x10\\xcal\\xdb\\xeb-e\\xfb\\xc0 \\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448.  
  449.  
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\xb1\\xa1=^y\\xdec\\x80c\\x9e\\xf9\\x83\\x97\\xf3\\xd4:\\xb8\\xf8_\\xeb\\xbd\\xc1\\xce\\x85\\xde\\xe8\\xef\\xcf\\xf8i^\\x04\\xf8\r\\xc6\\xce\\xf4k\\x06\\x92\\x9c\\xbc:y_\\xa8@\\xca\\xbc\\xb1\\x9d\\xa1\\xd9\\x0c*,\\xae\\xc4!\\xba\\xe2q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nw\\x05\\x9f\\xd4\\xb94\\xceg\\x8ak\\xdd\\x81\\x9d\\xba\\xf8\\x1ds\\x04~\\xb0\\\\xc3\\xab)o\\x04\\x99\\x1au-.\\x11\\x14\\x86&z\\xa4\nw\\x8d\\x9ev\\xe1\\xd1\\xdc\\xa6 "
  451.  
  452.  
  453. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xcd\\x1a\\xf3\\x1f\\x99\\xe5\\xd9\\xcc\\x83\\xc8\\x98\\x81\\xd6%\\x82\\xfc\\x04\\xf0qm\\xa2\\xd2$\\x80\\xb5\\xa4b_|=l\\x0e\\xbf\\xd30m\\x82c\\xca\\xcf@b\\x1a-\\x1csf#\\xe5\\x04\\xd6\\x1d0\\x1b\\x1a+\\xd3\\x17\\xca\\x87\\xe6|\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\x9bb\\x87n<+\\xd7\\xb4.iwm\\xf2f\\x90\\xe3r\\x10\\xbd\\xf6\\xd72\\xcat\\xa6\\xb5\\xce\\x07\\x83\"k\\xdd\\xa2g_\\x97\\x8a\\x05`\\xc3\\xe2\\xb3d\\x88\\xf1"
  454.  
  455.  
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\x9d\\xfe^\\xc6|4y$$\\x1b\\x08o\\x1at\\xb9<6z\\xff\\xa0\\xed,\\xd8\\x7fz`\\xaf\\xe8\\x9da\\xadb\\xe8\\x90\\xc2\\xe6\\xa6\\xe4\\xbe\\xe7\\xfb\\xf4\\xe4\\xdc\\xc5\\x191f\\xbf\\xad\\xbc\\xad@\\xd4\\xb2\\x15\\x9b\\xfe\\xce2\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000^\\xd5\\x8aq\\xdbv\\x83\\xa6\\xe5'\\xf8-\\x88\\xaa|ig\\x18\\x86\\xbe\\xfc\\x1d\\xfe8\\x02*%\\xefg4\\xb9\\x9b\\xe4\\xf3\\x8b\\x1e\\x97f\\xbb\\x021\\x85l(e\\x16\\x1f\\xf2"
  457.  
  458.  
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6\\xca\\x12\\\\xe2\\x86\\x19\\xa8\\xd0\\x91huy\\xb8\\xc5\\xed|\\xfa\\x08\\xb8\\x8f\\xa2\\x80\\xf6\\xa16va\\x80\\xb5_\\xa0\\xd2q\\x99;\\x80\\xc3\\x99!\\xb6,\\x1c\\xe0d\\x1f\\xca\\xe1\\xb7\\x908y\\xed\\xbe\\xce\\xc2\\x18\\xf4\\xc3l\\xf1\\x08\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2s\\x8c\\xdc\\xc6|\\xfazr.\\x8b\\x0f\\xdb~\\x06\\xaa\\xe1~\\x94\\x9a\\xf4!fh\\x0f\\xca\\xd3\\x07\\x13u\\xf2\\x02r\\x1a\\xf6\\x8b\\xd7lk&e\\xf9t\\xce\\xd6uqt"
  460.  
  461.  
  462. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2(!0~\\x84\\xc99\\x06\\xd0\\xee\"\\xc8\\xaa+\\x1ek\\x04\\x15>\\x0e\\x94e\\x17k\\x90le)\\xd5\\xb9\\xca\\x124\\x12\\xfb\\x07\\xa0\\x12\\xf3\\xb3\\xc6\\xc2\\xdem\\x8d\\xee\\xc9\\xed\\xeb\\xbc\\xd81\\xf45\\xb8tj3\\xc4\\xf0&\\xefa9;\\xa6\r\"\\xa2*\\x0f\\x88\\xc3\\xdc\\xc5\\x8f\\xd3\\xd0\\xdb\\xa9\\xe2\\xdc\\xb5\\x86x\\xbc\\xb0\\x8a\\xb3\\xf51\\xbd\\x9fk\\xf4\\xe9\\x9e\\x86\t\\xb01\\xebb\\x03\\xae\\x06\\x8bz\\xc4j\\x0ch9y\\x8bhm\\xbd\\x11p\\xf4\\xa2v,\\x1e\\x83h\\xd8\\x12\\x8f\\xc5\\xb3n#\\xe87\\x19i\\xaa\\x06|\\x99\\x0f\\x1a\\xd5\\xb3\\xc1\\xddv\\x99\\x01\\x07p^\\x90)\\xd4t\\x93*.\\xd8\\xfb\\xfa\\x14\\xf9\\xbb2\\x0f\\x96\\xe7\t\\xc7\\xf3\\xce\\xe3\\xdc\\x9a\\xc9\\x0ez\\xa1,p\\x10\\xdb\\xbb\\xe8\\xe7\\xadgl\\x0c\\x10\\x9e8c\\xbc9\\xb5^x~y@s\\xcb\\xe9\\x9f\\xcf\\x7fh\\xa8(\\xfawe4`x\\xf3\\x91q\\x17@\\xe2\r%b\\x16*\\xa1\\xb9>\\x85\\xa53\\xa0d\\x7f\\x91!\\xb7\\xe5\\xaeg\\x9a"
  463.  
  464.  
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xd0v\\x90a\\xa59\\xca\\xc8\\xb8s\\xcf\\xce2\\xcct\\xd3\\xb7\\xc3\\x8e'\\xf8\\x82\\xa5\\xc8\\x12=z\\xb9\\xa9\\xeb\\xcb\\x8d. \\x91n\\x97\\x8c\\x00\\x9e\\x8d$:\\x94\\x0c+\\xec\\x88\\xad\\xd7\\xd38s\\x91-\\xe6\\xa0(\\xdd\\xe8\\xc3\\xf1t\\x7f@\\x8d\\x85j\\x8f\\xf0\\x00\\xe7\\xef\\x0b\\xeb\\x94y\\x8fo\\xeabd\\xf5l\\xd9\\xbe\\xf7%++v1\\x84\\x9c\\xef\\x10\\x90\\xacv\\x1evi\\xba\\x89z\\xec\\x03\\x0e\\x1d\\xddi-\\\\x95\\xad0r\\x8e\\xfa\\x9byj\\x9e\\xaf\\xa9\\xe2fw\\x89\\x003\\xcd\\xfdupd\\x18\\xd5'\\xd0\\x8ffj5\\xe6d\\x86\\xce\\x16\\xe8\\x1cek5\\xf9s@\\xcf\\xc8b\\xe2\\x89k\\xd1p\\xe7\\x8d\\x86k\\x11\\xaf\\x16\\x1f\\x10^ \\xf2\\x0c\\x04\\xd1\\x93\\xd59\\xb8@\\x85\\xd1\\xf3d\\xb2\\x04\\xfb\\xd2\\xden\\xd7\\xb9b|\\xdbn\\x8c\\x1d7\\xfb\rn\\xc6be\\x9c\\x8f-\\xa7\\x11\\x17c8\\x08\\xc5a\\xd6\\x95\\xa5\\x9fl\\x1d\\xa26x\\xd5z\\xe9\\x93|\\xb8=y\\xdas\\x18\\x90\\\\xbb"
  466.  
  467.  
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15\\xeas\\xca\\x94wy\\xf9b\\xa9i\\xaf\\xdd\\xdc\\x8b\\x1d\\x90\\xcf\\x05\\x8e\\xce\\xee\\xf4\\x1b\\xd3\\xc1\\x89\\xc1\\xd2a-\\xd4\\x98\\xc4i\\x03>\\xa0\\x1d*\\xf4^\\xfeh\\x80r\\xdd\\xcby\\xdc\\xae\\x94\\xb5\\x7fe/\\xc2\\xa1\\x8dz\\xd8\t\\xa7v\\xd1\\x8b\\xb2\\xd1\\xd5\\xaen\\x90\\xa3\\x95\\xb7v\\xfaf\\xc8\\xc1ck\\x92\\xa4j\\x9e\\x06&\\xfd\\xed\\xd8\n\\xe5\"\\x160\\x19\\xaf\\xd7`\\xe7h\\x9b\\xe1\\xbb\\xfb\\x80\\xdc\\x01\\x99\\xe769\\xa4\\xca\\xda\\xb7\\xf8\\x1f\\xd9z\\xdb\\xd1w\\xbd\\xde\\x90z\\xa0\\xc6\\xb0\\x13g\\xad\\x9a\\x89\\x9f\\x08w\\xb7j4\\xa2\\xef`e\\xa3u\\x1d\\xbct\\xb4\\xdcm\\xca\\x15\\xd9a\t\\xa8b\\x1e\\xa0\\xf4\\x87\\x0e\tn\\xc6f=4\\xa9@\\xe3\\xa7\\xa3\\xd5\\x02w\\xf6#\\x82\\x16\\x9dd1g\\xfb\\xd7\\x1c\\xd474\\x8dff\\x93\\xad;2\\x90j<f$\\xf9\"\\xfa|\\x8d\\xb3\\x94k\\xa6\\x06\\xf7jj\\xfc\\xb0g\\xd8_c\\x01\\xef\\x97\\x94\\x99+\\xa8c\\xa2\t4y\n\\x0e\"\\xa9\\xa1d\\xc5"
  469.  
  470.  
  471. "http_request": "winword.exe_WSASend_\\x92\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\xa4j.c\\xd5\\x99\\x87\\xf9\\x16b\\x11\t\\xda\\xbf\\x9ex\\xb7.>\\x81\\x19<\\xaco7\"n1\\xa8\\x10\\x86|d\\xbd\\xdc4\\xda\\xde\\x80\\xbd\\xde\\xf8\\xd8_\\x08\\x97\\xc2\\xf2\\x99\\xf2\\xc9>\\xa3!#\\x9d\\x82y\\x8b\"\\x82\\xed\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\xf8\\xb0\\x8c:\\xb2\\i\\xa2.\\x8c\\x90,\\x90&\\xb78x\\x1dv\\xbd\\xd1\\xdd\\xfayk\\xee\\xde\\x11\\xba\\xfb#n\\xa5\\x87\\x08-\\xe5\\xc6e\\xa5\\x85\\xbdu6\\x00\\xcf\\xe4"
  472.  
  473.  
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xc6 \\xb5\\x03\\x94s\\xba\\x85\\x06tl\\xc6\\xb6\\xad\\x8e\\xfe\\x1e\\x8c\\x9d?\\x88\\x19\\x927\\x99?\\x8c\\x9b\\x12z\\xa9;\\xea\\xa1\\x89\\xea\\xb4\\xf6\\x02\\xb9z\\|\\xdea\\xb2\r%\\x98p\\xa7j\\x06\\xc2\\xfc~\\xca\\x1a\\xd2\\x97\\xa4\\x83x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xd8\\xd1y\\x19r\\xdbx\\xa4q\\x9e\\xb0j\\xd2\\xb4k\\x9cp\\xce\\xd0sj)\\x03\\xf9\\xab.\\xb5\\xc9\\xfc\\x07\\x8e\\xefwz \\x04\\xb5\\xb4\\x00\\xb2\\xd0$\\x12h\\x1d\\x1c\\xeb"
  475.  
  476.  
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc\\xf6\\xc6\\xe1>o\\x01\\xfe\\xc1\\xaa\\x8e\\x8e\\xf1\\xde=\\x9b#j\\x1a\\xde\\x93:%:h\\xa5\\x99\\xcf;\\x04\\xcc\\xdf\\xd9\\xb2\\xb6\\xca\\xf5\\xfeo\\xb8\\xceu\\x9d\\xdcj\\xcdu\\xb2\\xd9\\xdb\\xdf\\x8bzx\\x7f\\x83\\xd5d\\x8cf\\xc0\\xb4\\xb5u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1k\\x8c\\x0c\\xd7\\xf6\\xaf\\xb3\\x84\\x10\\xf8n\\xd0\\x07`\\xbfl\\xb4q-cv\\xa2\\xad\\x98(.\\xfa3\\x15z\\xbb\\xec\\xe9x\\xd5\\xf0\\xe5\\x05\\xa8q\\xd5\\xf4\\xa2n\\x99"
  478.  
  479.  
  480. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xf4x\\x0e\\x87\\xc2m\\xb2\\x14\n\\xe19\\x82y.\\xe4\\xf4\\x9c\\x8b\\x9b6\\x18\\x8a\\x9ae\\xa0b1.\\x18r\\x12)\\xfdl\\x13\\x8d\\x07\\xaa\\x12$>n\\x98\\x9e\\xbf\\xd0\\xe9\\x1c\\xc2\\xd6\\xce\\x89\\xec;\\xae\\x95\\xae\\x85\\xb4\\x02&\\xb8\\xff\\x01\\x03\\x94\\x7f\\xbdw\\x89qx\\x05;\\xb7\\xaa~\\xe2\\xa7\\xaa\\x90\\x91gh\\xb5\\xd7\\xf1|\\xb4\\xbb\\x15\\xa0/\\xd2\\xbbj\\xdb\\xfc\\x9bx\\x8f\\xf1\\xd1&t\\x8d\\xb95\\x0f\\xb1\\xd6\\xad\\xf3\\xe3\\xabia\\xc6\nv\\xd8e\\x84h0d\\x0c\\xf8\t\\xbdg\\x9e.\\xbc!\"\\x9a|\\x8e\\xdb\\x898\\xc1\\xe5\\x11\\x8b \\x04\\x18\\x07\\xd8\\x14\\xc4\\xda\\x0cu\\xde \\xe6\\x83\\x08\\xbbpq\\xd5\\xf8\\xa4\\xf4\\xa6\\xd9\\xf7\\xb5\\xad\\x83\\xb8\\xf8ino\\xdf\\xd2/\\xd3`\\xf3i\r\\x19f1\te\\x07|\\xfbi\\x19\\x94\\x0c\\x89:\\xbd\\xeb\\x15'5z\\xfd\\xb9\\xf0\\xad\\xa7\\xd4\\x107\\xda~!\\xe3w\\x04_\\xd2l\\x13/ba5;\\xb6|\\xeffla\\xef\\x10\\xe9\\xf8\\xbdxx(\\x93\\\\xb1g\\x11"
  481.  
  482.  
  483. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\x04\\xb1\\xd1n\\xd4|\\xcd\\xef\\x99\\x14\\x0e\\xbb\\x84\\xf7\\xc5j\\x93\\xacbq\\xd6q\\xb6\\xcbi-\\x98\\xd1\\xecp(\\x04\\xd3\\x0e7\\xf3\\x1f\\x9d\\x13\\xbc\\xdc\\x82\\xd2\\x8e#\\x04\\x8f\\xe6k\\x86\\xf9r\\x13(\\xbc\\xa8\neh\\x95\\x9b\\xb2s\\xc2\\xb5\\xa3\\x1d4\\x96ms)\\xf4\\xe6\\x03\\x17~o\\x0c\\xab\\xfc\\xa7d\\xb1\\xf0zfn\\x1c\\xe1w\\xb6\\x04\\xa6\\xb63\"\\xec\\x13\\x13\\xacf\\xc3$\\xaak\\xc2\\xc6\\xb9\\x82\\x82\\x97j\"\\x8c\\xfeq\\x19\\xd4\\x91\\x93#+8\\xbbj\\xc1\\xbe\\xd48\\x9di\\x14\\xbe/m\\xc0c\\xea\\xd1n\\x86\\x88\\x957khgf\\x1a\\xc5l\\xa7\\xa6\\xcd\\x18\\xf6\\x02\\x87a\\xbdut6;/2l\\xd3o\\xcd\\x99\\xf4\\xfd\\x92\\xd0?\\x86\\xa8\\xd5\\xe9\\xa4\\x95\\xe5\\xf4pqk\\xef\\x1d\\x8e7\\xd3ai\\x9a\\xfb\\xa5\\x0b)\\x9dt|\\xec\"(u\\xa1rq\\xcbd\\xddv\\xfe\\xfc\\xc7x#\nt\\xe5$\\xf2\\x80\\xfe a\\xdb\\xe7`\\xbe\\x97\\xa2~\\xbf\\xc0\\xf4\\xe6\t\\xab\\x82t"
  484.  
  485.  
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17xk\\xa0#b\t\\x03\\x95\\x19\\xcf\\xf4\\xc1\\xbb\\x13sv8\\xfc\\xbb\\xe4\\xc0\\xb9\\xd6\\xf8u\\xcec\\xfa\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  487.  
  488.  
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd7)^\\xdb\\xf3\\xf1>\\xdb\\x80j\\xa4\\xab\\x918\\xa9s\\xbd\\xe9\\xed\\xb0\\xe8e\\x89\\xbb8\\xed\\xe09\\xf7\\xb6\\xc0\\xff)q\\x9d\\xf5\\xe8\\x18s\\xc1\\x8c\\xe2\\xd6\\xc7\\xa5`z\\x17980\\x04&c\\xd7\\xe4(\\xf9\\xb2b\\xe0\\x94\\xe1\\xa0\\x8b\\x8dt=\\xe2\\xbb\\xe2\\xee\\xbd\\xe6\\xa3a\\x90p\\xbb\\xfe\\xfc\\xbf\\xd2'$$\\x05m\\xfb\\xbehv\\xde\\xb7\\x17\\xd5\\x14\\xf3)@\\x84\\x8e\\xe5\\xae\\xfe\\xfd\\x0e\\xcc\\x96\\xe1\\xad\\xe1,\\x14\\xdd\\xe7\\xef\\xe2x\\xd0\\xb7\\xa3(\\xf5\\xcc\\x8c\\xdc\\xc4\\xafc\\xee~\\x955?a'\\x92\\xfe\\xfe\\xb2\\xed\\x11\\xca;k*yn\\x95\\x90\\x03\\x1fn\\xddb\\xd3\\x8d\\x93\\xc6\\xa3\\xfd\\xfa\\x0c\\x15/6\\xba\\x87\\x14\\xe7n\\xaf\\x12@$j\\xdf\\xb6\\x8bt\\xec\\xa7\\xab\rh\\xdc\\xd5\\xa6\\x13@jl\\xeb\\xdc|\\x8e\\xe6\\xfe\\xc1\\\\xba\\xcd\\xec0b\\xa8\\xadw\\xe84a\\xcaa#\\xaf\\xc6~\\xc9\\x94\\x96<\\x87ja\\x1b\\xcb\\x1a\\xb7\\xfe\\xf6_\\x07\\xb3\\xda\\x13\\xdce.\\x19`\\x9e*\\xc2\\xae\\xff\\x02\r"
  490.  
  491.  
  492. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x010\\x17x\\x8a\\xe4o\\xcd\\xfb\\xcb\\x8c\\xf4\\x91*\\xd9\\xf2u\\x08 \\x13s\\xaa\\x84\\xd8\\xd7j-\\x88\\xdaj\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  493.  
  494.  
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w\\xc1\\x045o\\x16iwd\\x94u\\xbfw\\xf1\\xa8b\\xd4k\\x04\\xfc\\xae\\x9a\\xbd\\xe5\\x88\\x9b\\xda\\x11<\\xc8\\xac\\x99vcd\\x02o`p\\xf6t\\x93\\xbe\\xf9\\x136g\\xa3\\xf8*\\x10\\xc4\\xd5\\xae\\x89\\x97\\xc6m\r\\x06h\\x85\\xa78\\xdf\\xe9\\x12\\xd2\\xe5\\xa9\\xcb\\x9e\\x1d\\x8cm\\x01#;j\\xb7\\x85\\xf3\\xe7\\xdeh\\xc1\\x9b\\x95\\xb6\\x87xh\\x91\\x13/^,\\x98\\x807\\x8cw\\xf7-iq\\xc2\\xebi?\\x8a\\xcc%u\\x820\\x08\\x1b\\x8e\\xa5\\xb1\\xcc\\x99\\x84d\\xa8g\\x8f\\x0e\\xb6\\xb6\\x9bk\\xe9jq\\x03\\x85\\x92\\xaca\\xbe\\x88<\\xfd4\\xb6\\x82\\xa3\\x12&z7\\x87\\xd7+\\xc67\\xc7b\\xc0\\x0e5\\xa0(\\xda\\x9bb\\x83jr\\x88\\x12ul\\xb4\\xeat\\x8d\\xcfe\\x1c\\xd9@qj\\x81v\\x1e\\xf4r\\xab.\\x1f-\\xf5d\\xf9y\\xbb\\xfb\\x93\\xec'\\xf3\\x82\\x12\\xad\\x19\\x8d\\x90\\x98\\xee\\x02\\x0b%k\\xa8\\xef\\xb4y\\xfe\\xf8\\xcd\\xdd\\xbd\\xb2\\xdam\\x96\\xd8\\x87\\x0f\\xee\\xa4m\\x80%\\x1e\\xaf\\x90\\x92\\xf0\\xfav\\xb7\\xb9\\xd3\\x84"
  496.  
  497.  
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc03\\x8d\\xb6\\xfb\\x8ff\\x1d\\xd0r\\xb2\\xf4\\x15\\x91\\xdf7\\xbf?\\xd1a\\xc4~vx\\x80p\\xda\\x16,w\\xee>\\xd0\t\\xed\\x99\\xa2h=\\xac\\x08j\\x87_\\xd37\\xb9y|y\\xda@\\xe2mv\\xf1\\x8f\\xccqa\\xa3\r\"\\xa1\\x12x\\xee\\x8f\\x0e|\\x16\\x18fn\\x14\\x85\",\\xff\\x03\\xddh/\\xc0#o\\x0f\\x9d\\x15?\\x93\\xba\\x9a\\xf7\\xa5\\xad\\xe2noj\\xda\\xeca?\\x95\\xd6\nv\\xde\\xda\\xc3\\x05tb\\x8a\\x93l\\x03\\x97\\xfa\\x81\\xb5\\xcf\\x04\\x12\\xfa\\xccntwk\\x82\\x80\\x07\\xa0\\xd4\\x9b\\xe9\\xee\\xac\\x8f\\xfe7x:ij\\x1f\\x0br\\xb2\\xd7w\\x96\\x1c\\x07!\\xb031\\xd9\\xd7::\\xa5\\x17?\\xff`g\\x0c\\xc9\\xcc\\xf0\\xb6\\x1f\\xc3':z\\xdd\\xfeo\\xe3\\xf9\\xa2\\x88\\xc1>\\xcf\\x00\\x15\\xdc\\xa7d\\x9dn\\x0c\\x861\\x88\\xfd\\x0c\\x18nt\\xbbbh\\xc5r\\xebt\\xdfc .\\xe1\\xed\\xc8k\\x88\\xdf\\xf2\\x97l\\x81\\x8b\\x1d\\x91\\x9dvt\\xf5\\x95\\x80\\xb3\\xac\\x94v\\xcc\\x8f\\xfc\\x97\\xbdtk\\x19\\xa9"
  499.  
  500.  
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8\\x07\\xe2\\x95\\xe6.\\xce\\x13h\\xd4\"\\xeb\\xd9\\x8f\\xb3\\xea\\x8e\\xa6\\xb2vt\\x0b0\\xec!%\\xb3(\\x83\\xa0k\\x0bt\\xa1\\x84\\xacm\\x15ue\\x9f\\x84\\x9ac(\\xe3^\\xab\\xb8,i\\xa7\\x96_\\xcaz\\xe0\\x84\\xa6\\xb2zm\\xa7\\xea/qi\\xf5\\x9bl\\xf1\\xd4\\x03m\\xb0\\xab\\xdb\\x9ah\\x82.\\x1c\\xb2\\xe8\\x94'\\xeemy\\xd7\\xe0\\xdc\\x84\\x14\\xbekz\\x8c\\x90\"\\x1e\\xa0\\x0f,\\xae\\xbeq#\\x19\\xd0)\\xd6\\xf7x\\x14;\\x0f\\x106r#\\x04\\xa9\\x86qa\\xe9\\x9a\\x17n\\xe1|k\\x18\\xf4x\\xe9\\xd3i\\xac\\x00\\x00\\x13\\xcft\\xa3$\\xd0\\xd8\\xd3n\\xbd\\x0e\\xe0\\xeb\\x15$\\x93\\x1b\\xf8\\x8b\\xe2\\xeab\\x934(y\\xec\n\\xb0b\\x08|\\x8ac\\x16\\xfb\\x9a\\x91\\x97lb3\\x8e\ne\\xe4\\x08w\\xefov0\\xcb\\xde\\x00&e\\xca\\x87\\x0f\\xba\\xd6\tsig3eu\\xa9x\\x1e)/\\xe1\\x06\\xbe5k\\xe2\\x05\\xcbb\\x8c\\xb2\\xed\\xf5\\x10z\\x87\\xf0>\\x1c\\xdb\\xb7/\\x85\rg\\\\xbd;\\x0b\\x94\\xdb"
  502.  
  503.  
  504. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03\\xb9-\\xeb\\xedi\\x08\n\\xde\\xc3\\x02\\xcd#\\x8b\\x88\\x03~;\\xb0\\x8a\\xedt\\xa2\\xa9\\x0eup!8\\x9f\\xdawj\\x07\\x81dn\\xbd\\xf7\\xc2\\xd8\\x07\\xe4\\xa5\\xc5\\x9e\\x8f\\xd7t,\\xfe\\xe2yr\\x9f\\x10\\x86b\\xef\\x95\\xd5\\x1c\\x9a\\xcd.?\\x94\\x8917\\x9f\\xc0\\xaa\n\\xa5\\x93\\xa2w\\l\\x18\\x9fe\\xe3v\\;\\xc5f\\xaav\\xa93\\xa8\\x81\\x9d\\x9b\\xf4\\x1ao\\xfe?\\x9a2\\x1d\\x87-v\\x12\\xf1\\xe6\\xbf\\xf5\\x85\\xfb\\x96\\xbaza\\xcccb-\\xa4\\xd2\\xd5\\x97o\\xe7'~\\xe4\\xd8\\x00!a\\x05\\xef\\xb3\\xce\\xdc\\x12\\xa3\\x04^xt\\xe5\\x04\\xc8o\\xfa\\x16\\x06-\\x8a\\x99\\xd2\\xf4\\xb4\\xe4\\xd2\"\\xc25\\xe3+\\xe0\\xccr\\x13\\xdb\\x88+woa\\x82\\x16c81\\x049\\xd1\\xf8\\xceu\r\\xf4pqi^\\xda\\xc2\\x84\\x91\\xd19\\xc7\\x86\\xfc\\xa4\\x94,\\x1a\\x03v\\x18\\xaa\\x0ft\\xc0\\xdc\\x05\\xa7\\xce!\\x9b\\xd9\\x16\\x82\\xc4y9\\xce\\x84\\xdf7\\xf1\\x17\\xfau\\x83d\\xb22\\xaa| p\\xf6\\xfd\\xae\\xcc\\xa1\\x9f\\xb0"
  505.  
  506.  
  507. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd6\\xcc\\x1d\\xc9\\xcf\\xd6\\x8f\\xad\\xe1p9\\x88ea.\\xa1\\xb1ou\\xf6\\xe1\\xe1`1\\xcef\\x14wl._\\xe0c\\x0f\\x12\\xc2\\xe1'$q9\\xe3n\\xac\\xc4\\xd5\"`j\\xabfe\t\\x0c\\xbd\\xe6\\xb0f\\xcc2\\xdc(u\\x0c\\xd6x5\\xa9\\xaf\\xeck\\x06\\x08\\xab\\x83@\\xf1\\x825\\x8e\\x11\\xdaxxd\\xc0m\\x1c g\\xf8\\x9a\\xbf\\xc3k\\x0f|\\xcc\\xeax\\xa4`\\xa5\\xc5\\x15\\xfdk\\x12\\xff;k\\xcb\\xe0\\x1f\\x18\\x1d\\xdc?\\x8eu\\xd8\\xf4\\xe0\\xeb\\xd8\\x05\\xa1\\xa0d\\xd7\\x02\\xefizg\\xf3\\x91\\xd3\\xd7\\xa6\\xe4\\x96\\xee\\x87\\x8cx\\xab\\x0b\\xee\\xb7\\xc1nja 5\\xf2j\\xbc\\x870\\x8d\\x82\\x0c$:\\xdd\\xe1\\xa7\\xba\\x85\\xa2v\\x89i\\x94\\x06).un\\xfe\\xeelh\\x86\\x18\\xce\\x18y\\x93\\x8buw\\xbfg\\xeb\\x9eb\\xca\\xaa\\x92\\x93/\\x18\\x08\\xfc\\xcc\\xed\\xe4\\xc2*5\\xf1\\xbbu\\xf5\\x9d\\xee\\x92n\\x99\\xafw\\xe8\\xfb\\xcc\\xe2\\xca\\x93\\x8b\\xcc\\xff\\x0e\\xdf\\xd5r5<\\xb9\\xa7\\x93\\x85\\x9el\\xce"
  508.  
  509.  
  510. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xed\\x14\\x10\\x85 \\x9a\\xad\\xae\\xc8\n\\xfa|\\xcf\\xd6\\x7f^\\x13\\x11\\x0e\\x8b\\x9b\\x9byo\\x9c\\xab\\xbb\\xd5\\xb0g\\xec\\x1az\\x18\\xb9\\x04:\\xdfy\\x8d\\xbd\\x9da:\\x19\\x93\\xc1\\xe7\\x82\\x00\\x84\\xbep\\x9f\\x10w\\xf00\\x8bw\\x95\\x84\\x1d\\xb8o\\x97*\\xdb\\xf8i\\xe2.t9\\xe66a\\xe9n\\xec\\xbd\"\\x8e\\xa9\\xc0\\xae\\xe0~*\\x9a.\\x8b\\xcb\\xcd\\x0c\\xc4sz\\xe8\\xb8\\x0b\\x13e\\xfe?n\\x93\\xe1\\xb2i\\x16\\xc5\\xcf\\xcd\\x0c\\x95\\x8a@\\xdbv\\x1a\\xf6\\xdd\\xf3\\xea\\x9fn\\x15\\x10\\xfb\\x1c%|+\\x91qq=\\xa54a\\xa1w\\x82\\x03e\\x824>\\xfc@dw\\x95\\xf94\\xdc\\x9e\\xdc\\xbb/\\xcdpxs-d\\xc69\\xd9\\x95d\\xcel\\xea\\x8a\\xb4\\xa9ii\\xf7\\xf6v\\x95\\xbc\\xde%a(b\\xbb\\x08\\x96\\xba\\xe04\\x17\\xfdl\\x87oo\\xde\\xfc\\x96\\xc1%\\xa5\\x06\"\\x07\\x9b)\\xb0\\xbd\\x8f\\xbe;n\\xf7\\xae.\\xae\\xd4\\xc7s\\xc0\\xd4\\xca\\x13\\x8d\\x07ss\\xb4@t?\\x94\\xa3\\xad\\xa4yb2"
  511.  
  512.  
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03~r\\x13\\xe8'\\xf4\\x0c\\x1f\\x06\\xe0\\x86q\\xd5\\xca\\x0e\\x1emxq\\x00\\x85_\\x82\\xb1.bt'\\xaa\\xa1\\x19\\xfdyb\\xca=\\xee~\\xe0\\xd3\\xb2\\xc5\\xe7c\\x1f\\xb1\\x9a=bcg\\xd2u\\x01\\xcaj\\xcbk>\\x16\\x12&<?<\\xd9\\xc8u\\x13\\xa6\\xa3\\x19\\xd5\\xdb%wz\\x9c\\x1f\\xe8\\x0e\\x84\\x03\\xa1\"\\xcb\\xdc\\x8c\\x1ee\\x02\\xa8\\xb1>\\xb84um\\x12\\xdcfmf\\xdahn\\x03\\xfb*\\xdb\\xb3\\xb0\\xcd@\\xa00how\\x14p\nq\\x17(1\\xce\\x8eno\\x99\\x0b5\\x1f\\x8c\\xe3o\\xa2wx\\xc0j\\x80(\\xeb\\x1f\\xab\\x98\\x98%\\xfb\\xa8\\x97\\xaa\\xe7\\x99\\xe6\\x9b?j;\\x9e\\xf8\\xa8j\\xb6\\x8b\r&\\xd3\\x02\\xef\\x14\\x16%bl\\xbcv\\xfb|\\x0c\\x92\\x01\\xdfx\\x84\ta/\\x04/\\x16\\x01\\xb6 \\x0ev\\xcf\"m\t2a\\xac\\xa0\\xc0\\xcc)\\xa5c\\xc0\\x8bb\\x1d8\\xc6\\xea\\xd3\\xb9\\x16e\\x1279\\xf2\\xcd\\xc3\\x96\\xbc\\xc1@7#b\\x84-s\\xbc\\x92e5\\x10\\xcf"
  514.  
  515.  
  516. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9j\\xfd\\x7f\\xc6\\xa2f\\x9c\\x93\\xe7\\xae\\xc5\\xae/\\x9f\\xd4+\\xea\\x93no\\xc0\\xeb\\xc2_\\xaf\\x96\\xa7\\x19\\x1e\t\\x8bin\\xd5\\x17\\x1a\\x16\\x04x\\xe5\t\\x890\\xa0\\xdbgl\\x90\\xd3_|\\xca\\xbd\\xf1\\xa8azb\\xd7\\xb7\\x08\\xa6\\xc2\\x82\\xf8g*\\xcf\\x14d\\xda\\x0b\\xd8\\xee\\xb0/\\xa2\\xb0\\xe7r\\x8f\\xd0+\\xc2\"#\\xf6\\xc5\\xd6\\xf2\\xd2\\xe3_\\xe1)z\\xb4\\xca\\x19=\\xca\\xcb\\xd6q\\x9c\\xe3\\x0e\\x81m\\xbb\\xa5.\\xf3\\xfc\\xc1\\xe8\\x8a\\xdf6\\xf1#:\\xb9\\x14n\\xb2\\x1dix\\xae\\x01\\x14lsn\\xa0\\x15*\\x9e\\x8es\\x1c\\x8c\\xcc\\xdbjn\\x8c\\x92\\x1a\\x1e\\x83\\xd7\\xad\\x8a7f\\xc3\\xbc\\xa5\\xc5\\xaf&\\x88\\x9bb\\xa8\\xee\\xe0\\xfe\\xd5_\\xa1t\\x06\\x17~\\xd4l\\x99\\x05z\\xf0\\xf8\t&:\\x95ji\\x17\\x82\\xcc9\\xad\\xa4\\x05+\\x9b\\xe6g0\\xe8\\xdf\\x92\\x17\\xa8\\xdb\\xd6\\xd3\\xbb:\\xfb\\x80o$m\\xf5\\x18\\xb2h\\xcdo\\x8b\\xc6\\x8f\\xac\\x87\\xd0\\x95\\xf6\\xdc+\\xad\\xe6+\\xb3c\\x9f\\x1ax\\xeb\\x01a\\x01\\x08"
  517.  
  518.  
  519. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?\\xdeny\nb\\xffi\\x05n\\xae\\xac\\xdc\\xd8\\x85&\\x8c\\xcb\\x9f\\xa4\\xfdudw\\xd2\\x1cbw\\xce\\x89a\\xa6o.a\\x13\\xab\\xee\\xbcg\\xbe@\\xc3\\x05b\\xb5\\xda\\xa8x\\x95\\xe2\\x11\\xaed\\x94\\xa4\\xea\\x07\\x9f\\xb0h*\\x80\\xd5\t,3'4fr0\\xb4\\x9e\\xb0\\x85\\x8elhq\\x1a\\x99\\xb1v:\\x83\\x12\\x16lr\\x99\\xfb\\xbek\\xe2*qg\\xb1c\\x86\\xa1\\xfd\\xfd;\\x90\\x1c\\xc2\\x99\\x8e\\x1c\\xddzf\\xa74\\xe82\\xaf8\\x9f\\xeb\\x9b\\xd1\\x89\\xf2\\x14\\x87\\xfc\\xf3u\\xa3\\x976\\xb1\\xec\"1\\xedvs;p\\xdaz\\xbf_\rt^x1\\x9dx\\xa2\\xe7\\xba\\x88la\\xe8\\xdb\\xc9\\xe3a\\xcd\\x1c>n\\x81%\\xb0d5\\xad\\xb3\\x89\\x90\\xa1\\x1e\\xbd#\\xb9\\x8c\\xdf9\\xa2\\x1b\\xd4iu!d\\x8d\\xf5b\\xc2\\xfe\\xf6\\xa7\\x13\\xc7\\xde\\x9ay\\x89^'+\\xe4`\\xc7\\xbbq\n2k\\xb2n\\x12\\xed\\xc4,,(\\xbda\\xfa\\xc2\\xac\\x8f\\xa2;r\\x15\\xd6\\xae\\x91\\x02\\xabn/\\x80\\xfe\te~r"
  520.  
  521.  
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x14\\xaf\\x93\\xc4\\x05d\\xc2b\\xd3s|\\xd2\\xab\\xb6\\x85\\xfe\\x7f\\x03|\\x14\\x06\\xc0\\xcb\\\\xfds\\x0e$z\\x00\\x9ei\\xe6\\xd7m\\xd8\\xa4\\xe1\\x95v\\xe1\\xc7\\x14\\x03b\\xa7qb\\xc7\\xed\\xf9mq\\xe6m\\x9e\\xda\\xb9\\xb1h\\x95\\x13p\\x9c\\x19n\\x91\\x7f6f\\xfa\\x12!3\\xf0\\xd2\\xe1e\\x84\\xe2vo\\xeeb\\x0e\\x045\\x11\\x88j\\xb4\\xa3\\xe2\\x7f\\xccoq\\x11\\xc5\\xe1\\xf2\\x16\\xbf\\xaf\\xc7\\xb1\\x00\\xf3\\xd8\\xd1\\xec09e\\x15n'v\\xc1\\xa5\\x1a\\xc5\\xfb\\x10\\xeb\\xfc6p5\\xa9q\\xe4\\xf9\\xa7\\xcchp\\xcd\\xb6\\x86\\xed\\xf5\\x1dd\\x80\\xeb)\\xbe\\x1e\\x9b~r\\xe0\\xf6g\\xca\\x8a5\\xc9m\\x87g\\xb9\\x8du9q\\x17r\\x0c\\x89iaqb7\\x8e~j\\xc3e\\x03\\x14h>\\xf8r\\xc2$\\xca\\x91\\xc3)\\xa5\\x9c\\x14#y\\xc2\\x85y/v\\x8b\\xbc\\x87\\xe6\\xa6j\\x07?y\\xedzc\\xff\\xd4\\x8d\\xf9\\xdej~\\x1csq\\x15\\x17\\xe49g\\xa7\\x8e.w\\x11\\xe1\\xe0\\xde,.\\x91\\x92\\x0e"
  523.  
  524.  
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xee\\xbe\\x18~o\\x07bi+\\xd0\\xb9\\x90g\\xe5\\xea\\x11\\xbf7\\x17\\\\x8a\\x1b\\xb8\\x9fj`\\xd5\\xb0or\\xa7>3z\\xc6\\x01-\\x04\\xe7\\xbei\\x03w\\xc5\\xfd\\xcd\\xd5\\x87z\\xae\\x9b\\xe7\\xa0\\x97a\\x94ep?`q\\xd4ia\\xeeo\\x1c\\xd3\\x93\\xed\\x15\\xaed\\xa5\\x1c\\xd5\\xcak\\x19co\\xa1>\\xac\\xa9\\xda#a\\x8dr7\\xa8\\x18\\xa4i\\xc5\\x95!\\xfa\\x07!\\xa79\\xb9\\xe7\\xe5\\x9ce.\\xc8\\xc8\\xe96g\\xc5dt\\xc06r\\x03\\x16\\xcf\\x0fn7\\x1f\\x1c\\xe9\\xd3u\\xe4\\\re\\xfb3\\xfd\\x03'\\xdbe#\\x03ea;\\xad\\xef\\xba\\x18\\xbe\\xd4\\x82x\\xadx\\xde\\xa8w\\xcc%@\\xc2\\xfc\\x07\\x1b\\xf6\\xdenq\\xdab\\xa7q^b\\xf3\\xa7\\xa1\\x06vk\\xf4\\xdc rd\\xb8\\xeb\\xed\\x7f?v=~\\xc2d\\xcbv\\xa8\\xafa\\x05\\x02\\x18\\xb6\\x8e\\xbcb\\xe36\\xa6\\x0f\\x19\\x1f\\xba*\\xfa\\xe4;\\x911\t\\xfc\\x9f\\xc4)@!b\\xe7t:fr\\xfc\tc)\\xe5#\\xce\\xbey\\x9c"
  526.  
  527.  
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\x97$\\xd6\\xcex4\\x1cb\\xf5\t\\xad\\xcc\\x1d\\xf9\\x02p8m\\x18$\\xae\\x05\\x8d\\x89\\xde\\xbc\\x82i\\xa0\\xc8\\x9a\\xd5\\x8b\\x05\\xd1cr#\\xc8\\xda\\xf5\\xe3\\xce\\xfbo\\xe9d:\\x1e\\xd9m\\xc8\\x7f\\xefl\\xf3s\\x1c\\xac\\x8e\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xff\\xde\n\\x1d\\x8d\\xd5x\\x9d\\xcd\\xbe\\xc4\\x18\\x18c\\xc1\\xab\\x16\\x802s\\x1bx\\xf2\\xc8\\xb2\\x98jy\\xd6h\\xef\\xb1\\x84\\x14\\xee=`\\xfd\\xa8\\xc6\\xe5s\\xc7\\xaa\\xc3\\x7f"
  529.  
  530.  
  531. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdcwi>\\xa9\\x11w\\xd8\\x17=:q\\x10\\x00\\xa9\\xf2~\\xaep\\xa3s\\x89+\\xd6\\xd7y:\\x82\\xe6w\\x1a\\xd0\\xf5\\x1f\\xda\\xe9\\x96\\xcaq\\xe2\\xecz\\xad\\xc0\\\\x80m\\xb3m;#\\x083d\n\\x9e\\xc8h\\x1f\\xa5\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae\\x06e%\\xcba\\xaa \\x9f\\x18ow\\xab\\xa3'\\xa9g\\xce\\xbe\\xad\\xe7h\\xb3\\x9f\\xce_\\xe8\r\\xa5\\xfat\\xb2\\xfak\\xc7\\x1ab\\x90\\xc7\\xf2\\x8d\\xc0\\xb9\\xf7\\xf9\\xe6"
  532.  
  533.  
  534. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)\\xcc\\x8a\\xab\\x9c\\xcdbr\\xac\\xd3r\\x9cn\\x17xg\\xbb\\xc2\\xc3\\x16|\\x97\\xe4\\xab\\xbf_\\xec\\xe0\\xc3(\\xdd\\x00\\x14##\\xfd\\x1e\\xf5\\x8b\\xc5l\\x1f\\xc9\\xdf\\xaf\\xf3\\x13\\xba\\xa5\\xddl\\x19\\xd5\\xa1\\x8a\\x1f\\x962;b\\xc7<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\xc8\\xe9yn\\xbf'\\xba\\xc0\\xbb \\xc9 \\xb6\\xf8\\xb9\\x81\\x0cd,\\xf0\\xcc\\xb3(\\xdb\\x9f.\\x9c\\x1a\r5\\xa0t\\xe55\\x84\\x98<\\xb7-.\\xab\\xe2\\xb6\\xf3"
  535.  
  536.  
  537. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb\\x8e\\/\\xe5\\xd4\\xb2\\xe5\\xe3\\x95\t\\x9c\\x89\\xe8`\\xb8p\\xca\\x15\\xfck\\xae\\xab\\xd4\\x08\\xea|a\\xd3\\x84\\xc2\\xe48\\x01\\xd7\\xc6jk\\x9e`<@\\xa1vwl\\xed\\xf4@\\xcb\\xbc\\xedul\\x17\\xa8\rp@\\x14g\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\xe4\\xd6\\x03\\xe8\\xfb\\x1a\\x8a\\xcc#c\\xca\\xf2\\xf3\\xefnl\\xd7z\\x02\\xde)\\x91a:\\x93ghz\t<^2c\\xbeb42%\r\\xd7\\xa9ie\\xa0\\x9d\\xae\\xd6"
  538.  
  539.  
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93\\xccp\\xfe+\\x86,\\xe9\\xc6y\\x00\\xf5n`\\xec\\xab'\\x01\t9\\x8c\\x1et\\xa0cb\\x15\\xfc*\\xf6?\\xeag_\\xe8\\x02\\xd9\\xad\\xfca\\xc0\\xac\\x89qh\\xd1\\x08ot\\xea\\xf6e0i\\xc9\r\\x84k).\\x06\\x9a\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\xbfl\\xe3',\\xea\\xf30\\xf3\\xee\\x83\\xed\\x07\\x83\\x130m\\x02a\r\\x1e\\x02\\xcc\\xf3\\x91v\\xae\\x13\\x0b\\xc2u4\\xbd\\xc7\\xfe\\x86t\\x939\\x9d:\\xcc\\xdf@\\xab\\x9al"
  541.  
  542.  
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049i\\xaf\\xf2\\x08);\\xb8\\x9e\\x01\\x94e\\xc4m\\xbcz\\x04\\xea\\x1e\\x8e\\xa4\\xed\\xca\\x8b\\x94uy\\x92'\\x11o@\\xcd\\x9czsr\\x973\\xeb\\xb8\\xcfyw\\xf8\\xfb\\xc2\\x85c\\x98\\x0c\\x1f\\xff_\\x16\\x90\\x93j/\\x88\\xd2\"\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xb3\\x9a\\x8a\\xcf\\x9a8\\x15\t\\xb1\\xe4\\xa9g\\xc9hj\\xfe\\xf7\\x01\\xc7\\xbe\\x17\\xec\\x11l\\xcd\\x83\\x0b\\x8d\\x8a\\x04\\xd4\\xf8\\xd5i\\x182g\\xbce\\xdc\\x87d$\\x8a4\\xb6"
  544.  
  545.  
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc3\\xb9m\\x07\\xde\\xac\\xab\\xfe\\xcaj8\\xeff\\x9e\t>\\xb0q\\x929\\x17\\xdf\\x8b\\xe0d+\\xf7\\xeb\\xb5\\x95=\\x1b\\xc5\\xb9<f\\xe3;5*\\xa9\\xb1\\xd8\\x8f\\x91\\xab\\xa2\\xed\\xac\\xa3\\xa52\\x0c\\xb4d\\x13\\xd2*y\\xc3o>w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c\\x18\\xdc\\x8cl\\x98t4\\xbe-naf3\\xe7\\&\\xc3\\xa2(\\x07o\\x17\\xd3\\x1f\\x81':\\xa6\\xfe\\x04\\x9f\\xf7q\\xda|b;\\xb2^w\\x12\\xfd\\x88\\xban\\xb5\\xb1"
  547.  
  548.  
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\x90\\x07\\xa1|j70\\xf9\\x9d\\xa5+\\xc7\\xe7a\\x84\\xcf\\x7f\\xea$s/\\x90\\x0cpn\\xd8\\x88\\xe2~d\\xbf\\x12\\x1f!\\xa1\\x0f\\xe6\\x940\\xc0'<\\x0b\\xc3 \\x7f\\xf7\\xe6\\xd9v\\x898\\x95\\x96`\\xa3w>4bvl\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4\\x1f\\xcc\\xb9\\x07\\x10\\x94\ti8\\x95wc\\xe8\\xf70\\xec*\\xe1\\xb7\\x9a\\xf8\\xdf\\xaa$\\xdd\\x971\\xdde.g\\xc9*\\xf0&!l3\\xe5;\\xd5g\\xcf\\xd3\\xf16c"
  550.  
  551.  
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)$\n#\\x1df\\x1c\\x85\\x9f\\x1e\\xc3\\x81^\\xe8&x\\xcf\\xb5p\\xb32\\xd1r&\\xe4\\xed\\xf9\\x8d%u\\xf5\\xab\\xd76g\\xc2\\xf9;>\\xc5\\x1bj\\xa5\\xe1\\xfba_l\\xe0\\xb9\\xaf\\xd4\\x89\\x8bz.\\xf9\\x9c\\x8e\\xec\\x0e\\xa6\\xe6g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 \\xb0d\\xbdz\\xa8\\xf0z+\\xb2\\xc4\\x08$\\xb7<\\xab\\xac\\x0e\\x9b<\\xba\\xd1w\\xaa\\xa0\\xfc\\x080\\xbb\\x91ye\\xe4\\x1a*\\xbb\\xf0\\xd7\\xb3\\x89u\tuo\\x06$\\xd6\\x0f"
  553.  
  554.  
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xabp8\\xd0m\\x91\\x12(\\x8d\\x07=\\xd5\\x89\\x11t\\xdc;\\x8e\\x0f\\xe9a8\\xd4\\x14e\\xcfo\\x9b\\xbd\\xdalu\r\\xb7*n,g\\xcf\\x94\\x1a\\x88\\xe7)\\xd6\\xd4\\x01\\xcby\\xb7\"v\\xab\\xe1g m\\x12\\x02s\\xe7\\x11f.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99g\\xc0\\xa6\\xf5\\xe4\\xfc\\x7f\\xb3\\x02\\xf6\\xeb\\x93\\xd9\\x17\\xe2\\x9e\\x9a\\xc9\\x86\\xea\\xd5\\x8a3\\xb5\\x0bh\\xa2c\\xc7|i\\xbe#/\\xa2y\\xe6\\x99\\xe2$9\\xfb\\\\x91\\x82"
  556.  
  557.  
  558. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109\\xcb_\\x85*\\x8ctm1:<\\xfb\\xc4\\xd6k\\xd3\\x8ab\\xf8y\\xc6?\\xd9\\xd0\\x9e\nt\\x91\\xe5\\xe2\\x92\\xa9\\xd5\\xbd\\x81p3\\x9f\\xd6\\xd4\\x98\\x19`\\x83\\x0e\n\\xb0;n\\xa3%\\xf7\\x15\\xdbj\\xae!\\xc1\\x98\\xa0\\xd8\r\\xcb\\xa0\\x059a\\x93\\xa6\\xac\\xfe\\xe8i!rb\\x00\\x925r\\x821\\xe0\\x8d\\xf6\\xc1\\xbf\\xe7\\x03\\xf8\\xa4\\xa1\\x99.\\xe7\\xf8\\x91\\xeepbp\\xbb,0\\xac\\xa0\\x85\\xed+l\\xaec\\xb1\\x106\\xael\\x060h\\x0f\\xae\\x1czo\\xcd\\x91\\xa7\\x1ax\\xdf\\xa8\\xd5\\xb6<ms<znd:\\xc9\\xb7\\xbe\\xbd\\x92\r\\xcd\\x97\\xd2\\x0b \\xe0\\xdd\\xa6\\x06\\x1e1\\xb6~\"\\xc1\\x8f\\xe8\\xd9\\xb8\"\\x13\\x17yx\\x1cej\\xdf\\xb1\\xb1\\xa3(\\x1b\\xac\\xc5\\x8cb\\xc2v\\xc6\\xa3<\\x1e\\x1cp>\\xcfp\\xc0ep\\xe1-\\xe2%\\\\xa3\\xf8\\xcd\\xf2t>\\x17c\\xcdz\\x19;\\xde6\\xc8\\x8c\\xcb\\x10n8\\xe7c\\xc1:s\\xfbp\\xef\\x1f*\\xef0\\xd9\\xfd\\xd7\\xf4\\xe3\\x82\\xc7\\xeb\\xe7\\x15\\xcc\\xb2%"
  559.  
  560.  
  561. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\xe2s\\xf3\\x0e\\xb3\\x80\\xa4\\xcb(nm.\\xb20\\xb4\\xa1\\xfa\\xb5\\xe7\\xf3cu\\xb4\\x8d\\xb7ts>\\xe3\\xb0z\\x9c\\x04\\x97a\\xa5\\xd0s\\x87\\xa4i\\xd3\\xa2\\xb8u\\xfcd\\xae6lr\\x7fq\\xa6/f;\\x91\\xb4&\\x8e\\xaf\\xbf\\xa2\\xd6\\xf1\\x1d\\xa7\\xe2\\xcc\\xf9\\xe6\\x8b\\xf7s\\xed;\\x1bl!\\x07\\x82o>o\\xad\\x90,*\\x0e\\x81\\x12\\xb8\\xed\\xcfp\\x9d\\xec\\xd9\\xcd\\xa2c\\xc0\\x82su\\x02fc\\xe7\\x96\\x00\\x9b\\xe9z\\xdc\\xc4\\x9d\\xfc\\x1c\\x7f\\xf0\\xe8y\\xa2l\\xd8hvu\\x7f\\xc7\"59\\xf5\\x118\\xec`\\xbc6\\xb1%\\xf8\\xa0\\xc2=\\x9ah\\x0b\\xa5zv\\xd3\\xf8\\xa4\\xf3\\xd4\\x8b\n\\xdce\\xe4\\xec\\xd8f\\x81r\\xf3\\xc6o\\x9f\\xd3\\xf7\\xcey>w\\x139\\xae\\xbd\\xe2fuh\\x8e\\xd4)*\\xef\\xb9#\\xa71\\xfam\\x8b\\xdf.\\xb0s\\xa3\\x99u\\xb1\\xb0\\xe1\\x93\\xd3\\xc0\\xae\\xdc\\x84\\xed\\xd4\\xc4\\xb4\\x96u3\\xa7\\xfd\\xd9o\\xbb\\xd6v\\x18'\\xf4)8\\xd3\\x16\\xc5%\\x1c@\\xc5x\\xa2%:e\\xbe\\xbb"
  562.  
  563.  
  564. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>\\xa2\\x0f\\xcbh\\x9a\\xae\\xdb06\\xd1\\x82\\x98\\xc1\\xba\t\\xe2\\xbb\\xaf\\xd8p\\xa0j\\x13\\xb3g\\x8c\\xd5\\xd52|\\xd0\\x8b\\\\xd7%\\xab^\\xdf\\xd2/ew\\x02\\xf0\\xff\\xf4a\\xea*i\\xa9'\\x02\\xd8\\x03%\\x1a\\xa9\\xd1\\x9f\\xfc\\xdax5\\xb0\\x9fa\\xce\\x80e`k\\x81\\xfd\\x14p\\x87,\\xd5e4sg\\x8e\\\\x11\\xab\\x17n\\xa3\\x19\\xcd!s\\x04o\\x17\\xffk\\xe6\\xd2%\\xcd\\xfe\\xaf\\x0b\\x05\\xd0\\xd2f\\xd5\\xa9?x,#\\xd3a\\xdd\\xd9e\\xb3\\x97r \\xb8g\\x15\\xee'mh\\x05\\x1b\\xd2\\xa34\\x1f\\x89\\xfdn\\x0f\\x16\\xb4\\x02\\x87\\x1f\\xaa<\\xa9\\x9f\\x92\\x89\\x071y'\\xff7\\x0b\\x02p\\x89h(g\\xce\\x8f\\xbczv\\xeay\\xe1x\\x18\\xe8b\\xf5t\\xa7h\\xa0\\x8d\\x91\\xf4e\\xc9sy\\x81\\x91\\x08\\xd2\\xcb\\xf5\\xea\n6\\xce\\xd3o\\x16\\xc8\\xea\\x93v\"\\x17\\xd6:\\xf1j\\x87r\\x93\\x8c\\xf4\\xcby1\\xb3\\xd3\\x97\\xa4`s\\xa3\\xc1\\xdd\\x1b\\x7f\\x16r\\xc4zv\\x9e3\\xea\\x06\\xa4\\xca\\xf1\\xca\\x9d"
  565.  
  566.  
  567. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb\\x8bzw\\x05v\\xf6\\xf8\\x8e\\x81\\xe1\\x96\\xabmt|h9\\xdb\\xf9d\\xccxi\\xdd\\x96\\xc6\\xee\\xeci?\\xfcbg\\x1f=<\\x80\\x1d\\x08\\xbaz\\xcd\\x99\\x80\\x83\\xc44\\x05\\x81>\\xbci\\xd8\\xf1\\xf6\\xf0\\xb2j\\xa5\\xcb\\xcd\\xe7\\x96\\x8d\\xe8~\\x0f*i\\xf0n-\\x93\\x1c&\\x07\\x1f7\\xbcv\r\\xbc\\xe7\\xba\\x19\\xec\\xdal\\x9fvzp\\x88\\xb2\\x81\\xc2\\x89\\xc1$\\xdf\\x18\\xf3\\xf2\\xa4\\x8c1gh\\x16\\xa3\\x9d\\xd2\\xd2\\xa4\\x8c/\\xf6\\x9a\\x05\\xbe\\x19\\%\\xf2\\x05\"\\x82\\xcd\\xdf\\xa0_l\\x86\\xac\\x88q~\\xb42\\xf6\\x05!b\\xe1\\xf4\\xfd^\n\t\\xc6\\x9fn\\x00jy\\x92d\\xf1\\xafrs\\xf1\\x0bx\\x0f\\xea-\\xbfv\\xe4\\xdc\\x81\\xa7\\x17\\xe9\\xc8\\x1e\\xb3\\x05lx\\xa7\\xd4\\xd8\\xe8e \\xbce\\xc8\\x0e\\x10\\x9f\\xe8\r\\xbb\t\\x9fc\\xad\\xb4\\xcc\\x85\\x8ey*\\x94\\xce\\x80>\\x80\\xfb,*m`8\\xeb\\xec=g,\\xb3\\xab\\x97\\xa4\\x1d\\x1b\\xfd\\xc6s\\xc3\\x8a\\x1ep\\x9bv\\xc0\\xef\\xaf\\x9d\\xc0\\xd7\\x81\\xaf"
  568.  
  569.  
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e'\\x16e\\x9e..\\xfcv\\x8c\\xbdv\\x8f7\\x9e\\xe8-\\x1b\\x90b\\xf8e\\xd5\\xacz\\x83g\\xb8\\x06\\x1d2phz\\xbb\\xb7\\x1e\\x1c\\x19\\xccea\\xaa\\xbb7\\xe1~h\\x8e\\xbc\\x84\\x01l\\x96\\xf6\\xec%%\\x9b\\xd6\\xb5\\x94\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd90\\x12\\xb9l\\xf25.\\x0f\\x9eb\\xf6z|&^\\x02\\xfc\\x91\\x94@\\xa7(\\x8f=\\x89\\x8e\\x11:\\xc2\\xc6w\\x98\\\\xc7\\x96eg\\xa0\\x8b\\xf4\\x0eq\\xa5\\x04w\\xf9"
  571.  
  572.  
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\xb6by\\x15\\xc1\\xdcc\\x9e\\xbfhq\\xa3y\\x90-\\x8b\\x9d\\xbd1\\x9fyj\\xd5*u\\xb6\\xce*\\xb8\\xb1\\x16\\x83s+7\n\\xb5\\xae\"@\\xc3mn\\x80\\xa0\\xc2\\x1c\\x15\\xa4\\xcb\\x9fq\\x92\\xb1u\\xa8\\xf1qb\\x9a\\xa1\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xec\\xcd\\xc0\\x0c\\xa3\\x9d\\x9e\\xce\\xe1x\\x9b\\xe5x\\xbfxd\\xdd\\x81y;gn\\xa8\\xc3\\xc9\\xe9ie\\xa6\\xc2\\x87\\xd5\\xfc\\xd1\\x90\\xe5\\xe9\\xf5\\xb76\\xf5\\xc3\\xf8\\xbf\\xa4)\tz"
  574.  
  575.  
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\\xb9\\xb0k^\\xd7ey5_iz\\x92\\xb2\\xec\\xd2\\xc2\\xd2\\xe6-4\\xda\\x01\\xa5\\xfbm\\xa8s\\xd5p/\\x99\\xcd\\xf0\\x16\\x90n\\x01/\\x89\ro\\x1e\\xfe\\xcaq\\xf7-\\xf8\\x87w\\xca\\xf9\\x86\\xb6r\\xbf\\xfd0\\xfado\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd7\\x91i\\xb6\\xca\\xa4q\\xd4r|\\xb8\\xf0(\\xa6\\xd5\\x01\\x06z7|\\xbb\\xd5\\xb8\\xcc^%$z\\xack\\xa2\\xaf\\x8d|~\\x00\\xde\\xb8x/\\xd5\\xa6\\xf1 p\\xbf\\xe4"
  577.  
  578.  
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1fz\\xb0\\x01\\xa7iq\\xcf\\x8ay`\\x92\\x00\\xbbhy\\x16\\xb9)\\xe3\\x1d7\\x1c\t$iw\\xaf\\xfan\\xa6z\\xe4\\xc0\\x91b\\x18yp\\xa7j\\x1f\\xa6h+\\x03-\\xb8\\x10_\\x00\\xd7\\x9a\\xe6j\\x12.\\x82:\\xb2\\x89\\xea2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x9a\n\\xf3\\xe01\\x9a\\x92\\xa2\\x86\\xcd\\xae\\xa5\\x037s/t\\xc3^\\xaa\\x7f\\x95\\xbd\\xf5e\\x8b\\x1f=\\xd2\\x9dkt\\x8a\\xad\\x8c\\xe6yz\\xd2\\x87\\x9f\\x14\\xad\\xa9 ."
  580.  
  581.  
  582. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd1.9\\x94\\x1f\\xfe\\x8bi\t\\xd0\t\\x07>\\xe1y,\\xdbs\\x9d4\\xab\\xd5y\\x13\\x13\\xd0\\xba\\xfci\\xf9\\xe4\\xb7\\x98\\xe9u\\xcb\\xca\\xcb\\x9c\\xac=\\x88\\x0c@`r\\xa3q\\xb0\\x96\\x87$\\xbb\\x9f@\\x85c1\\x87*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e\\xc9\\xcew*g?\\xdd\\xdc0(\\xa7*\\x99\\xc2\\xc1\\x9d\\xf1\\xe7\\xe8\\xedm\\x89\\x86p\\x94\\x8c\\xb3\\xfcw\\xd7/\\xddf\"\\xad\\xfe\\xd4e\\xe1x/\\x90\\x18\\x06\\x87("
  583.  
  584.  
  585. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046\\xfa\\x13cia\\x91\\xe53\\xf76\\x04\\x1f\\xbc\\xdd\\x18\\x0e\\xf2\\xe6\\xdd\\x82\\x7fa\\x12,\\x83\\xa1\\xec!\\x82\\x01\\x12@\\x87g3\\xd3\\xc9\\x96r\\xca\\xc7\\xb7\\xb0nh\\x97\\xca\\xdb w\\xd6\\x81\\x87\\x06\\xa9k\\xa8*\\xbc\\xaai\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\x97\\x9b\\x1d\\xd9\\xee\\xb4\\xff\\xe2\\x13w%\\xafyte\\xdd\t\\x00\\xfd\\xba\\x88x\\xacvb\\xd1\\xfa\\xb1\\x06\\x0e\\xa4i\\x1f-\\xa9\\xc6\\x15$\\x89\\x01\\x159,a;\\xb4\\x16"
  586.  
  587.  
  588. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9.)t#\\x97\\x86y\\x11\\xea\\xf7\\xdce\\xc6\\x9c\\xc7?\\xe4\\xf6\\x9a\\xedn4\\xbe\\xf2\\xc2\\xb8%*k\\xc7\\x8d\\xf6\\xf3\\x1c\\xb7\\x87\\xf2\\xeej\\xdb4%\\x1d\\x1029\\xef\\xca\\xb4>\\xfa\\x84_\\x90q\\x08\\xfd\\xban\\xa1\\xb4\\x90\\xa2\\xc7\n\\xedd\\xca\\xf5\\x8ad\\x96\\xd3;i!\\xce\\x8d\\x9eg\\xeb\\xc9e@u\\xac=\\xdbcl4\\xc0b\\x83\\x97wtv\\xe6\\xca\\xed \\xd8\\x00\\x81\\x92\\x841\\xc2pe,\\xb06\\xd7\\xf9\\x8fn\\x95\\xf9\\xc1\\x0c\\xad\\x93\\x1b\\xf1\\xdb\\xa8|\\xc1x\\x1d\\x81\\xc4a~aw\\xac\\xf8=\\xc0\\xe7\\x9a->f\\xf5\\xe9\\x85\\xf3l\\x9c>\\x98\\x97\\xa4x\\x1f6b\\x8b\\xec\\x0bi\\x8cd\\xbbp\\x0b\\xa4p$\\x81\\x04 \\xb3\\x85h\\xe3\\xcb\\xfb\\xb6\\x9a\\xb0\\x92\\xbao\\x17\\xb9\\x8b\\xc8\\x8eu\\xf1\\x7f\\xbb@c\\x84o\\xab\nb\\xa6n\\xc8\\x0fe\\xfd\\x1a=_\\x16a\\xde\\xdd\\x9c\\xaa\\x0f\\x11&\\x89\\xbb\\x06#\\x04c\\xe3\\xd54\\xc0g\\x08\\xf41^\\xf9\\x9aee\\xa2h\\x91\\xc3\\x8b\\xb6\\x08l"
  589.  
  590.  
  591. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\xe9 ?\\xb7o\\xc5\\x93\\x8d\\xdd\\x15\\xc3\\x08`\\x18\\x9e\\x9c=\\x90\\xb3t\\xd2g\\x0bl\\xeb\\xa2\\x04\\xe9k\\x82e\\xcb\\xc1\\x80\\xb3\\x97\r8>\\x82\\x938'k`\\xb1\\xef\\x81co\\xc4\\xaf:?\\xd4\\xf7\\xe7xo\\x8e\\xa3\\x8d\\xd4\\x96ue\\x17i\\x91sz\\x00\\xf3r\\x8albd-\\xb3pu\\xbb\\x8b\\xa4\\xc5:5\\xcc:o\\xb9g4s\\x9d\\x1a\\x8ec\\xf7o\\x08c\\x84e\\xc1\\x00\\x96m~\\xfb\\xf2\\xbe\\x9e\\xd2\\xd06\\xee\\x0f\\x0fz\\x93\\x0cs\\xd8\\xec%r\\x86\\xec\\xcdmof\\x06\\x92\\xee\\x82\\xa7g\\xcbu\\xca,2\\x97\\xca\\x19ux\\x00&)\\x1b8\\xc8\\xe7`~;^\\xc7\\xb9\\xff\\xbe\\xb37z@\\xeae\\xba5\\x7fg6\\xbek#x\\x93\\x149\\xbf\\xfc\\xd5-\\x13vm \\xab\\xa6&d\\x91\\x07;\\xedyt\\x10\\xa5v_h\\xd3\\xd9\\x1b\\xc1s\\x1bg\\xe4\\x82\\x15z\\xf6\\x92j\\x19j\\xc2/\\x01\\x81\\x0b\\xd4/\\xcef\\x0ej\\xf8\\x9c\\x87om\\xba\\xed\\x08pg5\\xa0\\x02"
  592.  
  593.  
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d3\\xcf\\x1bq\\xba\r'\\xfebyc\\xf5\\xe7\\xf2\\x1e\\xe5\\xaf\\xaa\\xeen\\xd9\\xb8\\xc1%\\xb0\\x80\\xf8\\xc9l\\xaa\\xe0&h\\x12c\\x8a\\xe3e\\xc8\\xdfr!\\xc2\\xf7\\xef\t\\xdc \\x00\\xe7\\xa3\\xe3k\\x15\\xf7e\\x9a%\\xcf\\xa6\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\x1fuexm8\\xd7\\xf7\\xe5z\\xa4+\\xc4\\xfce\\xd3\rx\\xba\\x91\\x97\\xb5d\\xaf\\x0c\\xe1\\xdc\\xfa>\\xcac\\xad\\x94u@o\\x1f\\xf1\\xca\\x15\n\\xed\\x8c\\xbe(\"l"
  595.  
  596.  
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\x93v(\\x8a!\\x19\\xe8\\xb3\\xbd,\"\\x9aa\\xc5m\\xc9\\xeek\\xb6(\\x16\\x0f\\x9b\\xad\\xb0\\xcfg3\\x0f\\x07\\xe5p\\xab\\xd1\\xced\\xebd\\xcfw\\x85ln\\xa4o\\xeayx\\x9ak\\x0b\\x94wn<\\xec\\xf0.\\xe3\\xbbw\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcez\\xaabnx\\xbe\\x06\\x80m\\xcf<\\x96\\x04\\x95\\x8b\\x96\\xa3e\t\\x96\\xa1\\xa0\\xb7\\xe3\\x07\\x0b\\x8e\\x94\\xfd\\x97\\xcdy\\xa3\\x1eb\\xbc\\x17\\x93\\xf0\\xd3\\xb9\\xa7\\xa2\\xdf0w"
  598.  
  599.  
  600. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0e\\xc2\\xc5\\xd1.\\xf0\\xbfc\\xd2&\\x02n\\xcf\\x06\\xa1*\\x8c+\\xdfut\\x97\\x01\\xa0g`\\x03y\\x14\\x00\\xb64\\xdf\\\\xb0\\x93iy\\xc95\\xd1\\x19\\xb6\\xe1t\\xa6*x\\xa6\\xd03\\xacl\\x9b\\xd9\\xd0\\x04\\xcaq\\xb3byx\\x83\t./ke\"\\x9dr\\xca\\x8f\\x82 \\xdfc\\xed\\xb0\\xd2o\\xa9\\x18\n\\xb5\\xc8\\xb1\\xd34\\xfa\\x8d\\xa1\\x96\\xe2?`\\xe5y\\xc4\\xb0\\xca\\xee\\x8c-s\\x14h\\xfbyo\\xe3g\\x00\\xf9t\\xe5\\x80\\x08\\x06\\x83p\\xa6\\xa6\\xdd\\x16\\x18\\x93\\xe4\\x1f\\x14\\xfd\\xebzn\\x06\\xf3%\\xd4\\x12\\xf5\\xbdez\\x8ce\\xf1\\xbf\\xd0\\xb8\t\\x89\\x98\\x7f\\xf4\\xfc\\xe6\\x07\\xfc_kd7\\x81\\xbd/\\xe7n\\x04\\xc4s\\x8dhs\\xe0\\xb6\\x95t\\x91;s\\x05\\xa3\\xc6r`\\x89(c\\x90n\\xeb\\xe0\\xb0:\\xc0!\\xe58\\xb2\\xb9n\\x0f\t\\xb8\\xa4|\\xbc\\x8f\\x19\\xaa\\x94\\x9f\\xa0\\x17|\\xc8\\x06\\x0e\\xd3\\xa9\\x9b\\xfe4\\xa0y\\xf4_\\xfen\\xcd)\\x9b\\x15m\\x8e\\x03\\xed\\x1a\\xa0\\xc1v\\xff\\x86\\x12\\xa7xui\\x97"
  601.  
  602.  
  603. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1d\\xba+r\\xe0,\\xbeu4d\\x00\\xa5\\x00&\\xe24y4\\x96pl\\xd5\\xf8\\xdc\\xe4\\xf4,<\\xf5\\x92\\xc1 u\\x8a\\xecwa\\x92\\x01\\xd6\\xbc\\xc1\\x0f\\xf5qe\\xd6\\xc7\\xcd\\xb4\nw\\x8f\\x83\\x18\\xeewp-z\\x9c?w\\xb2\\xf5v\\xd9\\xb78\\x82\\x9f\\x80\\xa4\\xb1-w\\xdd\\x16\\x18\\xb8.j\\x04hq\\xe4^\\xefuwdkyy\\x08\\xdf\\xd2\\xe9g1\\xa6\\x80\\xac\\xddi0j\\x94\\xd6\\xa1 \\xf68\\x0fp\\xb10\\xfb\\x85h;\\xaby\\xb9c\\xbf\\xc1~t9\\xfd\\x82\\xdf*\\xc4\\x8cp\\x90\\xcc\\xa6lk\\x99\\xff8\\x17\\x91\\x1eoa\\x81\\xdb\\x14\\xbb\\xa0ww\\xed\\xe6$\\xde\\x97\\xcb\\xfd\\xf1\\x14\r\\x8d\\xabs,&\\x05\\x7f\\xc1\\xf5\\x1ep\\xbc\\xa1\\x1a2\\xb3p\\x91\\x08p\\xcd\\xc6\\x81\\xd8\\xf6;\\x0e\\x80\\x81\\xeb\\x89/\\x18\\x1f~\\xcf\\xbc\\xd4\\xf5\\x0e\\x92\\x91~\\xc5\\x97\\xdd\\x96\\xc9\\x84ic\\xaf\\xeama\\x14\\xc2\\xa4\\xf4\\xc0g=.\\xdb\\x8e\\xd3\\xb8\\x13\\x14\\x0c\\x1b\\x06o\\xbe\\x03g\\xe4\\x1c\\x0c\\xf0\\xdd2"
  604.  
  605.  
  606. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vuxp\\xdd*\\xc8/\\xc9\\xa5w\"\\x90\\xcd\\x7f\\x8d\\x0b\\xce\\xe0_\\x91\nm\\xa7\\xfadj(\\xc9\\xb0\\xc8t\\xd3\\xa1\\xce\\xf5z\\x1a\\x95.\\x84\\xad\\xac\\xb0\\x93wa\\x84_\\xef5pa\\xff_\\xcf~\\x7f\\x96\\xe7x\\xacx\\xe3p\\xbb\\xf7\\xf9\\x0e\\x9d\\x0c\\xab|&\\x9d\\x1d\\x1a\\x85\\x16\\xe7_\\xe9\\x9c/\\x14\\x0b\\xf6\\xb10\\x1e\\x9a\\x9c\\xc0\n?l\\x1b\\xc6\\x01\\xdd\\x04et\\xbd\\x9e\\xc4\\xfe\\xa0\\x1c\\xef-_\\x94sz\\xe0\\xbb\\x1b\\xd0f\\xb3\\xec\\xd0\\x1b\\x0e\n\\xd5fe\\xc1\\xa0n\\xe0v\\x16\\xc0\\xf4\\xf7 \\xa0f\\xc3\\x04t\\x16\\x84\\xe5\\xac\\x8d)m\\x06f\\x810\\xff!\\xc9\\x840b<m\\xb7\\xbf\\x08\\xcd/_\\xf3\\xa2\\xee\\xe6io\\x8axc\\x0e`p9\\x00\\xf5\\xa1\\xd2\\x1a\\xfe\\xa1\\xa0\\x04px2\\xc4\\x08\\x81f\\a\\xc2\\xbbm\\xd9\\x95\\x80\\xc0#\\x95y\\x843\\x1a\\xc1k\\xc8\\x8a\\xb8\\xbd\\x06ru\\xdap\\xe7\\xe6\\xb3\\xc7i\\xdcno|6v\\xcc\\x85\\xe0y\\xfc0!42\\xe71\\xe5\\xd8"
  607.  
  608.  
  609. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa7m\\xa4&\\xd0\\xf4\r\\xf9\\xa5\\x16\\xc3k\\x85j4\\x82\\x9e\\xbb\\xc4\\xb9i\\xa6il\\xdc\\xbe\\xa85=\\x15\\x13at\\x1aw\\xa3@\\xf6sb\\xd0\\xee\\xd7w\\x92:\\x0b\\xa2y\\x94\\xcc\\xcf\\xdf\\x1a\\xcc\\xfd\\xd8\\xaf:\\xc6\\xfa\\x92b\\x93w\\x95$\\xe9.\\x02et59\\x06\\xc9\\xee\\xfe\\x94\\xa3\\x15\\xfe6\\xed\\x16\\x8b;`\\xc5|*\"\\x83\\x041\\x06\\xcdz\\x90\\xe6b\\x96\\xedq0\\xa5p\\x1df_d\\xaf\\xdf\\x06\t\\x19\\xd3\\x9f\\x9dt/\\xb8\\xb1\\x8d\\xba\\xc2\\xba\\xe6k\t\\xfd)\\xafx\\xf9fq\\xcc\\x10\\xd8c\\\\x84v\\xe1h\\x8c\\xa3\\xf9\\xb6!\\xe4\\xb65\\x1e\\x08\\xcb\\xef\\xadt\\xd6t\\x83\\x10d\\xbaih\\xd5\\xac>9\\xdb6\\xb7\\xc3w\\xa9\\\\x07\\xd0\\x8c\\xa1\\xfa>\\xec\\xf2\\xb1\\xd46\\x17\\xd1-ei\\xf1\\x9f;c\\xfd<\\x16w\\xfb\\xb7\\xa8\\x87\\xd7\\xea\\xa6\nh\\x14\\x9a#\\x82ig\\x95b\\x7f\\xe2\\xe8\\x91\\x94\\xbf\\x9c3\\xb1\\x06\t^\\xc6v\\xde\\xc9\\x96ci\\xb2\\x91\\x8ef\\x8do\\xbc\\xec"
  610.  
  611.  
  612. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\xc4\\xe9r\\xa3c\\xe5`\\x19\\xfbb|\\x99\\xeb(\\xe7j\\x9b\\xe2wzo\\xf1\\xdbf%\\xbc\\x0b\\x81\\xf3\\x1b#\\x89^\t\\x8e\\xedz%4,\\xb3tl\\xee9\\x97\\x06n\\xc3xt\\x81(\n\\x8a\\x1bj\\xf3\\x83!\\xe7\\xc6\\xd7\\xce(\\x90\\x01~\\xec\\x13\"\\xff\\xcfcpf\\xe0pgy\\xf7\\x95\\xfep\\xeb\\x08h\\x95z\\x85\\xdek'\\xc8?r\\xca\\x8fv@d\\xec\\x9c\\xf7\\x13\\xad\\x9f\\xcav\\x91lw\\x9fa|\\x85\\xd3\\xf7\\x04\\xf9\\xc0u@)\\xbe$\\xb4\\xcd\\xf2u\\x19\\x8e\\xf5\\x926\\xc1=\\x81\\xc8\\xbf!d\\x14\\xe5\\x01\\x10\\xa5\\xd8\\x99\\x08\\xc27\\xe7ug-\\x8b\\x12\\xben\\xb1j\\xdae\\xbb\\xd8fq0\\xca\\xa6\\xa0\\xf15\nt\\xc3*\\x0b\\xd3\\xe0\\xf5\\x08\\xd01.\\x07!\\xec\\x01;\\x94l\\x86q\\xfb5\\xdb+\\x8a\n'\\xcd\\x89\\xe0\\x9e\\x86\\xe3\\xf0zu\\x01\\x85v\\xf5\\x03 \\xf6\\x17\\xe5\\x8fbv\\x8f\\xee\\xa6h8\\x1b\\x8cv\\xca\\xf7|\\xe1<\\xcdx\\x15q\\xdc\\xfb\\x0c\\xa7\\xd7g\\x13t"
  613.  
  614.  
  615. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xecu\\xc5\\xc2ob\\x90\\xe2\\xe5j\\xd4\\x85yv2\\xc1\"?f\\x8fh\\x18\\xb1\\xdf\\xdc6\\x06\\xc1\\xe8\\xb8\\xb7'\\xed\\xa8(b\\x17\\x12\\xd1\\x18\\xa1a\\xcc\\xd3\\xa4e\\xc9\\xb0\\xc9\\x81\\xfd\\xd3\\xff\\x13z\\xa5\\xc9`%\\x01\\xf9\\x8f\\x04 \\xd7\\xf2`\"~\\x08\\x92\\x12%\\xb9\\x80\\xa2\\xc4\\x13\\xb4i_p!\\xdc\\xe7f\\xed\\xf5\\x1d\\xb0\\xf3\\x8a\\xeb2v\\xab\\xda\\xb8\\xa4\\xa0\\xd6\\x89<\\xd2\\xa8e\\xee<p8q\\x14\\x9f*\\xb9\\xfb<\\x86\\xa5ets\\x9ek8\\xa5)\\xdb.\\xda)a\\xb7z\\xf3g\\xb0(\\x91\\x802\"\\xff\\xf1\\x96\\xed\\xbc5g#k<3m\\x8a\\xeb\\x1aw\\xac\\un\\xc2ekn\\xe1\\xd4e\\x00jy\\x1a\\x16\"h\\x08\\x15\\x06\\xeb\\xe8\\x9d\\xed:\\xf4\r\\xac\\xaa8p\\x95\\x9f\\x94s\\xcf\\x02\\x1co\\x17\\xc9?\\xd9x\\x1d\\xe0ww\\xbfk\\xa7hq9^\\xe6$&\\xfdy>cj\\x19\\x94\\xcfm@4\\x848p\\x93\\xa3\\xee\\xd3\\x07+#\\xc5\\xaf\\x93\\x16\\xaf~\\x13z\\xa5p"
  616.  
  617.  
  618. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\x80\\xea\\xc1\\xd6h\\xd5\\x8a\\xe4)\\xdc\\x9c\\x8a\\x9e\\xd4\\xde\\x85r\\xe2\\x9a\\xbf\\xcd\\x8f\\xf4\\x94\\xe3ky\\x19\\xa1\\x15\\x06\\xd5\\x0e\\xd7\\xc2\\xbb\\xea\\x07\\xd6\\x13\\x8b8\\x9f\\x0f\\x9e\\x0c*n\\x15\\xba\\x00\\x1c\\x97cm\\xd0\\xb3\\xa86*at\\x17\\x1b\\x81\\xf7\\x93;|\\x9d\\x8a\\xa2!\\xfa\\xd6z-\\xf1\\xe9\\x11`\\x983'\\x07\\xad/\\x7f\\x00\\x1a!\\xa8s:d\\x0b\\xab\\xc5n\\x8c.'\\xb6\\xbde\\xaa\\x06\\xad;\\xbd\\xf0\\xca\\xcf\\xd0\\x02f\\xc9\\x9bs\\xcd\\x17w \\xca7\\x80\\xdde\\x13(\\xa99\\xa4\\x17vr\\xd5\\x02xp\\xca\\x00d\\xa4\"\\xfa\\xc0d'\\x00\\xeb\\xe7\\x19py\\xb8\\x92\\xa9k!e\\x8f\\xfb\\x99\\xc3\\x81\\x1e\\xe6c\\xa1\\xf6\\x9a\\x89\\x9d\\xd6\\xc9\\x89o\\xd9\\xfb#\\x99\\xac5\n\\xfa\\xdf\\xf5\\x83f\\x829\\xca\\xa4\\xf0\\xaf\\xa8k\\x86n\\xfd\\x18\\xad5r\\x13\\x9ef\\x00\t\\x7f\\xafk\\x9aa\\xd3\\xe8\\x9f&4\\xe1\\xfc\\x0ed9n\\xf0`!\\xf8\\x98r\\x17\\x85^av\\xa1\\x01\\x08\\xce\\xd8\\xcf\\xc8\\xb2,\\xfd"
  619.  
  620.  
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i*\\xdfzp8q\\xf1!l\\x94\\xa2#\\xd5\\xd3\\xfe'i\\xea\\x00y\\xe82\\xa0\\xbao\\x0fh,\\x93\\x17v\\xa2r\\xb2\\xf0\\x92k\\x13\\x01\\xcd~\\xdd\nhp\\xa0\\xf2\\xf4\\xbcl\\x9a\\x96\\xa7\\xd7\\x86\\x0f\\xba\\xcc\r\\xf7\\xeet\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1\\x04$\\x88\\x0c=\\xb8\\x00\\xa8\\xd6j\\x07=\\xc4q\n\\x0f/0\\xfb\\xf8\\xb7\\x84f$\\xc4\\xed\\xea\\xee\\x1fl\\x0fk\\xec\\xf0\\x98\\xaf\\xfb/e\\xd7p\\x88/r6\\x8f\\x1c"
  622.  
  623.  
  624. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010~9~b\\xa3\\xa9\\xeb\\xb2\\xeb\\x06\\xe4\\xd6\\xe5\\xc8\\xe4\\xdc\\x8c\\\\x8d\\x8a\\x9b\\xde\\x0c\\xb4\\xe0\\x17\\xb9\\xabz|/\\xaf\\xa1cg\\xc1v\\x0893\\xf0\\xe7\\xc6\\xe4\\x8d\\xc0u\\x7f\\x95\\xf9%\\x93bs\\xce\\xd9\\x08ek\\xa1j\\xb6b=r\\xe2\\xd7\\xa6\\xf9\\x04\\x8a\\xa9y\\xbe\\xae+*\\xbd\\x0f/\"d\\xb6\\xb9\\xdb\\xaa\\x80&v\\xbd^\\x16lxha\\x0c\\xfa\\x03(,\\x8a\\xb2\\xf5\\x807\\x98x\\x80\\xfd\\xc0\\x8a2%\\xccta\\xdc\\xc7\\x90&o\\x06\\xadr\\xd1\\xd94j\\xd8\\x90\\x0c\\xb9\\xc4\\x9d\\x83\\xb2\\x17\\\\xa8\\xf9!f\\x11\\xa1j\\xf5\\xa9\\x1b\\xb7i\\xf9&w\\xbe\\x17\\x97~\\x8c\\x8a\t\\xb4ok\\xe5(\\x14u\\xd6!\\x99\\xffa\\xe7\\v\\x14\\xb2\\x0fx\nj\\xaa\\x97\\xe2\\xf9ac\\xd4\\xef\\x12s\\xaf\\x80\\xd5\\x96\\xbf\\x1b\\x1by'\\xe26\\x84=\\xdfa\\x80\\xfe\\x95i\\xf0\\x1f\\xe3\\x1d*'\\xad\r\\xef\\xb3\\xc4e\\x8a!0v\\xber\\xf6\\xaf?\\xf1v\\xd3\n\\xab\\x1c;t\\xbc\\xe7k\\xd9mw0"
  625.  
  626.  
  627. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb=\\x96^\\xa9\"\\x00\\x85l\\x05\\xffp\r\\x8c\\x90\\x84\\x93w\\x1c8\\xcf\\xfc\\xc8\\x98\\x07\\xa3\\x03\\x03\\x03\\xf0\\x08\"\\xbe\\xd51\\x82i\\xb9s\\xdbdb\\xe8\\x81\\xf90\\x19\\xe6\\xf7\\xca\\x12\\x08\\x84\\x85\\xd6b\\x98\\xa9\\xa7\\xec\\xcd\\xfc\\xec+\\x01\\xf5\\xa7~\\xc6\\xa3b\\x9e\\x90@\\x01\\xe6\\xf7\\x8e9\\x97\\xae\\xfa`(\\x80\\xe3\\xf8\\xd6\\xaf\\xd3f\\xcb\\xdf\\x16\\xe5\\xeck\\xf9?\\xe0\\xc1\\x9a!i<\\x990\\xef\\xc9\\xf6w9- \\xfan\\x8f\\x1c\\xf0zx\\x86\\xado=\\xca\\xd9\\xac\\xdau\\xe1z\\xa4\\x96o\\xbc\\xfb\\xe0\\x89\\x8e\\xacp\\xf4w\\x82\\x97\\xada\\x97\\x10\\x8d\\x11t\\x1f\\x14\\xef\\xaf\\x16yt\\xb8\\x0e\\xb7\\xcc\\x98\\x14\\x85\\x84\\xef7\\xfc\\x9e\\xd0\\xd1l2\\x9d\\x98\\xc5\\x91\\x80 3\\x14@\\x87\\x9fv9isn\\x8a\\xc7\\xef'5\\xb6\\xe3\\xaa\\x98\\xcf\\x00i\\xfd^\\xf1\\xda\\x08l\\xc82r<\\x16\\xd1\\xd0\\x99\\x87+\\xf3\\xa9\\x96k\\x12\\xb7\\xaavue\\xb5b\"m\\xf2\\xc3\\x04\\xedu\\xd7\\x1eg\\xae\\xb8\\x07\\x1c\\xb9"
  628.  
  629.  
  630. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x126mz\\xf6\t\\xba\\xca\\x9f w\\x1d\\xc4e\\xc3\\x15\\x80t\\xbb\\xb3hc\\x1b\\x0f~\\xcb\\xe8\\x9d\\x00\\xa7>\\xaa\\xd0\\xfdt\\xbe\\xc5r\\xb3\\xa4_\\x14\\xc7d\\x98\\xd99\\xec\\x89\\xaa\\xef\\xac\\xbc\\xb1,d\\x9am\\xe1|b\\xbfk\\x9a\\x92ys\\x14+\\x1e\\xb4\\xea\\xda\\xa2\\x8c=\\xa8\\xc3&|b\\xa3l\\x95\\xf5\\x88\\x06\\xb5\\xec\\xc9\\x14\\xd3\\xabeql\\x9br\\xd3)\\x18\\xc7b\\x1e\\xb5\\x91\\x8a'l\\x04\\xa1\\xf7zm)a\\xc8\\x08\\xfb\\x15\\xc6\\xe4\\x10h\\x05j9\\x0fs\\xe5w\\xe9b\\xa8i\\xcb\\x8ae\\x1b\\x00\\x9f/\\xe6\\x98k\\xd4j2\\x86j\\x98\\xf8\\x15\\xf6\\x8e\\x01p\\x13@\\xcf\\xe1s8\\xe8k4?e\\xd2.\\xdb\\x94\\xb9f'%_\\xaf\r%$z\\x1dz\\xf9&\\x18\\xebf\\x9fz\\x1cd\\x99r\\xd5i\\xff&\\x0f\\x92\\x84%\\x0bl\\xf8hz\\x0f\\x9dan\\x15iy\\x9e\\xd2\\xd8\\xc5 \\xd3i\\x07ly%n\\xea@\\xc7\\xdd\\xf8\\xed\\xcb\\x048\\x0117\\xab&\\xe5z\\x1d\\x83\\x9c"
  631.  
  632.  
  633. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010rju\\xa4~\\xddjz\\x1f\\x87r\\xd7k !\\xd0\\x84\\xa1!\\xb9\\xe0\\xbd5\\x1a\\xd6\\x85bn\\x8f\\xa6\\xcb\\x08!\\x92\\xcem\\xfb\\xcd\\xe0 \\xca\\xde\\x82h\\xdac\\x94\\xc1\\xc3\\xe3*/n\\x12q\\x91\\x87dl\\xbdq\\x84\\x7f\\x1f\\xb5\\xdf\\xf9\\x04\\xfew\\xcbve\\xe2m\\x18\\x90\\xc6\\xd2\\xad\\xb6h\\x90n\\x1f\\xb7w\\xfb\\xc5\\x1f-\\xe3\\x07z\\xfcu\\xf9\\x9d\\x02l\\xdc\\xf6b\\xc3\\xd2\\xc7\\xc5d\\xc7|\\xbd\\x96\\xb8\\x86\\xb4e\\xdd\\xb3\\x8ft\\xc4\\x9f\\xc3 \\xed\\xcf\\xe8\\x83m\\xe0\\xda1\\xf7g'i\\x0c\\xe7.\\xf3\\xb4\\x8c\\xb6\\xce\\xa4r\\xaej\\xc9i\\x00(\\x81\\xc5\\x89\\x82\\x01>\\xabs'\\xbb\\xc2\\xec\\xa63\\xba\\x97\\xd5^mw.\\xben\\xab\\xb0u\\x87\\xa8,\\xac\\x8e\\x9d\\xe6\\xa7iz\\xa5\\x12e\\xb8\\x8bj\\x91\\xc0\\x8d\\xe92\\xdc\\xf8\\x1d\\xe2\\xe1\\xb4tjn\\xd9kx\\x80jo8a\\x9f\\xd7\\xbb\\xe4w\\xa4\\x93og\\x89\\xf8\\x0fv\\x00\\x9f\\x8e\\xa4\\xcfa\\x05j\\x1c\\x15\\^\\x94q"
  634.  
  635.  
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb2c\\x95\\xf5j!\\xed\\x94\\xc2\\xf8\\xaap\\x02z|\\x00w\\xce\\x18\\xf4\\xb0\\xd2\\xb7\\xb6ix\\xddox\\xb3\\xe7\\xad\\xa1-px\\xa8!0\\xc9\\x05>\\xbc59kke\\xcex\\xff\\x94\\xbe\\xbdfc^\\x7f\\x049\\x1f6\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xf8o\\xa0\\xf2\\xf5\\x1f7\\xf5>\\x8bhz\\xcbb\\xb8\\xec\\x17 e\\x9c\\x8d\\x8e \\x15\\xb2\\xfc\\xa6\\xa8 t3,\\xb2\\x1f\\x82\\x8cu\\xb84e\\x9b\\xadc\\xfb^\\xdf\\xd6"
  637.  
  638.  
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2p\\xf7+~\\x96\\x02l\\xf5:\\xd1\\x81k\\xac\\xbbz\\xe8\\xfb\\xb3\\xfd\\xd3\\xa8ksd\\x85\\xa8\\xc0\\xbe\\x80\\x003\\xbb\\xbf\\xfb\\xe4/\\xb9f\\x1d\\x19\\x94\\x91w\\x1d\\xc9ug\\x80va@\\x01\\xa2\\x7f\\xde\\xeb\\x13\\xf1\\x7f8\\x9c\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbaa\\xc1\\xdbl\\xebn7\\xfd\\x9d\\xec\\xff\\xb7c\\x1a\\\\x1b\\xba\\x05jb\\x85\\xcf\\xf2\\xd1\\xf3p\\xc6<\\x7ft\\xb6\\xd7\\xd8\\x95\\xeed\\xf3\\xfdl:\\xa7\\x98oi\\xef7"
  640.  
  641.  
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xf7x\\x8d\\x14b\\xa1\\xff\\xfbo\\xda/\\x826\\x85\\x11l\\xbb\"\\xbb5y\\x9d\\xd3\\x8b\\xf2\\x91\\x89\\xf0\\xb3\\x04,\\xbe\\xdfq\\xc2\\x15o\\xa27\\xb6\\xa7\\xc4\\xa6d\\x03?\\xdbm\\xd1crm\\x90yh\\xa64j\\x9e\\x14\\xc9\\x8cj\r\\xa5:\\xed\\xa6\\x13\\xc2*\\xcf\\xbe$\\x10\\xf9w=\\xdb\\xc3\n\\xa7\\xf5\\xdd\\xf5\\xce\\xa0\\x06\\x05\\xdc0f\\xbc\\x07\t;\\x95\\xf5\\xf11\\x8am\\x9a\\x8c\\xf2j`\\xc8b1\\xbc\\xc2\\x94\\xfa\t\\xcal\\xa8\\xc7\\x9c\\xc2\\xea\\x92,\\x956\\xecj\\xac\\xf2\\x8d\\x0fn\\xea\\x89\\x8ax\\xc33by\\xf7\\x1a\\x14\\x84\\xe4\\x0e\\x0fun9\\xb9\\x0b\\x18\\x10\\x8d\\xa8\\xf6c\\xea\\xc9\\xf34\\xee\\xbd\\x81\\x06@e\n\\xf8\\xda\\xdca\\xc2\\xcc,\\xe7\\x13\\xbex\\xc5ma\\xa2h\\x10\\xf9\\x99\\x1a\\xa2\\xb8>\\xd2\t\\xa6g\\xc6\\x1c9/\\x0c\\xc6#\\x904\\x15\\xbc\\xf9\\x85\\xb1\\x06\\xa99\\x1d\\x1d\\xaf\\xd0\\x97\\xdc\\xa8\\xbc\\xa7\\x04\\x07\\x9fc\\x8cn\\xee6<\\xdd\\xeb\\x86\\x16\\xa9q\\xfd\\x82p\\x8f4\\xe0\\xb7\\xf4"
  643.  
  644.  
  645. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x010\\x17x$e?\\x8b\\xb7\\x83\\x99x/\\x9ew\\xd8\\xcf\\x1bz\\xf7<gt\\xdf\\xee\\xb7m\\x1b&\\xee.\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  646.  
  647.  
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01099*\\xe6z\\xd2\\xed\\xa6y\\xcc\\xf9aw\\x92\\xef\\xd1\\xe4\\xd4i\\xa8\\xd3\\x1d;\nd\\x8a'\\x8f\\xda\\xe3hwm\\xa2\\x86\\x150\\xa4\\xe0\\x14\n\\xdf7\\xd1\\x9c\\xac\\x06m\\x05*d3~\\x99rr>\\xc4\\xee\\xbc\\xd7p\\xfd\\xf7k6\\xcbg\\x11\\xed\\xa9\\x9blt1\\xad\\x86\\xfd\\xac\\xb8\\xf1\\xb1o\r>\\xbf\\x89<\rs\\xbe\\xb2\\x18\\x08\\xd3\\xb6\\xe6\\x86\\x04\\x8cdf\\xfb\\x9a\\x1e\\xd7>\\xe7\\xd3\\xe2\\x18_j\\x0b\\x85\\x13\\xd0\\xecl\\xde\\x18-\\xfa\\xe0\\xdf\\x0b6x55\\x1f'o\\xbc\\x05_c\\xdf\\xcc\\xc2\\xb1\\xcd\\xd07\\x10p\\xaa\\xed\rv\\xfd\\x18\\xb2\\xcerl\\x0e\\xc9d\\xf4\\x7fq\\xfd\\x8b\\xedt\\x0c\\xb2\\x98\\xc8\\xcb\\xc2,o$\\xc0b\\xdc\\xdd\\x05y6\\xd7\\x8b\\xc9\\x8c\\x81yh\\x90j\\x18qlk-\\xc5$x\\x80\\x18_\\x02\\x82\\xc1\\xc4\\xbc\\xfej\\xa7\\xaa\\x81\\x80\\xea\\xd9\\x92v\\xe8\\xc6$\\x90\\xea\\xbf\\xb7\\x80\\xae9\\xd8ifc\\xa2\\xf2\\xad\\xb8\\x00\\xa2n\\xc6\\xc9\\xc3s\\x8e3\\xe5\\xa0t\\xfd\\x9d\\x96"
  649.  
  650.  
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\xd9\\x81\\xd7e\\x06\\xebt\\xeb?2iw\\x96\\x1a\\xbc\\x9f97\\k\\x15\\x1a\\xb0\\xb9ou5un\\x8e\\x12'xj\\xb3\\x18\"\\xc4\\x14\\xe4\\xb4 i\\x80<\\x12\\xdf\\x00p`\\x0f\\xab\\xe83\\xc4k\\xdb\r\\xbe\\x0e\\xdam\\x8a\\xa0kjx\\xee\\x9b\\xff>\\xc0\\x93<\\xc2\\xc5\\xdd\\xfbu\\xe3\\xe9uzt\\xac\\xd7\\xe6=\\xa9=\\xd1\\x9a\\x16\\xfcq\\xce\\xf3\\xba\\xd51\r\\xccl\\xf7\\xaar\\x9b\\x06\\xf9gs\\xecm\\xcde\\x8c\\xe4\\x91\\xe3gi\\xd8\\xf2\\xb7\\xa0$\\xc3\\x86x\\xd30\\x06\\x96\\x99\\xb0\\xdf\\xf0\\x90\\xb8\\x08\\xe0>\\xf2d\\x9f\\xaaq\\xd6\\xf4\\xeb\\xd3o\\x7fz9pi6(\\x0b\\0\\xdc\\x8e\\xf3,b\\x1d'e\\x8a\\x99\\xc8f\\xe7\\xfbdw\\xf4\\xa0b\\xc3c`^_\\x1b\\x07\\xc7\\x14h\\x18\\xea\\xe6\\xbd\\xc0\\xbc\\xb5f\\x9ej\\xf8\\x04\\x12\\xc0\\x19|>\\xa1\\xca\n\\xe8\\x19\\x9f\\x01)`\\xd7c\\x84,\\x19\\xae\\x0b\\xb0o\\xbf\\xcd\\x87a5b\\xa7~jo\\xaf\\xcd\\xe1\\xae\\xe2\\xb4\\xb4\\xf0\\xc4o\\xb3"
  652.  
  653.  
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010uf\\xf4c\\xc9\\x8e\\x7f\\x939\\xd7\\x80\\\\xaekv\\x06\\x98\\xa3\\x1e<x\\x16\\x14\\xa9\\xfc\\xe5ap\\x92\\xe8#vc\\xa5\\xc1:\\x9a\\x1d\\xe1l\\xf6$o\\xb4vw\r?o\\x93\\xbe\\x8c,<#uqdz\\xc5\\x08\\x82\\xc03\\x10\\x03\\xbe\\xb1s\\x7f\\xa6>n\\x8f4\t\\xcam\\xdc\\xff\\xbe\\xb6\\xa2&\\x19v\\xe7n\\xdf\\xcd\\xd10m\\x9duuh\\x96\\x1e\\x0cb\r\\xf18\\xaf\\xea@\\x0cq,7\\xf5\\xa3\\x9ea\\xd8\\xca\\x1cpy\\x8c.+\\xae4\\x84`1`a4\\xd2n\\xb2\\x87\\x11\\xd3\\xb8\\xf4\\xa4|s\\x1djc\\xff\\xe9\\xa4\\xa0\\xc5\\xe2\\x8c(`p\\xe8\\x98\\x0e\\xfcm\\x1e\\xa5\\xd7\\xe0-\\xd8\\xec\\xd4\\xe9z<\\xaf\\xa2\\xe4\\xaf\\xc7h?\\xf5\tc\\x1f\\xa2\\x82\\xf1a\\x93\\xc5z2\\xdc\\x08\\x96\\\\xec\\x11\\xa2\\x0fs\\x96s\\xc9\\xa8\\xca\\x06\\x0fg\\x92|\\xd5@\\x1b\\xd0e\\xb9\"j\\xbc\\x90\\xfd\\x83n\\x0e\\x81\\xa12\\xd9\\xc2~\\xbc&a\\x8a\\x1e\\xe1\\xc1\\x91\\xb4'c\\x7f\\xfa9gk\\xa1\\xa58\\x1c"
  655.  
  656.  
  657. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9azvu\\x84\\xec\\x00'\\x83\\xf1\ri\\x8a\\x91\\xfe\\x03e\\xc8\\xdb\\x9c~\\xca\\x8d\\xc6\\x0b\\xbab73\\x81q\\xaa\\xcd<t\\xee\\xdd\\x00\\xba-\\xe9\\xcc\\xc5\"?\\x01)*\\x1a2c\\xa4\\xdd\\xcc\\xe2\\xa6x\\x18\\x8av\\xa7\\x10\\xf9\\xe0n\\xe6\\xe0\\xd3\\x1e\\x96oju\\xa28\\xbes\\xfe\")j\\x8eo_\\x1d\\x08\\xe2\\x92x\\xf5\\xb54-\\x9c\\x81\\xe4\\xdbm\\xdd\\xe7\\x03h\\xfd\\xdd\\xfd\\x1c\\x00\\x04\\x92\\xdbx\\xeb\\xe7\\xd1o`k\\x10\\xfaf\\xeb28\\xdc\\x07bs:\\x13\\x93\\x18\\x8f\\xbd\\x8e\\xf0\\xfc\\x8d\\xb2\\x89';pe\\xa31\\xf8u\\xfcu\\xe8n\\x0b\\xd5\\x05\\x8f\\xf9\\xb6_\\x8b\\xdd<\\xa9\t\\x10r^fc\\xcc\\x84\\xa2w\\xd0b\\xb6\\xf6q\\x8b\\xae\\xfa\\xa1\\x8d6\\x19\\x9c()\\x9b\\xcc\\xed\\xcah\\xf4\\xd8\\xa5\\xdd\\xbaonf\\x1d\\x95`\\xb8\\x8a\\x11\\xe7f\\xe4+\\xc8\\xc1\\xfb1c\\x07z\\xef\\xb1*\\xc9&x.\\x03\\xe0\\xcb8h\\xf75\\xf1\r\\xb1!|\\xf5\\xc4\\x00\\x9a\\xe5\\x9c\\x06\\xb5\\xea\\x8e"
  658.  
  659.  
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010vv\\xf7y\\x7f@\\xcf`\\xa5\\xe1o\\xc5\\x002\\xcf2i\\x93\\x93\\x92_\\xbd\\x13p\t\\xb5\\xeecg\\x84\\xf5#\\xac\\xff>\\x1d\\xd8\\xd8s\\xb0\\xf7\\x88,\\xce\\x911\\xd21w\\xbb\\xe0$3\\xe4\\x86\\xd6t\\xfc\\xe8o\\x05\\xc3\\xbf\\xce\\x9a'\\x04\\x16\\xe0\\xe8\\xfc6\"\r\\xd5xjsi\\xab\\x9f(\\xefu\\xf5\\xbf\\x94\\xed\\xbe\\x82\\xfd\\xb0\\xa1\tg\\xa5\\xe5auisv\\x12\\x7f\\x1c\\x8b\\xd9\\xeck\\xd2\\xbad-\\xfc=\\x1a\\x030\\xda%\\x8e\\xf9\\x13d\\x9f\\x87\\xcb\\x1f\\xc9\\xf5\\xc4\"c\\xb6\\xbe\\xc7\\x8e87\\x12\\x87\\xcap\\x8d\\xa1v\\x9a3$\\x1by\\xe7\\xf8\\xef\\x95>\\x14w\\xa8\\xdf\\x18zs\\x08\\xefs\\xea\\x0e\\xb2t\\xaff\\x1a\r4\\xd9l\\x1ae\\xe4\n \\xd7\\x10\\x14\\xc8\\xc2\\xbcha\\xa3\\xf0g\\x1aj<\\xb3\\xf4c=\\xce\\x95\\xa6 zs(|\\xb8b/5\\xf9\\x12d\\xedy0\\xc92\\x94\t\\xc9\\xcb\\xc90\\xb3\\x8d>\\x91\\xd1\\xf2\\xe6\\x939\\xcb\\xe6\\x9dy3\\x96\\xdf\\xdap3\\xa5\\x99\\xb7\\xd3"
  661.  
  662.  
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03\\x0fm\\x94\\x16w!\\xeb\\xbd\\xe4k\\xedi\\x9a\\xec\\x97\\xf8\\xf0\\xf3\\xab\\xbb\\x1c\\xacw\\xf0\\xecv`\\xd4jl\\xd8\\xe7\\xbeu\\xbc\\x89o\\xe2\\xc6\\xe42\\xc9i\\xcek36\\xc9\\xca=a\\xfb\\xb1\\xca;4\\xbddf\\x8e|\\xb1\\x99\\xe9\\xdc\\xe5\\xa6\\xb9g\\xa8\\xa21\\xaa\\x01\\x83\\x9e\\xadl\\xd8\\xc0\\xa37\\x82\\x00\\xb7\\x038c\\x1a\\xeevjw<mkv\\xd7p\\xe4p\\x10\\xce\\x85\\xd5\\x9b:w\\xd4\\xf5\\xce\\xa7\\xec\\x9c1\\x91m\\xd3\\xce&j\\xe4\\x9f\\x17y\\xa7\\xaf\\xcf\\xe0'_xy\\x1b\\xb1\\x1c\\xe6ob\\xe9\\x1d4\\xdf\\xbe4\\xd7\\xa8\\x7f\\x9c\\x12\\xc0$67z\\xbb\\x16\\xee\\xb1\\x11\\xf8:\\xf5o3\\xads\\xc1`\\x96\\xda\\xc5s\\x07r6n'\\xaa \\x1d\\x00\\xe6\\xcal\\x7f\\xd6\\x12\\x06\\x08o\\xd0\\xc2\\xf8f\\x9ep\\x88\\xab\\x11\\xcf\\xff\\xbc:\\x87\\xfd\\x92\\x8a\\x9b\\xcf^\\x9b\\xc1\\xed\\xc7\\xb9\\xc5\\xe1\\x16\\x00\\x8e\\xe3\\xb0\\x8c\\xe1\\xc7j\\xd1\\x19\\\\x1e(\\x1d\\x9d_\\xa6n\\xf6\\x05je\\xeb\\xc1\\x99\\xd4\\xc2"
  664.  
  665.  
  666. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\aq\nh\\xd96\\xf6q\\x9e\nz\\xf8\\xd1\\xb4i9\\xd0\\x1c7\\xb1\\\\x96\\xb2u\\x8e&\\xc9\\x7f\\x93\\xe2%wk\\x05q\\xb8_63ae\n\\xc8\\x15\\xc9\\xf6o\\xea6\\xa9\\x03c\\x85\\x02\\xcb\\xe1e\\xe4\\x8c\\x0fxlq\n\\xe8z\\x15\\x90\\xf4y\\xcck\\xc0\\xc5vvc\\xc8\\xeaw\\x7f\\xf7>)\\xc3(\\xee3\\x89<z\\x03vk@,\\xed\\xa0u\\x8c,\\x86\\x99\\xb2\\x9053\\xc1\\xf5\\xea\\xfe+ag\\x11\\xa4\\xff\\x8c\\x17a\\x01\\x17\\x96_ylu\\xea\\xcd\\xc9\\xfbs\\xc1g\\xfax\\xa8|\\x1c'\\x92\\xd4\na\\xe1s\\xd4t\\xbdt\\xcd\\xca\\xaa\\xfe\\xd3g*t_\\xf1;\\xfa\\x1e\\xc4\\x86\\x83q\\x98y\\xb0&v\\xa1it\\xf5\\x8d\\x16\\x8fa\\xea\\x1f\\x89\\xe8\\x11\\x8boip\\x88\\x02\\xf0\\xfe\\xd5|&i\\x15$i\\xe5\\x08|%\\xb6\\x05\\x95\\x16\n\\xdcl\\x91\\x1cobd\\x06/\\x92\\x99c\\xed\\xa1\\xff3t\\xdd\\x04\\xdd96\\x12i.\\xd4/\\xa2\\x01\\xd7\\xa6\\xce"
  667.  
  668.  
  669. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010|\\xa8npc\\x94;\\x93\\x92\\xcfrb\\xddt\\x18\\x05\\x8d\\x0fm\\x9aah\\xb4\\xa63\\xd7\\xd4\\xbc3\\xd3\\x1648_(\\x05|\\x13\\xf4z\t\\x963a\\xa5/\\xff\\x1f\\xe3\\xe3s\\x98\\xb3cu\\xaa,\\x03l\\xe2\\xd9\\x85j~\\x1c\\xba\\xa9onitv>v\\x1e)/\\xa6\\x98\\xf9\\xcc=tn\\xd3\\xba\\xf1\t\\xe6o\t\\x9d5\\xb1t\\xbe\\x82\\xc6e\\xbct\\x94\\xfbh\\x16\\x07\\xc3\\xf0\\x1e\\xa3\\xbe\\x16l\\xc8_\\x89\\x87\\xe1n'\\xbe\\xf3\\x02\\xdf\\xe7\\x1f\\x19\\x9f\\xe9\\xa9\\xab\\x95 a\\x84\\x1e&\\xb4*@\\xa5b5`\\x02l\\x12\\x82c\\xe5r\\xc2\\x1f\\xc4\\xe8\\xb5zy7\\x0c\\xaf\\x83c\\xb8\\xb1\\xd2\\x8c\\x1d`\\xc9e`\\xf5\\xael71\\x8d\\xc0\\xed)\\xa5\\xa7\\x82\\xe49\\x9e+\\xb0\\xbc\\xf6\\x81\\xfe\\xd8%\\x8b\\x8e\\x16q\\xce\\xb0v(\\xa0\\x8e\\x8eso7f\\xb3n\\x85l\n\\xe3\\x11\\x11k\\xb2\\x88<\\x95\\xb1\\xdcns\\x9ee\\x86\\x86\\xecmo\\xa2\\x06\\xf41\\x17\\xb1\\xf4\\xc3j\\x1f\\x8b\\x80\\x03\\x95\\xf0"
  670.  
  671.  
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x80\\xd4m\\x80\\x805\\x0c\\x12s3ppdfsk\\xee3\\x15\\x9a\\x8c\\x91!d\\xda\\x1dyq\\xbdj\\xbfrg\\x15\\xd6o\\x07\\xee\\x05\\x84\\x86\\xe8u\\x7f0ma\\xd0\\x94\\x97e\\x87\\xd7ra\\xc1\\xd8z\\xd9\\x9f\\xc2\\x13\\x7f\\xaf\\xec\\xc9\\xa6\\x04\\xb9\\x18\\xeb^\\xcd\\xd0\\x00_\\xad\\x16/up\\x1e\\x03\\xc7\\xabm\\x9e\\x93\\xb11b\\xd3c\\xd5\\xdc\\xa2\\xda\\x0e\\xda\\x1c\\xa5p\\xa5\\x88'\t\\x15\\x1c\\x9d_\t \\yu\\xd3\\x07\\xa3\\x15r)\\xac\\x04\\x03\\xb4.\\xc4\\xafa\\xa7\\x0b\\x93\\x04\\x16$\\xe5\\xa6\\xb9d q\\x9c\\x1b\\x107\\xc0p\\xcd\\xad\\x96#`\\x02h\\x82\\x08\\x19\\xf4\\xae\\xb5\\x10\\xd8j\\xb6\\x04\\x17\\xbb\\x05\\xfe\\xd8\\x02\\xc3\\xf7\\xe2w c\\x028\\xfc\\xc2\\xd4\\xf6~\\x8b\\xe8\\x94\\xf0\\x02\\x84ga\\xce\\x8d9<\\xc8\\x835+ix\\x1e\\x18\\xf9\\xdb\\xce\\x90e\\x8aw/\\xdd\\xf3\\x0f\\x7f\\xa38\\xf5\\x07\\x07|\\x999\\x9e\\xdb\\xd0\\xf2?r\\x83\\xb6\\xc3\\x90\\xe2,`\\xbf\\x1b\\xfeh\\xa4\\xa2\\x12"
  673.  
  674.  
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\r\\xd0jp!\\xd6\\x9e0\\xd2,\\xba\\x1ce\\xbb\\xf4#\\xf8\\xca\\x1as\\xbdm\\xac\\xb1cba\\x94\\xf0\\x83a\\x19\\x10\\x81\\xd3<\\xd3\\xdd9\\xbd\\x87!qz\\xfe\\x9e\\xba\\xd3+\\xb9'\\xe2 \\x1e\\xec\\xd8q\\xe6pn\\xa3#\\xf0q\\xfa\\xaa\\xc6*ib\\xf3\\xdccgl#\"\\x91 \\xf1\\xde^\\xffr\\x85\\x99\\xf0\\xb0\\xd5\\xcemb\\xe5j\\x9f\\xdd\\x15\\xe2(o~\\xfc\\x14~\\xd0x\\x8f|\\x97\\x9f\\xbf\\x13\\xac\\xd8\\x1f\\x1e~\\xd8\\x80z\\x92\\x02!j\\x08t\\xda\\xb6\\xe9\\xcc/\\x08.\\x02q;\\xa5e\\xe84b\\x9cmg\\xe0=\\x8ba\\x07>ah\\xd0n\\xc3a\\xfbs\\xf8\\xe7\\x8cc\\xef\\xa4\\xa6\\x9bdp\\xad\\x9f=\\xd5\\x8b\\x0e\\xc4\\x0b\\x13'b\\x98~\\xf1w\\xb1\n-\\xcbt\\x9a\\xee*\\xc4\\x1d\\x126\\xeb\\xa1\\xecq\\x8d\\xa5\\x8e\\xab!\\xb69l\"\\xa3\\x80lx,\\x97\\xfa\\xf7\\x94\\xe9\\xfc\\xbb\\xf6*\\x81\\xf8\\xdb\\x08\\xff\\xefc+4l\\x07i\\xd4d8\\xf2i\\x7f.\\xeb`3w"
  676.  
  677.  
  678. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa3z\\xd0\\xf3\\xb3f\\xa9ns\\xd8\\xca\\x17#\\x91s\\xd8c\nl\\x94\\xe560t\\xb5`mrd)\\xac\\x8b\\xce\\xf9\\xacvr\\xea\\xcfeoj\\x8b\\xf3\\xf0\\xa3\\x0e\\xf4\\xc1\\xfek8@\\x04sou\\x02+\\x17\\xe6\\x9b\\xc1\\x81\\x14\\xb8\\xc7s\\x8d\\xe3\\xc3\\xe0\\xd2\\x16\\x96\\xbb\\x1c\\xf8g\\xf4\\x92\\x99\\xddi3i\\xd95\\xa7\\x1b,\\xe7\\x1b\\xcc\\x1f\\xf9h\\xa8i\\x0c\\xdc\\x9d_$\\xa1\\xf1k\\x83\\x9a\\x8b\\xb2\\x85,j4\\x99%\\xb5j\\x95\\x9357\\x84\\xc9a\\xb9\\x9a4\\x06\\xd7\\x95\\xd2\\xd5\\x7fm\\xbd\\xce\\x80\\xf0%\\x85\\xc7\\x17\\x87'm\\xa9\\xf3\\x87\\x1cy\\x97k\\x8d\\xf4qd\\xe0\\xfey\\x94\\xc5rn\\x84\\x13$\\x9e<z\\xfa\\x8c\\xe2\\x995\\x16\\x8f\\x97\\xb2\\x9a\\x96\\xc4_e5\\xeat\\xca\\x8b\\xbfp\\x93\\xd2\\xc5\\x08\\xbc+\\xa2;)\\x1eb\\x10k ry(\\xc8h\\x05\\x98\\x89\\x88\\x8d\\x01\\x08'\\xe4\\x90\\x0b\\xd9&\\xd7\\x10i\\xd3\\xd8\\xeei\\xe8\\x8d\\x11\\x16\\xef\\xee\\xef\\xe3f\\xe0\\x81\\xcey\\xf2\\x83w;"
  679.  
  680.  
  681. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x7f\\x01\\xb2\\xd1\\x8c\\xd3\\x1c\\xf1\\xe3\\x1e;l\\xef\\xda:\\x07\\xf0l.y\\xb7_l$h84\\x1fm4\\xc7\\xa2\\xbf\\xd0ly\\xe0\\xedozgu%\\x82(\\xbe\\x81)?n\\xf2\\xe6s\\xb0\\x88\\xa5|6\\xa6\\xa0\\xc9sh\\xd7@\\x00,\\xa6v\\x10\\x96\\x8c\\x03_f\\xfe@\\xc0qs\\xbb^e\\xbb&\\x8c!\\xef\\xce\\xf1c\\xf6?\\xb6\\x0b\\x0ey\\xa4\\xad0\\xd7oc\r\\x01\\xe5\\xe5\\xcd\\x82\\xa1~\\xbb\\xa5t\\xc0\\xc8\\xbe\\xfe\\x03_\\xd2\\xa4\\xb6v\\x9e\\xdc\\xf0n\\xf8-\\x00\\x15/\\x81ap\\xe3vc9\\xb7,#^\\xb8\\x17\\x80\\xfca\\xa3\\x05\\xba\\x96\\x9fjp\\x9c\\xabb\\x99\\xf5\\xdb3\\xe5q\\xed\\xb7k\\xe5\\xd6du\\xf8\\x12\\x06e\\xbe\\xde$w\\x96i\\xb6\t\\xe2f\\x9ej?i\\x87\\x82\\xa2w\\x9e\\xdf\\xa0nji\\x18\\xc4\\xec\\xc02\\xa3\\xbf\\xd4\\xd4\\xb7\\xdf\\x07p\\xd3\\x8en\\xd0\\x98u\\x90\\x8d\\xaf\\xf4\\xc8j\\xcb\\xec\\xa3\\x88\\x82\\x07\\xf1\\xd9l\\xa6\\x87\\x95q\\x17\\x92'\\x08*)>t|f"
  682.  
  683.  
  684. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3\\x08d\\xd1\\xe50\\xa7\\x8faa\\xbd\\xee\\xac\\x14\\xb3\\xc5\\xe1\\x96yy\\xc6\\x91\\xa2\\xc2!\\xbbk\\xb3\\x82\\x8b\\xef\\x18\\xa0\\xcdd?\\xcc\\x92\\x7f\\xee\\xf0\\xe5ky\\xa3\\xa2\\xbbn\\x9ej\\xa6\\xd4'\\xe6\\xa5c:\\xd0|\\xdc\\xc2d7\\x8f\n\\xc3\\xbb\\x16h\\xbes\\xe3\\x14\\xcf\\xb0\\x9b\\x1c\\xc0\\xff\\xfat\\xfe4\\x8f:0q)_q\\x1c\\xba\"u\\xe1(\\xf5\\x97\\xc1\\xdd\\xa0\\xdd\\x9edw\\x189\\xcc:\\xbd\\xbdut\\x81h\\x88\\xcb\\xc5u\\xb6#n\\x0f\\x19wi(g\\xca3\\xbcl\\xa7\\xedt\\x94\\x9dm\\x9f\\xfb\\xfe\\xb9\\x02|\\x87\\xc4-\\xc3k\\x03\\xe5\\xb9\\xc5\\x9da\\x07\\xc9\\x81h\\xb8m12\\xd8\\xcb&\\xa1sv\\xf1x\\x97\\xf39=\\xe7w\\xd4\\xea5\\xd7\\xe2\\xb7\\xf6\\xbe\\xc4\\xdfl\\xef@\\x1e\\x89\\xa4\\xfew8'\\xc9\\xc4\\x08r\\xc9*:\\x9b\\x12'\\x10\\xee\\x81\\xa1\\xd1z\\xb0\\xd9 \r\\xff;)\\xcfh\\x12\\xde\\x89x\\xed\r~ir\\xdc\\x9a\\xf82\\x00\\xcbp\\xcd\\xba\\x8a\\xf2\\xa71\\x7fva\"|"
  685.  
  686.  
  687. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90\\x84\\x9e\\xcf\\x1e\\xa8\\xef8\\xfe\\xff\\x0e\\x16\\xd2a\\xec\\xe7t\\x16l\\xd9\\xee\\xb6\\xfa\\x91o\\xe3\\x0e\\xbd\\xf7\\xe0\\xc5\n6\\xe5:^\\xc3qx\\xad\\xc1\\xc6\\x82\\xa3\\x9eb)s6\\xb7\\x08<\\x89`a\\xb9\\xde\\xbd\\x16!\\xa8i \\xc1\\xbf\\x13\\xf0\\xc7\\xb8z\\xfe\\xd7\\x07%m\\xa4\\xc2f\\xcd\\x90\\x92.\\xed\\x06\\xcb1\\x07\\xb0\\xe9\\xc6\\x9ex\\xe6k\\x08\\xff\\xb1ks\\xb1\\xc6\\xcfc\\x9f$\\xb1\\xe6\\xfe2\\xdd\\x01\\x17\\x10e\\xd7b$m\\x18\\x02\\x88\\x03\\x0ce\\xc6\\x9b\\xe4\\x9c\\x02\\xbe\\x89\\x8dw\\xa8\\xb1\\xbd\\xc5n\\xec\\xfc\\xaev\\xb9\\xa3w\\x0b\\xecm\\xd1\\xf93\\xf7\\xb0\\xa2\\x8a 1=yn\\xed\\xd5\\x01\\x8d\\x8c\\xd6s:h!|=f~\\x96\\xfa\\x14\\x8bx\\xcakb\\xc5z19\\xe2\\xd0\\xc5\\xc0\\xb7\\xa4\\xfb\\x81r\\x9b\\x91\\xc3\\x7f7\\xbd\\x97\\x82\\xdcfa\\xd0\\xbf\\xcfc1~2\\xb291\\x9f\\x16\\x0fx\\xe9\\xe9\\xc6i\\x11`h\\xe3dtm\\xb1\\x88\\x12\\xf9\\xcfik\\x95o\\xd9\\x1eo\\x07<\\x89\\xb7\\x858"
  688.  
  689.  
  690. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xa4k \"_\\xad\\x8a\\xfc\\x08\\xb0al\\xb1<\\xc3\\x89)\\xab?\\x91\\x8b?2\\xe2\\xf7\\xf2\\x8bjjr\\x8f\\xab\\xb9\\xe9x\\xb3\\xfd\\xb5@l\\x8fr|\\x93\\xd3nf\\x91\\x92\\xa7\\x12\\x14\"\\x92l\\xb0\\x0e\\x8dg^@\\xf3\\xfe\\x9ai&n\\xcb\\x915\\x02/\\x8c\\xc6\\x82\\xa6\\xef#r\\x17\\xe6\\x1e\\xb5\\xbbo\\xa2\\xe2@l\\xbf\\xa9k^\\xdeh\\xb6\\x7f\\xcf\\x08\\xf6>\\x94\\xb5\\xa0\\xe1s\\xd7\\x82wn i&\\x86\\xe6\\x92\\x10\\xde\\x8b\\xac\\xdf\\x12\\x13\\x1b\\xee\\xb0ej5\\xfdy\\x0f\\xe7^f\\xc2\\xb3\\xd1\\x9c\\xa9\\xb0\\xe3v\\xa7\\xfa\\xa9\\x1d\\x1f\\x999!m%,\\xafp\\xd8o\\xd0\\xbd\\xae\\xb3\\xc35\\xe4euch\\x1c\\xee\\x8e\\xc4s\\xee\\x81\\x0e\\x8d\\x08t\\xd3!\\xba*\\xe9\\xbb\\x05\\xe4\\xd9\\xc9\\xf9\\x8f8\\xf5\\xc9\\x086\\x111a\\x0f*f\\xab\\xe2;\\xe9\\xdblax\\xf5\n.\\xe3\\x8d:\\x8cggy\\x12|\\x99>\\xb8\r\\x1e\\x0eo\\xdbe\\xd2\\xdb\\x01v\\x9ag\\x94\\xb6\\xaf\\x96\\x13\\xc4'\\xc2\\xf1"
  691.  
  692.  
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010yrfja\\x07wja\\xd1\\x12\\xda\\xc7\\x11\\xd2\\xa9\\x12\\xf6&\\xb1,\\x01k\\xf7z\\xf1\\xbdv#.z\\x8f\\xe9\\xc8\\xcf\\xd2\\x00m\\xbb$\\xf5\\x1b\\xb3\\xbc\\xe0y0\\xd4\\x90.\\x07v\\xc5#\\x9fu\\xc2p\\xf6\\xfez\\xd9\\x07\\xd9\\xc0l9\\xe80\\xb9\\xb5\\xaa\\x9a\\xff\\xb86gp\\xa8e\\xf9\\xc2\\x96\\xbfu!\\x8a\\xce\\x85\\xd5\\x81\\xa0<>\\x99\\xe9\\xf3\t\\xe7\\x00\\x0c+=\\xeb\\x91\\x8e\\xf8h\\x02\\xc5;\\xc2t\\xd5\\xdf\\xfby\"!\\xb7\\xef\\xf0\\x92\\xb5\\x10\\xe6b\\xb25\\x94\\x028\\xc7\\x9c\\x04\\x13\\x89\\x0f\\x10\\xb2\\x9ft\\x9e\\xf8r\\xea\\x99@b\\x07\\x98<y\\xb9\\x89\\xc8\\x1dw\\xbb\\xa4\\x86r_\\x92'u\\x8d\\x0b*\\xc6\\xf8\\x91\\xc84i\\xabpg\\xe6\\xce\\xa6\\x16\\xe4>\\xdf\\xf5\\xf5\\xa8msa@^z\\xc6\\xcfx\\xb3\\xceg\\xb3\\xcao'\\xe9\\x8b\\xb14=\\xa9\\x15\\xb3\\xde\\x01/\\xa1\\x11\\xa4a\\xf9\\x91yr\\xb2\\xfb\\xac\\x91\\x81\\xb7\\xe3\\x0e5\\xfdpw\\xe6\\x15\\x10`\\xaa<\\xd4r\\x95\\x89\\x82\\xe7\\xfe\\x99"
  694.  
  695.  
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\xae\"s\\xf0:\\xf1\\xf1\\x84\\xb4\\x15\\xf7\\xdcg\\x19\\xcd\\xd3\\xe4\\xfc\\xf2\r\\xf7u\\xec\\x8b\\xf4+\\xea\\x85\\xf7\\xa8\\xdd\\x00l\\x93\\x88\\xb8\\xb0\\x0f\\xf2h\\xec|u\\x0f\\xe8\\xdb\\x9aa\\x00\\xd8\\xaf\\:\\xb6\\x90?\\xe9?\\x15w\\xc3\\x0c\\xdf\\xb2i\\x9e\\x1b\\xe8v\\x1egx\\\\xf3\\xb2\\xc8yc8\\x8c?\\xd18\\x0bu\\xfc\\xbd\\x99\\xe0\n\\xb0\\xa2\\xd5\\xab>\\x12\\x9d\\xc9\\xca\\xda6^@\\x91\\x08\\xa1\\x80\\xedf\\xf3\\x9d\\x820l\\x00\\x82\\x08+\\x8d\\xe1p\\x95\\xff\\x11`xfr\\xdfqya\\xbc#q-o\\xac*\\x12\\xf2t\\x95\\xc3\\x7f\\x90bao\\x16\\xea\\xcdj\\xf9q1\\xbbe\\xee\\x12\\xe1\\xd8\\xbcjq\\x90\\xda\\xd72\\xde7\\x89\\xa4\\x96\\x07\\xe9\\xaag\\x86\\x8bn\\xd5\\xd3\\xf7n\\xdb\\x957^i\\x85\\xee9h\\x82\\x97\\xef\\xda\\xa6\\x8cn\\x9e\\x93\\xebm\\xb9\\x19\\x87\\xc3\\xfd\\xf7\\x840\\xb5zj\\xa2\\xc2\\xb8\\xedc\\x8cfq\\x15\\xc4\\x0e6j\\xe6\\xa7\\x0f\\xd5&s?r\\xfe/l\\xd6\\xa7z\\xbfr^\\xf0"
  697.  
  698.  
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb1>\\xd6\\xe5;\\xdf1\\xbd\\xb4\\xc2>\\xeft\\x83m,\\xc3\\xc4\\x1c\\xb3<.6zo\\xad,z7\\x01\\xd7d*2\\xdap\\x94\\xe5x9\\xe2.\t\\x8a\\xcc\\xbbcxr\\\\xdb\\xc0\\xf2\\xd0ez\\x96ty\\x01\\xf4t\\xa3\\x9e\\x8f(\ra\\x89p\\xe8\\xea\\xa5\\xaa\\x0b\\xbb\\xee/\\xed\\x87\\xb96\\xd5\\xae\\x8ck\\xe5\\xab=\\xa7\\x0fa$k\\x0c\\x8c\\x82\\x14\\xb5\\xfbp\\x9f\\xcb\\x8fl\\x94\\xb0@y&\\x91\\x82\\x0f\\xcf\\xcfq\\xfek\\x98\\x80x.\\xc1ql\\xd2\t\\xa8\\x1e\\x1d\\xd4l\\x92l\\xa9\\xa2\\xcb\\xa2\\x88+x\\xb9\\xefv\\xc8\\xa3\\x01\\x04\\xaf\\x8bn\\x1f\\xe0\\x81rvnkcxl\\x83p\\xf29\\xb1 \\xc1\\xdel\\xb1\\x134\\xb4\\xfc\r~\\x94\\xachv+\\xfd\\xcb\\xf0\\xee\\xd9\r@\\xf3`\\xf1\\xe0a\\xe0_\\x01v\\x99\\xe2;0|q\\xe3\\xfby\\xa9\\xd10k\\x18w\\xa8p^\\xd5'+\\x19gi\\xd2\\xd5\\xc4\\x85%\\xa8c\\xf6\\xd8jh\\xc9\\x93/\t\\\\xf7t\\xac\\x1b\\xd6dd"
  700.  
  701.  
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9a\\x043\\x8apia\\xdd\\x89wf`\\xa8\\x12\\xbas\\x98\\xb3\\xbci\\xa1\\xda\\x0f\\x1f=\\xe5@%\\xcf^\\xf2f\\xd9\\xce\\x04\\xf2wy\\xc5\\xea\\x98\ri\\xc2\\x1e\\xd1\\xa2\\rx\\xeey\\xa9\\x04\\xe7p\\x0cn9o8\\x1e\\x10:\\x0c|\\xd2\\xec\\x92\\xb7\\xbd\\x98l\\xf9o\\xe0\\x9e\\x07-\\\\xf8\\xa9\\xed\\x98\\x05wh\\xdbx\\xf0<w\\xd2\\x89\\x8bo\\x0f\\xc6\\xa4\\x95\\x0e\\xebo\\xf8.\\xfa\\x8a\\xf7\\xad\\x0c\\xb9\\xb6\r\\x9d\\x1bslw\\xa4g\\xb9b\\xcd\\xef\\x1a\\x99-\\xd4\\x8d\\x0e\\x13nhh\\x81\\x189\\xd2\\x87u\\x91\\xd7\\x96\\xfd,\\xa4\\x97\\xf7+\\xc1g\\x82\\xe8\\xd6in\\x9bmt\\xbb\\xef\\xa3\\x8e\\xe3,#c\\x05\\xad\\xabg\\x04\\x00>\n\\x07\\x93z\\xad_\\xce\\xd3;\\x05*\\xa8\\x80\\xeap\\xb7\\x15\\x05\\xc0\n\\xe3\\x9d\\x96w\\xfd\\x94\\xbf\\xc3x>js\\x0e\\xc6o\\x94\\xf9\\xc8\\x0cu\\xf9\\xd2'\\xbbo\\xb2\\xe1\\xd1mj\\xd4\\xd0\\x9a\\x0b\\xc6\\xc9&\\xcd\\xca(\\xdcj\\xd6y\\xf5\\xa2"
  703.  
  704.  
  705. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19:\\x99\\x95\t\\xbd\\x12\\xce55\\xc5\\xf88\\xc2\\xa9\\xecq\\xabb3\\x1cc\\xfa\\xb8\\x90\n\\xf9\\xbf\\xdb\\xc5r\\x1c\\x18w\\x9e\\xba%\\xe0skg,\\xa7\\xf7\\x9c\\xca60i\\x07)\\xe87a\\x00\\xb6d\\xe9\\x13s~\\xfa\\xee\\xb2\\xd2\\xe7\\x1c\\xe1\\xa7\\x8d\\x9d\\xc4\\xcb\\xb6-c\\xb7\\x14\\xb4\\xfcq-\\pz\\x1c\\x0b\\x1d\\xa7\\xa8\\xf1\\xf1&slp\\xa4n\\x11\\xba\\xbc1b\\x0b\\xcd\\x08jh\\x99\\\\xe3\\x90\\xc7q\\xa4\\x81\\x93\\x90\\x91\\x85v\\x86hm;r\\xa1\\xd9\\x94\\xb6\\x81\\xbb\\xc3\\xc2\\x9bta\\x9a\\xf4\\xfa\\xef\\xa8n\\x86\\xd8#\\xf7\\xc6q\\x801`\\xd8\\xfa\\x07\\x99\\xcb\\x1f\\xf2w\\xc7\\xe1\\xb8k\\xdc\\xa4\\x0c\\x14\\xfeak\\x9c\\x87i\\xed\\xbc0u\\xa0q\\xc8 /-\\x8f\\xa3\\xd1\\x93\\xb0\\x84\\xc7\\xa2c\\xd3\\xa87\\x94/)\\xe0\\xcf\\x04y\\xbb\\xf80\\x83\\xcd\\x7f\\xd0\\xc5\\xb3\\xaf\\xba\\xf7\\x9e\\x15\\x1b\\xb4/g\\xc2\\xa1x1\\xd6w\\x1d\\xda\\x0c\\x97\\xa9\\xb5\\xd7\\xb4\\x87|$<\\xc8\\x12\\x8fh\\xd6w\\x1c"
  706.  
  707.  
  708. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x86e\\x1d\\xb1\\xbc\\x1a>;\\xf0\\x91\\xd2n\\xc8y\\x7f@?\\xd6\\xe0\\xe6\\x82n\\x88r\\xd7\\x0eb\\x1b\\xd4\\x88\\xed(\\x1bnrnro\\x18?\\xd5r\\xa7vr\\xb3r\\xe3\\x82\\xbd\\xa0\\x19\\xc2\\xfe\\xf6\\xcc*\\xf4\\x7f\\xa3\\xa0\\xcc`\\xf3\\xd7\\xb5\\x86$(\\xacu$\\_\\xeb0s\\xd2*oa\\x0c\\x9c\\x9e\\xc7\\xbd\\x17\\xe4\\xd5mxc(\\xdb9acj\\xd0\\xc0\\x7f\\xfd\\xb2p\\xcc\\x06\\xc54\\x07%\\x04\\xc3\\x88\\xbd\\x03\\x83\\xe2\\x96\\xd9\\x8d\\x80\\x86\\xc2\\xc7ft\\x97\\xb7\\xf2\\xd4\\x00\\x94j \\x97\\xd9v\\xb2\\x8f\\xb6q\\xe5\\xfa^\\xab\\x00q\\xcdo\\xbb\\xa5l\\x0b\\xa4z\\xe0\\xf2\\xdb>\\xa3\\x1d\\xac\\xe2\\x0b\\xec\\x8b\\xd7b?l\\xbf\\xc3dn\\x8e\\x1aww~\\xd3:\\xcd\\xba\\xbb\\xf2\\xd2\\xcc\\x9d\\xf7\\xf7e\\xa7\\x9c\\xe3:n\\xd2\\xb3xk^\\x96\\x84\\x93\\\\xd1\\x89\\x11\\xe9\\xa6>?\\xae\\xd1\\xfd\\x13p\\xe6s\\x81\\x90\\xac\\xac\\xfc\\x8eq\\xaa\\xf7m\\x13k\\xb6e\\x0eu\\x87\\xa8lt_z\\x07"
  709.  
  710.  
  711. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  712.  
  713.  
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x99j\\x07\\xf0\\xea\\xd3\\xc6\\x8e\\xbe#m!\\xcc4\\xf3\\xca\\xf1'\\xccm\\x93/\\x0fzy\t\\xa2\\xb2\\xdajx\\xbc\\x00\t,\\xb3pq\\x9e\\x7fek\\xe3|\\x1bk\\xda\\xa9'\\xad>\\xde\\x1c\\xe0\\x85\\xd9w\\xf9f\\xe8\\x10\\xe5\\x9a\\x85u\\x10\\x97\\xb3\\xa3:\\xa3r\\x9b\\xbe&\\x94\\x9a6\\x8b\\\\x11\\xfe\\x06\\xea\\x0b\\xf9d\\xe2\\xd5fg\\xa2\\xbc/:\\x94e\\xed)\\xfa4\\xbe\\xa6t\\xf3\\x02\\x0ce\\xfd\\x17\\x89\\xd2\\x11\\xf2\\x10\\x01a\\xc6\\xd5a\\xe7k\\xbc>1\\xfc\\x03\\xbb\\xd5\\xdd\\x99\\xbc\\x04\\x04\\xef\\xd9s\\xe2\\x1a\\xcc\t\\x02\\x83\\xde\\x8f\\xf6\\xfe(d\\x8c\\xef\\xa5d\\xc3(zd\\xd0\r\\xc6\\xd5l\\x9b\\x8f.3b\\xac\\xb4\\xba\\xeb|\t\\x9cf\\xb9\\x8e|\\xf0\\xbcq:\\xfe\\x1a\\xe0\\xf34'l2\\xda\\x1d<f\\x82\\xb4n\\x07\\xebl(gf\\x1f\\xb1\\x7fn\\x17xi\\xf9(\\xf6d|\r\\xdbo\\x8bo.h\\x9aj~^?k\\xa4+\\xcbn\\x8anl\\x99r\\xb2\\xbar\\xd8\\xdd\\xd4\\xe4"
  715.  
  716.  
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x0c\\xaay\\xa7\\x12h\\xb2\t\\x9b\\xde.\\xbcb8\\x9f\\xcd\\xc3\\xa8\\x19)\\xd8\\xf0p\\xd97\\xfe\\x14\\xb8\\x83m\\\\xd6\\xfd*^\\xe9\\xec\\x94o\\x84\\xfcp\\x90\\x9b\\xcf\\xa2\\xea\\xd1p\\xcc\\xbe,c\\xad\\xc2\\xdf\\x99kl\\_\\xf3\\x9e\\xaf\\x81\\xb2>&\\x1a\\x07y\\xc7\\xb8j0\\x82st+\\xa5\\x95\\x06e\\xb0g\\x1d\\xac(\\x1b\\xd1l\\xf5\\xd1%\n\\xcf\\xce\\x13\\x9a\\xbcd\\xd5\\x1f\\x05|\\xedb\\x93\"\\xc3\\xe8\\xdfc\\x08\\xbd/\\x97$v\\x9f\\xba\t\\xf7o\\x95\\xf6\\xf6s\\xf36\\xbb\\xcef\\xa7\\xb0\\xeb@u\\x0b\\x91\\xfa\\xdeq\\x1c1\\x03\\xbb\\x0f\\xa5\\xdf\\x14\\xf5\\x14\\xd79'\\xf9\\xfd2i\\xd3\\xd9k\\x98\\x18\\xef\\xdf\\x92\\xf7b\\x1f\\x1a\\x9b\\xf5\\x83\\xa9\\xb0\\x83!4g\\xe4\\x08\\\\x8e\\xbb\\xb0wo\\x1e-ku\\x84\\x1ab\\x84\\x99u\\xffgc~\\x88>\\x1b)\\x03\\x80\\xa4\\xe2\\xe5\\xa6\\xf8\\xfdadzh\\x16j.\\xb0\\xa1\\xcd\\x0fg8\\x98\\xd5h\\x84\\x10\\x00y\\x85\\n,\\x9b\\xae\\x8d\\xeb\\xc6\\xd8x\\xe6v\\xa0"
  718.  
  719.  
  720. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  721.  
  722.  
  723. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  724.  
  725.  
  726. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  727.  
  728.  
  729. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x010\\x17m\\xb8\\xb6\\x88\\x93\\xe2\\x00\\xd7\\xb9\\xaei6\\xb4\\xdcs\\x97\\x0c\\x86\\x05)\\x9a\\x8du\\xd7c#\\xe1\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  730.  
  731.  
  732. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xae\\xde\\xdb\\xef/\\xa2\\xfb\\x83\\xcd\\xfe\\xf3a\\xb1\\xec>\\x83\\xc9$\\x9f\\xab\\x18\n\\xc2\\xfbm\\x8e87\\x1a\\xa2\\xa1\\xcc\\xcc\\xee\\xe0q\\x8e\\xa6\\x0b\\xa8-*\\x8c\\x02\\xc7\\xcf\\xa89by\\xfe\\xc4\\xe9@6a\\x06\\xbc\\x05=\\x96\\xa5\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0p\\xcfu\\xd4\\x8b\\xb4z\\x9e\\x86\\xcd\\x85\\xac=\\xba\\xe4r\\x9e^x\\xd8\\xbb\\xf8z\\xfa\\xbe*\\xe3\\xf7\\xdd\\xa3\\xe0\\xa6\\xd5\\xfb\\xe4\\xaao\\x15\\x83\\x18fn\\x98,\\xb2\\x9f\\xcc"
  733.  
  734.  
  735. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc6+\\xb7oe\\xa8z)\\x8d\\xf5\\x8d\\xbckr\\xe3\\x96\\xba\\xc3v7o\\xbe\\x17\\xe2\\x1b\\xeb\\x8e\\x9c\\x84ae\\xf0\\xe0m\\xa0\\xdbq$\\x7f\\x07\\x84p\\xf5n\\x8a\\t\\x1e\\xb1\\xe6@\\xd7\\xd7z~|~yv,\\x99ak\\x97\\x145\\xa3\\x8ev\\x99\\x1e\\xd7n;\\x18\\x96\\x07\\x11\\xb6\\xa4\\x913(\\xceno\\x07o\\xa2\\xe6\\xc2\\xab\\xc8\\xf7(\\xa8e`o+- m()\\xee\\xd3~pf\\xe8\\x8a\\x9c(ge??&\\x08\\x94\r'\\xa1\\xd9\\xb3\\xa7\\xa8\\x1e\\xf7\\x9d\\x99oo\\xf6\\xfb\\xefh\\xa2\\xad\\xaas\\xfcp\\x86\\xbd\\xcd\\xbb.\\x9agd\\x9c\\xf6u\\xac+\\x16\\xb3%\\x13m~\\xe7\\x80\\xe1d\\xec\\x1c\\xbb\\xb0\\xfb2\\x90\\xb1t\\xcc\\xd0\\xb4)\\x85+\\x84fp\\x1a\\xff\\x9c\\xe1\\xee\\xa9\\xf4\\xd6\\x9f\\xab\\x06\\xdc\\x0cgn\\x83a\\x1a\\xdf\\x88\\xb3|kr\\xdf\\xdf~\\x93\\x8c\\x8bb|&\\xed\\xa9\\x8d^b\\x0fvw>\\x107o\\x13\\xec\\x12%\\xbe`\\xb3\\x16\\x1c\\x17\\x05>\\x8f\\xa6"
  736.  
  737.  
  738.  
  739.  
  740. "Description": "Creates a hidden or system file",
  741. "Details":
  742.  
  743. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  744.  
  745.  
  746. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  747.  
  748.  
  749.  
  750.  
  751. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  752. "Details":
  753.  
  754. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  755.  
  756.  
  757. "FireEye": "Exploit.CVE-2017-11882.Gen"
  758.  
  759.  
  760. "McAfee": "Exploit-CVE2017-11882.bu"
  761.  
  762.  
  763. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  764.  
  765.  
  766. "Symantec": "Exp.CVE-2017-11882!g3"
  767.  
  768.  
  769. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  770.  
  771.  
  772. "Avast": "Win32:ShellCode Expl"
  773.  
  774.  
  775. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  776.  
  777.  
  778. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  779.  
  780.  
  781. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  782.  
  783.  
  784. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  785.  
  786.  
  787. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  788.  
  789.  
  790. "DrWeb": "Exploit.ShellCode.69"
  791.  
  792.  
  793. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bu"
  794.  
  795.  
  796. "Sophos": "Troj/RtfExp-EQ"
  797.  
  798.  
  799. "Cyren": "CVE-2017-11882.D.gen!Camelot"
  800.  
  801.  
  802. "Avira": "EXP/CVE-2017-11882.Gen"
  803.  
  804.  
  805. "MAX": "malware (ai score=82)"
  806.  
  807.  
  808. "Microsoft": "Trojan:O97M/Obfuse.AE"
  809.  
  810.  
  811. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  812.  
  813.  
  814. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  815.  
  816.  
  817. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  818.  
  819.  
  820. "ALYac": "Exploit.CVE-2017-11882.Gen"
  821.  
  822.  
  823. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  824.  
  825.  
  826. "Zoner": "Probably W97NativeOnly"
  827.  
  828.  
  829. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  830.  
  831.  
  832. "Ikarus": "Exploit.CVE-2017-11882"
  833.  
  834.  
  835. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  836.  
  837.  
  838. "AVG": "Win32:ShellCode Expl"
  839.  
  840.  
  841. "Qihoo-360": "virus.exp.21711882.d"
  842.  
  843.  
  844.  
  845.  
  846.  
  847. * Started Service:
  848. "osppsvc"
  849.  
  850.  
  851. * Mutexes:
  852. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  853. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  854. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  855. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  856. "CicLoadWinStaWinSta0",
  857. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  858. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  859. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  860. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  861.  
  862.  
  863. * Modified Files:
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_7fea5a654003608c9d89c9a51cf1439f.doc",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_7fea5a654003608c9d89c9a51cf1439f.doc",
  866. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  867. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF1F948B7F-1E2C-4FAE-AF0F-EAA3FA64E279.tmp",
  868. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  869. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  870. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0EB6851-F87C-4E28-A417-B590C17498A5.tmp",
  871. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  872. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2CCF.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2CD0.tmp",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_7fea5a654003608c9d89c9a51cf1439f.asd",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1A595E3A1D57838B.TMP",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B68.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B79.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B78.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C17.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C19.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C18.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C39.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C4B.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C4A.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C6B.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C8D.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C8C.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C7B.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CBD.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D5A.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D6C.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D6B.tmp",
  896. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  897. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3EF3.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3EF4.tmp",
  900. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F44.tmp\\pictureorgchart.glox",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F44.tmp\\Content.inf",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F64.tmp\\TabList.glox",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F74.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F64.tmp\\Content.inf",
  906. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  907. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F85.tmp\\Equations.dotx",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FB5.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F85.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FF4.tmp",
  912. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  913. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B2.tmp\\mlaseventheditionofficeonline.xsl",
  915. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B1.tmp\\architecture.glox",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4143.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4145.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B1.tmp\\Content.inf",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40E2.tmp\\ThemePictureGrid.glox",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4155.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4144.tmp",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4121.tmp\\VaryingWidthList.glox",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B2.tmp\\Content.inf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4142.tmp\\iso690nmerical.xsl",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4121.tmp\\Content.inf",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40E2.tmp\\Content.inf",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41D4.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41A4.tmp\\sist02.xsl",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4142.tmp\\Content.inf",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\BracketList.glox",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\Content.inf",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41A4.tmp\\Content.inf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4233.tmp\\turabian.xsl",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\cab448B.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4467.tmp",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44CA.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44DB.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4233.tmp\\Content.inf",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4479.tmp\\gosttitle.xsl",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab44EB.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\RadialPictureList.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\Content.inf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar44EC.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar447A.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452D.tmp\\PictureFrame.glox",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FD.tmp\\ieee2006officeonline.xsl",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452D.tmp\\Content.inf",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab45AC.tmp",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456C.tmp\\InterconnectedBlockProcess.glox",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4479.tmp\\Content.inf",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar45AD.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456C.tmp\\Content.inf",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FD.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4698.tmp",
  963. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  964. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab46E8.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46FA.tmp\\iso690.xsl",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E7.tmp\\content.inf",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar46E9.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E7.tmp\\Frame.thmx",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4769.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4749.tmp\\TabbedArc.glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46FA.tmp\\Content.inf",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar476A.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4749.tmp\\Content.inf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4827.tmp\\CircleProcess.glox",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4847.tmp\\Basis.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48B8.tmp",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  980. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4827.tmp\\Content.inf",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4887.tmp\\HexagonRadial.glox",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4887.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48F7.tmp\\harvardanglia2008officeonline.xsl",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48B7.tmp\\chevronaccent.glox",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48F7.tmp\\Content.inf",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48B7.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4847.tmp\\content.inf",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4994.tmp\\content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4994.tmp\\Parallax.thmx",
  995. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AAF.tmp\\gb.xsl",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ABF.tmp\\Circuit.thmx",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AAF.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AD0.tmp\\rings.glox",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AD0.tmp\\Content.inf",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ABF.tmp\\content.inf",
  1008. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1009. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CA6.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D14.tmp\\Berlin.thmx",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D14.tmp\\content.inf",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cab513B.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51C9.tmp\\content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51C9.tmp\\Wood_Type.thmx",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5489.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\content.inf",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\Slate.thmx",
  1022. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C8A.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D95.tmp\\Insight design set.dotx",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E03.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D95.tmp\\Content.inf",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EEE.tmp\\content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EEE.tmp\\Mesh.thmx",
  1030. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60D4.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6152.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61B1.tmp\\content.inf",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61B1.tmp\\Vapor_Trail.thmx",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  1039.  
  1040.  
  1041. * Deleted Files:
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2CCF.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2CD0.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1046. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_7fea5a654003608c9d89c9a51cf1439f.asd",
  1047. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1048. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  1050. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3EF3.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3EF4.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F44.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F64.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F85.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F64.tmp\\TabList.glox",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B79.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B2.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B1.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F44.tmp\\pictureorgchart.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C39.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40E2.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F85.tmp\\Equations.dotx",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C8D.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4121.tmp",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4142.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41A4.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4143.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4144.tmp",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4233.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4121.tmp\\VaryingWidthList.glox",
  1078. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464fn=Dividend.eftx",
  1082. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D6C.tmp",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464fn=Dividend.xml",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B2.tmp\\mlaseventheditionofficeonline.xsl",
  1094. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  1096. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40B1.tmp\\architecture.glox",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD40E2.tmp\\ThemePictureGrid.glox",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464fn=Dividend.xml",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C4B.tmp",
  1104. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3F74.tmp",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4479.tmp",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C6B.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\BracketList.glox",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3CBD.tmp",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FD.tmp",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452D.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456C.tmp",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab44EB.tmp",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar44EC.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4142.tmp\\iso690nmerical.xsl",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FF4.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4467.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD41A4.tmp\\sist02.xsl",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab45AC.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D5A.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4478.tmp\\RadialPictureList.glox",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar45AD.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C4A.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4233.tmp\\turabian.xsl",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C8C.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E7.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46FA.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD452D.tmp\\PictureFrame.glox",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4749.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B68.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab46E8.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar46E9.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4769.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar476A.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4827.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4847.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4887.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456C.tmp\\InterconnectedBlockProcess.glox",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46FA.tmp\\iso690.xsl",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48B7.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4749.tmp\\TabbedArc.glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4479.tmp\\gosttitle.xsl",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C19.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3B78.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C7B.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD44FD.tmp\\ieee2006officeonline.xsl",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3FB5.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46E7.tmp\\Frame.thmx",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44CA.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4155.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4994.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4887.tmp\\HexagonRadial.glox",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48F7.tmp\\harvardanglia2008officeonline.xsl",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4145.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD48B7.tmp\\chevronaccent.glox",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cab44DB.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C17.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4827.tmp\\CircleProcess.glox",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AAF.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41D4.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ABF.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AD0.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4994.tmp\\Parallax.thmx",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4847.tmp\\Basis.thmx",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab448B.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AAF.tmp\\gb.xsl",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C18.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AD0.tmp\\rings.glox",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D6B.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4ABF.tmp\\Circuit.thmx",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab48B8.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D14.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4D14.tmp\\Berlin.thmx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4CA6.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51C9.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD51C9.tmp\\Wood_Type.thmx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab513B.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5507.tmp\\Slate.thmx",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5489.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D95.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5D95.tmp\\Insight design set.dotx",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C8A.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EEE.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5EEE.tmp\\Mesh.thmx",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5E03.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61B1.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623E.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD61B1.tmp\\Vapor_Trail.thmx",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab60D4.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623E.tmp\\Main_Event.thmx",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6152.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSE0EB6851-F87C-4E28-A417-B590C17498A5.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_7fea5a654003608c9d89c9a51cf1439f.doc"
  1204.  
  1205.  
  1206. * Modified Registry Keys:
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\=\"+",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\246F07",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\246F07\\246F07",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1230. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1233. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\246F07\\335C42",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1292. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1593. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48"
  1838.  
  1839.  
  1840. * Deleted Registry Keys:
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\=\"+",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:)",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\246F07\\335C42",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\246F07\\246F07",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate"
  1869.  
  1870.  
  1871. * DNS Communications:
  1872.  
  1873. "type": "A",
  1874. "request": "sukaponic.com",
  1875. "answers":
  1876.  
  1877. "data": "103.229.72.62",
  1878. "type": "A"
  1879.  
  1880.  
  1881.  
  1882.  
  1883.  
  1884. * Domains:
  1885.  
  1886. "ip": "103.229.72.62",
  1887. "domain": "sukaponic.com"
  1888.  
  1889.  
  1890.  
  1891. * Network Communication - ICMP:
  1892.  
  1893. * Network Communication - HTTP:
  1894.  
  1895. "count": 1,
  1896. "body": "",
  1897. "uri": "http://sukaponic.com/wp-new/val/vary.exe",
  1898. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1899. "method": "GET",
  1900. "host": "sukaponic.com",
  1901. "version": "1.1",
  1902. "path": "/wp-new/val/vary.exe",
  1903. "data": "GET /wp-new/val/vary.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: sukaponic.com\r\nConnection: Keep-Alive\r\n\r\n",
  1904. "port": 80
  1905.  
  1906.  
  1907. "count": 1,
  1908. "body": "",
  1909. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1910. "user-agent": "Microsoft-CryptoAPI/6.1",
  1911. "method": "GET",
  1912. "host": "ocsp.digicert.com",
  1913. "version": "1.1",
  1914. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1915. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1916. "port": 80
  1917.  
  1918.  
  1919. "count": 1,
  1920. "body": "",
  1921. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1922. "user-agent": "Microsoft-CryptoAPI/6.1",
  1923. "method": "GET",
  1924. "host": "ocsp.msocsp.com",
  1925. "version": "1.1",
  1926. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1927. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1928. "port": 80
  1929.  
  1930.  
  1931. "count": 11,
  1932. "body": "",
  1933. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1934. "user-agent": "Microsoft-CryptoAPI/6.1",
  1935. "method": "GET",
  1936. "host": "crl.microsoft.com",
  1937. "version": "1.1",
  1938. "path": "/pki/crl/products/microsoftrootcert.crl",
  1939. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1940. "port": 80
  1941.  
  1942.  
  1943. "count": 3,
  1944. "body": "",
  1945. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1946. "user-agent": "Microsoft-CryptoAPI/6.1",
  1947. "method": "GET",
  1948. "host": "crl.microsoft.com",
  1949. "version": "1.1",
  1950. "path": "/pki/crl/products/microsoftrootcert.crl",
  1951. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1952. "port": 80
  1953.  
  1954.  
  1955. "count": 3,
  1956. "body": "",
  1957. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1958. "user-agent": "Microsoft-CryptoAPI/6.1",
  1959. "method": "GET",
  1960. "host": "crl.microsoft.com",
  1961. "version": "1.1",
  1962. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1963. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1964. "port": 80
  1965.  
  1966.  
  1967. "count": 1,
  1968. "body": "",
  1969. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1970. "user-agent": "Microsoft-CryptoAPI/6.1",
  1971. "method": "GET",
  1972. "host": "crl.microsoft.com",
  1973. "version": "1.1",
  1974. "path": "/pki/crl/products/microsoftrootcert.crl",
  1975. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1976. "port": 80
  1977.  
  1978.  
  1979.  
  1980. * Network Communication - SMTP:
  1981.  
  1982. * Network Communication - Hosts:
  1983.  
  1984. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!