API tools faq
paste
paladin316

Docs_608d61e92b9146193f80067c5c6893ef_doc.json

paladin316
Jun 19th, 2019
2,277
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 330.53 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Msoffice"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Docs_608d61e92b9146193f80067c5c6893ef.doc"
  7. [*] File Size: 8577
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "6ec144c5ca5a7ce3a2f33f97372968be7a54d63dee8967dbcc4f304ea64c20a2"
  10. [*] MD5: "608d61e92b9146193f80067c5c6893ef"
  11. [*] SHA1: "9f72eb74191327090cc479db9d428af65364cc93"
  12. [*] SHA512: "f49fdfeccf6deadbc40074209fa1d236908d8cb1afaff6c4d95aceb05b848a90652852a7d761038fb054bca790537779e5a0bb74ab2d6c66f140557f3cb8a64f"
  13. [*] CRC32: "65319980"
  14. [*] SSDEEP: "96:BBTvCws1HmMgb56xHpL2DWHKVagdzmgYL7zm+x:r7CwCHXgbO9okgY/x"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 2848"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "A process attempted to delay the analysis task.",
  31. "Details": [
  32. {
  33. "Process": "WINWORD.EXE tried to sleep 361 seconds, actually delayed analysis time by 0 seconds"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details": [
  40. {
  41. "IP": "52.109.16.5:443"
  42. },
  43. {
  44. "IP": "65.52.98.231:443"
  45. },
  46. {
  47. "IP": "104.18.24.243:80"
  48. },
  49. {
  50. "IP": "104.93.33.19:443"
  51. },
  52. {
  53. "IP": "104.93.189.220:443"
  54. },
  55. {
  56. "IP": "184.84.243.209:80"
  57. },
  58. {
  59. "IP": "72.21.91.29:80"
  60. },
  61. {
  62. "IP": "52.109.16.4:443"
  63. }
  64. ]
  65. },
  66. {
  67. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  68. "Details": [
  69. {
  70. "ioc": "chicago.xsl"
  71. },
  72. {
  73. "ioc": "ontent.inf"
  74. },
  75. {
  76. "ioc": "gostname.xsl"
  77. },
  78. {
  79. "ioc": "iso690.xsl"
  80. },
  81. {
  82. "ioc": "sist02.xsl"
  83. },
  84. {
  85. "ioc": "ext.glox"
  86. },
  87. {
  88. "ioc": "gb.xsl"
  89. },
  90. {
  91. "ioc": "ist.glox"
  92. },
  93. {
  94. "ioc": "ieee2006officeonline.xsl"
  95. },
  96. {
  97. "ioc": "e.gu"
  98. },
  99. {
  100. "ioc": "chevronaccent.glox"
  101. },
  102. {
  103. "ioc": "ccent.glox"
  104. },
  105. {
  106. "ioc": "rocess.glox"
  107. },
  108. {
  109. "ioc": "mlaseventheditionofficeonline.xsl"
  110. },
  111. {
  112. "ioc": "gosttitle.xsl"
  113. },
  114. {
  115. "ioc": "rc.glox"
  116. },
  117. {
  118. "ioc": "rid.glox"
  119. },
  120. {
  121. "ioc": "..3b"
  122. },
  123. {
  124. "ioc": "rame.glox"
  125. },
  126. {
  127. "ioc": "architecture.glox"
  128. },
  129. {
  130. "ioc": "nline.xsl"
  131. },
  132. {
  133. "ioc": "content.inf"
  134. },
  135. {
  136. "ioc": "ividend.thmx"
  137. },
  138. {
  139. "ioc": "rings.glox"
  140. },
  141. {
  142. "ioc": "pictureorgchart.glox"
  143. },
  144. {
  145. "ioc": "set.dotx"
  146. },
  147. {
  148. "ioc": "turabian.xsl"
  149. },
  150. {
  151. "ioc": "asis.thmx"
  152. },
  153. {
  154. "ioc": "anded.thmx"
  155. },
  156. {
  157. "ioc": "adial.glox"
  158. },
  159. {
  160. "ioc": "harvardanglia2008officeonline.xsl"
  161. },
  162. {
  163. "ioc": "iso690nmerical.xsl"
  164. },
  165. {
  166. "ioc": "quations.dotx"
  167. },
  168. {
  169. "ioc": "etropolitan.thmx"
  170. },
  171. {
  172. "ioc": "rop.thmx"
  173. },
  174. {
  175. "ioc": "adge.thmx"
  176. },
  177. {
  178. "ioc": "amask.thmx"
  179. }
  180. ]
  181. },
  182. {
  183. "Description": "Performs some HTTP requests",
  184. "Details": [
  185. {
  186. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  187. },
  188. {
  189. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  190. },
  191. {
  192. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
  193. },
  194. {
  195. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  196. },
  197. {
  198. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe"
  199. },
  200. {
  201. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  202. },
  203. {
  204. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  205. },
  206. {
  207. "url": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes"
  208. },
  209. {
  210. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  211. }
  212. ]
  213. },
  214. {
  215. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  216. "Details": [
  217. {
  218. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\":3i4\\xf9\\x95uz_\\x8a\\xbb\\xf6\\xb3#\\x86\\xec(c\\xc4h\\x86,2d\\x89*\\xadf\\xdc=\\xdb\\xa1\\x90\\xf2\\x9f7\\xe23{6\\xd0&\\xf9w\\x88\\x18\\xaa\\xd4\\x8f\\x9a5\\xd9\t|\\x01\\xd67\\xc8d3\\xa4}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008\\x92\\xca\\xf4z\\x03\\xb3\\x952\\xbc\"\\xa4;/.\\xdcb\\x11\\x93\\xc6\\xd9\\xf0\\xc9xk\\x0c\\x85;.\\x83\\\\xcf9>\\x1a\\x16\\xc63\\x8e\\xab\\x83~y\\x02\\xab`t\\xdc"
  219. },
  220. {
  221. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x0e\\x02\\xb0r\n\\x1fw+\\xc7\\xb2\\x05'jm\\xea,\\xb0\\xf6\\xb0\\xdb\\xa1\\x04\\x984?5{7\\x9f\\x93\\xbft\\xf8\\x7f\\x98\\xa5\\xe1\\x93o\\xd6\\x97\\xa3t\\xeb?\\`\\xbf\\xbcz\\xdf\\x89@\\xdeq\\x82\\xe0t\\xe9{\\xfc\\xcfor3\\x96.s\\xc0\\xd3\\xac\\xeb>z\\x98\\xeb\\x81\\x01\\x16\\x00\\x1em\\xf92\\xc2\\x1d\\x03\\xf9\\xf0\\xd0\\xc6\\x07\\xd5\\xb9\\xd3\\x89e`\\xb8\\x1e\\xd2on\\x1b\\xc9\\x16k\\x97\\xa20cq\\x17\\x06+\\xb1\\xc3\\xa7\\xb5\\xc3r\\x16\\xe8\\xf2\\xe44y\\x10h6v#\\xe9a\\xab\\xf8i\\x9e\\xf1\\x1cz\\x8cb\\x98{\\xdfi\\xb9\\xba\\xfd%\\xb60l\\xc0\\xc3w\\x90\\xd6\\x99w\\xf5\\xa6\\xe5j2\\xda\\x92\\xce\\xdbx.\\xb1\\xd2\\xb4\r\\xb5\\xa7\\xb1\\xe4\\xceo\r\\xaa^l6m\\xf0_(\\xc2mc\\x88\\x8a\\x1aq\\xad=y\\xf6\\xdf\\xd6\\x12\\xd1\\xc3\\x15c\\xe8:\\xb4\\xe1^\\xc2\\x0c\r?l7e\\xfa\n\\x8b\\xe31\\xb4\\xc7\\xb2\\x1cz\\xa7e\\x89{\r\\xacqv\\xfe6\"f0\\xc0\\xe7\\x029rk\\x8c"
  222. },
  223. {
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\t\\xf7\\xf3t\\xff\\x93_3\\xba\\xd5z\\xdf\\xcc\\xf6\\xabn\\xad\r\\xb4\\xd2\\xc3\\x89\\x13\\xdak\\xc1\\x84\\xaa\\xf5y{\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  225. },
  226. {
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6)vp\\x90}\\xb5k!#m\\x0c\\xe6p\\xd7b\\x02\\xb2wpy\\xb5,\\xd7o\\x19*\\xfe\\x0c\\xe0\\x92\\x82\\xbf\\xd8\\xb0\\x07i\\x81\\xd6\\x07_\\xdf\\xf07\\xc7\\xc3\\xe0\\xce\\x13\\xf6\\x8e\\x02g\\x90~\\x94\\x84-\\xbf\\xb6v\\x0cr\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0f\\xd4\\xa06\\xa7b\\xeb\\xc0\\xf0\\xc2\\xa9\\xaa\\xeb\\x84\\xb3\\xa5\\xa4\\xf1\\xe4v\\xdfk\\\\x19\\x94\\xc0\\x88\\xeb\\x84\\xa8\\xa6\\xeb\\x97\\xfa\\xcf\\xde7u\\x14a\\xbc\\x1ff\\xe9\\x9f\\xe1\\xb8w"
  228. },
  229. {
  230. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  231. },
  232. {
  233. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  234. },
  235. {
  236. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xfdjzc\\xc0\\xa9\\x03\"\\xc0\\x96\\x9b\\xbb\\xf2\\x80t\\xe3\\xbb&f\\xfa\\x0e\\x0c\\xc1\\xfe\\xe5\\x04\\xb6%\\x9e\\x1dxh\\xa8\\x93\\xa0\\xab\\x98\\x18\\xeag\\xe3\\xba\\x06\\x8aqw\n*\\x1e\\xeb&\\x9a?-\\xe6c\\x82\\xcc\\x0bl\\x9b\\x1f\\x9b\\xf7$#\\x14\\x98\\x85\\x0e\\x11j\\xd1\\xfd\\xf3\\x1fj)\\x1duzv\\x13]\\x0b\\x87\\x0f\\x19\\x14\\xd8\\xf2i\\xbf\n\\xcc\\xbd\\xa4\\xd5t<^\\xbc\\x07q@\\xf6\\xee\\xf2\r\\xaf\\xb0\\x86\\xb8\\xb7\\x92\\xe0\\xf2\\xb7cy~h\\x8f\\xd4a\n.\\xc6\tu=\\x90ty\\xb7\\x88\\xf1\\xef\\x9c\\x9a\\x0f}3\\xe5\t\\xee]\\x95\\x10\\xcd\\x8cy\\xd4@\\xc8h<\\xcdy\\xf8:v\\xc14\\xe9\\xad\\xa8l\\x1d\\xfd\\xbdo3\\x8a\\xa8\\xff\\x15\\xf8\\xc1\\x96j\\xaf\\xea$x'\\x01\\xf6\\xd6\\xa9\\xd3\\x14\\x8e\\xeas\n:\\xcf\\xc2r\\xe2\n\\xac}\\xea\\x07\\x1b\\xb4\\xc1\\x0bbp\\x90\\x9f\\x9f\\x8fw\\xc9\\x84\\xf1\\x1b\\x7f\\xd8n\\xe1,\"\\x86\\xfa\\x98@\\xce\\x00'(\\xeb\\x02w\\xfa\\x1bm\\xedl\\xac\\xcf\\x83\\x9dh\\xc7\\x87\\xf6"
  237. },
  238. {
  239. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x05~\\x7fv\\xe3@\\xd5x\"_-];\\xee\\x9a\\xb3\\x8d|\\xcc\\x04\\x03\\xe8\\x1a\\xce\\x98\\xe3\\xeb(\\x80\\xc3\\xf3(a$t(5\\x8c\\xbb%\\xd0\\xaf\\x8a\\x0e\\xa2/d\\xd1rn\\xc3\\x9f\\xbe3fiv\\xce:\\x88x\\xb2>p\\xb5.&]\\xfc\\x84\\xbe\\x84\\xce\\xf9\\x9d\"\\xca\\x8d\\x8dq\\x13\\x1f\\xecl|\\xb7*g9\\x8e\\xb9$\\x8c\\x86{\\xabp\\xd05\\xd0\\xd2\\x05\\xf5\\xbc\\x109_x\\xfc'\\x89x\\x7f\\x82\\xfcj\\x0c\r\\xf6\\xf1\\x00\\x9c\\xe9\\xb0}vw\\xaf\\x05\\x12y\\x16\\xb9\\x911\\xca\\x07)\\x0b\\x7fu\\xed%\\x01\\xfe\\xa4\\xa3\\xacd6\\xfa\\x12\\x12~\\xea\\xa4\\xc1#\\x915\\xc9e\\x81\\xe1\\xd5\\x7f\\x87\\x12p\\x99\\xb7\\x18\\xa3\\x02\\xcc0\\x821/\\xbfb\\xea\\x0eg=\\x7f\\xbf\\x99w\\xf9\\xb6\\x82le\\x98t\\x00z\\xaa\\x85\\xfd/\\x07\\xc3\\xbc\\xf4^@\\xb7+\\x03\\x9bjxa\\xeb@\\xaf\\xe7\\x80\\xc8y!\\xfe\\xa2\\xd8\\xeb\\x02o2%\\x9e\\x06)3\\xcc\\xda\\x86\\x9cb)\\xf6\\x17w\\x89\\x11\\xfb\\xca\\xcda\\xe2"
  240. },
  241. {
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\t\\xf7\\xf9\\x1dg\\xe1;\\xb9\\x93c0\\xfazkr\\xe7\\xb9\\x04\\xcd\\xf2\\xcf\\x14\\x95\\x85\\x908\\xfdg\nm\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243. },
  244. {
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\x82|\\xd9\\xca~`\\x05\\xfc\\x05)x\\xab\\xf0\\x0e5j\\x04\\xe6zw\\xb7m\\xecqn\r%\\x10\\x1a\\xfc\\xec'\\xa4\\x94\\x9e\\xda\\xc9\\xe2\\x95\\xc4\\xee\\x1cu\\x89\\xe8(f8\\x88\\xd2he\\xf1\\xb8\\xb6r\\x86\\xcf\"\\xd1\\xd8\\xdd\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0e\\xfb\\x17\\xf0\\xe6\\xce\\xf1c\\xa2t\\xce\n\\x18\\x0e\\x15|-\\x9c-)\\xc7hykv\r\\xecd\\xb5v\\x17\\x02 0\\x14\\x8a\\xa9=\\xa6l\\xa9\\x8b\\xd45t\\xb9\\xff\\xae"
  246. },
  247. {
  248. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x89\\xb7yf\\xdf\\xba\\x8e\\x10\\x81s\\xe98`6\\xbf\\xe9p#\\x99\\xd5\\xdd\\x8b\\x7f\\xc6\\xf1*\\xe9\\x16,\\xbb&\\x1fp'\\xc1!\\xe3\\xe4\\xa4\\xfa\\x9b\\xd2\\xd2\\xd0|\\xc1\\x91e\tn\\xca/\nv&\\xe3\\xf3.0\\xbc\\xd7w5$\\xf9\\x9ez\\xca\\x81o\\x04n\n\\x11\\xcf\\xa49\\xdb\\xfe\\xab\\xf7k\\xf8\\xe1\\x11\\xd7`\\xb7\\xa4\\xb9\\x01\\xdfozy\\xdc\\x9cdu\\x8f\\x07\\x01\\xd2\\xf7\\x83\\xab)g\\xe1\\xc0\\xa5+\\x12\\xc9)g\\x1a\\x92\\x8d\\x83\\x85`\\x80\\xe2\\x14u\\x19a\\xc0\"\\xa5\\s\\x99v\\xfb\\xf5\\xa7\\xbb\\x86\\xf8\\x1c\\x85;\\xc0\\xe3\\x00\\xda\\xc3!\\xefnr3\"\"\\xfc\\x94\\xc6k\\xe5\\xf7\\xce\\xe9\\xab\\x1a\\xa2<,oi\\xf17e\\x83w\\xb3\\xfd\\xe8<y\\xdd)j\\x95/\\xaa\\x0c\n\\x8fk\\xf1\\xd0?\\x0e|<|+\\xf2\\xaer\\x1b\\xb5^f\\x8c;\\x80f\\xdbn3s\t\\x89\\xf1\\xc5\\x07\\xc4\\x17\\xaealz\\x8am'z\\x9ce9\\xe2\\xde\\x9c\\xdfx\\xa0@\\xd6\\xbd\\xbf\\xcd6^nu\\xb9\\x9a\\xb5\\xd5"
  249. },
  250. {
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\t\\xf7\\xfbu+2`lx=p\\xd4\\xa4\\x98@`\\x97\\xc3n\\xe7\\x06l\\xb4\\xf2#\\x9b\\xcc\\x82\\xef(\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252. },
  253. {
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdak:\\x9c3\\xe4\\x81\\x83\\x11pt\\x9a\\xff\\xf7\\x91?\\xe1\\x9a\\x1aza\\x87n\\x8ex\\xf6\\xa8\\x91\\xb4\\x93\\x8b+\\xa6'\\xcc\\xe4\\xc9\\x85\\x93\\xf6\\x9cq\\x97d'\\xebn \\x19\\x0eec\\xe3h\"\\x87%\\xe8(\\xa2\\xbb\\x90\\x95/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ij\\x05(\\xd2_k\\x1b\\xaa\\xf1\\x1e\\x9eg\\xb3\\xf6.\\x1e\\xa5w\\x83\\xa4=\\xd7(\\xe15w\\x9at\\x1ee+f\\x1a6!+i\\x1e\\xdb\\xd5l\\x97 <\\xefpm"
  255. },
  256. {
  257. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x95\\xd7f6\\xea\\xeds\\xf7\\xf8y\\x86e\\xcf\\x14\\x80\\x19\\x1e\\xd7\\xd4\\xaf~\\xef\\xd35\\x85jbj_pkk\\xc3\\xa4{\\x8bt\\xfa\\xbe\\xb5\\xa5\\xe6\\x8bw\\xca\\xf84tw\\xaf\\xde\\xbf6\\xd3\\xaa\\xcc\\x1epb\\xe4\t\\xb1\\xec\\xca\\xc0\\xf6\\x0c)\\xe6\\x83f.\\x8ee\\x07_]\\x03\\xdcm;\\xb08\\x15\\xdb\\x05\\xacxc*\\xb5\\x9e\\xa9\\xa5\\xee:xro\\xcdh\\x84\\x11\\xc8*\\xab\\xfc\\x96\\xdb\\xfav\\xe9/f\\xbe\\x19\\xf6mu\\x82\\xa7h\\x8f\\x1e\\xc6\\xe7\t\\xaa\\x03w\\xe0\\x12\\xedwfx\\xe4qo\\xc4r|\\xbc\\xc8g\\x80\\x8fki\t\\x8de\\x15 \\x98]\\xc3hqof\\x8b\n\\xce\\x05,\\x88j\\xc4\\xac\\xb5,\\xe7\\xb2e\\xfd\\x95$\\xee6\\x955\\xbb\\xc2\\x98\\xe8\\x03/s\\xc0\\xa6i \\xeadr\\xe3\\x9c\\xb8\\x8f\\x16\\xe9\\xb6\\xb3\\xbb1lq\\xd2\\x86\\xe7o\\xb5o\\xe9p\\xd2\\xe2\\x8f\\xb6k$c\\x16\\xec^j\\x91\\x1bg\\x96\\xe9\\x9e\\x94\\xc3>\\x7f_\\xc1_3gde\\xee\\x18\\xe4\\xc0\\x94\\x8eg"
  258. },
  259. {
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdmg\\x98\\xa7~ne\\xbc!8\\x8c\\x0f\\x1e\\xb5\\x9c\\x00~{\\x15?\\xd24#\\x99\\x91\\xa5v\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  261. },
  262. {
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd1;\\x0e\\x13w\\xc4\\xd5\\xbfbd\\x15\\x8f\\x7f\\xf8\\xac_4m?b\\xfe\\x1c\\xac\\x8b%\\x13\\xb2\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264. },
  265. {
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xf1t\\xac\\xdd\\xe9\\x0e\\xc43_\\xd9\\xd3&:\\xdf!\\xd0\\xf8\\xe5e:\\xb4\\xcfsm\\xb1p\\xfd\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  267. },
  268. {
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd3\\xcab\\xc1\\xa0r\\x8e\\x86\\xf7,\\x10\\xee\\xf9\\xb5\\xf0l\\x96y\\x056~\\xbd\\xc0|k{\\xf8\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270. },
  271. {
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x7fc\\xb7\\xba\\x8d\\xe6\"l>w\\xdd\\xdd\\xb1y\\xc6\\x10\\x88m\\xfe\\x14\n\\xce\\xb3_\\xbdo\\xb1\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  273. },
  274. {
  275. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xd4\\x9d?\\xc8\\xb0\\x8f\\xba\\xaf\\x0fv\\xa4\\x1f\\x9c\\x07\\x94\\x07\\xb5]\\x7fp\\xea\\x81\\xe9\\x90\\xc0\\xa6\\x95\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276. },
  277. {
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdr\\xdf9\\xccb(\\xcf;\\xbe\\x08\\x97\\xa0\\x84\\xf3.\\x1a\\x03\\xd4\\x80qo\\x9d\\xe5_p\\xdc\\x85\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279. },
  280. {
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xc2k\\xa3\\x16\\xcc\r\\xf4f \\xe0b\\xc4\\x94\\x01\\xcde\\xca\\x99,\\x98\\x1a#,\\xcf\\xb6\\xec\\x92=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  282. },
  283. {
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xa6\\x01qq\\xc0\\xc7\\x90q\\xafz\\xf8\\x98\\x8f\\xa0\\x02\\xd3\\xd3\\xd6\\xb3\\xae\\x0e\\x16\\xb5v\n>z\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285. },
  286. {
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdc\\x8ex\\x91u\\x84\\xe9\\xc7\\xb0\\xe4\\xb7\\xdb\\x00\\xa7\\xd7\\xc0\\xc9z\\xfd\\xc9\\xcf\\x0c[\\xc7i`\\xe6\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288. },
  289. {
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdp7\\x9b\\x93\n\\x07:\\xae\\xe0\\xab\\x98\\x01b\\x14\\x02\\xb8\\x0c\\x980\\x85\\x9c\\xc1\\xf9\\xa0\\x04t\\x80\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291. },
  292. {
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xd0\nf\\xd9\"\\x9e\\xd0\\x10\\xe2\\x81\\x8aluu\\xb2rm\\xf8j\\x03j\\xc5\\xd7j\\xd6&/\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294. },
  295. {
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdn\\xa7ti\\x04j\\x9d\\xef\\x1f\\xb7\\x01rf2%\\xea\\x8b&i3%3$z\\x81`\\xb65\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297. },
  298. {
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x03\\xd39\\xfba\\xfa\\x84@b\\xd1\\xbf\\x81\\x10a|#\\xdd\\x02\\xac{j\\xd6&.\\xaf\\xcc\\xaai\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300. },
  301. {
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xb6/\\xdd/\\xb9\\x86\\x04\\xe2\\xae\\x17f\\x9e\\x1f\\xce\\x01\\xb4\\xdb4\\xcfs\\xa5\\xae\\xa9l\\xd70\\x8da\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303. },
  304. {
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdknb[\\xf7\\xdb&:\n\\xcf\\xb8 [\\x15\\xd8\\x8f\\xa0:\\xc7\\x99\\xe2\\xb2\\xb7\\x9c\\xf6\\xe8v\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306. },
  307. {
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xf0_i\\xad+\\x1e\\xac~l\\x9b\\x17\\xa3\\xe0\\xb8\\xdbs\\xe7\\x17\\xfb\\xb5\\x8b\\xe9\\xdc\\x10\\xa8\\x05\\xc4 \\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309. },
  310. {
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x11\\xd0\\xa9\\xb0\\xe8\\xfd\\xf9\\xb8*\r\\x85is\\xd21\\xb3h\\xd0\\x11\\x13\\x99\\x9e/7e\\xb4b\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312. },
  313. {
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x8bk\\x16~}c2\\xf3<7\\x90\\x12\\xb6bc\\xe4\\xe3\\x9c\\xe7\\xf3lea6\\xf9\\xad\\xb8\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315. },
  316. {
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdz\\x0b\\xd3\\xa2m#1\\x91\\xf7\"\\x90\\x01!\\xc9]\\x85\\x89\\xeb\\x17\\x8ec\\x95k\\xad\\xee:\\xb6\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdn\\xfe\\xb8p\\xf9\\x07\\xdd\\x83\\x13f\tyx.\\xcb\\x97h\\xc1\\xf6\\xa1\\xc3\\xdf\\xd5cdh|=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\r/\\xb9$>\\xd4\\x19\\x04\\xc7(\\xc3\\xca\\xa1\\xcbx[\\xe6\t\\x92\\xc3\\xc8\\x16\\x9e,\\x06\\x05\\x9c\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x8b\t\\x93\\xdd\\xa5\\x05\\xbd\\xac>p]c\\xe59o\\xcc\\x06\\xc6\\xd7qf\\x88f\\xf7_\\xa7\\x8e\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x81\\xd5\\x08\\xbd8\\x83\\xfd\\xfe\\xf0\\xedd5\\x0f}dc\\xb4\\xe6\\x80\\x9airp\\xee\\xb3\\xac\\xa8,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04_\\x97nr/\\x86\\x9f\\xef\\xc6%h\\xa4\\x97\\xaf\\xf1\\x88\\xba\\xbb\\x82<\\xaej*\\xfe\\x8d\r\\xc0\\xb2\\x89\\xcf\\x80,;=k\\xa5\\x02b\\xd5\\xd2%\\xbb\\x16\\x9d\\x11y\\x82\\x81\\xea\\xc5\\x8c$\"\\x14/t\\x8f\\xcb\\xfb{\\xd8\\xad\\xa7\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000{\\x19\\xec-g2mu\\x9c=\\xe2\\xe4\\x08@lo\\xceg\\x14!\\x01g\\x15\\x1b\\xa1\\x16h\\xd4\\xda\\xf4\\xa8\\xdd\\xfd\\xc1h\\x87\\x04$\\x90\"a\\xf5\\x81\\xbb2-\\xe9g"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xc8\\x1f1$\\xd43\\xec\\xa3\\xa2\\xc2\\xd4\\x95\\x17\\xa0\\xe0\\xdb9\\xd2j\\x83\\xd3\\xbdpl\\xf0\\xf4\\xb2\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd7\\x12\\x9b\\xcf\\x17\\xf0\\x17u\\xd7\\xb9n\\xaa\\xa9\\xca\\xb0\\x1e\\xaej\\xb5=\\xb6\\xa0\\xa0\\x8fr\\xc3/\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdq;\\xf2\\xac\\xe7\\xba1\\x10pn\\x9al\r\\x17\\x0f\\x9b\\xfa\\x81{\\x12\r\\x91c?\\xf4\\x87q\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xbe9\\xe8\\x0c\\xd5\\x13\\x07\\xb4r\\x12y\\xaew\\x87\\xb7\\x951|\\xb1!f\\x0f\\x05\\x03\\xe7\\x94y\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10\\xcc\\x17s\\xf9\\xcc\\xd2$o\\xce\\x05\\x08\\x13g*\\x92gx\\xeae\\x81\\x1a\\xc8\\xf3m!\\xc5n\t4\\xd7!\\x14l\\xd5\\xc6)\\x02n\\xea\\xb3\\xf2\\x82wku\\x17s\\x07os\r\\xc1\\xf0\\x81\\x9a\\xb4xr\\x0b\\x04\\xc0\\xb7\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8d\\xc6\\x12\\xdb\\x88v\\x87\\xb1\n\r\\x11\\x9f\\x00dw\\xba\\x181\\x96(\\xb5$]\\x9a\\xbf\\xfdd*\\xd1\\x89\\xedytnh'8\\x96\\xc5p\\xf8rp\\x11\\x90?\\xc5\\xc6"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x80w\\xc5\\x8b,\\xd4\\xf0\\xd4\\x8c\\x9c\\xe1[\\x81a\\xad\\x85\\xc5\\xa7v\\xb7{\\xaa\\xa7\\xccy\\x01\\x89\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xb1\\xee\\xa2z\\xa7@\\x0e\\xb7t\\x9a\\x9f\\xff-h\\x90\\x82\\x82\\x89\\xec\\xc7ne\\xcc\\x08\\xfdo\\xe6t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfddxw\\xb05\r\\xf3\\xd7\\xc7\\x8b\\xe1\\xc9\r)*f&gr\\xe4p\\xe1\\xa8r]j\\x8ds\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x18y\\xdec\\xc5&\\xe0.j\\x05\\x9a\\xc5p\\x11}%\\xd3\\x9d]y\\xa6)\\xdb\\xd9\\xf3\\xa2si\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd7\\xc4\\x9a~\\x0f\\xe3\\xf2\\x0f@\\xfc*\\x0f%\\xf9\\xa7\\x14\\x95\\x02u\\xb8\\xa4!)\\x9b\\xb1\\xe8\\xfc\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd7>\\x00t\\xb5\\xca\\x05o1\\xacq\\xc3'!\\x04\\xf06\\x84\\xc3\n9ha;e(\\xeb:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xc83\\xb3bqj\\xc4l\\xe3\n\\x16\\xa4\\xa5\\x99z\\x8a\\xcd\\x8av\\xb7\\x13\\x96!\\xb4\\x83g?7_\\xa1ynl\\x8f\\xb9\\xd4\\xe62\\xf5<hc(\\x8ad\"\\xcf<e\\x92\\xc8\\xf5\\xb8\\xbe\\xe6\\xa7\\xb9\\x91\\x1b(1\\xe4\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9\\x0f\\xdc\\x18\\xf2y\\xee[\\xfc\\xb1t\\xe2y\\x1e \\x0e\\xe0l\\xb5#\\xcbe\\xef\\xd5c\\x18~\\xcc\\xd0\"@\\x896\\x14\\x12\\x92\\x96\\xa1\\xf1\\x00\\x01 \\x00w\\x95\\x08\t\\x9c"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xea\\x9a\\x04c+\\x95h\\x8ad.jm'\\x8b0r\\xaf{\\xaf\\x9d \\xfb\\\\xd6n\\xa3\\xf2\\x01\\x1a\\xcc3\\xfe\\xfb\\x18\\x9e\\x1a\\xd5\\x94\\x91\\x8f\\x06\\xa2\\x81g\\xfbdg\\xb2h\\xde\\x92\\x968\\x1f\\x80(\\x8b\\xaf?sh\\xa2\\x93g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x19`\\x06\\xcel$\\xca\\xa3\\x97\\xf7p\\xca\\x9b*\\x9dm4\\xb1\\xa8\\xbd\\xb9\\x97\\xed\\xaa\\xfa\\xe5\\xb33\\x0f\\xf8<\\xc4\\xf8\\xb5\\x02\\xc9m\\xa8\\xe2\\x89\\x1c4\\x80\\xaa\\xa2bv3"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04c\\x95\\xab\\xd0l\\x92\\xae\\xf2\\x00\\xc7\\xde\\xbbq\\xe5=0o4\\x98\\xcf\\xed#\\x0f\\xe2\\xcc\\x94\\xa2\\x04\\xfe\\xf0r\\x95s\\xbbi\\xc0v\\xf7b\\x10\\xee\\xfei3\\x7fn~\\xa7\\x84\\x94d\\x81\\xf5\\xb9\\x90|h\\xa5a!h\\xb9\\x11\\x11\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\xb0\\x97.51\\xe8\\xe28\\xe3\t\\xfc\\x82\\xf2\\xe8\\xb3v\\xc97\\x17\\xc5y\\xe5\\x02\\xb9t\\xfa\\x01h\\x14\\xc2w\\xe5\\xac\\xa7v\\xd1\\xc9\\xc5\\xf3\\x0e\\x0ff\\xd1\\xe4\\x96\\x96_"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\x03u\\xc6\\x81g\\xba\\xd6\\xb7\\x82\\xcem\\xb2\\xfe2\\xcd\\xfbp\\xce\\xbaj\\xe7\\xb1\\x0f2\\xd0s\\xf2\\xa4\\xa5\\xda\\\\x16\\xe6\\xa5f\\xefl\rqn\\xa0\\x1bo\\xcd\\xd6\\xfe\\xf5\\x1co\\x98\\xff\\x87t\\x99\\xa72\\xe5che9\\xd7t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xac\\x9e\\xcejw\\x0e\\xbb\\x01\\xd4\\xec\\xb0{.\n\\x01\\x04\\x17b\\xa9\\x93q6r\\x8d\\xf8y8:`\\x86\\xa0\\xb9\\x84x\\x85\\x84\\xe8\\x84\\x86\\x9bbzo\\x05-^t"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x91\\xfdnf\\xc5\\xc2\\xc2\\x9b\\x8df\\xaeml\\x0c\\xe7\\x04f\\xfb\\xc6\\x9d\\x13\\xba\\xe4\t\\x9c\\xdf?\\xa1\\xc7\\x159a\\xea\\xa0\\xbe \\x1f\\x9fjmn\\x82n\\xd17h\\x1bj\\x17<\\x91\\xbb0\\xc4\\x14\\x1br\\xba\\x9d\\xaf\\xcf\n\\xf0\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\xcf\\xa5 \\xdct\\xc1\\xa3\\xb5\\xf3\\xafo\\x1e\\x9f\\xa7\\xea7\\xb4\\x01\\xdej\\x0f\\xa5\\x00\\xf6\\xb5\\xa8\\x10g\\xa6\\xbbo\\xa2\\xf7\\x9f\\x84\\x10h\\xafi\\x84\\x8b\\xc4\\x07\\x0f=\\xbc\\x7f"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xd6\\x9e\\x1d\\x1a\\xa2\\x18\\x9c\\x94\\xb7\\x7f\\xa3\\xfe\\xb6em?k\\xdc\\xefk\\xfa\\xf4g\\xc2\\xc5\\x03\\xa3\\xbd\\x91\\xb29x\\x85i\\x8d\\x00\\xff\\xa9\\x0b\\xa4\\x0b/\\x14&\\xf1\\xaf\\x13\\xfb\\xcb<\\xb5\\x83\\xdd\\xa5\\xd8\\xf2\\x7f\\xady;\\xb3\\xbd\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0002\\xdb\re#\\xdec\\xaeva\\xfcz\\xc3\\xa9\\xc4\\xf6\\xd4\\x83\\xe9\\x9d\\x9c\\x90\\xb2\\x04(\\xcev\\x91+\\xb5\\xa1\\xc3r\\xbd\\xc6\\xab\\x1d\\x94\\xc3\\xdb\\xf8\\x0e]i~o{f"
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7;\\x89\t\\xb0e?\\xc5>\\xd0\\xaf\\x83\\xb1\\x15z\\x8f\\xc4\\x0b\\xcd\\xb9d]\\xb1\\x15\\xd9\\\\x90\\xb7\\xe7\\xfd\\xd8\\xb2\\xc9\\xa3\\ui\\x85\\xb7\\xc1\\x9d7\\x93\\x98=\\x94\\x8b\\x8a7\\xa1\\x9d\\xadvo'\\xeay\\xb6\\x07\\x99\\xc9h\\xf3^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\xed\\x9d\\xde\\xf5&\\x87*{n\\xc8\\xea^\\xd6\\x9b<\\x02\\xefvz\\x15$m\\xc0\\x84\\xa2\\xd3\\x1e\\x1a\\xe0*$\\xd4j\\xc3m\\xb2k\\x99\\x81\\xd7\\x14\\x95`\\xd5\\xbc}\\xdd"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3\\xd3\\x81g\\xee\\xcb\\xdf\\x90\\xe4\\x9bg\\xde\\x1a\\xc58\\x16\\x89[l\\x0b\\x0f\\x9e\\xecs\\x11\\xef~/\\xc5\\x0e\\xf3%\\xf7\\xad\\x84\\xac7)p\\x1e\\xfe\\xb6m\\xb4\\x0e~1&\\x0b+\\xdc\\x89\\xd9\\x80g;\\x9d\\xcc\\xd56\\xb6lna\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xbc\\x15tgk\\xf0b\\x99\\x0cg\\xd7\ni\\xce7\\x8e\\xb1\\xb1zoe\\xc8m\\xe1\\xc0u]\\xce\\x94\\x8c{\\x12\\x95\\x7f\\x1d\\xf4\\x0c\\x19 \\x94/\\xaa'\\x84\\x19h]"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\xaa0\\xec\\x98\\xab$\\xac?\\xfb\\x8c\\xce\\x9bh\r5\\\\xc8\\x9dpe\\x91\\xf9\\xa4\\xb5\\xefto\\xb0\\xdd\\x7f\\xd1\\x84g\\x1c\\x8b\\xa6\\x12@\\x9d\\x1b,c\\xf9\\xedkl\\x02\\x00\\xfeb\\xec\\xa0\\xa8\\x14\\x08\\x954\\x7f\\xc5/\\xac\\xc6\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xe0s?/&\\xbc~\\xf0\\xd2\\xbd\\xdec\\xf5+\\x1f\\xbc}9uz #@\\xa82\\xc4\\xb4\\xde\\xc54\\xd1\\x1b\\xcc\\xcdsx\\x15l\\x11\\x08\\x87v\\x9b\\xc4\\x9c\\xa39"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xae\\x96\\xd3l\\x7ft\\xf9\\x8a+\\x99s'\\x9d\\xa7\\xfb*\\xf4i\\xc0o\\xdf\\xa7ja\\xdb\\x92\\\\xa7i\\xf3b\\xf4!\\xc3h\\x02\\xef\\xd9%-\\xd9\\xa4\\xc2\\xbf\\x06\\xfb\r\\xdd\\x84\\xc0(q\\xc7o\\xa9\\xc1\\x12\\x87\\xaf\n89\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zl>\\xdc\\x12\\x1bss\\x80\\xe1\\xad\\x90h\\x87\\x1e\\x12\\xea[\\x9d\\x17@\\xe1*b\\xa8mi\\xf8\\xeb/\\xac\\x06nu\\x9d\\x13\\x00\\xbb/(\\xef\\x1b1b\\x1dw\\x86\\xde"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\xfc\\x94\\xf4\\xaa\\xa8\\x91\"s\\x8c\\x8c\\x1a!=\\xa8\\x8b\\x11\\xeev\\xac1v\\xe9)\\x1a\\xff\\x9ff8\\xe5\\xbej5mb\\x05hm\\xff\\xf4\\xc2ec\\x0e\\xff\\xcd\r\\x8c\\xa7\\xfd\\x9a\\xa1`\\x08f\\xda\\xa1\\x17\\x84;\\x7f\\x11\\x8a\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa6g\\x05ek\\xa1\\x99\\xf1\\xb5\\xbf\\xf6y\\xa0q\\xb8h\\x16\\x0f\\x8f\\x9a\\x81j\\x14\\x9b\\xde\\x04\\xa5e\\xe8\\x1b\\xa1\\x10\\xbbkfgh\\x03\\xd2*\\xe1auan\\xed\\xcb~"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x96h+ b5q\">\\x801\\xcf\\x8b(\\\\xc7\\xfelvb\\x9b\\x89\\x94]m#\\x87\\xcb\\xd0k#z\\xfb\\x81\\xac\\x1e\\xaf\\x90\\xab\\xa85p\\xbd\\xe1\\x90\\xc1\\xf4-\\xa7\\x99\\x08\\xcc\\xfds\\xc9c\\xde\\xe48\\xb9v2q0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\xf9m\\x92\\xbe\\xfa\\xb2t\\x9c)\\xa1i\\x93\\x1b\\xab_\\xc3\\x8d\\x84\\xcfwo -\\xe0\\xf1\\xa2\\x91\\x05\\x8bv&\\xa0l\\x9a\\x02\\xb6r\\xfc\\x1f\\xef!dd\\xe6\\x03\\x9c\r"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9bm\\xdd\\x161\\xb8\\xabo\\x12g^@\\x95\\xda\\xfc\\xfe\\x12w\\xe9\\x055t\\x82\\x1a)[37\\x0e\\x06\\x8e\\xa3c(\\x1cj\\xda\\xce\\x13\\xf7\\x82\\xccm\\xc5r\\xf2\\x1fu\\xc8\\xed\\x8c\\x8e\\xfd\\xf8\\x14x>*k\\x99>w\\xb0q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfey\t\\x01r*\\xab\\x03ce&\\x0c\\xeebwa\\xd0\\x9c\\xb9\\x98jiz\\xb8\\xd1\\xe8\\xe9\\xf4\\x89\\xb6\\xd6sv;\\x98\\xfb\\xa3\\xb5\\xeby\\x8c\\x17\\x1c@\\xa0\\x81v\\xaa"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\n\\x92\\x7f\\x05\\x08\\xe3\\x81\\x0b\\xe5\\x94\\x1a\\x15\\xfb\\x0f\\x07\\xae\\xa5\\xad\\x8ec\\xa5[b\\xe6\\x7f\\xad\\xca\\x1e\\xf1\\x1ao\\x12\\xcc\\xb9\\xf0\n\\xdd\\xa8\\x12\\x05\\xbe@\\xf9k\\x8a\\xbd\t\\xc8\\x83\\xf40\\x9fsf?\\x88\\xdc\\x13wh\\x02\\xe6s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0c[\\xce\\xf6at\\xaf\\xf9\\xc5\\xd5\\x01g\\x07\\xa4\\xaa\\xeax6*>\\xac\\\\xa3\\xf7k\\xc6\\x9ay\\xfd\\xeb\\xc4\\x0f\\x1c\\x9cj\\xda\\xae.\\xe2\\xab\\x86'\"3\\xeb\\xfa$\\x80"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x96\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x041c\\xa2b\\x8e\\xaf-]\\x02)\\x1d\\xc41\\xc1\\xb1\\xb2\\xbd<\\xc7\\x1b7\\xcak\\x7f\\xe5\\xb7l\\xfd&_6\\x13\\xc3\\xe2\\xd1=\\xaa\\x81\\xaat\\xe9\\x86\\x97\\x19\\xbd\n\\xae++\\xcd\\x90\\xde9c=e*\\xbb\\x90\\x077k\\x02-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\xd5\\x18\\x7f,\\xd1\\xc6\\x03\\xee\\xce\\x14\\x04=\\x93n\\xf1\\x9ba\\xf4\\x90\\x95\\x0c\\xe0z\\x0f\\xa9\\xce\\x8f\\xdd\\x13\\xe8e\\x1f.f\\x8e9\\xef\\xc5uc{8\\x85zp\\x1c\\xea"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t7\\xca\\xadm\\xc4\\xc7\\xda\\xd8d-\\x1f\\x9f7t\\\\xe9\\xd6\\xb2\\xb7\\x81\\x04a\\xaam\\x08\\xeap\\x1d\\xa9k\\xa0\\x9fw\\xae\\xbe;\\xbb\\xa67\\xd3ib\\xf9'\\xff\\x8a\\x02o\\x96;\\x01\"\\x93\\x9dk\\x1e\\x93\\\\x85\\xf9`7\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2ij\\xcc\\xf8\\xa0\\xcc\\x10z\\x8ft\\x1e\\x0f6\\xf7\\xad\\x15:b#\\x12\\x0bx\\\\xb5g\\xa0\\xa6\\x7f\\x1f\\x91o\\xd6\\x97\\xb6\\\\x9ex\\x11s\\xff\\x9d\\x1ci\\xddy\\xe5j"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\x94c\\x1e\\x97\\xb3\\xf3\\x1e\\x84\\xe0\\xb3\rq\\x9e\\xb8\\xf6\\xd3\\xe0\".8\\x9f\\xc4j\\xaa{y\\x1e\\x81\\xca\\x8fn\\\\xc9ocz\\xa7\ro\\x1d\\x11\\x7f~n\\xad@5\\xfc\\x0ck\\x1b[u\\xd9\\x13\\x81\\xe5s@<qc\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xc88j\\x12@,\\xa4\\xcajfj\\xfctr\\xffp\\xdfz\\x082#\\xc1\\xf4\\xdf\\xf7*\\xddo\\xb6rr\\x89tdj\\x93\\x16\\xb1\t!\\x1bm\\xd1v\n\\x154"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t4i\\x809c\\x8a\\x1f\\xe8\\x1a\\x91\\x850\\x03v\\xceip\\x80\\xf6'\\xccn\\x80+\\x14\\xf8\\x05\\xf9[d\\xb3fk\\xe8?^\\xd4\\xff\\xd3\\xe0\\x08b\\x9c\\xaev\\x86\\xe2^\\xad\\xe4rl(qg\\x0b\\xb2\\xa7n\\xf8w\\x153\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\x10\\xe8\\x87\\x88\\xdd\\x83\\x85l\\xb9\\xc5\\x029\\xd4\\xcc\\xbd.\\x18h\\xb5;\\x1d\\xdb\\xb0|\\xe1\\x97\\xcf\\x99f\\xbc\\xd5p\\x15\\x9e\\xe5\\x11\\xe5nj\\xd2'\\xefu\\x8e\\xfal\\xdd"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbe\\x8d\\x0f\\xe7%\\x9ac\\xe1pzo\r\\xb8o\\xa0\\x8d1\\xa8\\xf5\\xc2\\x10\\x8e\\xf2i\\x9f\\xb2\\xbe\\xbe_v\t\\xdbr\\x16*[\\\\x0f\\xdd\\xa2\\xcc\\x11\\\\x8e\\x80\\xc7\\xb4\\x0c1\\xebm\\x94\\x06i\\xbc\\xd1\\xae\\x85\\xabyt?\r\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\xef\\x18\\x00\\xa4\\xfc\\xc0\\xa4\n\\x9a\\x1e\\x90/\\xab\\xea\\xba\\x98\\x96\\x8d#x \\xc2\\xea\\xfd:\\x0b*\\xbd$\\x08_/\\xfa_\\x1bnl}\\x18>\\x9em\\x8a\\xd9\\xa8\\xc4\\x9d"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xc6\\xb3n \\xe6\\xf0\\x97\\x83\\x0070\\xde\\xa1\\xee\\xdb\\xce\\xd1\\xd1\\xaf\\xc3\\xce\\x82z\\xe8\\xaa\\xc9#\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xebln\\xb2lr0\\x19\\x19\\x90s%\\x8b90\\x03\\x8b\\x1ab\\xde\\xe0v2\\xcd\\xa9k\\xdc\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x96\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\xb0\\xd4^\\x8b\\x1b\\xcd\\xf9n\\x0b\\xe5|\\x97\\xd5ka&\\x81\\x83\\x9e\\xc9\\xc6t\\x0eg:=\\xfc\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbd\\x1c\\xa3$\\xdc\\x83\\x8dkhg\\xa9\\xf9\\xd7}z\\xafn\\xa4n!\\x9d\\xe7'\\xd9u\\xc1\\xba\\xd7\\xdf\\x97\\x0b\\xb3\\xf06\\xccdw\\x01\\x9b\\xde\\xf4_\\xf5\\xbdb\\x1e\\x92\\xecbc\\x8a\\xf0\\x89\\x0f\\x92\\x05\\x11\\xab\\xd4\\xf9\\xd7\\xa5bv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc}\\xa2\\x85\\xf1\\x96\\x18w\\x1a\\xdb\\xf4f\th\tls\\x9d\\xf4u\\xb8\\x8cj\\xe3\\x0ch\\xed\\xf3q\\x1e5\\x8f\\x9b\\x10\\xfat\\x94\\x15\\x91@`\\x91k\\xbd&\\xbedd"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xfd\\xe1\\xa7\\x91\\x96\\x0ed\\x9fd\\xaa#x\\xbb=\\x9c\\xcbv\\xe2-\\xa8\\x94g\\xca\t}jb6\\x08y\\x17<\\x91d\\xfcz\\xf5\\xaff\\x9d\\xb30\\xf3\\x9b\\x19x^\\x19\\xb9\\x1d\\xc9\\x84\\xff{\\xc6\\xc8~\\xd8\\xa0\\x807\\x93\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6@\\x0c\\xb2n\\xc6c\\x8f\\x13\"ic\\xa9\\x17(\\x98\\x1c\\x1f\\x8btg?\\x9fj\\x84;\\x05\\xce\\xcd\\xcb\\xec\\xb5\\xb7\"\\xce\\xf2\\xf7\\xed\\x18ud\\xe3\\xa2\\xa3kl\\xce\\xab"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3wg\\xdf\\xa9f\\xddf\\xc8x\\xf7p\\x1f\\xee\\xb3:\\xdd\\xb9\\x8c\\xd3)\\x91\\x81\\x8d&\\xc1\\xb6\\x19ui\\xbf7\\x1f\\x96\\x83\\xd6\\xe4:\\xe6\\x9d\\x99\\xbc\r\\x87\\xc8|\\xda\\xfe\\xe4\\xe5\\x1c\\x94>\\xd6\\x02m\\x07\n\\xcc\\xa7\\xf4\\x13\\xb3\\xe3\\xaf\\xd7\\x12\\xe4\\x8b\\x19\\xc3\\xf7>x\\xd5\\x13.k\\xb7\\x02\\xae\\x1b|u\\x87\\xb8\\xef\\x8a\\xb9\\x8a%+\\xbc\\xa5\\x8f@v7\\x93$\\x07\\xd6n\\xcd\\x82\\x01\\x8e\\xd5\\xc0\\xb9\\xf5\\xf3s=r\\xa2\\x97\\x9e\\xf2s\\x13\\xe5\\xf7vq\\xaa\\x86rv\\x8a\\x11\\xaa\\xef\\xe0\\xae\\xd9\\x97\\xfb\\xf6\\x0e\\xabpgu\\xf3\\xeb\\xed\\x99p\\x84\\xb0\\x08:\\x96\\x02\\x86qfz\\x0f\\xf6\\xa7\\xa5\\xe2\\x08\\xbbf\\xb8\\x96v\\xbfy\\xbbz\\xb7\\x9da\\x1f\\x01\\xb5\\xd3\\xb5g\\x9dy\\xd7~\\x12\r%\\x9ffa%m\\x89\\xe8q\\xbe\\x1d4e\\xe7\\x9fq\\xda\\x04:\\xc3\\x87-\\x8c\\x94v\\xff\\x9b\\xea\\xab_i|w\\xabm`y\\x03\\xb4\\xe7\\xb4b\\xc7\\x9e]\r\\x87\\x13\\x02{\\x02\\x03\\x9e\\xfcg\\x86\\xb2\\x92/p48"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaf*?\\xb4\\x8d\\xd5\\xa2\\x03\\xfb\\x06\\xe0\\xf7\\x8f\\xd4\\xf8v\\xd5f\\x9b\\xeb\\x04*-\\xd4b%g\\xc4p\\x8f\\x19\\xc8!\\xce #w(\\x9f\\xf9\\xebtz\\xbb\\xa25\\x08\t\\xca\\x7f\\xfd\\x02\\xda\\xc5\\xac\\x0e\\xfd\\x17v\\x97f\\x8by\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x14\\x0ei\\xe4+q\\xa4\\x99\\x8c\\x03\\xe4\\x1a\\x85\\xf8h\\x8f=\\xe6\\x1c\\xa3\\xeb\\xbd:\\x8c\\xa0\\xe1\\xf99h\\xc1\\xff\\x07fk\\x7f\\x9b\\xdb\\xff\\xf7,\\x10\\xafms\\xf1\\xa8q\\x16"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010?d\\x19\\xcb\\xc2\\xb5\\xe1\\x18\\x8b\\xf6\\xc2t\\xa4iw\\x12r3 p6t\\xad\\x9d\\x10\\xd72)\\x06\\xabe\\x19!\\x9f\\xe27\\xd9\\xc1\\x0f\\x9e\\xbbx\\xc0}w\\x92<\\xd9\\xeb\\xb6\\x19&l\\xd6\\xa6\\xac\\xd7\\xde\\x8d\\xc5\\xa039\t\\xd1\\x94\\x97\\xc2\\x028\\xb8%r\\x10nc\\xb9-]\\xcdh\\xe6\\x0f\\xdb/\\x14\\x93\\xec\\xef\\x1b\\x1b\\xe0\\xd4\\xc3\\x9e\\xa8\\xeem\\x15\\xf3\\xf2\\xf9\\xa1\\x95\\xd4\\xebg\\xeecqg^\\xdav\\x89\\x02\\x859p\\xb0\\xb5\\x892@h&\\x97\"\\x06\\x05\\x80\\xe7y\\xea\\xa7\\xc2i\\xe8\\xc8\\x9b\\x07r\\x15/m\\xd0v\\xbc\\x9av\\x0e\\xff\\xe0\\x1b\\xc7i\\xe7\\x98\\x00\\x02\\x85\\xbd\\xb0\\xedj t\\xad\\xfc\\xcf\\xaa\\xe9\\xf6+\\x12\\xa6\\xeep}\\xbb\\xd92\\xc6\\xaezs\\xbb,\\xd4<i\\xe1\\xc5\\xab`s\\xe6\\x8cpt\\xf6j\\xa0\\xd9z\\xd6\\x898h\\xd4\\x00\\xd4\\xe3\\x91\\x87\t\\x7f\\xe7m\\x1cv\\xcd9\\xc6{\\xb5\\x0ei\\xad\\xe9l\\xd3\\xcf\\x7f\\xdf\\xf9\\xee\\xfd\\xac\\x8b\\x1c\\x97]r\\xfc\\xc2\\xbc\\xbd\\xa2k`"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xce\\x88\\xeb\\xb2v\\xf5!\\x1fzg\\xe0\\xb9ufk\\xb1\\x9c\\x81\\xf7\\xb4h\\xb6\\x0f\\xde\\xe8\\xf2\\xc0\\x80\nld\\xde\\xd7so\\xaa&d\\x9c\\xc5h\\x94y\\x8du\\xe3\\xa2u\\x1b\\x9ae\\xda\\x15y?\\x07\\x9d\\x96\\x86\\xb92j(\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5\\xba\\xd8\\x81\\xbe\\xf3\\xa0\\x1et\\xd9\\xeax\\x1c\\x17c;\\x98}\\x91b\\x1anx\\xb4\\xe8n*4sr8\\x87ouh\\xcd\\x1d\\xedvi\\x12nv\\xe12\\x8f[("
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02:x\\xda\\xf8\\x99\\xf1p\\x02m\\x97?_\\x13\\xb4e\\xcffvk\\x81\\x7fasfh\\xd4\\xab\\x90\\xcc\t!\\xefl)ynr\\x82\\xde$\t\t\\xcd\\x8d\\xb0\\xd1\\xa13\\xfa3?f8\\xb08r\n\\xcd\\x96\\x00\\x1d\\xe1\\xf3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\xbb\\xff\r\\xd1\\xba\\x0c\\x87\\xcdtlv4\\xc5\\xf2\\x91y\\xe6\\xaam\\\\x95!\\x87\\x1c\\x0f\\xbd\\xb3\\x86\\x9c!\\xd8\\xbe\\x14\\xfb\\xfe\\xee(v\\xab\\xb0#\\xfb\\xb5\\xbf\\x13[n"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdr7@hudg\\xeb\\xe24\\x85e\\x88\\x16c\\xb0s\\xa6l\\xa7w\\x18a\\xc5@d\\x0f\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa0\\x9a\\x80\\xcch\\x98p-\\xec-\\xe7\\xe5\\x93\\x00l@\\x0f\\xa3\nge\\}\\x84\\x1791\\xd5o\\xddb\\x04\\xf8\\xa44\\x9e\\x037\\x1cx\\xda\\x12w/\\x97\\xa4\\x11\\xf9\\xad\\x9d\\xb1\\x98\\xd5\\xa7\\x9c\\x86\\x0b\\xba\\xcc\\xf3-63\\x13\\xe7\\xa9]\\xc0\\x03\\xc2\\xe6\\xf9b\\x90\\xd1h\\xbc\\xbbd\\xb9g\\xd4\\xb1\\xfex\\xd5\\xd04\\x05\\xccnngl**#+\\xe0\\xb0lj\\xbbl\\xae\\xf9*\\x1d\\x01z\\xea\\x8f\\xe3h\\x85e\\xdds=-k^\\xa3\\x9c\\xf3\\x9e\\xd5\\xd6+\\xadjczr/\\x08\\xf4\\xcdl\\xfb\\xd2\\x98\\x85;\\xc8\\x85)coion\\xd8.\\x04\\xd1b9\\xbb\\x11\\x12\\x8c\\xe9\\xf5\\x9fh\\x93\\xeb\\xa0\\xf8\\x7f\\\\xe6n\\xff=\\x0b)\\x04\\x7fm\\xaf\\x8bp\\x111,(\\xb5\\xb4[\\xacf\\x12\\x87i\\x7fj\\xae\\xb8\\xf3\\xff(\\xc6\\xb1\\x8f\\xd2s\\x90\\x06\\x12\\xf8\\xad \\x1e>\\x98a\\x15\\x1d\\xf7\\x1f\\x85\\x8czoj\\x01x\\xc9\\x93\\x06si\\xe6\\x92\\xb9\\xf2\\xe7-\\xcds\\x0c[\n\\xa0\t\\x0e\\xa1\\xaf^"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\xaa\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04p\\x8fu\\x96\\x11\\xa9\\xb2\\x97\\xe6\\x86\\xd3\\xdd~#4\\xf1d\\x1f\\xe0{lcsh\\xb2\\xee\\xcf~t\\xb37\\x0f.\\xe5s\\xa1h.>l\\xcf\\xb5\\xfc\\xa1l\\x80\\xc6\\x0f\\x84\\xe6\\x87\\x00\\xabg\\xd2h\\xe1{q\\x0f\\xe5[\\xfa%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd08\\xa1\\xcdp\\xc9u\\x1b1\\xdfw\\xb0b\\xe4\\xe1\\xb8>\\x0e)\\xc9u\\x8a\n\\xde\\xe9x\\xe4\\x039h\\xb7$\\xaa?\\xe6n\\xd3j\\xa6\\xca\\xb4~vgt\\x12{\\xec"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\xaa\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x7fy\\xear\\x80\\x03.r\\xdc\\xe3\\xf4\\xa6\\x86e\\xc4\\x85vs\\xbf4/y'}\\xb0\\x97\\xe3\\x9c\\xb1\\xad\\xf4\\x88\\x02\\x06\\xbf\\x83\\xec\\xddk\\x0fi\\xe0n\\xd4h/(\\xe9\\xc5h7a`d\\x976x\\xd4\\xef8&\\x90\\xe7\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x9d\\xa5\\x01bj\\xb7\\x07\\x17\\xa3|j\\xbe\\x9dx\\xc4\\xad\\x9a\\x16\\x9c\\x0c\\x93\\x99?\\xdd\\x8d\\xb3\\x93gv\\x18\\xb8\\xdab\\xcad\\x97\\x18\\x0b\\xc9\\x01\\xc8\\xfc\\xd6\\xcc\\x92m\""
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdfm\\xd2\\x96\\x8f\\xdf(\\xc5\\x05\\xf7jw\\x89;z@\\xa2\\xf6\\xc3\t\\x11!\\x02j\\xa9yrb\\x89]\\x8bs\\xf0%\\x1a}\\xec{l\\xd8+\\xd5\\x0cz\\xac\\xf6\\x95\\x0e\\x1erc\r\\xa4y\\xe0k\\x08\\xd6\\x0f\\xbd\\xac\\xaf^\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad\\xb0ivy\\\\xa3\\xc7\\xf3\\xd4\\xc4\\x0btvw\\x1bg|r\t\\x9f\\xc0\\xbc\\xc5\\xea\\x06\\xd1\\xef\\x18\\x8e\\xb7\\x06k(\\\\xf3\\x84'\\xe9e\\xc3\\xab\\xbb\\xddo\\x9b\\x0f\\xf8"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ug@(\\x14\\x0c\\xfd\\\\x8fr\\x8ek<\\xb7\\xb5w\\xbc\\xfa\\x8bjl\\xd6o\\xbe\\xcawe\\x15\\xae\\x92*\\x1f\\xe8e\\x89f6\\x10\r~|\\x9ff\\xce\\x13\\x11f;h\\xde[\\xa8\\xa69\\xb1\\\\xff\\xde\\xfc\\xcb\\x83f\\xeb'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\x9b\\xe4\\x03\\x14t\\x02m\\x9a\\xbc\\xe3vm\\xf5{u\\xc2\\xd7]\\x1c?e\\xae\\x81\\x91\\xbdmw<=n\\xf6\\xc9\\xc6\\xb1m\\xcb\\x1av\\xadenb4\\xc4<x\\xd2"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9)r\\xff\\xc2\\x9b\\x06\\x91\\x90\nu\\x0bx\\x13\\xe6i\\xb6\\xaa\"i\\x8a\\xf7\\xc7gi\n\\xf9\\x05m.\\x0b\\xdf\\x9ds\r\\xa9\\x00\\xa5t\\x12\\xc0\\xb9u\\x99'\\xe3\\xda}\\x06i\\x06w\\xd4|\\xbe-\\xc2\\xbeq\\x12?\\x17m5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xc5\\x8e\\xe3u`3\\xb2\\xc8\\xd4\\x0ea7=\\xbb\\xf2v\\xefs\r_z\\xd7\\x84\\xff\\xa1d\\xdec\\x05\\xe5fr\\xf2r\"\\xa5*\\xed.c\\x9e\\x9f\\x19<j\\x0f\\x12"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\xc3\\xd6g6\\xc2\\x1b\\xb7\\x9c \\xd5b)k\\xc3[n\\x98+>\\xb4k\\xf3\\x91\\xf3ge\\xea\\xbb\\x00\\xb0\\x96\"6!\\xdc=\\xc6\\x17\\xb0\\x19\\x02\\xe67k\\xbf\\xbc\\xefh`\\x86\\xa6\r\\xe2dy\\x89\\xbb\\x84\"\\xdd\\x81\\xa3v\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xdcz\\x1b\\x1e re\\x90du\\xferh@\\xfa\\xba\\x97\\xf9`\\xe07 \\x0f\\x10\\xa7w\\xd9\\x1f!\\xdc\\xd8\\xb9\\xc3o\\xc3bx\\xdd\\xae\\xb1dc?\\xb8\n\\x85\\xe6"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010dn\\x947\\xdce\\xae4\\xb6\\x1e\\xdd\n\\xe0b\\xfd\\x84\\xa3l\\xf0\\xb382\\xfe\\x9ba\\xd7\\xae\\x82\\xf9\\xf5\\xd0\\xc7\\xf8/z\\xc2\\x0f\\xaeu\\xf0\\xd9`!\\xeb\\xe3\\xa8}kb\\x08\\x96\\xbf\\x13\\xf0\\xddm\\xba\\x1a\\x06\\xb0>\\xe7\\xe9u\\xb0uu\\xb5\\xc2lx\\x135\\xa4\\xbfz\\xfa%\\x1a\\xc3ei-\\xb8w;y\\x18\thr\\x90|\\xcf\\xeb\\x0c\\xe2-rlq\\x15c\\xc3'\\xde\\x86\\xdf\\x19\\xb7ig0\\x1e\\x16\\x95\\xb5\\xf3w\n%\\x7f~.\\x03\\xd8\\xf1\\xe5\\x16\\xacshc\\x8b\\x1f\\x07\\x8d\\xech\\xd2\\x92\\x1a\\xcar\\xf6z^-\\xd5\\xcd\n\\x1bo\\xf9\\x9av\\xf4l\\x1f\\xe8\\xcc)g\\x7f\\x1b8^\\xc4k)\\x87\\x12fej7\\x10\\x8e\\xea\\x19\\x8cb\\x02\\xc6\\xcbry_d\\x86\\xb0\\x99\\xffe\\x08\\x15\\x16\\xediz\\xb8\t\\xb8\\xd8\\xb2\\xcc\\x02\\x17l\\x17\\x81n\\xde\\xd2\\xf5a\\x1d\\x99\\xcdi\\xd5 \\x83\\x93\"\\xe4t\\xe80\\x95\\x06{m:\\x08\\x10r\\x19\\x0e\\x97b9o\\xce\\xda\\xdd\\x05\\xed\\xcd\\xd4/"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\xaa\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16g?\\xe8\\x18\\x0b}.\\x068\\x8d\\xda$\\xf9\"\\xec\\x0b\\xdcw\\x8a\\x16\\xa5\\xaf\\x8c\\xdce\\x95\\x87\\x05\\x89l`\\xd3\\xe15\\x02\\xb1q\\xa6\\xe4\\x1d\\xef\\x8f\\xbc\\x1b\\x93\\xbd\\x960\\xb8'p\\x03\\xc1\\xc8\\x876\\xf7l\\xa15\\x16\\x18\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7`v\\x98=g*b\\xdd\\x8ahv\\xd5\\xbai\\xc1\\x9ey\\xe6\\xb6\\x06}\\x14\\xfd\\xae\\xcb\\xdc?\\x85!\\xbe\\xcb\\x0ce\\x86\\x07\\xed\\xba\\xe8\\xad1]o\\xef\\x0e\\x1a\\x91!"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf46q\\xcd\\xb6\\xfb\t\\xcf\\x0e\\x08+u\\xaa\\xd13\\x04&w\\xc5t\\xf0\\xf9w\\xd4\\xbf\\x07\\x9e\\x17u0#\\xff\\x14\\xec\\xfb\\xdf\\xc9\\xd5i3\\xe358[gh\\xc9\\x8bw\\xa3s\\x80\\x1d\\xa8>p]\\xb8\\xaf\\xfb\\xaaa\\x19\\xff\\x8b\\xec\\x15 ky\\x94\\xfe!\\x00\\xd9\\x91#\\xf51ru\\xa5\\xcb\\xe2\\x14x{\\xd5\\xff\\x8e\\xad\\xb9\\xa8\\x95/?-\\xeb\\xe8\\x8d\\x19\\xf6\\x9f\\xd0\\x8c\\xa3\nf\\x9b\\x1b\\xdd\\x1cu'\\xde\\xda\\x906j\\xfb\\x9d\\xbf\\x0c\\xe6\\x9al\\x98\\xa4\\x99\\x17\\xfa\\x99\\xed\\x88\\xed\\x90\\x8f/2\\xf5\\xc1k*h\\xcck\\xe72\\xf7\\xf78e\\xea\\xd2f\\xe4\\x7fc\\x0b\\x14\\xaaw\\xc6\\x1cl\\x1eh\\xbd\\xa4\\xf8\\x88\\x87\\x1f2&\\xe7\\x95a\\xc1k]\\xd2=c\\xc4\\xb6r\\xbf\\xb0\\x0e\\xe5vvz.s\\xe5\\xa7j\\xce\\xf5w\\x19\\xcfv\\x19\\xe7\\x8d\\x01\\xa9\\x81\\xfe\\xcc\\xd8w\\xf9pz\\x15\\xa3\\xcfc\\xefwz\\xcc\\xa0\\xafu'\\x85\\x07\\xad\\xfau\\x13rq\\x0ev\"\\xa6r\\xa8\\x9bt\\xfd?\\x9c\\xbc["
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\xbd,\\xb7o\\x02\\xb2\\xf65\\xf4d\\x1f\\xe71z\\xb6\\xcb\\x14x$\\xf2\r\\xd4\\x8e\\xc1\\xb3\\x85%4\\xb99\\x99\\xdb\\x8d\\xd1\\xf7\\xbc\\xf5\\x17\\xc4\\xf3\\xad\\x9b\\x19\\xfc\\xc8\\x99\\xf2\\xe6}xk\\xa0y\\xb1a0[\\x92\\x97\\x82b\\xfc+\\x98\\xa8\\x86\\xfa\\xfd\\xcb\\xbe@\\xf9a\\\\xf9\\xd9\\xcea\\xdb\\x1d\\x14\r6\r\\xd4\\x07\\xe8\\xaay\\x00u\\x85\\xa1\\xe1[_<-y@m0\\x1e\\xfeg\\xcd\\x8b\\x91v\\x03\\xdf\\xd5\\xf2\\xc1\\xc5\\xd8r\\xf5\\xb7\\xadv\\x9c\\xf1\\xca\\x01v\\xd07\\xd55\\x11 9\\x01\\xde\\xb2\\xb3\\x08c\\xd1/\\xc5\\x9edg\\xd4#\\xf8\\xcd\\xc3\t\\xee\\xae\\xff\\xdc\\v\\x81\\xe1\\x7f\\xfb\\xc1,k \\x94\\x1d\"\\x86>h\\xd7:s\\xeb\\xd5\\xa8t\\x96\\xe0=\\x04\\xe9x=e\\x9b\\x83uv\\xdf\\xfb\\xa2\\xd3\\xfe,/\\x9d\\x0e\\x8e\\xd0z\\xa2\\x86'\\x9c\\xee\\xc0c\\xf7hi\\x0b`\\x0c\\xff\\x93\\xf5wg\\x00\\x9a%*\\xbb4\\xb7\\x9a\\xfawfc\\x07\\x82\\x9e\\x96\\x0f\\xdb\\x8duh\\x05\\xc4dco\\x1a>ct"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x02\\xce\\x02\\x94\\xe7\\xd5&\\xfc`\\xedja5m\\xa5\\xa6j\\xdd\\xb9^\\xe8f\\xdc\\x8b\\xf4l\\xf5\\xef\\x8dk\\xe6\\xcd\\x1c\\xc32v\\x9b\\x0e\\xcc\\x8c\\x0c\\xb9\\xb4-\\x93\\x82\\x87[\\xd5\\xaa\\xda\\xcf\\xad\\xd9,\\xaa\\xca\\xf5\\xfb=\\xff\\xbc5.nxlpe\\x1a\\xed\\x85n\\x9a\\xd9\\xc1>\\x1b\\xa8;[*q\\x835\\x9em\\xc5\\xd1\\xeccy\\x1b\\x0f*\\xd4\\xac\\xb7\\x14\\xd6\\x05t\\xb5a\\xe4\\xbc\\x0e\\xe0\t\\xac\\xc4/?\\x8a\"\\xeb\\xb0\\xd0,mu\\x19d\\x94!\\xdb\\x82\\xdd2\\xff|p\\xb3\\xdc\\xdaj\\xa3\\x0e\\x9b\\x9f\\xee\\x81a\\x86u\\x9f\\xa2\\x90\\xa3\rt\\x11\\x1e\\x05\\xd1nr\\xffm4\\x9c6\\xcbz\\x96\\x8c\\x08j\\xb3\\xc9\\xc4>\\xc1\\x83\\x83l\\x00\\xfa\\x17\\x1a\\xe8gq\\x1a\\x1co]\\x98q\\x03\\x02l\\xc1\\x97\\xd7\\xfb\\xfe6=a9\\xb1\\xff;bv\\xd8u\\x8c\\xdb\\x12a\\xaa\t\\xfcc\\x15_,\\x17\\xf5\\x9b\\xe8\\x01\\x16\\x8c\\x1a\\xfaw\\xcd^x>\\x8d]\\xfc6\\xfc\\xa0\\xca\\xaej\\xb2{\\xc0!%7\\xc5$"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0107\\x16\\x08\\x01\\xf1\\xfb-\\xba\\xc9x1h'\\xc6\\x93\\xc3\\x9e@\\xcc\\x07%\\xe0\\xe0\\x98\\xb8\\xa6\\x0e\\x93n\\x88\\x92]\\x86t~\\x05\\xdcx\\xbd\\xb3}\\xa2\\xbb\\xbb\\x9bp\\xe0\\xd9:\\x96$\\xcb+\\xff\\xe1\\xab9\\x1f\\x031\\xc6t\\x82c\\x13\\x10$\\xd3\\xb9\\xdf\\x04\\xd2\\xf2\\xdd\\x0b{\\xeb\\xc6\\xf4!\\xa1\\x1e\\xda\\xfbc\\xb4ynal\\xaf[m\\xc3\\xa3\\xb6p\\xce\\x1c\\xb1\\xb6\\xe6f\\xd8\\xa5\\xae\\xcb\\x02\\xe1f\\xf4\\x94\\x04\\xe6k\\xdc\\xd9*9\\x08\\x13d\\x9b\\x05t}\\xa70z\\xc7\\xf8\\xd1\\x1bh\\x8a-i\\x07i\\xe4\\xc6'\n\\xd5a[\\x0f:\\xb2\\xc4\\x83\\x1b\\x0ej\\xa7\\x90\\xcc\\xcb\\xf2x\\xff\\x9d\\xbc\\xf7\\xed#\\xd5d\\xbe\\xf0\\xdb\\xb4-\\xb3\\x1f\\x8bh\\xdd|\\xe6\\xec\\xea\\xaf\\xa8\\x05d'p\\xec\\x8e\\xc6mi\\x91hk\\xf9\\xb0hp\\x97\\xa2_\\xec\\x0b@f`\\x1be\\x9ec\\x16\\xea\\xaad\\xb9\\x8d\\xd3\\x1a\\xf3\"\\xa7l*l\\xb54\\xe4w\\xe6\\xe3\\x0e\\xcd\\xb6x\\x06\\x8b\\x8ap\\xe5\\xbf@>\\xba\\x7ft\\x86\\x98]_"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\xe8\\\\xfb\\xa0h\\x90?\\xc3\\xd42pz\\xd2\\x9a\\xf7)\\x82\\x14\\x8f\\x86gmk\\x06\\xad\\x14\\xb8\\xdcw|\\x87\\x11\\x01\\xb4v\\xf2\\xd22\\x1f0is;\\x01\\xe9}\\xb7\\x89\\xa1w\\xa7\\x83\\xeb\\xf7k\\xba\\x11\\xb55\\x91z\\xbal\\xed\\xf4\\x1e\\xfb\\x00ns\\xf92\\x12\\x1f\\xb7\\x98\\x93\\xc9\\xbc\\x90a\\xf9\n\\xb2&sp\\x1e\\x82\\xb1$\\xda/\\xf7\\xcc\\x1e$\\xb7\\xdcy\\x8a\\xc1t\\xc8\\xb35q\\x91\\xe2\\x8b;~\\xa8\\xb6i\\xd3\\x1f\\xdd\\x1c\\x91zxso\\x9e\\xc6\\x1a\\xbd\t\\x99\\xe6\\xbb\\x06\\\\xe5\\xa7\\xb6\\xeb\\xd1\\xb8n{\\xb6\\xec\\xcd\\x8f\\x0efx\\x98+\\x83^y\\xabz=]\\xf6c\\xd3\\x1fq\\x80\\x9a\\x04w\\xa3\\x82n\\xafs>l\\xd4\\xde\\x04n\\xd5\\x83h\\xfe\\xf0jv\\xde\\x96}l\\x9b\\xaek\\x15\\xf4\\xec\\x12c\\xbf\\xce\\xdfr\\xd9\\xc5\\xcd\\xde\\x12\\xda#\\x86tu\\xad.!)\\x92\\xff\\xd0p\\x08\\xd8\\x90\\x02\\xf9\\x82\\xb4\\x9e\\xdb\\xa1w\\xf6\\x9d\\xe6\\xf5g\tp\\x03d\\xc2\\xbb\\xd7\\xc3\\xb7\\x90z\\x9a\\xb6\\xe2\\x8a"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94bh(*l\\xb8dx\\x13<k\\xb1\\xbdc\\xde\\xfcvhm\\x11`\\x94\\x95\\x8d\"\\x96x\\xe1c\\xac\\xd9=\"\\x9bsx\\x90\\x1c'8\\xedni\\xa8\\xdfc\\xbeu\\xb14t4\\xff\\xa8\\xc53\\x8em\\xfe\\x9f\\x92\\xc0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xb9\\x9d\\x1atn\\xbc_\\x0e\\xf1\\xfd\\xd2\\xa4\\xf1\\xc3\\x8a9g\\x14\\xc2h\\xaf\\x07\\xb3\\x1e\\xcd\\xc7a|\\x9f\\x1e\\x9c\\x86a\\xb9\\x15\\xacw;\\e\\x84nx\\x99\\xb1dh"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010o\\xbe\\x00\\x1e\\xe5\\x0e+\\xc8\\xa1\\xe7>\\x87\\xa5s\\xa0\\xc0\\xd9z.\\xe0q\\xd7 \\x87\\xdd{\\xd4\\x03\\x9a\\x04{\\x89?\\xdeuk\\x87p\\x82\\xa4)i@\\xafqk\\xab\\xd2\\xa0\\x85\\xfe\\xa4\\xc7\n\\x98\\xa4\tn\\\\xfei^\\x0f\\xed\\xfe\\xabok\\x11\\xa0\\xfa\\x1ae\\xdb\\x1bub\\x94\\xd1\\xcduw,\\xe4\\xf32\\xd3y!\\x9eh\\x8e\\xcb\\xd4\\xc9\\xe5\\x87s\\x9dxp\\xa3\\x16a\\:\\x9a\\xf9r\\xd1loj\\xe2e\\x82l\\xe7\\xfa\\xc07\\xb0\\xd1h\\xf9\\x98\\x06}\\x92%\\x19\\x8c\\x914\\xd79e4y\\x18u\\x8c\\xf6\\x8e\\x18\\x8f0\\x85\\xfa\\xf8\\x1f\\xf3_]\\xa9\\xf1\\x94x\\x01\\x85\\xed\\xbf\\xa5\\xec\\xd7\\x1e\\x9du5\\xe6t\\xaeu\\xe9\\x89j\\xb8\\xf8bp\\xb7\\xda%\\x19-l\\xa4\\xe8y\\x82\\xb5\\xe1\\x9ag\\x88+\\x1f\\xef2\\xa3\\xe1\\xdc\\xdc\re\\xbc,\t\\x0c\\xb3\n\\x86\\xd5^z\\xae\\x01w\\xf7wy'\\xc7m3\\x95\\xf9\\xdet\\xdb\\x95\\xb3\\x9e8\\xc5(_\\x01x\\xf44\\x0e\\xd7\\x94\\xe8\\xd9a\\xc0(\\x12<"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010>\\xef\\x10\\x1b\\xb8\\xd6^@0/\\x06\\xfc\\xecu\\xef\\x9d\\xcd\\x0b\\xe8mj!\\xc0\\xf5\\x94f\\xfe\\x99\\xef\\x1b\\x1eg\\xc1\\xfa]{\\xad#\\xf7i\\xec\\xb0\\xe4\\x99\\x1c\\xf33\\x8ej\\xc2\\x05\\xb1zq\\xba\\xf9\\xcah\\xfc\\xacls\\xd5\\xbc\\x8dg\\x8b+\\xab\\x84\\x915\\xdb6\\xf0\\xd3\"\\xc49\\xb0\\x8c\\x13\\xeb\\xfca\\xf2\\x161<1e\\xd3hv\\x96>\\xbe\\x19\\xada\"2\\xe8lc\\xb8b\\x06\\x01\\x8dp\\xcd1\\x0e\\xb6\\xd6 `'qa\\xde\\xb0\\x84\\xf0\\xa7,\\x84\\xbe\\xfe\\xd8z\\xe3\\x16\\xbd9v\\xc0\\xb7\\x14\\x19{\\xa3\\x17\\xbcs\\xe6h\\xd3\\x85\n\\xfc\\xc3!/\\x9f 0\\xb4b\\xa6j\\xe8w\\xa4\\xde\\x82t\\xb7\\x90n\\xbc|\\x1f\\xc9\\x10\\x83\\xff\\xbb\\xe1sd\\x0e6\\xba\\xf1\\x1cqse\\x85?\\xae\\xcfs\\xa7\\xe3p\\xb1\\xff\\x871b\\xab\\x8f\\x10r\\x80\\xb5\\x96\\xb2^\\x10\\xbd\\xf1ibh\\x88\\xf4\\v>\\x93\\x8b\\xdc\\xb7\\xc6\\xa5\\xea\\x00\\x16\\xb5\\x00;\\xba\\x91}\\x80\\xd9\\xe0\\xe1\\x19!u\\xbcue\\xc3\\xf5^"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0102\\x18b\\x84\\xb5~u}?\\xbfsv:\\xc6\\xb16\\xfc2z\\x89i\\xaab\\xba\\xd4\\x9f\\xc5\\xbc>\\x8e\\xa2dljg:u\\x0e^\\x9ao0h)\\xf2\\x17\\xce\\xbd\\x00\\xeb\\xe5j\\x0c\\xe6\\xf2\\xf2\t]:\\xe9z\\x85\\xe9j\\xd7w\\x84\\x8a\\xff+n\\xd4\\xbe\\xe1\\xbf\\x88\\xeeb\\xfad\\xd8\\xf1\\xa0}\\xbc>\\x11\\xa5\\x1e{\\xfa\\x98\\x9e\\xb0\\xc8\\xfb\\x90r\\xabhq\\xf5\\x89p\\xaab\\x1fi/\\x8c\\xc9[\\xd0\\x9d\\xa8\\xbaq\\x81$\\xcc\\x18\\xe6n\\x1bu\\xbd\\x95!7i\\x7f\\xf94\\x87\\x14\\x10\\xa6\\xdc\\xbd\\xc91\\x06t~\\x9d7\\xc3\\x91\\x18(%\\xd4\\xb2\\xcc\\xda\\xd3}\\xba \\xf3l\\xbb\\xe1\\x1a\\x12\\x0f\\xc7'\\x91\\xd4\\x89=\\xba'2?\\x12\\x9a\\x0f\\xec\\xf2r\\xc5\\xcb\\xf3\\xa7\\xfcl\\xe0\\xc1\\x9f@\\x16\\x96\\x90\\xcd41\\xcd\\xf6n\\xbaa\\xd1\\xf2\\x9a~\\xef\\x1f\\xdc\\x16\\xd3v\\x072\\xfb\\xe2uf\n\\xb1\\xed\\x99\\x14\\xe1\\x8e\\x1a]\\xac\\x99.\\x03dy\\xef\\x15\\x9e\\xaa\\x8c\\xf7/$\\xc4\\xc6*\\xe1m{\\xe8%u"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8e\\x96\\xbc\\xbf\\x97{\\x11\\xc9\\xdb\\xb4\\xdc\\x1a\\xe4\\x04\\x8f\\x95\\xde4\\xec\\x00\"vaek~\\x03\\x9e\\xd8\\xfa\\xaf\\x10\\x10\\xc2\\x19n\\xa0&\\xfb-\\xd3+z\\x04\\xec~\\xef\\xef\\xf1\\xb4\\x0f=\\xe3\\x91\\x96\\x087g\\xa2 \\x0f\\xf2\\x1e\r|7p<\\xbd\\xec\\xa1\\x02\\x8f\\x9c\\x0f\n\\xa0\\xb3\\xeb\\x0b\\xc4v0\\xd9\\x13\\x1d\t\n\\x8e\\x02\\x19\\xd9\\xa4\\x1e\\xa9\\x87\\xef\\x7f\\xb6\\xf1\\xf2\\xac\\x9f\\x0e\\xf6\\x8fls\\xefy\\x07\\xf1u\\xe6rl\\xa9\\xd4\\x96\\x1a\\xa0\\xd7\\x01|\\xef\\xd0(x\\xb8;\\xb5t\\xb62\\x14\\xe8o\\xa6\\xaa\\xb5&r\\x15\\xff\\xc4\\xc6%\\x82\\x82\\xa5\\xa6\\x86\\x96\\xd3\\xd6$\\xdf\\x9f\\xdd\\x10\\xdd\\x82\\xa9u\\x90']\\x9d\\x8c5\\xd3lb\\x1e\\xac\\xed\\xc4p.0\\xfe?\\xec\ruqz>\\x07o\\xbf\\x07\\x83\\x0c\\xae\\w\\x192nc\\xd7a\\xfb\\xad\\xf1\\xe3\\x82\\x80\\x1cy\\xf0\\x19\\x00\\xb1\\x99\\x82w\\x96\\xeam[/\\xddg \\x88q\\x17\\x8a\\x84\\x04qi\\xf2\\x1f\\x18\\xbfedlyz\\x97^\\xa2\\xadk\\xa2\\xd9\\x9c"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010:\\xb6v6srq\\x1dw\\x88)fm\\xb9\\xe2+\\xcd*u\\x99yk\\x0c\\x91\\x18\\xa6\\x16j\\xeb\\\\x85\\xac\\x92\\x92b wt]i\\xb3s\\x8f\\xc8\\xd5cr\\?~\\xc2\\xcfb\\xb7\\xa6k\\x1dz\\x1c\\x8b\\x13<\\x02\\x9f\\x8c\\xde\\x8c\\xac~\\x97\\xeet\\xf4\\x16\\xae\\xfe\\xe1?\\x9f0\\x8cb\\x8a\\xc39{i\\x92\\xf6\\x8d\\x0c\\x81\t%\\x82\\x9f\\x82\\xd5\\xb2\\xe8\\x04\\xba8\\xfa\\x9a\\xc9/b\\xae\\x82\\x83(f\"\\xfdjp\\xac\\xcf\\xb5\\xc36\r\\xaf\\x15h\\x9fk7=\\xef\\x18\\xb4_t\\x91^\\x05\\xfb2kx\\xe8z!q\\xce\\x82\\xd5\\xb25\\x05\\xcb\\xf9\\xd8j:%\\xbc/\\xc3n\\xb3\\x0b\\x83\\xff\\x14\\xab\\x9e\\xe8\\x8a>~_\\x12\\xc9\\x9c\\xc9\\xae\\xf6\\x8b\\x81\\xc9\\xcc\\xbbe\\xbb\\xdf\\x87\\xd9u\\x05]\\x89\\xa6\\x8f.\\x19:zcxd\\x954\\xd3\\xdb\\xffy\\xebz\\x9fg\\xd9\\xa8\\x93\\x93\\xb0\\x9c;yn\\xf10\\xc4t\\x10\\x88*\\xc6z\\x07\\xcb5\\xbb\\x93\\.z\\xf7\\xca\\xf5)j,z\\x9d\\xe6\\xc54\\xf5"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\x1c\\&\\xce\\xea\\xb6#\\xda}/\\xc7\\xa1\\xf0\\xe3\\xfb\\xfal\n\\x02+\\xd7\\xaaq\\xdc-\\x06~\\x0fa\\x99\\x1e\\x12\r|\\x18\\xdav<0\\x91\\xf1\\x96w\\xc0\\xfe\\xb2\\xa9\\xe7\\x8f\\xfb\\x0f\\x87\\x16\\xb9c\\xec\\xd8\\x8d\\xcc;m\\x85\r\\xa1\\xeb\\x8e\\xc2\\xb8l\\xa3=\\xc1\\xb8\\xb2\\x91'\\xcc\\x9cdv\\xe8k\\xf3\\x92\\x1bc\\xe2\\xee\\xb0bp\\xaf\\xa7)\\xfby\\xb7\\xd79\\x00ux\\xd2\\xc9\\x91\\xc6\n\\xe3q\\x19\\xb3\\xb5\\xcd2v\\x94\\xcd(\\x8dbie#5\\x81\\xff\\x12\\xd1\\xf45\\x0b\\xdf\\xba\\xd5\\x92\\xf4\\x08\tu#g\\xe2?\\x94\\x0f\\x92\\xe5\\x14\\xb6w\t\\xc2\\x86\\xd8\\xa4<\\xe2e5\\xf4'\\x9amq\\x98\\xa6^\\xb9yy\\xb4p:\\xfd\\xdd\\x1e\\x19!\\xb7\\xb2\\xfe\\xae\\x90\\xe4\\x1d\\x8e,\\xb0\\x8e\\xf48al\\xc1b\\x91\\x05j \\xf2\\x04a\\xe7\\xa7\\x9b\\xb7\\x7f3\\xd6\\x83\\x0f\\x9b\\x81\\xb7\\x02\\x05\\x14d\\xc1\\xbex\\x89j\\xd6\\xe2\\xc7\\xfby\\x0c\\x8a9\\xb5e\\xf9\\xaa\\xca?\\x9dr14\\xae\\xf8\\x80=t;l\\xd5\\x13"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\n\\x87q\\x7f\\xaa/\\x91\\xe1x\\xe3ibj\\xd4\\x19\\x1b\\xf8\\x88\\xdck\\xd6r\\xe6,\\x81\\x82\\xf4<p\\xc1\\x11y\\x1as\\xba\"\\xd9\\xb2gl\\x17\\x10pt'p\\x03n\\xf4\\xa9]\\x1er\\x93\\xa3\\x86%u\\x13\\x18\\xa8\\xba\\xf1l\\xe3|\\x01y\\xfc\\xb2\ty:\\x8f\\xd3\\x85_\\xe5`db\\xd4\\xbe}a\\xf5gl3\\x1b\\x0b\\xb0\\xff\\xa6\\x16\\xa3\\xa2\\xea$\\x9f\\xda\\xc6\"wf \\xa3\\xf1u\\xae\\xfb\\xca\\x18\\xb2#_\\xd5\\x11\\x1d\\xcb\\xfb\\x86n\\xd0=\\x12\\xdb\\xf5m\\x03\\xd5h\\xa0\\xfe3\\xd0:\\xf0v\\xd1@:@\\xef\\x81.\\xa6b\\xbf\\xaa\\xec\\x89\\xdc9\\xa2?a-\\xd9\\xbb\\x13\\xdd\\xf8\\x17\\x84\\xbcy\\xdbw\\x10+\\xbci\\xd92m$\\xee\\xe6\\xe8\\xa2\\xdec^l\\xaf\\x065\\xf1\\xb66\\xd9!\\xfex\\x8chb\\xf9<\\x0f\\x88\n\\x9e\\x91\\x9by\\xcdi\\xba\\x11\\xab\\x87\\xd6\\x1d3\rt>\\xbf\\x7fn\\x8c\\xfa\\xf2\\xb3fn\\xec#ah7t\\xcd\\xbe\\xdd*o{<\\x16\\xa1\\xff\\x81{\\x0f\\x021\\x8c["
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1bb\\xcc\\xb4\\xac\\xc8\\xec\\xf16e@a\\xd1\\xd4\\xf20\\x1c\\x05\\xf1\\xb6\\x15\\xbbqa\\x92oe\\x9e~,\\x84\\xab6\\xd4\\x82\\xf2\\xcc\\xf1\\x9f\\xaa\\x1a\\x83\\x1e\\xe9\\x95\\xdffay\\x19\\xee\\x14j\\xf6}p\\x8ch\\xbe\\xda\\xd3\\xbc\\x85=x\\xb4\\xd2|y\\x11\\xc6>of\\x14\\xffi\\xa4\\x0b\\x87n9\\xe6\\x8f\\x9e\\x8a\\xb0\\x1e?h\\xbe?\\x88k\\x1fl\\xf3\\x82\\xf5\\x80\\xa6(\\xd8i\\xbf\\xf8g/+;\\xc95`t\\x0e\\xaaz\\xb4#\\xa3\\x12\\xdf\\xe2\\xa8v\\xbfc\\x88\\xf1\\xe3zn\\xc7\\x93\\xc6\\xcb\\xccwng\\x9c\\xb7\\x80\\xe8?j[\\x06g\\xe5\\xd5\\xac{\\xcfr\\xbc\\xa5\\xc5\\xb4\\x18\\xbe\\x19\\x8b\\xdf|\\x1d\\\\x93+\\xd7p\\xd3p]\\xfdi\\x94\\xa8\\xadj\\x04v\\x1a<'\\xc1*w\\x07\\xc3\\x11\\x89&\\xbd\\x9f(\\xf7 tyl\\xca\\x01\\x806_\\xde\\xa4\\xdc$'\\x8bc/\\xf87\\xc2\\x9d\\xbe\\x9c\\xddg\\xa9?\\xea5\\xd5p\\xa0\\xaa\\xc1ea\\xec_\\xe9\\x81z;\\x85}*\\x13\\x89\n\\xbdb\\xbe\\xd3u\\xc1"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xd9\\x83ak\\x80u\\x92\\x8e7\\xf0\\xb6\\xc7/}\\xb1\\xd2\\x9c\\x16\\x99\\x00j\\x16\\x90\\xb9\\xcb/\\xb9\\xc2\\xe3\\xda<!\\xd5\\xfe2ek\\xe3\\x13\\x940\\x14\\x14\\x06\\x0e\\xa6\\xa1k\\x85e\\xc2:=\\x1e\\x8d\\xc5\\xe1\\xf5\\x14^\\x0e k\\xd2\\xc9\\xa0\\x90\\x0f\t\\xf5\\xc6\\xdf\\x10\\xff%w\\xd6\\xf0\\xda\\xcb)\\xfa|8v\\x9e\\xc3;r\\x17\\x83\\x03\\x8a\\xe4\\xe0\\xd5\\x97\\x06\\x9ba~\\x81\\xf3z\\xd9\\xe0\\x01\\x17\\x0f\\xc6\\x0f\\xa0\\x89g\\x9b\\x8f\\xebs\\x8a\\xed\\x9e`+;\\xfb\\x99\\x1c\\x88~\\x85\\x8f\\x997;q\\xc0\\x88\\xfa\\xab\\x85i\\x97\\x12\\xb6[\\xa72yz\\xaa<\\x14j\\x18k\\x04<\\xa3\\xaa\\xc5\\x19\\x13\\x86\\xf9\\x14\\xe5v\\xfa\\xd0\\xf1\\xed|\\xd06\\xdf\\x1aws\\x14\\xa2\\xad\\xd3\\x92\\\\xf4z\\xbd68\\xbb\\\\xfe\\xba\\xc2\\xfe#\\xbe2\\x96\\xd2\\x14\\xbc\r\\x93\r\\xf4\\xb8d\\x88e\\x9d\\x93~\\x86y1j^]*l\\xa5|z\\xcf\\xe9k\\xc2]w\\xae\\x96\"\\xf4\\x8el\\x87g\\xd5\\x8e\\xfd\\xed:kc\\xe5\\xee\\x88\\x15\\x9e"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\x14\\xc9\\x84\\xd1\\x97\\x1d\n\\x97:\\xe7\\xe5j\\xffc\\xf5\\xcfh0\\x16\\x04\\x92\\xb9\\xcfh2\\x1fle\\xb9\\xed\\xc6\\x0b\\xc4\\xe0\\xff\\x7f\\x06\\xda\\xdfcur\\x0f\\x87\\xdc\\x83\\x0fw\\x83\\xea\\xba\t\\x8d\\xb5\\x7f\\xf3\\xa3\\xd0g\\xc2\\xed8\\xf7\\xc0\\x10a\\x82u\\xae\\x98:\\xeb\\xc3/\\x86\\xba\\x01p\\xf6\\x9cn\\xff\\xe3\\xe2ev\\xcb \\xdb`\\x1fs\\xa8'\r\\xb3v\\xbee\\xf8c\\xc5l\\x9e\\x0c\\x84\\xb9\\xbe1r\\xdf\\xb8\\xb4\\xeb_\\xd0\\xc5\\xb7\\x8e\\xd1\\xe1\\x9f.\\x05\\xda%e\\xf0\\#\\x82\\xc5\\xf1>z7\\x85\\x1c\\xa0t\\x0c%\\x7fk\\x84\\xd5\\xc7}\\xb0]\\x97\\xb2\\x80\\xbck^\\x1a\\xa1\\xa9\\x96(\r\\x14;\\x8f1c\\x1al\\xaa3 \\x0cp\\xae\\xf0\\x07\\x8c\t\\x1f\\xc4\\x8c\\x9e\\x90\\x82\\xc1\\xaag\\x10\\xba\\xa7\\xec\\xe1\\xfe\\xddr\\xbfg\\=@en\\xa9\r9n\\x05\\xf8\\xa0g\\xeb\\xd0n\\xb5y\\xc6\\xb4\\xd5\\xd9c\\xb2s\\xc4ih\\xb2\\x17\\xcb,q*y\\x14f\\xcf3a[\\xc2\\xa9\\x0f\\xa0\\xbc\\xc7\\xf9\\xf7ed\\xce"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80o\\x82\\x19z\\xa6 8$\\x95\\xb270\\x123\r\\x9b]\\x8d\\x0crrn,t\\x98\\xe8\\xf0\\xfb,\\x18\\x90\\xc4\\x7f\\xd8\\x83\\x8f\\xad\\xd4(\\xcb\\x93\\x10\\xc5qx2\\x0ey#u\\x18r\\x92\\x18nj2\\x10\\xd9\\xc5\\xafy>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x97\\xe6m\\x0e\\xe4a$\\xdc.\\xfe\\xc0\\x82_\\x0c\\xb9\\x84`\\xec-q7-\\x02\\x8d\\xb4\\xf9q\\xe1\\xb8b\\xc7%\\xe9g\\xf2f\\xd1\\xea\\xf7`e\\x98\\x9a\\xe5\\xb0\\x02+"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x045\\xbc\\x96\\xe3\\xf4i\\xa0y\\xc5\\x1bd\\x8e\"\\xc8\\x16\\x92h\\x99\\x9czy\\x0b\\xe6wxh\\x98$=1\\x02\\x8cr\\x93h3\\xe1n\t\\x08\\x0c_\\x00\\x83\\xc6,-\\xa5!\\xf0\\x17\\xdcw\\x08t0\\xeeb\\xc1ng\\xa0a\\x0e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xea\\xea\\xb6\\xa6\\xc5\\xfd\\xf8\\xb8ci\\xd4\\x1e>\\x02h\\x93\\xdb+|o\\xe4\\xd3f\\x025}\\xa8\\x97\\x18!b4f \\xae\\x006\\xb5\\x90#\\x9c`ka\\xdfv\\x19c"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\x8d\\xebyt\\x89^\\x00\\xf5&\\xa3\\xec\\xebs&m\\xe0\\x11\\x92\\x90_\\x11|\\x9fw\\xc9u\\xb2\\x08\t\\xf6\\u \\x04\\x0e\\x0e_\\xa1\\xd5\\x16\\xe6\\x83x\\xaepd\\xae\\x95\\xbe\\x8a\\xb3\\\\xc7\\x15\\xa5nb[\r\\xf8\\x87\\x8a\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdcek_\\xfben\\xb3\\xb9\\xc1i\\x16(\\x00\\xd9\\x8dg\\x07\\xbe7zr\\xaf\\x9c\\x06\\x914s\\xd0n\\x9d\\xa2\\x8d\\xf4\\xed\\xbd\\xaf\\x17z\\x92\\xda-l\\xb8t\\xddf\\x0f"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xef_k\\xad\\xc2\\x0eha\\xca`\\xbf\\xf4\\x8a\\xb6\\xf1\\xf6\\xabt\\x94\\xb1i\\x19\\xb1\\x1c\\x0f\\xf1\\xaexj\\xd0[\\xdb\\x0f \\xc6\\xaf<\\x82\\xfey-k\\xd1\\x04\\xd9s\\xba\\x95\\xe1o\\xfcd!l\\x8bq\\xdb\\xb8\\xd69\\x02\\x9b`\\x85,\\xc7\\xa2\\xed\\xe5\\xe6\\x0f\\xe1@\r\\x9ec\\x16\\xdb\\xa0c\\xf38\\x11.\\xf6\t\\\\x03#\\xbf\\xda\\xa9\\xd43y\\xe8\\xa1\\xec\\x92i+\\xd6\\x0c\\x13cs\\xff$\\xa4o\\xd2\\xc2zj\\x8e\\x18m\\x95\\x18\\x83\\xde\\xde\\xb8\\xfb\\xf4=\\xd6\\xba\\xab\\xb1\\x0b\\x86\\x93\\xee8[\\xef\\xc7\\x98/\\x00\\x91\\xe2a\\xc7p%\\x10y\\xach\\x1b\\x8d\\x10&n\\xd31\\xefw\\xc2{\\x95/f\\xcap~\\x8c\\xdci?.[h\\x1c]\\xb9s\\xf6\\x84h/\\xa8\\xban\\x05\\xd1jw_f\\x940c\\xa4\\xd5\\xc7\\xc5\\x1a\\xa1s\\x92\\xb7$\\xeb\\x19j\\xdfq!\\x8c\\x9e\\xf3*\\xb4l\\xb8\\xae\\x9e\\xb0\\xa5\\xa6\\x7fcx\n\\x1e\\xc7\\xcb64?\\x94\\xbc\\x9e\\x98c\\xdd\\xa3\\xa1\\xa3|\\x1c\\xef0\\xb1\\xc3\\xf1\\xa2n"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\r\\x1c0^\\xe3\\xd4\\xc0f\\xbd|\\xf0c\\xd7wh_~\\xf13\\x8cp\\xbeg\\x08\\xe8-\\x1f%\\xa7/\\x97\\x96\\x1e\\xa4\\x94\\xc7\\x11v\\x07\\x90\\xeb\\x90\\x8c\\x83\\xcfce\\x1e/\\xbc08-^\\xa9\\xe2+g4\\xbd\\xb3\\xa3\\xe2\\xb4|\\xe6p\\x125_\\xf0\\x99\\xa0\\x05\\xb0\\xfd\\xd3\\xf9\\x94\\xeae\\xa8v\\xc9\\x9d /}\\xab\\xc8\\x83(\\xafv\\xcf\\x89\\xd6\\x82n\\x01\\x88\\xa3i\\xd91\"x\\xaa\\x82!\\xe0\\xc9f\\xb6q\\x05\\x00\\xf7dwd)\\xd1n\\x0b\\xdahg\\x82%\\xa9\\xcf\\xdf\\xdd\\xa4v\\x92\\xc2l\\x05\\xea^\\xcbp\\x87t\\xf9\\x88\\xe8\\xcb:\\xcbo\\\\x0b\\xa9\\x90\\xcf\\x1e\\xa5\\xd2`\\x95\\x18\\x84\\xbb\\xa4\\x19\\xe1\\x96\\x9cr\\x8ef\\x85\\xa3(\\xc3\\xdf\\xc8\\x84\\x10\\xb7<\\xb8\\x026\\x94\\xc1m\\xd9@\\xd4\\xe69\\xef1\\xd4r7)\\xa8*\\xbc\\x90\\x07lp\\xef\\x16o\\xedque\\xe3c?\\x0c\\xbdi\\xd9r\na\\x10m^d_?&\\x17\\xf3\\x1e\\x9bv>ol\\xd8\\xe7\\x99\\xb3f\\xb5\\xfc\\xadp\\x8au"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\xf4\\x8b\\xa2\\xd0\\x80&\\xde\\xf3r\\x03\\xed\\xfez\\x0b\\x04\\xacrx\\x15\\xd5i\\xa3d\\x8d+!k\\xf75lm\\xe7}4\tw\\xf4\rd\\xcbg\\x17\\xd5\\xc1l\\x85\\xc6\\x8a.\\xd7(c/\\xf4\\xea\\x8f\\xfa\\xe0\\x92\\xdf\\xbb>{y\\x8c\\xc5\\xde,\\xaal@\\xca\\x89a\\x8b\\x93@\\xae\\x1c\\x13\nr\\xa0`do\\xc1\\x195\\xc1\\x1ac\\x81\\x84q%\\xc5\\xcat\\x10\\x0fo\\x11f\\xcflz\\x1c'(/\\x8d\\xed\\xc5cod\\x05\\xd3\\xfb\\xa8\\x84*v2\\xff\\x18)\\x8d\\xaf\t\\xbd\\xae\\xad0\\xb6\\x87\\xd3c3\t\\x06\\x8d\\x13\\x17\\x87io\\x8e\\x1a\\x16\\xd5\\x83\\x97>\\xde\\xbbh;`\\x9e\\xbch;(\\xbed\\xaf\\xfc\\xfa\\xbc\\x10ne:g\t\\xe5\\x9can\\x9a\\xc0\\x02\\x1bb\\xba\\x1c\\x96\\xb2\\xb7e\\xb4\\x97\\xecyx'\\xf0\\xf7\\x0f\\xd0\\xbc\\x83\\xd1\\xdf\\x10\\xf0\\xb7,\\xfe\\xc2?\\xa5\\xe9z\\xb9\t2[e\\xa2w\\x19\\xd3\\x8b[mt%x\\xee+~\\x14\\xc21yn,\\xa9\\xe0_-]\\xf2\\xe1\\xc0\\x92w"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xac\\xc8p6\\x1a<\\x12j\\xb3\\xbd\\x13\\xb7\\x9ff\\x113yd\\xb29\\x91\\x1a|h0gn\\x1c\r,\\x0b\n\\xb6&\\xd48\\x83\\xa4\\xa3\\x10\\xb8\\xe4\\xbf3:\\xd2\\\\xd7t=\\xa6=\\xff|\\x9d \\x1bx\\xb9q\\x16=\\x0f}\\x9d6\\x08f\\x17\\xa2\\x0c\\x9eg\\x84g#r\\xba\\xfd\\xfe\\xcf<\\xdawb\\xaa\\xa0\\x89\\xc6\\x03\\xa8\\x10\\xee\\x05\\xef\\xd6\\x05\\xf7\\x9b\\x8e\\xe0\\x9f\\xbef\\xd4\\xc99\\x91\\x96\\x8dh\\xf7\\xa0\\xf6\\xbf\\x9c\\xc6\t\\x91z&l\\xc9\\x96`\\x1e\\xa0~\\xc9\\x9a\\xa8e\\xc3\\x87\\xab\\xcb\\xa7_\\xb7\\xf9\\x0e\\xcce\\xf4\\x8c\\xa5\\xd3\\x0e\\x85><p\\\\xb1\\x1a\\x06\\xffk\\x8b\\xdf\\xb6\\xb0$\\x9boi\\x92v\\x1c\\xca\\xfd\\x04\\xd0\\xe3\n+\\xe6\\xe8\\x89f!\\xf3-\\xaa\\xd5+;\\xdc\\xa1\\xednue\\xbd\\xef\\x1f\\xaba\\xec\\xafn\\xcd\\x1f\\xc4\\xdc\\x93\\x8b\\x04\\xa8\\xc6\\x01\\x19\\x8a\\x96\\xe9q\\xcc\\xc5\\x03\\xaal\\xb9\\x13?\\x95l&\\xdc\\x15\\xca\\x85\\xd5\\x8b@c\\xd3 \\x91\\x84\\xb7\\x03\\xbe\\x031\\x9b+\\xbc\\x9f\\xc8\\x99"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1as\\xd5\\xf3\\xc5\\xd6\\x8b\\x00w\\xe0k\\xd0\\xc4\\xf6l\\x00\\x98e\\x00\\xa2.\\x92>\\xc8\\\\xbc2\\xbcp\\xfd\\xe7\\x81\\xea\\xbfk}\\xe0:6\\x1d&\\xffk\\xa8i@\\xccg\\x8d7\\x01!\\x8d\\x90\\xb9(\\xf8\\x9f\\x84\\x97\\x1a\\xca\\x85\\xcbg\\xdd\\xd1\\xf1\\x80\\x9e\\x16\\xe2\\x89~.f\\x8c\\xe1]\\x8a\\xc9i\\x12\\xf6\\xd7\\xe7b\\xa4f6\\xc4\\x8a\\x91\\x1b\\xc0\\xd7'}.\\xa4t8\\xfa\n\\x0fy]\\x1c$\\xedy\\xc4\\x9fj\\xd92\\x10\\xe6\\x19\\xde_\\xa3\\xd6d,\\x1a\\x91r3\\x15\\xce\\xd5\\xb4\\xab8\\xc9h\\x9b\\xef\\xdd\\xec\\x17o\\x13]r\\xe5u\\xd6\\xda\\x84a\\x07kf\\xd71\\x95\\x01\\x89\\xf6\\x07z\\xb6\\xae1z\\x87\\xady\\x04\\x14|\\x86\\x0f\\x011\\x1b\\x8c\\x1d\\x05\\xd4^\\xca\\x84\\x18\\xac@q\\xbd\\xdd\r\\xe6\\xdb\\xcae\\xe0/[]\\xdc\\xdbwo\\xda\\xfc\\xc1m/\\x82c\\xf3\\xa1\\xd92\\xe9cw\\xf8\\xfdv\\x93ob\\xd8t\\xc8\\xcd\\xe1\\x8b}\\xba;\\xc5\"\\xcb\\xd2a\\x85\\xd3#\\xfc\\xaf\\x1d]+=\\xc1\\xd4\\xb3]"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\xb3)\\xf8fmz\\x88o\\x1aw2\\xe7\\xab5zx9\n<\\x00\\xee\\x8d|\\xae\\xd7\\x9d\\x9e\\x91\\xac\\xb7\\x11\\x03c}\\xaf\\xbd\\xe2c\\xbf\\x11y\\xbb\\x8b\\x8any\\x8d\\xa4\\x7f\\xc9\\x1el\\xc2\\xd5\\x8e\\x02\\x89\\xe1x}\\xeb\\xb1\\x9e\\x8e\\xf5\\xf7\\x87\\xcf]\\xa8\\xf8\\xd2\\x9c\t\\xd8\\x1d\\xa96\\xca\\x1d\\xe3\\xc2+\\xc6\\x9d\\xdd\\xe4\\xf1;\\xeb\\x1f\\x97>\\xe4\\x85\\x01\\xedb\\xd9\\x1e\r\\xc4\\x8e\\xfb\\xf9-\\x16q2t\\xa03~\\x81y\\xe9\\xfb\\xb5\\xbe\\xc4m\\x1enyb\\xc4\\xa6\\x18z>\\xd8\\x7f\\xae\\x1d\\x1a\\xe89\\xd0\\x13l\\x13}\\xc8\r\\xdb\\x97{\\xb7\\x93\\x06\\xf4x$\\x94\\x01m\\xc1\\xbc\r\\x91)\\x161\\x14\\xf5\\xfbx\\x9c/'\\xd2\\xfd\\xed\\xf7\\xbf\\xfb\\x17\\x19\\xbd\\x04\\xf5\\x88\\xab\\xe9\\xd7\\xec,\\xe7\\xab\\x1b\\xde\\x81\\x8a\\x13%\\xb1\\xb5q\\xb9\\xc3q\\x00!\\x'e\\x8f}\\x8d\\xa4!\\xeas\\xb2\\xe7\\x82i\\x8ft\\x9bnd\\xc5\\x90\\x85n\\x8a\\xf2\\x05\\x97\\xaa$\t*\\xa1\\xf5\\xbd\rt3\\x9d\\xf6)\\x8fnz~i\\xc8"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82\\xf6\\x88\\xea\\xddc\\xc8;\\xder\\x97\\xc4f8,)0\\xda\\xf0\\x0e\\xd4\\xcco6:\\xda\\xfbp\\x93i`l7(\\xb4\\x83\\xb6\\xbe\\x00\\xdd-\\x9f\\xfek\\xb1\\xac\\xa6c\\xfa\r&\\xf6\\x1c\\xfa\\xa9\"'\t#\\xb6\\x7f\\xbf\\xf7i\\x1a\\xe8\\xed\\xd1n\\xbdj\\xbd(\\xae\\x16\\x7fn\\x9c\\x94\\x97\\xaa\\xd7\\xc8\\xe9\\xf9\\xd6k\\xaf\\xdd\\xd1\\x07\\x16\\x9f\n\\xab\\x1e\\xb9%\\x90h\\xa3\\x9fr\\xbd\\xf5\\xea\\x98\\xc5\\xb4-\\x1a\\xbf\\xa8\\x9a\\x9dg\\xe6\\xb4\\x9e\\x1f\\x01\ty\\xc6\r\\xa2\\xcf\\xa0[\\xe6\\x17-\\x89\\xbb\\xf7\\xf6\\xae\\x9a\\xb3l\\xce\\x19z\\xb1\\xc3\\xa4\\x19\\xff5\\xff\\xabw\\xfb\\xc3\\xff\\xfa`\\x8a5'|\\x94\\xfa\\xcc\\x81\\xf5\\xb3\\xf8\\xd4*\\xa4u\\xf0\\xcf\\xebe3\\x9d\\xb2\\x99\\xc9\"\\x1c\\xdbqc\\xb1za\\xeb$rn\\x8fqla\\xfc\\xb0\\xec\\x91u11a\\x14\\xc5c\\xe5-\\x8a\\xb5`\\x05f\\x9d6\\x8e\\xdd\\x10\\xb81\\x1f_\\xe6\\xe1b\\xa9\\x84\\xfb\\xb8\\xd7\\xc4\\x82>p\\xa5xt\\x83\\x07\\xeb\\x94(\\xe2;<\\xb3g|\\xde"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\x9ax\\xa4\\x14\\xab\\xc3bc\\xf2\\x81\\xa7\\x80\\x0f0\\xffm\\xcf\\xb9>cz\\xd6\\x86\\xc2\\xdau\\x18\r=\\xc4\\x99\\xbd\\x01\\xad@k8g\\x8e~=\\xed!\\xf8\\x08\\x04\\xd9=g\\xce\nvkk\\xebd\\x19n\\xb4y\\xd7\\xca\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9ebh\\x13\\xd0kk\\xb7c#\\x1a~\\x917'\\xa8bj/\\x05\\xf7)\\x87=\\x7f\\xd35,\\x04h\\xf3k\\x1a\\xe0\\xc0\\xd5d\\xe8\\x8b\\xd8t\\x9a\\xc7\\x92\\x17\\x86(k"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2s\\xe2l3\\xed\\xbf$\\xc1-:\\x8a\\xc2ug8\\xf7z*\\x10\\xfd|\\xe5u\\xfe\\xd5~\\x86\\xaf\\xf3\\x1e2\\x16\\x08_\\x95\\xf6\\x81r\\xcd\\xf5\\x03\r\\xac\\xc0\\xedo,\\xe3\\xf9\\xbb|\\x9e\\x15&\\x1dot\\xf2:e\\xe3\\xa2\\xc6\\x1d\\x9e\\x87\\x0e\\x90iny\\xd7|\\xe8vm\\x0e\\xb0\\xbd\\xaf\\xeb\\xaf7\\xcfd\\x18` \\xab\\xbbz\\x0f\\xce+\\\\x82@\\xf8\\xa2\\xc6!qo\\x11bn\\x93\\xbcs\\x1c\tn\\x17\\x99u\\xa1\\x84&\\x98\\\\xe8\\x92\\xa6,\\xb1:\\x8d$oz\\xdam\\xab\\xa1|@\\x01[\\x7f\\xb0\\xbf\\xae\\x13t\\x7f\n\\xae\\xe6\\xd6\\x8e\\x90\\x08\\xf7\\xd0\\xdcp\\x9a&s\\x80\\x85\\x19\\xdb\\x02\\x19\\x93\\xae\\xb2\\x88\\x1bx\\x919w\\x10\\xb0\\xeb\\x84\\x1b\\xb4\\xc3,\\x00\\;c\\xc3\\xf2 ;,i\\xfa\\xdd\\xfd/\\xf2d\\xad\\xff\\x9em\\xbe\\xa1\\x91u\\xff\\x18\\x16\\x8f'\\xabm\\xces\\@\\xdem\\x8d\\xc13?\\xe3\\xb8\\x07\t\\xf7k3\\x81\\xf1r\\x02\\x9c\\xfd\\xdf\\x8cx\\x9e*a\\xb5h\\xf4\\x12\\x07\\xf5t\\xfa"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaa&e\\x84\\x99e\\x81p\\x98b]\\xe41\\x16a\\x8e\\xb9i\\x03\\xc3\\xe9\\xfe*\\x0f\\x8b\\xb0\\xd0i*%t\\x81xw[!v\\x8f\\xce<9\\xect\\x17\\xf2\\xbf\\xe1\\xb1\\x16\\x98\\xd7\\xb9<\\xd6w\\xca7}\\xd1\\x81\\xadiq-:\\xecb\\xdde\\x92\\xa0rt\\x06k-d}\\x85\\xe5\\xbfp\\xd6=\\xf5\\\\xc2\\x87d\\xe0\\x13\\xdc\\xbb$l\\xba|\\xc5\\xf5s\\x0e\\xc8 \\x95\tj\\xbfqr\\x0b\\x92\\xc7,5\\x9c\\x1f\\x15\\x156\\xe8\\xe9\\xefj\\xf1\\xf4rt\\xce\\xeeh>\\xd0($r\\xd5\\xba^3cy\n\\x93\\x19edg\\xe1\\xa0xu\\xcby6\\x06,\\xcf\\xf8!r\\xf1\\x15\\x89\\x17\\xc0p\\xae+\\xd55\\xbc{\\x93\\xf2\\xd1n\\x81\\xc7\\x9e\\x8f=\\xaf\\xa6\\xa1\\xd1bo\\xea\\x1c\\xf4\\xc8:\\x01\\xc8\\x18\\xc5px\\xc8!\\x94e}\\xcc\\xd2\\xb8+@v}v\\xdc%\\x91\\xf0'\\x93n3|\\x02\\x1e\\xb9\\x8b\\x1d\\x1e\\x0be 0b\\x16\\x1a.c\\xc1=\\x0e\\xbc\\x87\r\\xfb\\x08\\xa3\\xa4\\x8a3mfc\\xcb"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4\\xa1\\x19\\xd9w\\xf7\\x7fb\\xef\\x9dz\\xa7iz\\x89\\xaa7\\xca\\xb3\\x81\r\\xc1\\xa4\t\\xe4\\x9a\\x16\\xb6\\xd7=p\\xc8$2c\\xdf\\xf4{hm\\xb6\\xe0@\\x90\\xca\\xe7\\x88\\x872\\xb4\\xf2`\\xf8\\xdc\\xa02\\xc2\\x0f\\xb9)`z\\xb6\\xb8\\x12\\x0e\\xbb\\xf8-\\xb6|g\\xe9\\xa1\\xc0>\\xb6\\xa6\\xd3'\\x898\\x91n\\xb7\\`\\x805\\xcbk?\\xf7rf\\xbd\\\\x88\\xcb l>m\\x05\\xd6_}\\xb3i'\\xd4\\x83`\\xbc\\xb31\\x97\\xda\\xc6\\xbc\\xd2]\\xf9\\xbc\\x19m\\x89\\x86\\xbe\\x84\\xd1\\xd8s\\xb7s\\xfb\n\\x00>\\xa1g\\x8c\\xf1\\x82\\xac\\x04t,9\\xcaa7i\\x99u\\xf3 x\\xdf-\\x0c\\xf8$\\xe2$\\x9fs\\x15\\xec\\xc0&\\xa9\\xa1ip/\\xc53\r\\x8as\\xdb\\xbc\\xd2\\xd4\\xe9\\xc4tk\\xa5x\\xf3bd\\xa3;\\xa0a\t]\\xe6\\xaf\\xa8\\x05\\x99\\xb6_\\x93=\\xf8\\xab\\xd7\\xc3\\xcc\\xe5\\x11\\x85^\\xfd\\xf0\\xbc\\x11\\x9f\\xbc\r\\xc2\\x18\\x8b\\x18\\xcc#\\xd2\\x90<\\xfe\t\\xf2-\\x12\\xc7h\\x1e\\xcf\\xbe\\x15uwo\\xf8\\x08}"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x08\\xe3\\xc2}hz\\xc0tu\\x98\\xb7_\\x074\\xbb\\xa8\\x88)s\\xf3\\xda!x\\xbd\\xb6\\xfe\\xbd\\xc8\\xf4\\xb8t\\x0b\\x08,\\xe7)\\xe0v2r3\\x9e\\xe3g\\x1f9i\\x13\\xb0\\x9c{w\\xd2\\xe9dc\\x96 \\x189\\x18\\xf2(\\x966\\xebffu\\xe2\\xd9\\xc5\\xc3\\xcf\\xf2\\x19k\\xaa\\x92\\x01\\xd2\\xa2\\xeb4\\xa8\\xf4#no\\x0f\\x94\\x8cpmpl\\x7f\\x89ztt2\\xfau\\xbf\\xa2n\\x9a\\xb4j\\xdb\\xb84i\\x17\\x8b\\xa35$|\\xa2jk\\x8a\\x1d\\xba_k\\x84\\x8fy\\x0f\\x17\\xa9\\x9f\\xe3\\x04/\\x9d\\xaa\\x9e\\x0b\\xf4@_wd\\xb5\\xdd?6x\\xb8\\xc8a\\x08\\xc0\\xef\\xd9\\xf7'/\\x1d\\xa5kq\\xabh\\x95\\x97\\xd4\\xce\\xbc\\x11\\xda\\x8b~\\xdfc`\\x90\\x03d\\xc0\\xdb\\xdb\\xae\\x96\\x86\\xe8r\\xa7l\\x9a\\x12\\xda!\\x9f\\xb6$e\\x95\\xc4\\xb4&w\\xbcwh\\xb9\\x9a\r\\xecc\\xfcj\\xf5\\xcd\\x0e\\x8d\\x9dj\\xce\\xd8w\\xd7\\xa2`\\xff\\xab@\\x9a\\xc1g\\xf1,d\\xf2\\x1d\\x9a?=\\xb6zisii\n\\x8b\r"
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff-\\x82^\\xefm\\xd0\\x13\\x1c\\xab\\xc5\\xeb8\\x80\\x82\\x90\\x98\"\\xa6\\xfbus-rx\\xf0\\xa3ur\\x91p\\xe0\\xb9\\xddk\\x83|y\\xfc\\x03\\x82\\xf1\\x8d\\xdd~\\xec\\x81\\xe2<\\x04\\x95\\xf4\\xd4|\\xde\\xcb*\r\\xc2\\xe1j\\x0fq[\\xaa;\\xe5\\x0b1u\\xbb\\x1e0\\x8c\\xb5jy\\x06h\\xbe\\x9f\\x9a\\xa1\\xfb\\x15\\xe0>z\\xfc:\\x97*~\\xdf4t\\xe3t\\xdcx\\xcb\\xe5\\xbd\\xd8\\xc5\\x1a\\xc5\\xd3\\xe2^h\\xf9\\x81\\x81td.\\x96~\\x01\\x84\\xfa>#>\\xfb\\xcc\\xcbg\\xfbu+d\\xcb\\xdba\\xab\\x12\\x9b\\xd3#\\xc6\\x97\\xe6v\\x92\\xa6\\xbd\\\\x8a\\x1e\\x83`v\\xc4\\x0c\\x1ck\\x8ap\\x1a\\x91\\x99i&\\x90\\xbe\\xa8\\xfd\\x86j\\x83\\xca}\\xa4\\xc8\\x84\\xa7\"{\\xa9\\xbb\\xfb\\xf7\\x89\\x9d9\\xd9:e\\x1f\\xb6u \\x0ev\\x8bf\\xd0\\x0c\\xbah\\xeb\\x0e\\xcc\\x85\\x99^hi*\\xc9<.\\x8a\r+u$\\xb3\\xce\\xd2\\xb0\\x01\\xe9\\xce\\xdd)\\xc8f\\x0b\\xad\\xf4\\xbb\\xed3\\xf7\\xfc\\x92y\\xeb\\xddj\\x83\\xf8@5z\\xddg\\xdc"
  579. },
  580. {
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\xe7\\xf3\\xbf'\\xde\\x1aba\\x83\\x1dw\\x11a\\x1e\\xc2\\x89^b\\xa7\\x14p\\xda\\x82\\x94uj{\\x04\\xd8:^\\x8e\\xa3c2f\\xb9\\xbe\\x18_\\xee\\xcc\\x9c\\xfc\\xd4#\\xbc\\xa9\\xb3\\x05n\\xd6\\x0fk\\x93vc}\\x98\\xb8\\x9b\"\\x9e\\xa1&\\xe4\\x98\\xe0\\xc8o\\x15\\xe2\\xffk\\x17\\xd6\\x98\\x1b\\xd0\\xb2n\\x14\\x19,\\xa63\\x0c\\xfc\\xf5e\\xd7\\xfe\\x9d\\\\x8cv\\xce\\x05?\\x8a\\x86}k\\xd2\\xc9\\xa5\\x01\\xac\\xfbf\\x82p\\xe7\\x05q\\x8d|7\\x9d\\xea\\xdf\\xd2\\xec\\x98(iw\\xff\\x83l$\\xac\\xf3\\x9a\\xea\\xa7\\x98u\\xd8\\xc3\\xd9\\x8a\\x06.\\x8a\\xf3\\x97\\xf3\\x19\\xc1c\\x01\\xc7\\xbdh\\x07\\xbb\\xc5\t\\xa0\\xa7\\x12nzc\\x1esh\\xc7w\\xbac\\xdc\\x04t\\x0c\\xdf|\n!\\x05\\xe3z\\xd4t\\xbfi\\xa7\\x1d\\xf2\\xb7\\x0e\\xd8pn\\xac\\xbf\\x12\\xd2ns\\x16t\\xdeel\\xca\\xebrs\\x9b\\xbe\\xcd\\x86\\xe3\"\\x00\\x90>z/\\x1e?\\xa0\\xfbu\\xbf#\\xea<\\x9c\\x89\\xcf\"\\x14\\xad\\xc0x\\x15\\xb1\\xeck\\xc2\\xd5\\x8d\\x9d\\xc7\\x7f\\xb9\\xa2"
  582. },
  583. {
  584. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\"6\\xd4\\x18\\xe4/\\xb8\\x89f%\\x85\\xc9\\xe0\\xd9\\xc9\\x1ep\\xa1\\x07\\xfaab\\x08\\xa0\\xbe\\x9a\\x93o\\xf9.\\xa5z\\x13\\xc8p\\xf3\\xd9i\\xb6\\xb1\\xb9\\x81^\\xf0m\\xda\\xa6\\x19g#\\x98\\x98\\x05\\xd1x\\x8a}\\x1ce6#\\xf8\\xb9\\\\xb3*\\xcf\\x9e\\x16\\xde\\x7f\\x8b\\xd1\\xf3\\xdc\\x06h\\xf0\\x7f\\x9d\\x8f\\x845m\\x13\\xb9\\x9e\\xcd\\xee\\xf0\\x81k0\\xf4f7\\xe5\\xacm\\x13z\\x02\\xef\\xe7\\xc1\\x90\\x80\\xb8\\xde\\xd5\\xb0\\x0e\\xe5\\x0ev\\x9e\\xe9<\\xcd\\x10\\x07\\xb8\\x8e\\x87\\xf7l\\x1c&\\xa3\\xff\\x12s`\\x8c.\\xa4\\xde\\xb1\\xa6k\\xb2w\\xaa!m\\xfe9y\\xba\\x1b6\\x07\\x19\\xdap\\xfb\\x1d\\xe1\\xa4\\xdf9z]\\x89:\\x87|\\xf8\\xee\\xb6_\\xbae\\x82d\\xce\\x82.:\n\\x0ft\\'\\xdf_=\\x10\\xf6\\xd9\\xb2=s\\xa5\\x0cv\\x8dxew\\x910\\x9e\\xa1\\x8d\\xcap\\xa5\\x93ox\\xea\\xc4\\xc3\\xcdsao\\xaf2|\\xe4i\\xcb\\xe3p\\xde\\xe3\\xf5e\\xb2\\xdf\\xbd\\xd5\\xb3\\xbe\\x85\\xa1\\xebr\\xf2,\\xec\\x0c\\xa4\\x08\\xc0\\x99o\\xe4\\x8e"
  585. },
  586. {
  587. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdt\\x97\\x02q\\x99?#\\x17\\x01[(\\x84^&\\xb7\\x80?h;a\\x919\n%5_\\x7f\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  588. },
  589. {
  590. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd\\x8e\\xe03\\xc6\\x02\\xfb\\xcf*?\\x1d#\\xe4\\xd9\\xac\\xa99\\x03&\\x13\\xca\\x17\\xcc\\xa2[8\\xcc\\xad\\xe9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  591. },
  592. {
  593. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfdk_\\xcb \\xe8\\xf7\\x9c\\xbb~w\\xe4l0\\x8d\\xd7\\xaf\\xd4\\xael\\xfb)1\\xe6u\\xd8\\x87\\x8d\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  594. },
  595. {
  596. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfd>\\xa23\\x13\\x95d\\x8e\\xf5\\xdf\\x86\\xa4\\xb3p\\x05\\x98f\\x15\\xc0rv7\\x85\\x86\\x98ier\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  597. },
  598. {
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010m\\x14\\x93\\x10~\\xf3(.`\\xf3\\x8d<\\x90\\x9bc\\x18z\\xbf\\xed\\xed[\\xc2\\x1e\\xee`\\xd6s\\xf2\\xf5\\xfb\\x13\\x8as\\x8f\\x13\\xd0\\x17\\x96\\x02\\x0b\\xcf\\x94\\x9a\\x14\\xdc\\x95\\xc6t\\xc5\\xbb\r\\x8e\\xae,sf\\xf2gy\\x8f\\xd5\\xe8y\\xb4m[\\x8dt\\xaf1\\xa0?pe{(\\xac\\xc0t\\x07\\x8e1\\xa3x\\xb4w\\xbe\\xfb)\\x9f\\xcd\\xbf?\\xb4\\x8b\\x95\\xe65\\x86\\xfbi\\x191\\xec]r\\x1a\\x17\\xff\\xe8\\xb7\\x1d\\xb13n\\xfc.p\\xed\\xb4\\x80(\\xb6\\xcc\\xd7\\xc5\\xbf\\xd2hj\\x9bj\\x00~\\xb4k\\x062\\xfc\\x80e\\xect\\xd3l\\xb7@\\x9f\\x16\\x7f\\xc3?j\\xc4\\xf5\\xcd\\x92\\x8f.\\xa5u\\xcehf^\\x90\\xd5fw\td\\x12\\x86\\xe2\\xb4\\x1f\\x94\\xd8\\xe7x\\xb5\\x84 \\x0c\\x88#\\x82s6\\xa1\\x01\\xe7\\xf0u\\xad\\xe4\\xc0g\\x9dh\\xac\r\\x0c.\\xc2\\xa2\\xf0\\x17\\x17\\x89\\x0f\\xc1y\\xd0\\x88k\\x1b\\x0f\rc\\xc2\\x938\\xc8\\xe0\\x8a7\\x1e\\xd8\\xdb8hz\\x1335>\\xd3x\\xc5\\xa8\\xe6t\\x8f\\xbf\\xf8\"2'\\xadx"
  600. },
  601. {
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\xaf\\x84\\xe7\\xbb\\xff\\xdb\\xf7[0\\xaa\\x0enn\\x82\t\\x08`\\xb3\\x05\\x89\\xa9\\xd2\\xe5 x\\x81\\x13\\x14\\xc5\\xaf\\xbb%\\xdd\\x8a\\xfb\\x92\\x04d\\x0c@\\xf6\\x03w\\xb4\\xc8\\x9b\\xcc\t\\x97\\x8a\\xb4\\xa6w\\xbd\\xc4b%k\\xb2u\\xfa=\\xcc5\\x86\\xe3\\x84\\xe3p\\xbc\\xa8\r\\x13\\x04r\\x89\\x1bl\\x0b\\xdbqm9l\\xefum\\xa6*m\\x189\\xd1\\xe5k\\xa1\\xa0r\\xb9\\xb1\\x8b\\x0b\rl$eo\\xb2\\x9f\\xd1\\xdb\\xf1\\xbe>\r/%\\xd2\\xfe\\xbdo\\x83!.\\x0b\\x1c\\x877\\xa8\\x9c+m\\x1e\\xf0v!f\\xe4\njn\\xedbo5\\x8dx\\xe4\\x89;\\xd4\\xd6\\x1c[\\xd7o\\x11\\xb1\\x8b)\\xb2\\xb6\\xb0<\\xc44v\\xcb\\xc4\\xa3z\\x1a\\xear(\\x9at\\xbe\\xbdd\\xf7\\xbdp)\\x02\\xfb\\xe5\\xce\\xf87\\x91\\xea\\xfb\\x13\\xc6+{\\x91t\\x8e\\xb2\\xdcd/[\\xb96mq\\x19\\xce\\x89\\xd5\\xb3\\xe29\\xca\\xe6=n\\xbe1\\xa7\\xd8\\x12w\\xf2ir{i\\xd4\\x08\\xcba\\xffr\\x98\\x86\\x0b\\x99\\xa0\\xc7\\xd7\\x0e,u\\xbe\\xce\\x83"
  603. },
  604. {
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,e3+\\xa2\\x1d\\x80\\xc5\\xee8\\x01a\\x93uv\\xbe\\xf7\\xa8\\xb7y\\x05\\xbco\\x04\\x87\\x90\\xcb\\x8b\\x87\\x8a\\xed^\\xa4\\x03\\x00\\x1c{(\\xe4d\\xef\"/\\xd7\\x0ceox\\x0c\\xb0\\xaf\\x8fb`cs;\\x1b\t<\\xe0\\xab's\\xce\\x84\\xb4h\\xe3[\\x19\\xc0\\x08m\\x9dbo\\x12wp\\xed\\x08\\xfd\\x12h8\\x8a\\x7f\\xe2\\x85zj}\\x98m\\x92u\\xf7\\xc5\\xb3\\x08)\\xa4\\xb3\\xf5\\xcbg.#\\xf2j\\xc0\\xc7\\x08p\\xde\\xcet\\xdd\\x81\\xffm\\xb4p\\xfe\\x13\\xd3\\x9a\\x16\\x9fx\\x0e\\xd8\\x077\\xd1x\\x13\\x06\\x0c\\xc5\\x1c<\\x9dy\\xc1_ytpfm\\xafy\\xdf\\x16\r\\x96\\xd0\\x83\\x1e\\xbb9\r\\xaa\\xa9\\xd4\\xc5v\\x9e4\\xfb\\xfe\\x94\\xb0\\x9bzo\\xd0\\xbf\\xa1\\x19\\xf8\\xfd7\\xb99\\x80\\xfc\\xef`\\x82k\\xfdy\\x827]\\x1a\\xcd*<\\xd7^\\xe1\\xfb\\xabw\\xaa\\x1a\\x1d\\xfd\\xa2\\xcb\\x8f#\\x01r\\xeb\\xc6\\x05\\x9d\\xa4:\\xa1\\x97)\\x84m\\x07$j\\xf7\\xaa.*y\\x95g\\x0c\\xca\\x9f\\x196\\xf43\\x0c\\x00\\x82!\\xb1"
  606. },
  607. {
  608. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbb\\xd1\\xc1%_a(\\xe7(\\xb9&n\\xc9\\x8c\\xce\\x02\\x8d\\x8ee\\xb1\\x03\\x97q*6\\xec\\x08\nj\\xd4\\x90\\x83\\xe7\\x06\\x1c\\xf9y\\x90\\x17\\xc8\\x04\"\\xcb\\x85\\x9c\\x0e\\xacf\\xc7\\xcd7\\xabd\\xb2\\xd7k\\x10\\xac#^\\x8e\\xfcq_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1b0\\xf2\\x7f&ff\\x84\\x0e\\xfc\\xabg\\xe6\\xbe\\x19\\xc9=\\xfa9\\xf8k\\xbf1a\\xbc\\x1d\\xe6\\xed\\xa3\\x8a\r\\xf21z?av\\xe6g\\x00\\xbb\\xa9\\xb3\\x95\\xf6,\\xc6\\xe4"
  609. },
  610. {
  611. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\xfc\\xd8\\xcba\\x83\\x88\\x99\\xa7\\xa8\\xd5\\x82\\xc4\\x04t\\x13qb@\\xfd\\xcd\\xe7\\xd3\\xd8\\x94\\xdb\\xf3\\xc7\\xd2j\\x1d\\xfb\\x97\\xcb\\x0c\\xe2\\xe5\\x9d\\xb5))d\\xe7t\\xbd\\xf9p\\xd9\\xd9\\x8f\\xda4$b\\xadfn\\xaf\\xa6\\xae#\\x88\\x95\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\x04\\xbfs\\x15;g)\\x9b\\xd3\\xf3t\\xb9\\xe2h-\\xedk\\xe3o~c\\xeaq\\xd3[\\xe4~\\x9f\\xd1\\xc2\\x0b\\x14\\xb3\\xe94\\x1f\\xf3\\xacyw\\xae\\x07\\x00\\xfa\\xc0\\x96>"
  612. },
  613. {
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfd\\xfc\\xe9\\xc3\\x1d\\xba/\\xb3\\x8e\\xbd\\x8c\\x9f\\x91\\xb7[\\xe7\\x8cd\\xa1\\xd9auy\\x14\\x05\\xd5\\x90g\\x1b\\x15\\x8c\t\\x1cs\\xb3\\xef\\xdb\\xc9g\\xa3\t\\xe1\\xa0\\x90c\\x82\\xcd\\x81\\x05\\x00\\xc9g\\xa8 {\\x98\\xf2\\xc8\\x83\\xc35\\x1fcq\\x86etp\\xe7\\x90\\xf8i\\x12\\xd46\\xb8vds\\xa1\\xfbv\\xa4\\xbc\\xdb\\xaa\\xaf\\xbc\\x8e\\x14\\xcc\\x81\\x1d\\xc3\\x01\\x00\\xb3\\xf6\\x8d>\\xcf\\xed=0\\x8c`.q;y\\x92a\\xc6\\xc1z\\xa4\\xb1\\xc7\\xc1\\x12\\xc42q\\x88(f\\xd6\"\\xa0#\\x18b\ns\\xae\\xed\\xb9\\x88pa\\x91\\xf0\\xe8\\x19\\xe0\\xf4\\x01\\x13\\xcf3\\xe2>\\xaf\\x91yy\\xcb \\x8e\\x0b&\\x05\\xcc\\xff\\x88,}\\xc5\\x92r\\x9f\\x19\\x01!\\x03\\xe5\\xb9\\xa9\\x13-\\xe8\\xeb?\\x14\\xa2,=\\xa9\\xdb9\\x8b\\xce\\xad#k\\x03\\xb3;\\xb3\\x9c\\x10\\xfb\\xa6\\xe2\\x84~\\x1e\\xdc[/\\xd6q plm\\x19\\xf9\\xb3uy\\xffv\\xf2\\xce\\xd5pts\\xfdf\\x82\\x922\\xfa\\xfe\\xaaz\\xee\\xcc2\\xb9ow\\x11\\xab@\\x96\\xb7\\xa9j"
  615. },
  616. {
  617. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\x87\\xd8\\xdc\\x02\\xfe\\xfe}`\\x1a\\xa8/\\xbd0\\xe6\\x1e\\xf5\\xcfs\\xeb\\xd5\r\\xb4+:\\xd7\\xd6\\xbc\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  618. },
  619. {
  620. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe{\\xf8\\x9e;\\xc0\\xc6?\\xf5n\\x15\\x16\\x8c\\x00\\x91\\xfav\\xf4\\xc1\\xed\\x1a\\x19\\x97_\\xccvb\\xea\\xb1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  621. },
  622. {
  623. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\x05\\xf8\\xbb\\xa7\\x9b \\xf3\\x10\\x8b\r?\\xec\\xc3\\x163\\x82\\xbb\\x15\rp\\x14\\x83&[:\\x8fb\\x89\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  624. },
  625. {
  626. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04yc\\xfe8\\xd5h\\x86&*(z\\xe9\\x9c\\xd9\\x7f!w+\\xf4\\xa9>u\\x9f[\\xef\t\\xd0\\x08\\xc1x\\xf8jzmon\\xd4\\x1dd\\xc3}\\xb5\\x00\\x99\\xf4:e\\x900\\x00\\xc7\\x14\\xaf\\x85\\x1e\\x0e\\xc0@qa\\x94\\x00\\xc3\\xa0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000cl\\x89\\xf9jvf\\x10\\x9b\\xd5\\xe68if\\xfa\\xc2>7\\xfd6\\xa7u\\xfc\\xfd'\\x08lj\\xce\\x17\\xd7luu@\\xcc\\xcd\\x90\\xecqi\\x16\\xd6\\x9d\\xf6\\xdb\\x11\\xdc"
  627. },
  628. {
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfekg\\x85\\xb2\\xb7\\x95d\\xc4\\xad\\x87\\xa4of\\x95\\xb9x\\x009\\xa3\\xf0\\xb1\\x96+\\x1b1\\x1dh\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  630. },
  631. {
  632. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\xc05\\xe3\\xf0wa\\x05\\xb6ee1\\xd8r\\xc4v\\xda(p\\xa6\\xdb\\x0e\\xb5\\xd2\"\\xd3tj\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  633. },
  634. {
  635. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\xc7\\xeb\\x15m\\xafi\\x9c\\xbd\\x99d\\xe8v\\xc2\\xc25\\xd6q>2\\=\\xaa5\\xb4\\xe3o\\x87(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  636. },
  637. {
  638. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\x87\\xa7\\xafy\\xaa:t\\x10q:\\x8d\\xf6i\\x1a\\xc6\\xfe\\xeb\\xeb\\xb07\\xb8q1ou\\xa2\\xc5\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  639. },
  640. {
  641. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04+\\xf2\\x9d\\xa7q\\xd9\\x9e\\xb16#\\xdf\\xc8\\xd0\\xd0n:\\xebsg\\xb9q\\xf4it\\xc9w\\x08vi\\xc5>\\xec'\\x1b4\\xe1\\xf6i\\xea\\xf2n!\\x85)\\x10\\x85\\x96\\xb8\"\\xf4\\xf7\\xa2\\xf6\\xcc^\\x13\\x17\\x04\\xd5\\xee\\xc0\\x0f\\x9cv\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\xcc/vp\\x9b\\xf5&\\xf8\\x80\\xcfw\\x00\\x9c\\xda~\\x0e\\xd1\\xe9\\xeb\\xadl\\xf3\\xf8-\\x9c\\xc8\\xa3{\\x85\\xf7;\\xab\\xad\\xd1\\x92\\xc9@\\xf4n\\xbd\\xadh\\xb0=\\xc7p\\x99"
  642. },
  643. {
  644. "http_request": "winword.exe_WSASend_\\x96\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe\\x7f\\x1a}x8\\xf3g-\\xc3\\x00j\\x1c,\\xc3\\xdc\\x00@\\xea\\x90\\\\xa8\\xb0\\x7f\\xa4\\x81\\xd7\\xf6\\xd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  645. },
  646. {
  647. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5rxf\\x9cr\\xaf\\x0e\\xc4\\xb3\\x92y\\x9a\\xc6\\xa8\\x9c4h]\\xce\\x07\\x03e\\xf5\\xf0\\x9b\\xea\\xc4_\\xcbj*\\xe6\\x17`\\xd9p\\x95b\\x81\\xd7\\xd7\ts\\xdfr\\xd2\\x97\\x93+\\xfc\\xdb\t\\x88t\\xea\\x80g\\xae\\x91\\xd0&\\x86\\xff\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\xc8\\xf9\\x17$\\xcd\\xca\\x1bk\\xae\\x99\\xb0\\xbe\\x81\\x96\\x9e\\xb8\\xf32\\xe7up\\xc6\\xa2\\xcc\\xca\\x11\\x94\\x90\\xac\\x0b\\x9d,\"l3\\x8a\\xbd\\xb9\\x86\\xdb\\xdfthkn#\""
  648. },
  649. {
  650. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\t*\\xeem\\xaaa!\\x13\\xac\\xe0\n\\x005\\xeei\\x87\\xc8\\xc5k(\\x04\\xcdn\\xd9\\xf1&\\x8a\\xa7\\xbd\\xc9\\)b\\xbb\\x94j4\\xa5\\xf0'\\x1e\\xfc\\x9e\\x14m\\xe9^\\xfe0\\xef+\\xfd\\xc0\\xb5\\x1fx\\x80\\xf6b'h\\xe0\\x94\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x1f\\xcf<ei\\xd6\\xcb\\xeda7'kd\\xb3lnr\\x0c\\x8ce@\\xdb\\x1c*\\x8e\\xa6\\xf0\\xeb\"\\x02\\xa0er\\xc3\\xa2\\xf8p&\\xe9h \\xff\\x86l=\\xe1\\x95"
  651. },
  652. {
  653. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\x97q\\xc8\\x80\\x11o\\xac}\\x14k\\x89\\x05\\x07\\x8a#j|\\xf7\\xe86<\\x14kdo\\x93\\x81a$v\\x1e\\x90\\xe9\\xa1\\xfe\\x03\\xcdo\\xf6\\x81|\\xd0\\xbah\\x83xf\\xc7t\\x80\\xe3\\\\x94&\\x96\\x81\\xad\\xa79t\\xeb\\x03\\xe1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xdc\\x8ft\\xd8c\\x92uz\\xa5\\xf7\\xc3}\\x88\\x92\\x95d\\xd8\\x1b\\x9a\\x8b`1,'2\\x1b\\xe2}*b##\\x1a\\xa9\\xff\\xe2.=wng?\\xff\\x1e\\xf3\\xff\\xfc"
  654. },
  655. {
  656. "http_request": "winword.exe_WSASend_f\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x93=\\xd9m\\x94\\xe7\\xbd\n\\xed\\x1a\\xac\\x1bcq\\x9f\\xabp~\\x04xm\\xf3\\x88\\xd7\\xda9\\x0b\\x94\\xc4<\\x81p\\xd2\\x83\\\\x95\\x95\\x8468\\xf8\\x1d\\x19\\xf0g\\xd2\\x0c\\x99\\xdd\\xf0\\xc3\\xcb\\xe9n'\\xe8\\x9azt\\xff\\xef\\x1e\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xee*\\xd3\n\\xa3f&\t\\x13u3\\x97\\xac\\xb3\\xe7[c`\\xe2\\xfaba\\xec\\xf6\\xb0mb\\xed\\xf1\\xd5l\\xef!\\xee+\\xfe\\xecn1\\xa4\\x84\\xf8y~]\\x82@"
  657. },
  658. {
  659. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfep\\xa7\tm\\xef\\x89twu\\xdc\\xda\\xa1b\\xa7\\xa6e\\xb3\\xd9\\xf3\\xedv\\x98\\xc4\\x81\\x18\\x0b\\xe4\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  660. },
  661. {
  662. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6.\\x99#izx`\\xd2\\xd8algw\\xd3..\\xac\\x1c\\xb2\\x83\\x00g^\\xcd\\x0ey\\xe7\\xa52\\xc2\\xaa\r \\xc7\\x9at\\x82\\xa6\\xdb\\x96\\xc9j\\xba\\xc8\\x1fn\\x86b\\x96\\xf1\\xac\\xbb\\xaa\\x9f\\x13\\x16\\xfc\\xac\\xc7\\xa1\\x86\\xb1\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\x13`\\xbc8y\\x19\\xcf\\xae\\xc2\\x93t\\x1f\\xc6\\xe6)\\xfd\\xda\\x8ap\\xddf\\xaa\\xa6\\xc4\\xbf\\x86\\x1a\\x11\\xac\\xd9n\\xb0*\\xc6y\\xd7\\xc2\\x84{\\xf4\\x0b\\x14_/\\xea\\x1b\\x98"
  663. },
  664. {
  665. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfe96\\xc8=:\\x1e\"\\x86g\\xbb_\\xc4:\\x1at\\x0e\\xff\\x80\\x91\\xf6\\x03\\xab\\x85\\x13\\xd3d\\xcd2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  666. },
  667. {
  668. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xe1la\\x9f\\x9e!s\\xb5v2y\\x8e%\\xd1$\\x8b\\xbd\\xb8\n%1\\x02\\xd0\\xa7\\x1e\\xb3\r\n\\xec\\xe0j \\xfd\\x93*\\xe8\\xe74,\\xe6\\x91d\\x06}\\xd4\\x93\\xd5\\x82{ \\x0c\\xc0\\x00\\xedi\\x9a\\xe7\\xd9\\xbfo\\xe4\\xc7\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\xa2\\x83\\xa4\\xd7\\xd6{\\xc2\\xb1o\\xfe\\xa4\\xa4\\x10\\xe9\\xbd\\xdc\\xef\\x9dmp3\\x10%6f\\x948\\x89i1\t\\xc3kl\\xe1r\\xcd\\xf0\\xcfqs\\xc5\\xfb\\xf9\\xbes\\xb4"
  669. },
  670. {
  671. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4u\\x17%t4\\x97\\xd2\\xe7\\xdb\\xca\\xa8\\xd2n\\x9a\\x0f\\x00\\xcf\\xa2\\xb1\\xb9\\x1d0\\xa7\\xc5\\xdce\\xcc\\xec\\xd3\\xcdbo\\xce\\xb50\\xc6\\xdca)\\xb8u\\x88g*e*\\xd2n\\xa5\\xf5]\\xdfl\\xf1\\xb4\\xe5=\\x95p\\xc0w\\xf3\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\n\\xf8ku \\x11;3\\x8c\\xb2k\\x01\\xc7\\x0ed\\\\xe6\\xd0@\\x83\\xf9\\x87\\xa0\\xce\\xb5\\xdb\\xb3~ \\xea\t\\xf5//6l\\xba%kq\\xa0\\xc7\\xbe@\\x98\\x02)"
  672. },
  673. {
  674. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff\\xa6\\xc6)\\x10\\xa5:\\xbbvw\\xd03$\\xe5\\x18\\x84\\xb0\\xab2\\xc7\\xca\\xca\\xb4tle\\xea]\\x98\\xda\\xb6\\xbd~\\xb2[x\\x80ps\\xed\\x11_\\xa46,\\xfe\\x1a\\x1a\\\\x83\\x9a\\xe0\\xd0s\\xe9!nwj\\xd3\\x8b\\xfd\\xcb\\x19\\xdd\\x80^\\x08\\x0b\\xbc\\xf3\\xf1/-\\xee\\x03\\xc2z\\x83\\x91\\x93\\xa5v\\x17{\\x13l:\\xc8\\x8aq\\x9ddm\\xf4\\xc7j\\xc9\\xd6`b\\xda\\xd6\\xc5\\xc4]\\x1c\\xe4\\xaee\r8\\x81\\x97\"\\xe0\\xd8,\\x83\\xc7^\\x818i\\x00\\xbb%,\\xaa\\x9fk\\x03\\x07\\xdc\\x11\\xf6\\xe4\\x0b\\x88\\x16\\x1e\\xe5\\xcb\\xcc[\\x86\\x95\\xc3\\x80|\\xaf\\xcf\\xfe\\x9e\\xca\\x1a\\x14lb\\xe9\\xb4\\xb4\\xa1\\x80\\x92\\x93\\x81/\\xbby\\xad\\x83\\xeb&b&\\xf7\\xd9?\\xfc\\xb0}\\xd7\\x88\\xfd\\xab]\\xc6\\x05\\xe4\\xaff\\x94<?ft\n\\x1c\\x91\\xb9\\x18\\x1dt\\xcbj\\xf5\\x05\\xe3<[\\x97\\xef\\xe9%\\xf7n\\x81x\\x07\\x1e\"/h\\xca\\xdez\\xc0\\xe8\\xea\\xf1\\xf1q\\x95\\x0f\\x859\\xc4\\xfc\\x18\\xf7\\xcb7y\\xa4fob\\xb7\\xb2\\x0e"
  675. },
  676. {
  677. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92q\\xb9\\xf5\\x18]p\\x03\\xc6\\x9d\\xd0\\xc9orp1\\x90\\xb9\\xa0*\\xe2\\x865\\x02\\x94c\\xda\\xde\\xf6r~nn\\xe7{\\xdc\\xcb\\xbf$\\x9e\\x1f\\xd8\\xb0\\x1a\\x83\\xef\\x08\\xdb\\x90\\xaep5@\\x82zo\\xb7\\xaa\\x81\\xbas\\xc7\\x17c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000m\\xf9\\x81h\\xabe\\x1a\\xa4\\xc6\\xf0\\xbe\\xa0ve\\x05'.\\x1czw\\x9fn\\xa4r\\xc9\\xeeg\\xc2q\\xa1p\\x12\\xa5\\xc2\\xb0\\xb7\\xf0\\xdb086\\xed\\x97\\x89m\\x94\\x9f\\x03"
  678. },
  679. {
  680. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xe1@6r\\x9dl\\x05\\xd5m>\\x10\\xfc\\x8b\\xe2\\xac\\x13\\x11=\\x89\\xeb\\x80h\\xd8<\\xfb6\\xb3f\\x11\\xd5\\x84\\x8c\\xf7\\x\\xb2r\\xf7\\x9e\\xd9\\xef\\xe9\\x9a\\x1c$\\xa0\\xebv\\xc2qp\\xfe[\r\\x97`f44\\xf4\\xcd\\x9f\\xd4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7\\x8a\\xf2\\}\\xf6\\xb5w<u\\xa3\\xcd\\xb9.fy\\xbe\\x8f\\xa3\\xe3n(o\\x02\\x12\\x87vc6\\xcas{\\xca]\\xb78\\xb0\\x18\\x99@\\xd0\"+e\\x97b\\x84j"
  681. },
  682. {
  683. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5>\\xfb\\x97e\\xd8e\t\\xc5):\\xf0s\\xaf\\xffm\\xb0\\xfa\\x16\\xdd\\xb2p\\xf1x\\x0cl\\x88\\x01*a\\xb1<d0\\x89\\xf34k\\x11\\x94~\\xe5\\x02|\\x14\\x87\\xcd\\x9c\\x04\\xa5\\x16\n\\x12p\\x9e\\xe5\\xa0vk\\x898\\x8al'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\xe8\\xa6'\\xe3\\x00\\xc5o-(\\xb0\\xdb\\xfc\\xa6p\\xa6\\xd7\\x1f\\xe6\\xa9k(\\x7f@w\\xa5\\xb5;\\xd9\\xc9\\x94\\xe2p\\xf0\\x93\\xfe\\xdb\\xfe\\x86 n\\xd0\\x81%uz(\\xa9"
  684. },
  685. {
  686. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\t\\xf7\\xfek\n\\xa0\\x88\\x8bd\\x1b*\\xd8\\xbe\\xc0d\\xba\\xda\r\\x062fz\\xd9\\x0f.i\\x83\\xaa\\xec\\xa5b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  687. },
  688. {
  689. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcc\\x95\\xf7\\xcc9>0'p,\\xc0\\x15i\\x19\\xbd\\x8b\\xd0\\xe2\\xa8\\x93\\xd1o\\x0en\\xd6\\xee\\x01w^|\\x04\\xd7u3\\xd6\\xfd;\\xc4@5\\xf4\\x0e\\xef\\x07q\"\\xf6r[\\x04\\xde\\x8e\\x95\\x0er-\\x92\\xf2\\xbc\\x9b\\x0f(&g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000en\\xd1\\x19\\x12\\xa0\\x13?=\\xd5\\x10a)\\x07i?nu\\xb2\\x01a9\\xce\\xf1q\\x1alk\\xedu\\x88\\x81\\xd9\\x0etzw-\\x81u\\xb4s\\x96\\xd0l\\xc0+\\xd2"
  690. },
  691. {
  692. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\\xf0\\xcf\\x071y\\ud\\xdai^\\xf8\\x92\\xd1p\\u\\x82\\x0f\\xe8\\xc6v\\xbc\\xf9\\xf6\\x08\\x92\\xeej\\x816\\xef/\\x92\\x8b\\x1b\\xcf[\\x98o\\xf0\\xebb%\\xdb\\xb0p\\xe2\\x04\\xb2~\\x82*\\xc0\\xb2\\x0cz\\x10,\\xcet\\xe1\\xcc\\xca\\xe3n\\x9b,\\xf3\\x0b\\x84s\\xcb{\\xcbj\\xd2\\xfb\\xf8\\xba\\xaf\\x8f\\xc4\\x96\\xe0\\x0b\\xa1\\x98ap\\xf1\\xf6\\xa2e\\x92\\xc6c\\xea\\x0e\\x96wl\\xd6\\xf4\\xd8\\xccx\\xcb}jg{%pcx/nh!~{\\x82\\xe0\\x03\\xa4\\x0c\\xa8\\x1aic\\xe4\\xb8q\\xea\\x08&\\x9er\\xd54\\x08\\xdd:(-'\\xad\\x8f\\x9d\\x85\\xa4\\xd7\\x9dqn\\x9br\\xb4\\xcc\\xc5\\xfbw7\\x84\\xa9d\\xa4:p\\xbct7z\\x00[\\xa0\\x1fjl\\x17\\xa5.\\x8dt\\x90\\xcch\\xfa\\xf9\\x1fq\\xdfr\\xf0\n\\xb5\\xec\\xb7q\\x8d<w\\x9d\\xd1\\x8f\\xff\\xa7\\x1fb4yr\\xbd\\x18lf\\xf7k\\x93\\xce@7y'.\\xef\\xe29\\xe7\\xfa\\xec\\xb5\\x02\\x17f\\\\x83\\xff\\xb3-\r\\xdd\\xf9\\xdet\\xa8\\xaew\\x0e"
  693. },
  694. {
  695. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12\\xe9\\xd9\\xbbti9\\x1bw/54k\\xa1\\xbe\\xa1\\xfag\\xcd\\xb2r)e\\xe0\\x80\\xd0f\\xdb\\xa7\\\\xc3\\x0c\\xda\\x0fzn\\xb3\\xbe\\xdc\\xb1\\xdc\\xe2e\\xf78\\x91j\\x05\\xf1\\xef^7-/\\xd06\\xd7a\\x14\\x93\\x9bn\\x8c\\xb8p?l\\x81\\x0b\\xe5bv*\\xd4\\xee\\xb3\\xfd\\xcb\\xc7\\xdb_\\x88\\xe5y\\xae\\xc5\\x1fj\\x9a,\\xfa.\\x14\\xe3\\xdf\\x12\\xb9\\x1f\\x83_0\\xcf\r\\x0eh?\\xcb.,.e\\xf7\\xe0?\\xac\\x04\\xc2b\\xf8ph\\xf3\\xd4d\\x18\\xae-\\xf9\\xa7\\xcbt*\\x84k\\xde$\\xbb\\x1f\\xdel\\x18\\xfc$\\xb6\\xd0\\x86y;\\xd4\\xa4\\xd7\\xf6c\\xd5\t\\xea7\\xedl<(w\\xccryj\\x16\\x89r\\x1f\\xb6\\x00\\x1e\\xe8\\xb0\\xc7\\xe3\\xcb\\x9et_0\\x1fn2\\xfev\\xed\\x86\\xc4y#\\x08l\\xde\\x14e\\xf6\\x89(-(\\xbd\\xccx>\\xbe\\x8a\\xee]\\xd6\\xf8\\x96f\\x9a]\\x9b\\x10\\xc6\\x8b\\x936\\x18)\\xee\\xa6\\xf3\\xc4`nyfp\\xe6\\x0e\\x9e\\xda\\xa0\\xf9\\xc8\\xebw\\xf8s\\xc4\\x9au%u\\xc6\\xf3"
  696. },
  697. {
  698. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\\xbfq\\xab\\x08i\\xcc\\x9cn5d\\xa3\\xb3gj\\xc8\\xba\\xac\\xc3\\xf7\\xe0\\xb9\\xb6zi\\xb4\\xc2\\xbca\\x8ev\\x1d\\x8f\\x86q\\x95\\xa1\\xf3e\\x86o\\x07\\x0b\\xe4\\xb0/0\\xae5\\xff\\x8e'?\\x08\\xd5x\\xdcfgn\\xd8x\\xd3\\x82d\\xb5%i\\xcb\\x94\\xc0\\x13na\\x85\\xbc\\xbf\\xc3s\\x05\\xab\\x8d\\xa4\\x98\\xdb\\xcb4l\\x03fn\\xd5\\x8a\\x8do\\xb3&\\x1b\r\\x18\\xec\\xa2\\\\x86\\xdc\\xa1m#\\xe06k\\xe4\\xdd\\x96j-\\xc8~\\x19z\\x85s\\x86`\\xd5[$\\xea\\xbf\\x1c\\x19)9\\xaeyqne\\xefe\\xb6\\xbe\\xa7m\\xee`\\xa7\\x9f\\xf3\\xe5g\\x19\\x89\\xfe\\x06\\xe6\\xeff\\x9c\\xfc\\xed\\xc4\\x81\\x01\\xce\\x05\\xc1\\x01\\x9bn\\xa5\\xfd\\x1djr\\x19\\xd5+\\x9f\\xbe;y\\x1f\r\n;\\x0c\\x95l\\x1e\\x1f^h(\\xd9\\xd7\\xf7\\xe4^\\xbe\\x04\\xbdl\\x81\\x8b3u\\x88}q\\x08\\xd6\\x9d\\xb7\\xa6\\xda\\xc8/\\x9a\\x86k\\x84'h\\x87t\\xa6\\x19\\x06\\xbfc\\xd7\\xd3\n9]\\xf9\\x9e\\xa0\\xce\\xaf\\xd5\\xe2\\x9cy\\x03x\\xf4\\xf2\\xc5\\xb4"
  699. },
  700. {
  701. "http_request": "winword.exe_WSASend_\\xc4\\x00\\x9c\\x00\\xb8a\\xd4\\x103\\x1f\\xa5\\x10\\xaf\\xe9.\\xcc\\xe9\\xfa\\xb9\\xcc|\n[\\xdb\\xde\\xa3\\xe6\\x83\\xda(w!\\\\xd3\\x04c\\xf2\\xed\\x1a\\xbe\\x83w\\xe5\\xbfo\\xaa\\x9e&w\\x044\\xf1\\x10\\xc6\\xbd\\x9bg\\xb4\\xd4h\\xf1\\xe97\\xef\\x00\\xb1\\xdd\\xca\\x9e3\\x92\\x16\\xbf7\\xbf\\x18:\\xa9`\\xb5?\\xb3)ner\\x06p\\xa5s\\xf9\\xce2\\xb1\\xf6\\xe14\\x9e\\xa4\\xba\\xf4\\x96\\xa1\\x12\\x00\\xcf@\\xce\\x1bbg\\x9a\\xf8\\x07\\xc7o\\x0e\\xde\\x80\\x9f\\x85\\x04\\xedezp\\xc8c!s\\x12f\\xb2\\x1f\\x81\\xcb\\x01i\\x00\\xce\\xed)\\xb6\\xabs\\xd8\\xa7\\xfe\\x83\\x9b\\xccu\\xa4m\"\\x92\\xc7\\xd53`_\\x99c\\xe5g\\xec\\xe6#q\\xe1\\xfa\\x1d\\xab\\x05\\xdd}_\\x856\\xa5\\x0c\\\\x9b\\xc0/\\xd49\\xe4\\xfa\\xee\\x14\\xd9\\xd6\\xed\\xae\\xee\\x05\\xa9e}\\xf1\\xd8fd\\xa72\\x85]rgr\n\\xc7\\xdd\\xf2\\xbb\\xe5<\\x88\\xea_h\\x9c\\xe4\\x0c\\xf5b\\xa4\\xfd\\x9e\\xc7,2\\xc5l\\xfcw\\x0e\\x15\\x9e\\xd9e\\xdf'\\x9b\\x15\\xa5\\xde\\x9b\\xed~`\\xeb\\x19n\\xe7"
  702. },
  703. {
  704. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f(y\\x1e'\\xf8\\xbb\\xc0\\xbf\\x9c*\r\">\\x19b\\xb0\\xd5\\xf1z(.\\xf8\\xbb<\\x8b\\xbb\\xf70\\xcf\\xd9\\x80w\\x82o\\xb7w;\\xcf\\xaa`\\xa0\\xf2\\xbd\\x86v\\x06]v\\x8c?\\x17/=\\x9b>\\x12\\x906\\xdf_\\x104\\xd1\\xc4\\xf0]\\x10e\\xc2k\\xa8\\x88\\x97\\xa0\\x1a\\x81\\x8a\\x07i,\\x06\\xbd\\x80\\x0b\\x8b]\\xbfbiz\\xcd\\xeb\\xa8\\xc9\\xe4\\xb6\\xe4\\x11 ng'z\\xea\\x01\\xa9q\\xc8x{\\xb8\\xc7\\xd3\\x19\\xfb{+j\\x94\\xb6vt\\xc5 -8j\\x02q\\xa69\\x03\\xdb6:h\\xc6\\xf0\\x89a[\\xf2\\x82\\xcf\\xdb\\xe4\\xa9\\xaa\\xba\\xb3\\xc6x\\x7f\\xfd\\xd2\\xf8>\\xcc\\x85\\x1cv\\xf1\\xef\\xa1\\x01\\xad\\x8b\\xae\\\\x97\\xee7.\\x84h\\xe9\\x08\\xcdz*\\x17\\xfc\\x88\\xebs\\xb4\\x8f\\xdev\\x07,\\xfa\\xa9\\x01e\\xc6r?\\xed\\xe2o'j\\x0e\\x9457\\x94\\xa1.\\x00e\\xcci\\x99\\xa6\\xe6,6\\x06\\x84\\x08\\xba|\\x83\\x04\\xfd\\xac\\xed3\\x1c\\x13\\xd3b\\xfa\\x039\\xf8;g[#m\\x9d\\xc2\\xca\\xadg\\xa25"
  705. },
  706. {
  707. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05\\xbf\\xb9\\xa3\\x0b\\xfc\\xbdmg\\x02\\xb1*\\x81\\xcc\\xbe\\xbc\\x85l\\xfb\\xf4\\xfa\\xe3;\\x82p(\\xe1\\xf8g\\x8b\\xbc\\xea_t\\x83\\x87\\x06e\\x81\\xff\\xbe&\\xec_\\xefi\\xa6\\xc0m\\xe6p\\xf0\\x92\\xc6\\x03@j\\xcc9\r8\\xea\\x01\\x85hiobh\\x1c.a-b\\xd7\\x83\\xd3\\xa2jz\\x96\\x0b\\xafu\\x0e\\xbe\\xe9a\\xd5\\xf8\\x0c8\\xfc\\xf1hf\\xb5]\\xd1m\\x0f\\x82;v\\x05vq<\\xc3\\xca6\\xdce\\xa4\\x84\\xebk@\\xde\\xdc\\xfad\\xdb\\x08\\x0f\\x87\\xb1n\\x08j\\xfe\\xdeg!o\\xba\\xc8\\x05j\\xf8\\xdd\\xe2\\x0f\\xe9\\x1a\\xde\\x94>\\xa9.\\x0e\\x91$\\x88y9\\x85\\xbf~\\x99|\\xb4\\x1f\\xdf]\\xcao\\x9b\\x8e\\x05>\\xe1rt\\xe9\\x81\\xbd\\xabk\\xff\\xda\\x93dl.\\xee\\x8e\\x9a\\xbbj~n\\x9cb \\xd0\\x82\\xa5\\x11\\xdc\\xaai\\xc5\\x0b\\xea\\x92\\xa2\\xbc\\xf3\\x0f\\xfah\\xd5\\xd4\\xaf\\x9as\\x81\\xeb1\\x97[z>\\xf5\\xac4\\xc7\\x16'$]\\xf0?0b\\xd1\\xcd\\x82\\x02\\x00\\xd7]\\x92uf\\x98h=\r\\xa9"
  708. },
  709. {
  710. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb1\\xddj\n\\xd1\\xa2s\\xea\\x8e\\x17jn\\xb8\\xac\\\\xef'\\x87\\xea\\xc6oa\\xe9&k\\xfb;\\xae\\xcb{\\xb1\\xf3\\xde\\xe9\\xc2\\xd4p\\x9dd\\xab\\x93\\xc1\\xc6s\\xack\\x84`j\\x82n|\\x8d\\xa2\\xaf\\xca\\x8bo\\xac\\xe3vl\\x19\\xc5:6\\x8c-\\xe6\\xd7\\x87\\x8fzp_ \\x98\\xb8^\\xed)\\x9a*\\xfb6\\x9c\\xb4f\\xca\\x12\\xda\\xb5p\\xc5\\x9d\\x0e\\xe9\\xd9\\xe3\\xdfl\t\\xf1\\xd0\\xb0m\\xbc\\xba\\xf1\\xc0\\x9a\\xf9\\xa6e-\\x00\\x9b\\xf4\\xcdnt\\x00a\\x13\\xb1\\x1d\\xca*\\x9c\\xd1\\xc56t\\x1a\\x17-(\\x0c\\x9f\\xc5\\x1e\\x81\\xb5\\x18\\x94\\xc5\\xa2k\\xe6\\xa6\\x88\\x0b\\x83o\\xdc#\\xd4\\xe3\\xe1\\x10\\xca\\xa2\\x95\\xe8e\\x87{\\x8dq>\\x94\\x921\\xce\\xed\\xe9\\x13\\xd3'\\xdb\\xb5\\x85&\\xa5\"g\\xbe\\x030'\\xc5\\xcea\\x87\\xf0\\xe2\\xa8\\xe2\\x06\\xa5\\xee&e\\x85\\xafus\n/=\\xbf\\xc7p\\x9c\\xbaw/\\xd7\\xec\\xcf{\\x9e\\xb42\\x7f\\xf4\\xa4m\\xa4q\\xed3\\xc5\\x82\\xde\\xab\\x0f\\x84\\xd7\\x1d\\xb1\\x0f|g\\xd7u\r\\xd1<?\\x0e"
  711. },
  712. {
  713. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca\\xdc\\xe08\\xfb\\xaa\\x12\\xee\\xa2\\xd9\\x83;#\\xde]\\x99x\\x1c\\x94s\\x8d\\xf4\\xd2~bhsc\\x9bk\\xda\\xc0\\x9b#i\\xec\\xdd\\x0b\\x04~\\x07g\\x92\\x0e\\xebv\\x1c\\x81 <\\xd9-\\xdeowih\\xa2~<\t_\\xa6\\xb5\\xfb\\xfaa%\\x19\\x18z\\xbbj\\xe6\\xbez\\x12\\x1b?\\xea\\xa3\\xa4\\xc9t\\xedg\\xdb\\xf0h\\\\xbd\\xd9\\xfb\\xeb\\xc7\\xedvo.\\x8e\\xd2\\xf0\\xee|\\\\x05i\\x8b\\xc0.\\xae^\\xd9\\xb3s\\xddq\\x82\\xceo\\x82c\\x0e$\\xe7/)\\x8c\\xbe:\\xa4p\\x83\\xece\\x1d\\xf3\\xfd\\x82\\xae2@5\r\\xfb\\xe4\\x89\"\\xc6/\\xeb\\xce\\xa2+]^\\x93b\\xb8\\x10\\xb3k\\xff\\x10we|r\\x0f\\xc6@\\xa4@(ls\\x1aa\\xad\\x07\\xf6\"\\xc8\\xad\\xd8\\x01\\xcdn\\x94\\x07\\x85\\xfb\\x98~b\\xfb\\xa2=s1&\\x1f\\x0b\\xee\\\\x93\\xd8tx\\x85\\x9c\\xb7\\xbe]\\xe86\\x86\\x88\\xca;\\xba\\x8f7$\\x8ax\\xe5\\x86:1+v\\xbf\\xed\\xb5\\xea\\xb8l)-{\\x9a=\\x0f\\xcf)e\\xafw\\xc6i"
  714. },
  715. {
  716. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbbfe\\xeb]\\x11\\x9b>6}\\xd40i\\x9e\\x1c\\xc2\\xdduw\\xd3\\x0e\\xe8\\x17\\xcf\\xa1\\x11pk\\xdf\\xd4h\\x82\\xf8\\x1c\\xc7\\xe4\\x9d\\xa1<\\xb9\\xd6\\xf9\\xbc\\xca\\xc4\\xff\\xb3\\xca\\xbe\\xaf\\x10\\xb6\\xa3(\\x13f\\x0c\\xa1\\xbc\\x05\\xe8b\\xb4o\\xa8\\xb3\\xa1c\\x91>\\xc66\\x89qzz\\xad\\xc57\\x142\\x17&u\\x87\\x9bj{y\\x8e\\x9e\\xe1o\\x18/\\xe2\\xb9\\x88-\\xf8\\xfc\\\\x8d\\x87\\xcbg\\xa2\\x95\\xcbk\\x91\\xf3c%\\xb5q\\xc5q2\\x7f\\x8e9\t\nmd\\x1a\\xd0\\xa9\\xdc>\\xae\\x89w\nz\\xb4g\\xe2\\x14vt\\x1f)\\xa8=\\xfd\\xcd\\x87\\xae\\xf5\\x8b\\xe1\\x83\\x17\\x04j\\xba\\xc9\\xf5\\x7f;\\x84\\xceay\\x1di\\xa7+y\\x06\\xe1\\xde5i\\xb4\\x93\\xbd\\x13\\x11\\x9c\\xe8p\\xc6\\xf9\\xbc[\\x1a\\xe3\\xf8(\\xaf\\xf3'[\\xfey ;\\x80\\x17\\x0en\\x9ew\\xaa\\xb6\\x9b\\xdc\\xebu?\\xa2\\xe9\\x82w\\xc8{\\x91\\x01x]\\xb3\\x8f\\xd1\\xa5\\xbf\\xa6\\xe3$\\xb9~\"\\x120\\x80uy\\x91\\xc0\\xef\\x14\\x8b\\xa0\\xe2\\xb7\\xfdjy\\x05"
  717. },
  718. {
  719. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa6\\xafc\\xfb\\xfc\\xf8t\\xd9\\xf9\\xe9\\x91.\\xaf1\\xa0}d\\xc2\\x08\nd\\xdb\\x8a\\x8f\\x90\\xaf\\x10\\xc5\\x8cg\\x15rt\\xca\\xd7vg;\\x12\\x0b+\\xce\\x17\\xedvh\\xe0\\x1d\\xe7\\x16\\xe9\\x8b(+j\\x000\\xc6d\\xec\\x18\\xfd\\x02\\xb97\\xfc\\xd1\\xcf\\xbbz\\x91\\x19bg\\xba\\xec\\xca\\x0f\\xc2p\\xf7f\\xd8\\xde\\x97\\xa4a\\xe3\\xf0\\xb3\\xab\\x06\\xfc\\xc7\\x8d\\x17\\xa8\\xa5\\x1e\\xf9w\\x13\\xe3\\xc1m\\xb5\\xa9\"\\xdd\\x9f\\xc9s>\\x871\\xecf\\xe6\\x97\\xef\\x11\\x1a\\x03\\x90\\x1b<\\xf4o\\xab\\xb3\\xa5\\x14zv\\xa2@)?\\x8bm\\xeb\\xd2>\\xb7\\x8a\\x02\\xb8\\x9c[8\\xfa\\xd0@\\xc5=s\\xc0d\\xe8\\xf2\\xf64\\xee]\\x7f\\x81t\rk[\\x1f^\\xf0\\x06\\x8c\\xe0t\\xf2\\x04\\xc8\\xf7\\xd7uz\\x08\\x1a$\\xf3y\\xe6\\x12\\x14%\\x11w\\xea\\xcb\\xad\\x92lc&?x\\xc9\\xab\\xa8\\x96\\xf7\\x06\\x06\\x172\\xc5\\xc9\\xd4\\x05kk\\xdb\\xb2\\x08\\x13o\\xb6\\xfc5\\x8df\\x0f\\xc5w\\xab\\xb41\\xec\\xd9y\\xddm\\x05\\xd0i\\xf5t\\x84c\\x1f\\x99\\xb8\\x02"
  720. },
  721. {
  722. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9`\\xa2\\xa1\\x8a\\x93\r\r9\\x0e\\xbf\\x02\\xeep\\xab\\xeb\\xad{\\xcf'\\x1e\\xd6rfle\\x90\\x19\\xf2\\x97\\x11\\x02\\x01\\xc7e3\\xcb\\xfftj\\x8c\\x93]\\xb6p\\x86\\x1c\\x02\\x1d\\xc7\\x85\\xfb\\x83qfu\\xda)\\xf9\\x00\\xf2\\xd6;7\\xd7$6n\\xc4\\xcc_?\\xb2u\\xdaa\\x08\\xccfv\\x8d\\xc9m\\x80^[\\x9c\\x04\\x03\\xa6\\x7f*\\xa4\\x83\\xe2\\xf2\\xfe>\\x13\\xc7\\xaa]\\x17\\xbd]\\xf5'3f\\x18\\x89\\xd06\\x1e\\x02d\\xdd\\x8d\\xf6\\xbe2\\xa9\\xab\\xdcf\\xe4l\\xe6\\x8bz\\xc6r\\x13u4\\x0c\\x01\\x9a\\x91\\x81\\xcd\\x97\\xfe3\\x84\\xed\\xf6\\x02|%\\xde\\xd4\\xff\\xacz\\x94c\\xd5i\\xec\\xa5o\\xfd\\xb7\\x8b\\x00\\x15\\xfa\\x12\\xc2\\x93q}\\x1db/\\xd7\\x98!\\xea\\xd5\\xd0\\xa2\\xb1\\xf6i\\xfe\\xb2\\x1a$\\x809\\x07\\xb6(\\xb6$\\xf9\\xfc\\xa6\\xf5\\x10\\xd6\\xa1\\xd9\\x03\\xb1b_'\\x81gl\\xfa\\x0e\\xcf\\xe5e\\x87=i\\xd6\\x91\\xfb\\x93r\\xd6\\x03#\\xc75d\\x97m\\xf7\\xcc\\xf1\\xb8(\\xfey\\x97\\x07j\\xcac\\x1a7xb\\x06"
  723. },
  724. {
  725. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe\\xf1\\x867\\xf9{\\x08>\\x7f\\xca\\xa3|\\x86\\xfb\\xb1\\x8a\\x7f\\xc0\\xd1v\\xbb\\xc3\\xfa\\xb73\\xb7p\\x88\\xf4\\x03\\x07\\xa6:(\\xa5q\\x13\\xec4r\\xe3\\x9d\\x1f\\x89b\\xc9\\xbami\\x12\\x7f\\xc3\\x96\\xca\\xaep\\xcb\\x0b\\x08c4\\xab\\x86b\\x07+\\xa4s\\xbf\\xd9\\xe06\\xa4\\\\x8b\\xb2%ml\\xf1\\x13\\x01\\xe8\\xc6\\xcf\\x03qz\\xc7\\x91\\x97j]\\x9cj\\x1a\\x96y\\xc9\\x8f\\x9d\\xb8\\xba\\xbe^o\\x04 \\xfa\\x1f\\xab\\xf0\\xf8@\\xd8k\\x98\n\\x9b\\xe7m\\xe5\n\\xc8\\x8e\\xe55b\\xa9\\xe4i\\x9d(\\x1a\\xed\r\\xc0]\\xe1\\xf5\\xd2\\xf1\\x9bq\\xc6t\\xe7\\x8d\\xa43\\xc0n\\x08-[\\x88\\xdf\\xbd\\xe6\\xd0\\xe63\\xcc1@r\\xcf\\x8bp\\xe4\\xe1gs\\xc00\\x8c\\x02\\xc18\\x10\\x92\\x8b8v,x\\xc2`z\\x8d\\x96\\x9d h\\xee.n\\x7f\\xbcb\\xe4\\xc4\\xe0\\xd4.\\t\\xd3\\x9a\\xfbm\\xc4\\xfe\\xd8\\xe1\\x0f\\x1b\\xef\\xc1\\xbcu\\xe0\\xac\\xdd\\x95^\\xb9$ez\\x8c\\xcequ\\x89)\\x84^m\\x03\\x12\\xb8a[\\xf4\\xbc\\x83\t\\xb5\\xbd\\xc9"
  726. },
  727. {
  728. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a)\\xa3\\x89^]\\x80h\\xddpbp\\xa3\\xfchpa\\xec\\xbf\\xdd\\xa8\\x8ca1c\n\\x8c\"\\x06\\xf8.wd\\x8di\\xbc\\xc7\\xd2\\x94\\xd9d-\\x96-\\xd2\\x1b\\xd2\\xdb\\xd2r\\xe1\\xe7\\xe4>\\x7f_u0\\xf5\\xc5i\\x96\\xd1q>\\xac\\xbb\\xe6\\xd9\\xcb\\x85c\\xf8\\xd2\\xa6h\\xd4\\x7fe\\x9b\\xbdq\\x88\\x94\\x07an\\x8e\\xaf\tbt\\xf4\\xdcqb\\xe4\\xd8\\xf7b\\x8b*[\\xa5y(\\x1f$\\xfc\\x17\\xdd\\xb92\\x80kr\\xbd\\x04\\xc2\\xb7\\xfb>\\x1d\\xd8`\\x14\\xa9\\xa9\\xb8\\xdd:}\\xcddi\\xf8\\xc3\\x0e\\x15&p\\x937\\x9d\\xaaze\\xear^\\xed \\xc8\\xdc\\x03\\xfd`_:\\xa8\\xa5m\\xcf\\x89\\xa5\\xb1\\xd2\\xc9|\\xec\\x0eu'\t\\xac\\xbc\\xbd%\\x83l!\\xc3\\x9d>\r6\\xef\\xf3\\xf5dg\\xa1\\xbf1!o5\\x93\"\\xbf9\\x92\\xef6\\x11\\xf3\\x84\\x97a`_\\x11\\xfej\\xdb\\xc6\\xcau%\\xa7\\xc0\\x97s~\\x85\\xdb,.\\x14b\\xb1\\x89\\x9fj\\xb8]\\x87\\xe6\\x03h{\\x12m!gu!\\xbc*\\xc9d"
  729. },
  730. {
  731. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01069}\\xfbapm\\xf1\\xc4/\\xb6+\\xec\\x80\\xd9\\x00oh'z\\xdell\\x99jv\\xcd\\xe5\\x1e\\x8e\\xe66\\xdd\\xc0\\xce\\xeb~\\xebq\\xecp\\xb2(\\xbdz\\x9b\\xfa\\xc1<|%u\\xe9\\xca\\x94\\x9c\\xae}\\x858\\xe2\\xf0v\\xf54a\\xdb)\\xfb\\xd3j\\xa8t)\\xda\\xdcn\\x90\\xdf\\xb7.\\xeb\\xc1d\\xe2d\\x18\\x96_\\xe6\\x9f#\\x9a\\xac\\x98v\\x1f\\xccy\\x8b\\;j\\xf6\\xf6\r\\xb8\\xb9/x\\x07\\x90g\\x13\\xf0\\x11s\\xc0c^\\xe4\\xb1\\x13\\x83\\x1ba\\x14q\\x02\\xb5n\\xa9\\x05\\x13\\x1e+b\\x07t\\x99%\\xbc\\x00\\x84\\x13k5\\x85\\x19\\xb4\\xcd@\\x89\\xb3\\xed\\xf4\\xbe\\\\xe19\\xf3\\x90@\\xa0\\xd8\\xca\\xb6\\xa4b\\xe6\\x7f\\x14\\xbd\\xb1kc\\x19\\xe5\\x1d\\xd0\\xa0ptxn\\xa1\\xa8wo\\x0cvw\\xd5\\x03\\x11z\\xc5t\\xb9\\xa8!\\x92\\x05s\\xc2\\xcb\\xdc\\xeb\\x88.ys\\xdf+iu9dm.\\x93\\x11%@;\nm\\x1aok\\x18\\x8eh\\xc6)\\xb9\\xfbu\\x88\\x82\\xe6z\\x99\\xbequb\\x1a\\x9b\\xdbw"
  732. },
  733. {
  734. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbb\\x98\\xf3j\\xc5\\xd2\\xe0\\x8f\\x187j9,\\xf3\\x93\\xb7k\\xb8|z\\xccz\\x06zb\\xf1\\xcca\\x95\\xe6\\xe7\\xeak\\xd58\\xeb\"9#\\xbc[|\\xaf\\xed\\xc0)\\xad\\xa8\\xde\\x81\\x0f;\\x10\\x82kg\\x9e\\x04\\x8b\\x96\\xcd\\xecn@\\xea\\xc3\\x0c\r\\xf2o\\x1fh@\\x19\\x1d\\xfe\\x9b\\x1fb\\xf6b\\xaa8%6\\x81{y\\xa0p:\\x87l\\x05ka \\xce\\x1b\\x87y\\xc0/\\xdf\\xd4\\xfb\\xaa\\xael\\xc61f>\\xc4l/ql\\x18n\\xe2\\xbew\\x8e,\\x0b:\\xb50\\xe9rt\\]\\x15\\xa1\\x12\\xfa\\xd9\\x85\\xa8)\\x82\\xd2;r\\x05>v\\x858n5\\xcei5h\\x86%*\"=\\xc6^\\xab\\x1c\\xc5b\\x8a.=\\xe5\\x91\\xb2m\\xd3?\\xad\\xec}\\x83~\\xdd\\x8b\\xcc.\\xd4\\x7f\\xc3\\xa4az\\x11\\xc16\\xd7:\\xd7\\xdd\\xf7/\\xa9\\xba:(\\x1e\\xd9[$\\x8e\\x124k\\x9ff\\xe8a\\xba\\xb9\\xa2\\xa6\\xf6\\x08\"\\x1c\\xcc\\x0c\\x95\"\\x9a\\xe9\\x0f \\xd3\\x83\\x06\\xf0\\x0bs\\xbe\\x94\\xdd\\x98}v\\xbd\\xdf\\xbc\\xc1g\\xc6"
  735. },
  736. {
  737. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  738. }
  739. ]
  740. },
  741. {
  742. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  743. "Details": [
  744. {
  745. "Bkav": "Exploit.Office.Heur"
  746. },
  747. {
  748. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  749. },
  750. {
  751. "FireEye": "Exploit.CVE-2017-11882.Gen"
  752. },
  753. {
  754. "McAfee": "Exploit-CVE2017-11882.yx"
  755. },
  756. {
  757. "Symantec": "Exp.CVE-2017-11882!g3"
  758. },
  759. {
  760. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  761. },
  762. {
  763. "Avast": "Win32:ShellCode [Expl]"
  764. },
  765. {
  766. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  767. },
  768. {
  769. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  770. },
  771. {
  772. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  773. },
  774. {
  775. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  776. },
  777. {
  778. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  779. },
  780. {
  781. "DrWeb": "Exploit.ShellCode.69"
  782. },
  783. {
  784. "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
  785. },
  786. {
  787. "Sophos": "Troj/RtfExp-EQ"
  788. },
  789. {
  790. "Ikarus": "Exploit.CVE-2017-11882"
  791. },
  792. {
  793. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  794. },
  795. {
  796. "Avira": "EXP/CVE-2017-11882.Gen"
  797. },
  798. {
  799. "Microsoft": "Trojan:O97M/Obfuse.AE"
  800. },
  801. {
  802. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  803. },
  804. {
  805. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  806. },
  807. {
  808. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  809. },
  810. {
  811. "ALYac": "Exploit.CVE-2017-11882.Gen"
  812. },
  813. {
  814. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  815. },
  816. {
  817. "Zoner": "Probably W97NativeOnly"
  818. },
  819. {
  820. "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
  821. },
  822. {
  823. "MAX": "malware (ai score=87)"
  824. },
  825. {
  826. "Fortinet": "MSOffice/CVE_2017_11882.BB!exploit"
  827. },
  828. {
  829. "AVG": "Win32:ShellCode [Expl]"
  830. },
  831. {
  832. "Qihoo-360": "virus.exp.21711882.d"
  833. }
  834. ]
  835. }
  836. ]
  837.  
  838. [*] Started Service: [
  839. "osppsvc"
  840. ]
  841.  
  842. [*] Executed Commands: []
  843.  
  844. [*] Mutexes: [
  845. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  846. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  847. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  848. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  849. "CicLoadWinStaWinSta0",
  850. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  851. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  852. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  853. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  854. ]
  855.  
  856. [*] Modified Files: [
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_608d61e92b9146193f80067c5c6893ef.doc",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_608d61e92b9146193f80067c5c6893ef.doc",
  859. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{C52D2B2D-0EBF-4789-BBA2-6B6EC1C0B35D}.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  861. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  862. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  863. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  864. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\CabE9F6.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEA07.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F53C3FC1-4883-43C1-9CDE-FFC9F7356AF2}.tmp",
  868. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9A5.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA91.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA1.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA2.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAC3.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFD.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFE.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFF.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC11.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC10.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCFF.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD00.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDE.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCEE.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD52.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD63.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD41.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD40.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDD.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEDD.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEDC.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE1.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD51.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF2C.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF5C.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAB.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFBD.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAC.tmp",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab10A9.tmp",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1098.tmp",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1221.tmp",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\cab129F.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1530.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab160C.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1968.tmp",
  905. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  906. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1EA9.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1EAA.tmp",
  909. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  910. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  911. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD215B.tmp\\iso690.xsl",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD239E.tmp\\gostname.xsl",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD215B.tmp\\Content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD239E.tmp\\Content.inf",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD243B.tmp\\ConvergingText.glox",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD243B.tmp\\Content.inf",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  919. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2594.tmp\\BracketList.glox",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2594.tmp\\Content.inf",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273B.tmp\\Equations.dotx",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273D.tmp\\chicago.xsl",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273C.tmp\\iso690nmerical.xsl",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273D.tmp\\Content.inf",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273C.tmp\\Content.inf",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273B.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28D4.tmp\\APASixthEditionOfficeOnline.xsl",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  932. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28D4.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A3C.tmp\\TabList.glox",
  936. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A3C.tmp\\Content.inf",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B66.tmp\\rings.glox",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B66.tmp\\Content.inf",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2DC8.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2DC9.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E09.tmp\\architecture.glox",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E09.tmp\\Content.inf",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2F33.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2F34.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F44.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F84.tmp\\Crop.thmx",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F84.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3002.tmp\\chevronaccent.glox",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3002.tmp\\Content.inf",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab30FD.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar30FE.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD312E.tmp\\harvardanglia2008officeonline.xsl",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD313E.tmp\\ThemePictureAlternatingAccent.glox",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD312E.tmp\\Content.inf",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD313E.tmp\\Content.inf",
  962. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  963. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3288.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3289.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3316.tmp\\pictureorgchart.glox",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3316.tmp\\Content.inf",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cab374D.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab37AC.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab37AD.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar37AE.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar37AF.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37CF.tmp\\turabian.xsl",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F0.tmp\\Basis.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37CF.tmp\\Content.inf",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F0.tmp\\content.inf",
  978. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3929.tmp\\InterconnectedBlockProcess.glox",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392B.tmp\\ieee2006officeonline.xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392C.tmp\\Badge.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3929.tmp\\Content.inf",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392A.tmp\\gb.xsl",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD393D.tmp\\ThemePictureGrid.glox",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD393D.tmp\\Content.inf",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392B.tmp\\Content.inf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392A.tmp\\Content.inf",
  989. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39BB.tmp\\PictureFrame.glox",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392C.tmp\\Content.inf",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39BB.tmp\\Content.inf",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39FA.tmp\\TabbedArc.glox",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39FA.tmp\\Content.inf",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B43.tmp\\sist02.xsl",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B43.tmp\\Content.inf",
  998. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DC5.tmp\\RadialPictureList.glox",
  1000. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DC5.tmp\\Content.inf",
  1003. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E24.tmp\\ThemePictureAccent.glox",
  1005. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1006. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EFF.tmp\\VaryingWidthList.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E24.tmp\\Content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FBE.tmp\\content.inf",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F9E.tmp\\Banded.thmx",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EFF.tmp\\Content.inf",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FBE.tmp\\Dividend.thmx",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F00.tmp\\Element design set.dotx",
  1015. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F00.tmp\\Content.inf",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD408A.tmp\\mlaseventheditionofficeonline.xsl",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4118.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F9E.tmp\\content.inf",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4214.tmp\\gosttitle.xsl",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4118.tmp\\Content.inf",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\content.inf",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD408A.tmp\\Content.inf",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4203.tmp\\HexagonRadial.glox",
  1025. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\Metropolitan.thmx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4214.tmp\\Content.inf",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4203.tmp\\Content.inf",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4293.tmp\\CircleProcess.glox",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4293.tmp\\Content.inf",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1032. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1035. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1037. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cab488F.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD492C.tmp\\content.inf",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD492C.tmp\\Damask.thmx",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1044. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1045. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E75D94E-67CA-466F-90A8-3686B68605CE}.tmp"
  1046. ]
  1047.  
  1048. [*] Deleted Files: [
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\CabE9F6.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEA07.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1052. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917[[fn=Berlin]].eftx",
  1056. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  1057. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917[[fn=Berlin]].xml",
  1058. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917[[fn=Berlin]].xml",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1EA9.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1EAA.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD215B.tmp",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475[[fn=Frame]].eftx",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104[[fn=Feathered]].eftx",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475[[fn=Frame]].xml",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475[[fn=Frame]].xml",
  1066. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485[[fn=Mesh]].eftx",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434[[fn=Wood Type]].eftx",
  1068. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104[[fn=Feathered]].xml",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD239E.tmp",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485[[fn=Mesh]].xml",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104[[fn=Feathered]].xml",
  1072. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485[[fn=Mesh]].xml",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434[[fn=Wood Type]].xml",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434[[fn=Wood Type]].xml",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD243B.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD215B.tmp\\iso690.xsl",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD239E.tmp\\gostname.xsl",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCEE.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA2.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2594.tmp",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD243B.tmp\\ConvergingText.glox",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDE.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2594.tmp\\BracketList.glox",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9A5.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273B.tmp",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273C.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273D.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28D4.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273D.tmp\\chicago.xsl",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273B.tmp\\Equations.dotx",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD273C.tmp\\iso690nmerical.xsl",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD00.tmp",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAC.tmp",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A3C.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD28D4.tmp\\APASixthEditionOfficeOnline.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAA1.tmp",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBDD.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2A3C.tmp\\TabList.glox",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B66.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFF.tmp",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B66.tmp\\rings.glox",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE1.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2DC8.tmp",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2DC9.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E09.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2E09.tmp\\architecture.glox",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFBD.tmp",
  1108. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
  1109. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937[[fn=Vapor Trail]].eftx",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937[[fn=Vapor Trail]].xml",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925[[fn=Droplet]].eftx",
  1114. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919[[fn=Circuit]].eftx",
  1115. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937[[fn=Vapor Trail]].xml",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103[[fn=Headlines]].eftx",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925[[fn=Droplet]].xml",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919[[fn=Circuit]].xml",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103[[fn=Headlines]].xml",
  1124. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919[[fn=Circuit]].xml",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103[[fn=Headlines]].xml",
  1127. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925[[fn=Droplet]].xml",
  1128. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2F33.tmp",
  1130. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F84.tmp",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2F34.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F84.tmp\\Crop.thmx",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3002.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F44.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3002.tmp\\chevronaccent.glox",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFE.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab30FD.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar30FE.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD312E.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD313E.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD313E.tmp\\ThemePictureAlternatingAccent.glox",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD312E.tmp\\harvardanglia2008officeonline.xsl",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCDD.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC10.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab3288.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar3289.tmp",
  1147. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927[[fn=Main Event]].eftx",
  1148. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927[[fn=Main Event]].xml",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927[[fn=Main Event]].xml",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3316.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3316.tmp\\pictureorgchart.glox",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1221.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37CF.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab37AC.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F0.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar37AE.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab37AD.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37CF.tmp\\turabian.xsl",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD37F0.tmp\\Basis.thmx",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar37AF.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAC3.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3929.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392B.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cab129F.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392A.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD393D.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392C.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39BB.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD393D.tmp\\ThemePictureGrid.glox",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAB.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39FA.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B43.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3929.tmp\\InterconnectedBlockProcess.glox",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBFD.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DC5.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392A.tmp\\gb.xsl",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39BB.tmp\\PictureFrame.glox",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD51.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF5C.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E24.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392C.tmp\\Badge.thmx",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab374D.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EFF.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3B43.tmp\\sist02.xsl",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD39FA.tmp\\TabbedArc.glox",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA91.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F9E.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD392B.tmp\\ieee2006officeonline.xsl",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FBE.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F00.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab10A9.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEDD.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3EFF.tmp\\VaryingWidthList.glox",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD408A.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD63.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4118.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FBE.tmp\\Dividend.thmx",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1530.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4214.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4203.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4293.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3E24.tmp\\ThemePictureAccent.glox",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCFF.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3DC5.tmp\\RadialPictureList.glox",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD40.tmp",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD408A.tmp\\mlaseventheditionofficeonline.xsl",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC11.tmp",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F9E.tmp\\Banded.thmx",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cab160C.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4118.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4253.tmp\\Metropolitan.thmx",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3F00.tmp\\Element design set.dotx",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4214.tmp\\gosttitle.xsl",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1098.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4293.tmp\\CircleProcess.glox",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1968.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD41.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4203.tmp\\HexagonRadial.glox",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF2C.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD492C.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD492C.tmp\\Damask.thmx",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\cab488F.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_608d61e92b9146193f80067c5c6893ef.doc",
  1225. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{F53C3FC1-4883-43C1-9CDE-FFC9F7356AF2}.tmp",
  1226. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1227. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E75D94E-67CA-466F-90A8-3686B68605CE}.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRD98A.tmp.cvr"
  1229. ]
  1230.  
  1231. [*] Modified Registry Keys: [
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\}l|",
  1233. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\52B22B",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\52B22B\\52B22B",
  1256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1787. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1788. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1789. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1847. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1865. ]
  1866.  
  1867. [*] Deleted Registry Keys: [
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\}l|",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\9/z",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\52B22B\\52B22B",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1891. ]
  1892.  
  1893. [*] DNS Communications: [
  1894. {
  1895. "type": "A",
  1896. "request": "blogmason.mixh.jp",
  1897. "answers": [
  1898. {
  1899. "data": "150.95.52.111",
  1900. "type": "A"
  1901. }
  1902. ]
  1903. }
  1904. ]
  1905.  
  1906. [*] Domains: [
  1907. {
  1908. "ip": "150.95.52.111",
  1909. "domain": "blogmason.mixh.jp"
  1910. }
  1911. ]
  1912.  
  1913. [*] Network Communication - ICMP: []
  1914.  
  1915. [*] Network Communication - HTTP: [
  1916. {
  1917. "count": 1,
  1918. "body": "",
  1919. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1920. "user-agent": "Microsoft-CryptoAPI/6.1",
  1921. "method": "GET",
  1922. "host": "ocsp.usertrust.com",
  1923. "version": "1.1",
  1924. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1925. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1926. "port": 80
  1927. },
  1928. {
  1929. "count": 1,
  1930. "body": "",
  1931. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1932. "user-agent": "Microsoft-CryptoAPI/6.1",
  1933. "method": "GET",
  1934. "host": "ocsp.digicert.com",
  1935. "version": "1.1",
  1936. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1937. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1938. "port": 80
  1939. },
  1940. {
  1941. "count": 1,
  1942. "body": "",
  1943. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1944. "user-agent": "Microsoft-CryptoAPI/6.1",
  1945. "method": "GET",
  1946. "host": "ocsp.comodoca.com",
  1947. "version": "1.1",
  1948. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
  1949. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  1950. "port": 80
  1951. },
  1952. {
  1953. "count": 1,
  1954. "body": "",
  1955. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1956. "user-agent": "Microsoft-CryptoAPI/6.1",
  1957. "method": "GET",
  1958. "host": "ocsp.msocsp.com",
  1959. "version": "1.1",
  1960. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1961. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1962. "port": 80
  1963. },
  1964. {
  1965. "count": 36,
  1966. "body": "",
  1967. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1968. "user-agent": "Microsoft-CryptoAPI/6.1",
  1969. "method": "GET",
  1970. "host": "crl.microsoft.com",
  1971. "version": "1.1",
  1972. "path": "/pki/crl/products/microsoftrootcert.crl",
  1973. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1974. "port": 80
  1975. },
  1976. {
  1977. "count": 1,
  1978. "body": "",
  1979. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1980. "user-agent": "Microsoft-CryptoAPI/6.1",
  1981. "method": "GET",
  1982. "host": "crl.microsoft.com",
  1983. "version": "1.1",
  1984. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1985. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1986. "port": 80
  1987. },
  1988. {
  1989. "count": 1,
  1990. "body": "",
  1991. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe",
  1992. "user-agent": "Microsoft BITS/7.5",
  1993. "method": "HEAD",
  1994. "host": "redirector.gvt1.com",
  1995. "version": "1.1",
  1996. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe",
  1997. "data": "HEAD /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  1998. "port": 80
  1999. },
  2000. {
  2001. "count": 1,
  2002. "body": "",
  2003. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2004. "user-agent": "Microsoft-CryptoAPI/6.1",
  2005. "method": "GET",
  2006. "host": "ocsp.digicert.com",
  2007. "version": "1.1",
  2008. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2009. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2010. "port": 80
  2011. },
  2012. {
  2013. "count": 1,
  2014. "body": "",
  2015. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2016. "user-agent": "Microsoft-CryptoAPI/6.1",
  2017. "method": "GET",
  2018. "host": "ocsp.digicert.com",
  2019. "version": "1.1",
  2020. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2021. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2022. "port": 80
  2023. },
  2024. {
  2025. "count": 2,
  2026. "body": "",
  2027. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2028. "user-agent": "Microsoft BITS/7.5",
  2029. "method": "HEAD",
  2030. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2031. "version": "1.1",
  2032. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2033. "data": "HEAD /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2034. "port": 80
  2035. },
  2036. {
  2037. "count": 1,
  2038. "body": "",
  2039. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2040. "user-agent": "Microsoft-CryptoAPI/6.1",
  2041. "method": "GET",
  2042. "host": "ocsp.digicert.com",
  2043. "version": "1.1",
  2044. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  2045. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2046. "port": 80
  2047. },
  2048. {
  2049. "count": 1,
  2050. "body": "",
  2051. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2052. "user-agent": "Microsoft BITS/7.5",
  2053. "method": "GET",
  2054. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2055. "version": "1.1",
  2056. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2057. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=0-6618\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2058. "port": 80
  2059. },
  2060. {
  2061. "count": 1,
  2062. "body": "",
  2063. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2064. "user-agent": "Microsoft BITS/7.5",
  2065. "method": "GET",
  2066. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2067. "version": "1.1",
  2068. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2069. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=6619-16604\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2070. "port": 80
  2071. },
  2072. {
  2073. "count": 1,
  2074. "body": "",
  2075. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2076. "user-agent": "Microsoft BITS/7.5",
  2077. "method": "GET",
  2078. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2079. "version": "1.1",
  2080. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2081. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=16605-26444\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2082. "port": 80
  2083. },
  2084. {
  2085. "count": 1,
  2086. "body": "",
  2087. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2088. "user-agent": "Microsoft BITS/7.5",
  2089. "method": "GET",
  2090. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2091. "version": "1.1",
  2092. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2093. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=26445-36977\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2094. "port": 80
  2095. },
  2096. {
  2097. "count": 1,
  2098. "body": "",
  2099. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2100. "user-agent": "Microsoft BITS/7.5",
  2101. "method": "GET",
  2102. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2103. "version": "1.1",
  2104. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2105. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=36978-58076\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2106. "port": 80
  2107. },
  2108. {
  2109. "count": 1,
  2110. "body": "",
  2111. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2112. "user-agent": "Microsoft BITS/7.5",
  2113. "method": "GET",
  2114. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2115. "version": "1.1",
  2116. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2117. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=58077-75872\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2118. "port": 80
  2119. },
  2120. {
  2121. "count": 1,
  2122. "body": "",
  2123. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2124. "user-agent": "Microsoft BITS/7.5",
  2125. "method": "GET",
  2126. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2127. "version": "1.1",
  2128. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2129. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=75873-113214\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2130. "port": 80
  2131. },
  2132. {
  2133. "count": 1,
  2134. "body": "",
  2135. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2136. "user-agent": "Microsoft BITS/7.5",
  2137. "method": "GET",
  2138. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2139. "version": "1.1",
  2140. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2141. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=113215-165122\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2142. "port": 80
  2143. },
  2144. {
  2145. "count": 1,
  2146. "body": "",
  2147. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2148. "user-agent": "Microsoft BITS/7.5",
  2149. "method": "GET",
  2150. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2151. "version": "1.1",
  2152. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2153. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=165123-245351\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2154. "port": 80
  2155. },
  2156. {
  2157. "count": 1,
  2158. "body": "",
  2159. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2160. "user-agent": "Microsoft BITS/7.5",
  2161. "method": "GET",
  2162. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2163. "version": "1.1",
  2164. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2165. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=245352-372751\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2166. "port": 80
  2167. },
  2168. {
  2169. "count": 1,
  2170. "body": "",
  2171. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2172. "user-agent": "Microsoft BITS/7.5",
  2173. "method": "GET",
  2174. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2175. "version": "1.1",
  2176. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2177. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=372752-539195\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2178. "port": 80
  2179. },
  2180. {
  2181. "count": 1,
  2182. "body": "",
  2183. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2184. "user-agent": "Microsoft BITS/7.5",
  2185. "method": "GET",
  2186. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2187. "version": "1.1",
  2188. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2189. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=539196-731317\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2190. "port": 80
  2191. },
  2192. {
  2193. "count": 1,
  2194. "body": "",
  2195. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2196. "user-agent": "Microsoft BITS/7.5",
  2197. "method": "GET",
  2198. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2199. "version": "1.1",
  2200. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2201. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=731318-952899\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2202. "port": 80
  2203. },
  2204. {
  2205. "count": 1,
  2206. "body": "",
  2207. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2208. "user-agent": "Microsoft BITS/7.5",
  2209. "method": "GET",
  2210. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2211. "version": "1.1",
  2212. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2213. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=952900-1114049\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2214. "port": 80
  2215. },
  2216. {
  2217. "count": 1,
  2218. "body": "",
  2219. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2220. "user-agent": "Microsoft BITS/7.5",
  2221. "method": "GET",
  2222. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2223. "version": "1.1",
  2224. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2225. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=1114050-1237934\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2226. "port": 80
  2227. },
  2228. {
  2229. "count": 1,
  2230. "body": "",
  2231. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2232. "user-agent": "Microsoft BITS/7.5",
  2233. "method": "GET",
  2234. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2235. "version": "1.1",
  2236. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2237. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=1237935-1499908\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2238. "port": 80
  2239. },
  2240. {
  2241. "count": 1,
  2242. "body": "",
  2243. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2244. "user-agent": "Microsoft BITS/7.5",
  2245. "method": "GET",
  2246. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2247. "version": "1.1",
  2248. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2249. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=1499909-1795272\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2250. "port": 80
  2251. },
  2252. {
  2253. "count": 1,
  2254. "body": "",
  2255. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2256. "user-agent": "Microsoft BITS/7.5",
  2257. "method": "GET",
  2258. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2259. "version": "1.1",
  2260. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2261. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=1795273-2134436\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2262. "port": 80
  2263. },
  2264. {
  2265. "count": 1,
  2266. "body": "",
  2267. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2268. "user-agent": "Microsoft BITS/7.5",
  2269. "method": "GET",
  2270. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2271. "version": "1.1",
  2272. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2273. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=2134437-2466730\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2274. "port": 80
  2275. },
  2276. {
  2277. "count": 1,
  2278. "body": "",
  2279. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2280. "user-agent": "Microsoft BITS/7.5",
  2281. "method": "GET",
  2282. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2283. "version": "1.1",
  2284. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2285. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=2466731-2851771\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2286. "port": 80
  2287. },
  2288. {
  2289. "count": 1,
  2290. "body": "",
  2291. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2292. "user-agent": "Microsoft BITS/7.5",
  2293. "method": "GET",
  2294. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2295. "version": "1.1",
  2296. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2297. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=2851772-3231406\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2298. "port": 80
  2299. },
  2300. {
  2301. "count": 1,
  2302. "body": "",
  2303. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2304. "user-agent": "Microsoft BITS/7.5",
  2305. "method": "GET",
  2306. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2307. "version": "1.1",
  2308. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2309. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=3231407-3609225\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2310. "port": 80
  2311. },
  2312. {
  2313. "count": 1,
  2314. "body": "",
  2315. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2316. "user-agent": "Microsoft BITS/7.5",
  2317. "method": "GET",
  2318. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2319. "version": "1.1",
  2320. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2321. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=3609226-4015674\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2322. "port": 80
  2323. },
  2324. {
  2325. "count": 1,
  2326. "body": "",
  2327. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2328. "user-agent": "Microsoft BITS/7.5",
  2329. "method": "GET",
  2330. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2331. "version": "1.1",
  2332. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2333. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=4015675-4452623\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2334. "port": 80
  2335. },
  2336. {
  2337. "count": 1,
  2338. "body": "",
  2339. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2340. "user-agent": "Microsoft BITS/7.5",
  2341. "method": "GET",
  2342. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2343. "version": "1.1",
  2344. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2345. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=4452624-4890353\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2346. "port": 80
  2347. },
  2348. {
  2349. "count": 1,
  2350. "body": "",
  2351. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2352. "user-agent": "Microsoft BITS/7.5",
  2353. "method": "GET",
  2354. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2355. "version": "1.1",
  2356. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2357. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=4890354-5322481\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2358. "port": 80
  2359. },
  2360. {
  2361. "count": 1,
  2362. "body": "",
  2363. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2364. "user-agent": "Microsoft BITS/7.5",
  2365. "method": "GET",
  2366. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2367. "version": "1.1",
  2368. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2369. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=5322482-5790530\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2370. "port": 80
  2371. },
  2372. {
  2373. "count": 1,
  2374. "body": "",
  2375. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2376. "user-agent": "Microsoft BITS/7.5",
  2377. "method": "GET",
  2378. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2379. "version": "1.1",
  2380. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2381. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=5790531-6256318\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2382. "port": 80
  2383. },
  2384. {
  2385. "count": 1,
  2386. "body": "",
  2387. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2388. "user-agent": "Microsoft BITS/7.5",
  2389. "method": "GET",
  2390. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2391. "version": "1.1",
  2392. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2393. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=6256319-6762943\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2394. "port": 80
  2395. },
  2396. {
  2397. "count": 1,
  2398. "body": "",
  2399. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2400. "user-agent": "Microsoft BITS/7.5",
  2401. "method": "GET",
  2402. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2403. "version": "1.1",
  2404. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2405. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=6762944-7271610\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2406. "port": 80
  2407. },
  2408. {
  2409. "count": 1,
  2410. "body": "",
  2411. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2412. "user-agent": "Microsoft BITS/7.5",
  2413. "method": "GET",
  2414. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2415. "version": "1.1",
  2416. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2417. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=7271611-7827317\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2418. "port": 80
  2419. },
  2420. {
  2421. "count": 1,
  2422. "body": "",
  2423. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2424. "user-agent": "Microsoft BITS/7.5",
  2425. "method": "GET",
  2426. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2427. "version": "1.1",
  2428. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2429. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=7827318-8383741\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2430. "port": 80
  2431. },
  2432. {
  2433. "count": 1,
  2434. "body": "",
  2435. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2436. "user-agent": "Microsoft BITS/7.5",
  2437. "method": "GET",
  2438. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2439. "version": "1.1",
  2440. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2441. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=8383742-8997155\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2442. "port": 80
  2443. },
  2444. {
  2445. "count": 1,
  2446. "body": "",
  2447. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2448. "user-agent": "Microsoft BITS/7.5",
  2449. "method": "GET",
  2450. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2451. "version": "1.1",
  2452. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2453. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=8997156-9673178\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2454. "port": 80
  2455. },
  2456. {
  2457. "count": 1,
  2458. "body": "",
  2459. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2460. "user-agent": "Microsoft BITS/7.5",
  2461. "method": "GET",
  2462. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2463. "version": "1.1",
  2464. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2465. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=9673179-10361207\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2466. "port": 80
  2467. },
  2468. {
  2469. "count": 1,
  2470. "body": "",
  2471. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2472. "user-agent": "Microsoft BITS/7.5",
  2473. "method": "GET",
  2474. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2475. "version": "1.1",
  2476. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2477. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=10361208-11178651\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2478. "port": 80
  2479. },
  2480. {
  2481. "count": 1,
  2482. "body": "",
  2483. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2484. "user-agent": "Microsoft BITS/7.5",
  2485. "method": "GET",
  2486. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2487. "version": "1.1",
  2488. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2489. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=11178652-11999923\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2490. "port": 80
  2491. },
  2492. {
  2493. "count": 1,
  2494. "body": "",
  2495. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2496. "user-agent": "Microsoft BITS/7.5",
  2497. "method": "GET",
  2498. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2499. "version": "1.1",
  2500. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2501. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=11999924-12888485\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2502. "port": 80
  2503. },
  2504. {
  2505. "count": 1,
  2506. "body": "",
  2507. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2508. "user-agent": "Microsoft BITS/7.5",
  2509. "method": "GET",
  2510. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2511. "version": "1.1",
  2512. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2513. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=12888486-13778185\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2514. "port": 80
  2515. },
  2516. {
  2517. "count": 1,
  2518. "body": "",
  2519. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2520. "user-agent": "Microsoft BITS/7.5",
  2521. "method": "GET",
  2522. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2523. "version": "1.1",
  2524. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2525. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=13778186-15256988\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2526. "port": 80
  2527. },
  2528. {
  2529. "count": 1,
  2530. "body": "",
  2531. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2532. "user-agent": "Microsoft BITS/7.5",
  2533. "method": "GET",
  2534. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2535. "version": "1.1",
  2536. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2537. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=15256989-16868873\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2538. "port": 80
  2539. },
  2540. {
  2541. "count": 1,
  2542. "body": "",
  2543. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2544. "user-agent": "Microsoft BITS/7.5",
  2545. "method": "GET",
  2546. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2547. "version": "1.1",
  2548. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2549. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=16868874-18572578\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2550. "port": 80
  2551. },
  2552. {
  2553. "count": 1,
  2554. "body": "",
  2555. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2556. "user-agent": "Microsoft BITS/7.5",
  2557. "method": "GET",
  2558. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2559. "version": "1.1",
  2560. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2561. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=18572579-19715433\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2562. "port": 80
  2563. },
  2564. {
  2565. "count": 1,
  2566. "body": "",
  2567. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2568. "user-agent": "Microsoft BITS/7.5",
  2569. "method": "GET",
  2570. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2571. "version": "1.1",
  2572. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2573. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=19715434-21049467\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2574. "port": 80
  2575. },
  2576. {
  2577. "count": 1,
  2578. "body": "",
  2579. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2580. "user-agent": "Microsoft BITS/7.5",
  2581. "method": "GET",
  2582. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2583. "version": "1.1",
  2584. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2585. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=21049468-23076807\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2586. "port": 80
  2587. },
  2588. {
  2589. "count": 1,
  2590. "body": "",
  2591. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2592. "user-agent": "Microsoft BITS/7.5",
  2593. "method": "GET",
  2594. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2595. "version": "1.1",
  2596. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2597. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=23076808-25035429\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2598. "port": 80
  2599. },
  2600. {
  2601. "count": 1,
  2602. "body": "",
  2603. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2604. "user-agent": "Microsoft BITS/7.5",
  2605. "method": "GET",
  2606. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2607. "version": "1.1",
  2608. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2609. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=25035430-26213834\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2610. "port": 80
  2611. },
  2612. {
  2613. "count": 1,
  2614. "body": "",
  2615. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2616. "user-agent": "Microsoft BITS/7.5",
  2617. "method": "GET",
  2618. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2619. "version": "1.1",
  2620. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2621. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=26213835-27519367\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2622. "port": 80
  2623. },
  2624. {
  2625. "count": 1,
  2626. "body": "",
  2627. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2628. "user-agent": "Microsoft BITS/7.5",
  2629. "method": "GET",
  2630. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2631. "version": "1.1",
  2632. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2633. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=27519368-29414105\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2634. "port": 80
  2635. },
  2636. {
  2637. "count": 1,
  2638. "body": "",
  2639. "uri": "http://r5---sn-tt1e7n7e.gvt1.com/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2640. "user-agent": "Microsoft BITS/7.5",
  2641. "method": "GET",
  2642. "host": "r5---sn-tt1e7n7e.gvt1.com",
  2643. "version": "1.1",
  2644. "path": "/edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes",
  2645. "data": "GET /edgedl/release2/chrome/AO3hITetZBsR_75.0.3770.100/75.0.3770.100_74.0.3729.169_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7e&ms=nvh&mt=1560934487&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 05:17:16 GMT\r\nRange: bytes=29414106-30336767\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7e.gvt1.com\r\n\r\n",
  2646. "port": 80
  2647. }
  2648. ]
  2649.  
  2650. [*] Network Communication - SMTP: []
  2651.  
  2652. [*] Network Communication - Hosts: []
  2653.  
  2654. [*] Network Communication - IRC: []
  2655.  
  2656. [*] Static Analysis: {}
  2657.  
  2658. [*] Resolved APIs: [
  2659. "mso.dll.#1443",
  2660. "mso.dll.#9214",
  2661. "mso.dll.#199",
  2662. "mso.dll.#1073",
  2663. "mso.dll.#4255",
  2664. "mso.dll.#3459",
  2665. "mso.dll.#1262",
  2666. "mso.dll.#5709",
  2667. "mso.dll.#7353",
  2668. "mso.dll.#5228",
  2669. "mso.dll.#2155",
  2670. "mso.dll.#1725",
  2671. "user32.dll.RegisterWindowMessageW",
  2672. "mso.dll.#4314",
  2673. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2674. "mso.dll.#6484",
  2675. "mso.dll.#8499",
  2676. "mso.dll.#9871",
  2677. "mso.dll.#4743",
  2678. "mso.dll.#5452",
  2679. "mso.dll.#2088",
  2680. "mso.dll.#5274",
  2681. "mso.dll.#3195",
  2682. "mso.dll.#8165",
  2683. "mso.dll.#9175",
  2684. "mso.dll.#5315",
  2685. "mso.dll.#8140",
  2686. "user32.dll.IsWindowEnabled",
  2687. "ole32.dll.CoGetCallState",
  2688. "ole32.dll.CoGetActivationState",
  2689. "advapi32.dll.RegisterWaitChainCOMCallback",
  2690. "secur32.dll.FreeContextBuffer",
  2691. "ncrypt.dll.SslOpenProvider",
  2692. "ncrypt.dll.GetSChannelInterface",
  2693. "bcryptprimitives.dll.GetHashInterface",
  2694. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2695. "ncrypt.dll.SslImportKey",
  2696. "bcryptprimitives.dll.GetCipherInterface",
  2697. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2698. "user32.dll.LoadStringW",
  2699. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2700. "ncrypt.dll.BCryptGetProperty",
  2701. "ncrypt.dll.BCryptCreateHash",
  2702. "ncrypt.dll.BCryptHashData",
  2703. "ncrypt.dll.BCryptFinishHash",
  2704. "ncrypt.dll.BCryptDestroyHash",
  2705. "crypt32.dll.CertGetCertificateChain",
  2706. "userenv.dll.GetUserProfileDirectoryW",
  2707. "sechost.dll.ConvertSidToStringSidW",
  2708. "sechost.dll.ConvertStringSidToSidW",
  2709. "userenv.dll.RegisterGPNotification",
  2710. "gpapi.dll.RegisterGPNotificationInternal",
  2711. "sechost.dll.OpenSCManagerW",
  2712. "sechost.dll.OpenServiceW",
  2713. "sechost.dll.CloseServiceHandle",
  2714. "sechost.dll.QueryServiceConfigW",
  2715. "cryptsp.dll.CryptAcquireContextA",
  2716. "cryptsp.dll.CryptCreateHash",
  2717. "cryptsp.dll.CryptHashData",
  2718. "cryptsp.dll.CryptVerifySignatureA",
  2719. "cryptsp.dll.CryptDestroyKey",
  2720. "cryptsp.dll.CryptDestroyHash",
  2721. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2722. "ncrypt.dll.BCryptImportKeyPair",
  2723. "ncrypt.dll.BCryptVerifySignature",
  2724. "ncrypt.dll.BCryptDestroyKey",
  2725. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2726. "crypt32.dll.CertFreeCertificateChain",
  2727. "crypt32.dll.CertDuplicateCertificateContext",
  2728. "ncrypt.dll.SslEncryptPacket",
  2729. "ncrypt.dll.SslDecryptPacket",
  2730. "winhttp.dll.WinHttpReceiveResponse",
  2731. "winhttp.dll.WinHttpQueryHeaders",
  2732. "winhttp.dll.WinHttpQueryDataAvailable",
  2733. "winhttp.dll.WinHttpReadData",
  2734. "webservices.dll.WsCreateError",
  2735. "ntdll.dll.EtwEventWrite",
  2736. "ntdll.dll.EtwEventRegister",
  2737. "ntdll.dll.EtwEventUnregister",
  2738. "webservices.dll.WsCreateHeap",
  2739. "webservices.dll.WsCreateReader",
  2740. "webservices.dll.WsSetInput",
  2741. "webservices.dll.WsFillReader",
  2742. "webservices.dll.WsReadToStartElement",
  2743. "webservices.dll.WsReadStartElement",
  2744. "webservices.dll.WsReadType",
  2745. "winhttp.dll.WinHttpCloseHandle",
  2746. "crypt32.dll.CertFreeCertificateContext",
  2747. "rpcrt4.dll.RpcBindingFree",
  2748. "webservices.dll.WsFreeReader",
  2749. "webservices.dll.WsFreeError",
  2750. "webservices.dll.WsFreeHeap",
  2751. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2752. "winhttp.dll.WinHttpOpenRequest",
  2753. "winhttp.dll.WinHttpAddRequestHeaders",
  2754. "winhttp.dll.WinHttpSendRequest",
  2755. "winhttp.dll.WinHttpConnect",
  2756. "winhttp.dll.WinHttpCrackUrl",
  2757. "winhttp.dll.WinHttpSetStatusCallback",
  2758. "winhttp.dll.WinHttpOpen",
  2759. "winhttp.dll.WinHttpSetOption",
  2760. "winhttp.dll.WinHttpWriteData",
  2761. "winhttp.dll.WinHttpSetCredentials",
  2762. "winhttp.dll.WinHttpQueryAuthSchemes",
  2763. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2764. "winhttp.dll.WinHttpGetProxyForUrl",
  2765. "winhttp.dll.WinHttpQueryOption",
  2766. "webservices.dll.WsOpenServiceProxy",
  2767. "webservices.dll.WsCall",
  2768. "webservices.dll.WsAddCustomHeader",
  2769. "shlwapi.dll.StrStrA",
  2770. "shlwapi.dll.UrlUnescapeA",
  2771. "cryptnet.dll.CertDllVerifyRevocation",
  2772. "profapi.dll.#104",
  2773. "sensapi.dll.IsNetworkAlive",
  2774. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2775. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2776. "rpcrt4.dll.NdrClientCall2",
  2777. "winhttp.dll.WinHttpSetTimeouts",
  2778. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2779. "shlwapi.dll.StrStrIW",
  2780. "winhttp.dll.WinHttpTimeFromSystemTime",
  2781. "cryptnet.dll.I_CryptNetGetConnectivity",
  2782. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2783. "setupapi.dll.SetupIterateCabinetW",
  2784. "kernel32.dll.RegOpenKeyExW",
  2785. "kernel32.dll.RegCloseKey",
  2786. "cabinet.dll.#20",
  2787. "cabinet.dll.#22",
  2788. "devrtl.dll.DevRtlGetThreadLogToken",
  2789. "cryptsp.dll.CryptSetHashParam",
  2790. "sechost.dll.QueryServiceConfigA",
  2791. "sechost.dll.QueryServiceStatus",
  2792. "rpcrt4.dll.RpcStringBindingComposeA",
  2793. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2794. "rpcrt4.dll.RpcEpResolveBinding",
  2795. "sechost.dll.LookupAccountSidLocalW",
  2796. "rpcrt4.dll.RpcStringFreeA",
  2797. "webservices.dll.WsResetHeap",
  2798. "webservices.dll.WsCloseServiceProxy",
  2799. "ws2_32.dll.#3",
  2800. "webservices.dll.WsFreeServiceProxy",
  2801. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2802. "ncrypt.dll.SslFreeObject",
  2803. "user32.dll.RegisterPowerSettingNotification",
  2804. "powrprof.dll.PowerSettingRegisterNotification",
  2805. "user32.dll.GetWindowThreadProcessId",
  2806. "user32.dll.GetWindowTextW",
  2807. "mso.dll.#25",
  2808. "mso.dll.#1056",
  2809. "mso.dll.#8136",
  2810. "mso.dll.#8931",
  2811. "shell32.dll.SHGetFileInfoW",
  2812. "mso.dll.#5362",
  2813. "mso.dll.#6044",
  2814. "mso.dll.#6516",
  2815. "mso.dll.#6221",
  2816. "mso.dll.#5780",
  2817. "mso.dll.#4870",
  2818. "mso.dll.#6046",
  2819. "mso.dll.#1241",
  2820. "mso.dll.#2821",
  2821. "mso.dll.#2340",
  2822. "mso.dll.#7287",
  2823. "mso.dll.#5290",
  2824. "mso.dll.#1508",
  2825. "user32.dll.IsZoomed",
  2826. "user32.dll.GetWindowPlacement",
  2827. "user32.dll.GetWindowRect",
  2828. "mso.dll.#821",
  2829. "user32.dll.GetSystemMetrics",
  2830. "user32.dll.MonitorFromWindow",
  2831. "user32.dll.MonitorFromRect",
  2832. "user32.dll.MonitorFromPoint",
  2833. "user32.dll.EnumDisplayMonitors",
  2834. "user32.dll.GetMonitorInfoA",
  2835. "user32.dll.EnumDisplayDevicesA",
  2836. "mso.dll.#2378",
  2837. "user32.dll.SetWindowPos",
  2838. "user32.dll.AdjustWindowRect",
  2839. "mso.dll.#5912",
  2840. "mso.dll.#9719",
  2841. "mso.dll.#8824",
  2842. "mso.dll.#6117",
  2843. "mso.dll.#3307",
  2844. "user32.dll.SendMessageW",
  2845. "user32.dll.DestroyIcon",
  2846. "mso.dll.#3813",
  2847. "mso.dll.#1815",
  2848. "user32.dll.PtInRect",
  2849. "mso.dll.#1613",
  2850. "user32.dll.SetWindowTextW",
  2851. "user32.dll.GetClassLongW",
  2852. "mso.dll.#8572",
  2853. "gdi32.dll.CreateDIBSection",
  2854. "gdi32.dll.CreateCompatibleDC",
  2855. "gdi32.dll.GetViewportOrgEx",
  2856. "gdi32.dll.SetViewportOrgEx",
  2857. "gdi32.dll.SetBkColor",
  2858. "gdi32.dll.ExtTextOutA",
  2859. "mso.dll.#1573",
  2860. "mso.dll.#8612",
  2861. "user32.dll.SetScrollRange",
  2862. "mso.dll.#2509",
  2863. "user32.dll.BeginDeferWindowPos",
  2864. "user32.dll.DeferWindowPos",
  2865. "user32.dll.EndDeferWindowPos",
  2866. "user32.dll.OffsetRect",
  2867. "user32.dll.EnumChildWindows",
  2868. "user32.dll.GetScrollInfo",
  2869. "user32.dll.MapWindowPoints",
  2870. "gdi32.dll.DeleteDC",
  2871. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2872. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2873. "mso.dll.#6126",
  2874. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2875. "gdi32.dll.GetFontRealizationInfo",
  2876. "gdi32.dll.GetFontFileInfo",
  2877. "gdi32.dll.GetFontFileData",
  2878. "mso.dll.#7261",
  2879. "mso.dll.#9540",
  2880. "usp10.dll.ScriptGetFontScriptTags",
  2881. "usp10.dll.ScriptGetFontLanguageTags",
  2882. "usp10.dll.ScriptGetFontFeatureTags",
  2883. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  2884. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  2885. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  2886. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2887. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2888. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2889. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2890. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2891. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2892. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2893. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2894. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2895. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2896. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2897. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2898. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2899. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2900. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2901. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2902. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2903. "user32.dll.SetRectEmpty",
  2904. "user32.dll.InflateRect",
  2905. "mso.dll.#1100",
  2906. "mso.dll.#7047",
  2907. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2908. "user32.dll.GetCursor",
  2909. "user32.dll.GetClientRect",
  2910. "user32.dll.SetScrollInfo",
  2911. "user32.dll.SetScrollPos",
  2912. "mso.dll.#3747",
  2913. "mso.dll.#8218",
  2914. "mso.dll.#5394",
  2915. "mso.dll.#331",
  2916. "mso.dll.#6829",
  2917. "mso.dll.#539",
  2918. "mso.dll.#4959",
  2919. "mso.dll.#6463",
  2920. "mso.dll.#4987",
  2921. "user32.dll.GetWindow",
  2922. "mso.dll.#7195",
  2923. "mso.dll.#7573",
  2924. "mso.dll.#445",
  2925. "user32.dll.GetCaretBlinkTime",
  2926. "user32.dll.CreateCaret",
  2927. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2928. "user32.dll.IntersectRect",
  2929. "user32.dll.DestroyCaret",
  2930. "user32.dll.GetCaretPos",
  2931. "user32.dll.SetCaretPos",
  2932. "mso.dll.#5932",
  2933. "mso.dll.#2071",
  2934. "mso.dll.#1024",
  2935. "mso.dll.#6245",
  2936. "mso.dll.#9041",
  2937. "mso.dll.#1767",
  2938. "mso.dll.#9369",
  2939. "mso.dll.#4617",
  2940. "user32.dll.FillRect",
  2941. "mso.dll.#343",
  2942. "mso.dll.#9636",
  2943. "mso.dll.#2022",
  2944. "mso.dll.#4750",
  2945. "mso.dll.#4577",
  2946. "mso.dll.#850",
  2947. "shell32.dll.SHAddToRecentDocs",
  2948. "mso.dll.#1776",
  2949. "mso.dll.#9026",
  2950. "mso.dll.#4497",
  2951. "mso.dll.#4647",
  2952. "mso.dll.#8926",
  2953. "mso.dll.#7212",
  2954. "mso.dll.#5407",
  2955. "mso.dll.#5152",
  2956. "mso.dll.#3327",
  2957. "mso.dll.#6333",
  2958. "mso.dll.#420",
  2959. "mso.dll.#1335",
  2960. "mso.dll.#2041",
  2961. "mso.dll.#7834",
  2962. "mso.dll.#239",
  2963. "mso.dll.#6357",
  2964. "mso.dll.#7026",
  2965. "mso.dll.#1671",
  2966. "oleaut32.dll.#7",
  2967. "ole32.dll.PropVariantClear",
  2968. "mso.dll.#8263",
  2969. "oleaut32.dll.#9",
  2970. "mso.dll.#9307",
  2971. "mso.dll.#1441",
  2972. "mso.dll.#9223",
  2973. "mso.dll.#6453",
  2974. "mso.dll.#8044",
  2975. "mso.dll.#3698",
  2976. "mso.dll.#8565",
  2977. "mso.dll.#8373",
  2978. "mso.dll.#9741",
  2979. "mso.dll.#478",
  2980. "mso.dll.#479",
  2981. "mso.dll.#340",
  2982. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2983. "bcrypt.dll.BCryptGetProperty",
  2984. "bcrypt.dll.BCryptCreateHash",
  2985. "bcrypt.dll.BCryptHashData",
  2986. "bcrypt.dll.BCryptFinishHash",
  2987. "bcrypt.dll.BCryptDestroyHash",
  2988. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2989. "mso.dll.#8633",
  2990. "mso.dll.#5213",
  2991. "mso.dll.#6163",
  2992. "mso.dll.#552",
  2993. "mso.dll.#5630",
  2994. "mso.dll.#2513",
  2995. "mso.dll.#1607",
  2996. "mso.dll.#791",
  2997. "mso.dll.#1848",
  2998. "mso.dll.#8735",
  2999. "mso.dll.#9374",
  3000. "mso.dll.#5286",
  3001. "mso.dll.#6368",
  3002. "mso.dll.#4262",
  3003. "mso.dll.#1010",
  3004. "mso.dll.#7979",
  3005. "mso.dll.#8549",
  3006. "mso.dll.#8970",
  3007. "mso.dll.#9198",
  3008. "mso.dll.#4795",
  3009. "mso.dll.#1865",
  3010. "mso.dll.#9688",
  3011. "mso.dll.#320",
  3012. "advapi32.dll.RegDeleteKeyA",
  3013. "user32.dll.DestroyCursor",
  3014. "mso.dll.#7173",
  3015. "mso.dll.#8511",
  3016. "mso.dll.#3299",
  3017. "mso.dll.#7001",
  3018. "mso.dll.#3913",
  3019. "user32.dll.PeekMessageA",
  3020. "mso.dll.#1380",
  3021. "mso.dll.#9500",
  3022. "user32.dll.TranslateMessage",
  3023. "user32.dll.IsWindowUnicode",
  3024. "user32.dll.DispatchMessageA",
  3025. "user32.dll.DispatchMessageW",
  3026. "user32.dll.UpdateWindow",
  3027. "mso.dll.#999",
  3028. "mso.dll.#287",
  3029. "dwmapi.dll.DwmIsCompositionEnabled",
  3030. "mso.dll.#1575",
  3031. "mso.dll.#5034",
  3032. "mso.dll.#1517",
  3033. "mso.dll.#718",
  3034. "mso.dll.#4708",
  3035. "mso.dll.#8046",
  3036. "mso.dll.#4175",
  3037. "mso.dll.#8672",
  3038. "mso.dll.#1990",
  3039. "mso.dll.#3051",
  3040. "mso.dll.#1819",
  3041. "mso.dll.#1419",
  3042. "oleaut32.dll.#147",
  3043. "kernel32.dll.WerRegisterMemoryBlock",
  3044. "dwrite.dll.DWriteCreateFactory",
  3045. "advapi32.dll.RegQueryValueW",
  3046. "apphelp.dll.ApphelpCheckShellObject",
  3047. "gdi32.dll.GetCurrentObject",
  3048. "gdi32.dll.BitBlt",
  3049. "gdi32.dll.GetClipBox",
  3050. "gdi32.dll.StretchDIBits",
  3051. "ole32.dll.CoRevokeInitializeSpy",
  3052. "comctl32.dll.#388",
  3053. "riched20.dll.REExtendedRegisterClass",
  3054. "user32.dll.GetWindowLongW",
  3055. "user32.dll.GetSysColor",
  3056. "user32.dll.SetWindowLongW",
  3057. "user32.dll.RegisterWindowMessageA",
  3058. "user32.dll.RegisterClipboardFormatW",
  3059. "user32.dll.GetDoubleClickTime",
  3060. "user32.dll.SetCaretBlinkTime",
  3061. "user32.dll.SystemParametersInfoW",
  3062. "user32.dll.GetKeyboardLayoutList",
  3063. "mso.dll._MsoGetFidUspDll@0",
  3064. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  3065. "usp10.dll.ScriptGetProperties",
  3066. "usp10.dll.ScriptItemize",
  3067. "user32.dll.LoadCursorW",
  3068. "user32.dll.IsWindowVisible",
  3069. "user32.dll.GetKeyboardLayout",
  3070. "user32.dll.PostMessageW",
  3071. "user32.dll.DefWindowProcW",
  3072. "uxtheme.dll.IsThemeActive",
  3073. "uxtheme.dll.IsAppThemed",
  3074. "uxtheme.dll.OpenThemeData",
  3075. "user32.dll.GetDC",
  3076. "user32.dll.ReleaseDC",
  3077. "user32.dll.IsIconic",
  3078. "user32.dll.GetParent",
  3079. "usp10.dll.ScriptGetCMap",
  3080. "user32.dll.InvalidateRect",
  3081. "user32.dll.HideCaret",
  3082. "user32.dll.ShowCaret",
  3083. "user32.dll.NotifyWinEvent",
  3084. "user32.dll.GetWindowTextLengthW",
  3085. "user32.dll.EnableWindow",
  3086. "msctf.dll.SetInputScope",
  3087. "user32.dll.GetWindowRgn",
  3088. "gdi32.dll.CreateCompatibleBitmap",
  3089. "gdi32.dll.SaveDC",
  3090. "gdi32.dll.SetPixel",
  3091. "gdi32.dll.GetPixel",
  3092. "gdi32.dll.RestoreDC",
  3093. "imm32.dll.ImmAssociateContext",
  3094. "mso.dll.#806",
  3095. "mso.dll.#4908",
  3096. "user32.dll.SetRect",
  3097. "mso.dll.#8439",
  3098. "mso.dll.#2736",
  3099. "gdi32.dll.GetTextAlign",
  3100. "gdi32.dll.ExtTextOutW",
  3101. "mso.dll.#8122",
  3102. "mso.dll.#2114",
  3103. "user32.dll.IsHungAppWindow",
  3104. "mso.dll.#6558",
  3105. "gdi32.dll.GetFontData",
  3106. "usp10.dll.ScriptItemizeOpenType",
  3107. "usp10.dll.ScriptShapeOpenType",
  3108. "usp10.dll.ScriptPlaceOpenType",
  3109. "mso.dll.#8395",
  3110. "mso.dll.#379",
  3111. "mso.dll.#6338",
  3112. "mso.dll.#7964",
  3113. "mso.dll.#1437",
  3114. "mso.dll.#1427",
  3115. "mso.dll.#6137",
  3116. "winmm.dll.timeGetTime",
  3117. "mso.dll.#5940",
  3118. "usp10.dll.ScriptPlace",
  3119. "usp10.dll.ScriptShape",
  3120. "usp10.dll.ScriptJustify",
  3121. "usp10.dll.ScriptTextOut",
  3122. "usp10.dll.ScriptCPtoX",
  3123. "usp10.dll.ScriptXtoCP",
  3124. "usp10.dll.ScriptFreeCache",
  3125. "usp10.dll.ScriptCacheGetHeight",
  3126. "usp10.dll.ScriptLayout",
  3127. "usp10.dll.ScriptBreak",
  3128. "usp10.dll.ScriptIsComplex",
  3129. "usp10.dll.ScriptGetLogicalWidths",
  3130. "usp10.dll.ScriptApplyLogicalWidth",
  3131. "usp10.dll.ScriptGetGlyphABCWidth",
  3132. "usp10.dll.ScriptGetFontProperties",
  3133. "usp10.dll.ScriptApplyDigitSubstitution",
  3134. "usp10.dll.ScriptRecordDigitSubstitution",
  3135. "usp10.dll.ScriptGetFontAlternateGlyphs",
  3136. "mso.dll.#7578",
  3137. "mso.dll.#8483",
  3138. "mso.dll.#2613",
  3139. "gdi32.dll.GdiIsMetaPrintDC",
  3140. "mso.dll.#7848",
  3141. "user32.dll.GetForegroundWindow",
  3142. "user32.dll.GetFocus",
  3143. "user32.dll.GetClassNameA",
  3144. "user32.dll.IsWindowRedirectedForPrint",
  3145. "gdi32.dll.CreateRectRgnIndirect",
  3146. "user32.dll.GetUpdateRgn",
  3147. "gdi32.dll.GetRgnBox",
  3148. "user32.dll.ValidateRect",
  3149. "user32.dll.GetUpdateRect",
  3150. "user32.dll.BeginPaint",
  3151. "user32.dll.EndPaint",
  3152. "mso.dll.#3624",
  3153. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  3154. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  3155. "mso.dll.#6247",
  3156. "gdi32.dll.TranslateCharsetInfo",
  3157. "mso.dll.#3300",
  3158. "mso.dll.#7465",
  3159. "gdi32.dll.SetWindowOrgEx",
  3160. "mso.dll.#732",
  3161. "mso.dll.#5804",
  3162. "ole32.dll.CoCreateInstance",
  3163. "mso.dll.#434",
  3164. "user32.dll.GetMessageExtraInfo",
  3165. "user32.dll.TrackMouseEvent",
  3166. "user32.dll.GetInputState",
  3167. "mso.dll.#8461",
  3168. "user32.dll.GetClipboardOwner",
  3169. "user32.dll.GetActiveWindow",
  3170. "user32.dll.GetAncestor",
  3171. "mso.dll.#3544",
  3172. "advapi32.dll.NotifyServiceStatusChangeW",
  3173. "mso.dll.#900",
  3174. "mso.dll.#1422",
  3175. "user32.dll.MsgWaitForMultipleObjectsEx",
  3176. "mso.dll.#8662",
  3177. "mso.dll.#4746",
  3178. "user32.dll.IsWindow",
  3179. "mso.dll.#1885",
  3180. "mso.dll.#832",
  3181. "user32.dll.WindowFromPoint",
  3182. "user32.dll.GetCursorInfo",
  3183. "advapi32.dll.RegDeleteTreeW",
  3184. "user32.dll.GetCapture",
  3185. "xmllite.dll.CreateXmlReader",
  3186. "user32.dll.GetWindowDC",
  3187. "gdi32.dll.SetLayout",
  3188. "gdi32.dll.RectVisible",
  3189. "gdi32.dll.GetClipRgn",
  3190. "gdi32.dll.ExcludeClipRect",
  3191. "gdi32.dll.SelectClipRgn",
  3192. "user32.dll.GetMessagePos",
  3193. "user32.dll.ScreenToClient",
  3194. "user32.dll.IsClipboardFormatAvailable",
  3195. "user32.dll.SendNotifyMessageW",
  3196. "user32.dll.SetFocus",
  3197. "user32.dll.GetDesktopWindow",
  3198. "user32.dll.FindWindowExW",
  3199. "mso.dll.#9465",
  3200. "mso.dll.#1266",
  3201. "gdi32.dll.GetStockObject",
  3202. "mso.dll.#6501",
  3203. "riched20.dll.REMSOHInst",
  3204. "mso.dll.#511",
  3205. "mso.dll.#8118",
  3206. "gdi32.dll.GetGlyphIndicesW",
  3207. "mso.dll.#8705",
  3208. "mso.dll.#8060",
  3209. "mso.dll.#844",
  3210. "mso.dll.#3702",
  3211. "mso.dll.#3484",
  3212. "mso.dll.#1966",
  3213. "mso.dll.#3901",
  3214. "mso.dll.#6960",
  3215. "mso.dll.#7892",
  3216. "msi.dll.#39",
  3217. "msi.dll.#111",
  3218. "mso.dll.#7931",
  3219. "mso.dll.#3837",
  3220. "mso.dll.#8574",
  3221. "mso.dll.#8398",
  3222. "mso.dll.#2477",
  3223. "msproof7.dll.DllGetClassObject",
  3224. "msproof7.dll.DllCanUnloadNow",
  3225. "mso.dll.#4172",
  3226. "mso.dll.#1439",
  3227. "mso.dll.#9566",
  3228. "mso.dll.#111",
  3229. "mso.dll.#4191",
  3230. "mso.dll.#3802",
  3231. "mso.dll.#6982",
  3232. "mso.dll.#8800",
  3233. "mso.dll.#3572",
  3234. "mso.dll.#167",
  3235. "mso.dll.#5737",
  3236. "mso.dll.#590",
  3237. "mso.dll.#3758",
  3238. "kernel32.dll.FlsAlloc",
  3239. "kernel32.dll.FlsGetValue",
  3240. "kernel32.dll.FlsSetValue",
  3241. "kernel32.dll.FlsFree",
  3242. "msgr3en.dll.CheckVersion",
  3243. "msgr3en.dll.#29",
  3244. "msgr3en.dll.#30",
  3245. "msgr3en.dll.#31",
  3246. "msgr3en.dll.#32",
  3247. "msgr3en.dll.#33",
  3248. "msgr3en.dll.#34",
  3249. "msgr3en.dll.#35",
  3250. "msgr3en.dll.#45",
  3251. "msgr3en.dll.#46",
  3252. "msgr3en.dll.#47",
  3253. "msgr3en.dll.#48",
  3254. "msgr3en.dll.#51",
  3255. "msgr3en.dll.#50",
  3256. "msgr3en.dll.#49",
  3257. "msgr3en.dll.#43",
  3258. "msgr3en.dll.#41",
  3259. "msgr3en.dll.#42",
  3260. "msgr3en.dll.#44",
  3261. "msgr3en.dll.#39",
  3262. "msgr3en.dll.#40",
  3263. "msgr3en.dll.#36",
  3264. "msgr3en.dll.#38",
  3265. "msgr3en.dll.#37",
  3266. "msgr3en.dll.#56",
  3267. "msgr3en.dll.#52",
  3268. "msgr3en.dll.#53",
  3269. "msgr3en.dll.#57",
  3270. "msgr3en.dll.#58",
  3271. "msgr3en.dll.#59",
  3272. "user32.dll.LoadStringA",
  3273. "mso.dll.#2561",
  3274. "mso.dll.#408",
  3275. "mso.dll.#2714",
  3276. "mso.dll.#8622",
  3277. "mso.dll.#3380",
  3278. "advapi32.dll.CryptAcquireContextA",
  3279. "advapi32.dll.CryptGenKey",
  3280. "cryptsp.dll.CryptGenKey",
  3281. "advapi32.dll.CryptImportKey",
  3282. "cryptsp.dll.CryptImportKey",
  3283. "advapi32.dll.CryptExportKey",
  3284. "cryptsp.dll.CryptExportKey",
  3285. "advapi32.dll.CryptDestroyKey",
  3286. "advapi32.dll.CryptCreateHash",
  3287. "advapi32.dll.CryptSetHashParam",
  3288. "advapi32.dll.CryptHashData",
  3289. "advapi32.dll.CryptGetHashParam",
  3290. "cryptsp.dll.CryptGetHashParam",
  3291. "advapi32.dll.CryptDestroyHash",
  3292. "ieawsdc.dll.HrExtractTemplateToPath",
  3293. "msi.dll.#90",
  3294. "user32.dll.GetScrollPos",
  3295. "mso.dll.#629",
  3296. "crypt32.dll.CryptQueryObject",
  3297. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3298. "advapi32.dll.ConvertSidToStringSidW",
  3299. "msi.dll.DllGetVersion",
  3300. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3301. "cryptsp.dll.CryptGetDefaultProviderW",
  3302. "cryptsp.dll.CryptAcquireContextW",
  3303. "crypt32.dll.CertEnumCertificatesInStore",
  3304. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3305. "cryptsp.dll.CryptReleaseContext",
  3306. "wintrust.dll.WinVerifyTrust",
  3307. "wintrust.dll.WintrustCertificateTrust",
  3308. "wintrust.dll.SoftpubAuthenticode",
  3309. "wintrust.dll.SoftpubInitialize",
  3310. "wintrust.dll.SoftpubLoadMessage",
  3311. "wintrust.dll.SoftpubLoadSignature",
  3312. "wintrust.dll.SoftpubCheckCert",
  3313. "wintrust.dll.SoftpubCleanup",
  3314. "wintrust.dll.CryptSIPVerifyIndirectData",
  3315. "mso.dll.#8837",
  3316. "mso.dll.#1455",
  3317. "user32.dll.LoadImageW",
  3318. "user32.dll.CreateWindowExW",
  3319. "comctl32.dll.HIMAGELIST_QueryInterface",
  3320. "comctl32.dll.DrawShadowText",
  3321. "comctl32.dll.DrawSizeBox",
  3322. "comctl32.dll.DrawScrollBar",
  3323. "comctl32.dll.SizeBoxHwnd",
  3324. "comctl32.dll.ScrollBar_MouseMove",
  3325. "comctl32.dll.ScrollBar_Menu",
  3326. "comctl32.dll.HandleScrollCmd",
  3327. "comctl32.dll.DetachScrollBars",
  3328. "comctl32.dll.AttachScrollBars",
  3329. "comctl32.dll.CCSetScrollInfo",
  3330. "comctl32.dll.CCGetScrollInfo",
  3331. "comctl32.dll.CCEnableScrollBar",
  3332. "comctl32.dll.QuerySystemGestureStatus",
  3333. "uxtheme.dll.#49",
  3334. "uxtheme.dll.CloseThemeData",
  3335. "user32.dll.EnableScrollBar",
  3336. "user32.dll.ShowScrollBar",
  3337. "user32.dll.ShowWindow",
  3338. "user32.dll.SetParent",
  3339. "user32.dll.KillTimer",
  3340. "user32.dll.ClientToScreen",
  3341. "user32.dll.MoveWindow",
  3342. "user32.dll.DestroyWindow",
  3343. "gdi32.dll.GetViewportExtEx",
  3344. "gdi32.dll.GetWindowExtEx",
  3345. "gdi32.dll.GetTextCharset",
  3346. "gdi32.dll.GetMapMode",
  3347. "gdi32.dll.GetLayout",
  3348. "oleaut32.dll.SysAllocString",
  3349. "oleaut32.dll.SysStringLen",
  3350. "oleaut32.dll.SysAllocStringLen",
  3351. "oleaut32.dll.SysFreeString",
  3352. "uxtheme.dll.GetThemePartSize",
  3353. "user32.dll.GetMessageW",
  3354. "gdi32.dll.IntersectClipRect",
  3355. "gdi32.dll.SetTextColor",
  3356. "gdi32.dll.SetBkMode",
  3357. "gdi32.dll.SetTextAlign",
  3358. "gdi32.dll.ExtSelectClipRgn",
  3359. "gdi32.dll.GetTextColor",
  3360. "uxtheme.dll.DrawThemeBackground",
  3361. "user32.dll.WaitMessage",
  3362. "advapi32.dll.RegDeleteValueW",
  3363. "wininet.dll.InternetGetConnectedState",
  3364. "rasapi32.dll.RasConnectionNotificationW",
  3365. "sechost.dll.NotifyServiceStatusChangeA",
  3366. "gdi32.dll.GdiFlush",
  3367. "osppcext.dll.SLActivateProduct",
  3368. "osppcext.dll.SLGetTokenActivationGrants",
  3369. "osppcext.dll.SLGetTokenActivationCertificates",
  3370. "osppcext.dll.SLGenerateTokenActivationChallenge",
  3371. "osppcext.dll.SLSignTokenActivationChallenge",
  3372. "osppcext.dll.SLDepositTokenActivationResponse",
  3373. "osppcext.dll.SLFreeTokenActivationGrants",
  3374. "osppcext.dll.SLFreeTokenActivationCertificates",
  3375. "advapi32.dll.SaferiSearchMatchingHashRules",
  3376. "wintrust.dll.WTHelperProvDataFromStateData",
  3377. "wintrust.dll.WTHelperGetProvSignerFromChain",
  3378. "crypt32.dll.CertCloseStore",
  3379. "user32.dll.GetClassNameW",
  3380. "cabinet.dll.#23",
  3381. "user32.dll.VkKeyScanW",
  3382. "gdi32.dll.CombineRgn",
  3383. "user32.dll.CopyRect",
  3384. "gdi32.dll.SetStretchBltMode",
  3385. "user32.dll.UpdateLayeredWindow",
  3386. "mso.dll.#4702",
  3387. "advapi32.dll.CryptReleaseContext",
  3388. "mso.dll.#7531",
  3389. "user32.dll.RemovePropW",
  3390. "user32.dll.SetCursor",
  3391. "mso.dll.#1414",
  3392. "mso.dll.#8202",
  3393. "mso.dll.#7189",
  3394. "mso.dll.#2738",
  3395. "mso.dll.#8691",
  3396. "mso.dll.#6079",
  3397. "mso.dll.#7167",
  3398. "mso.dll.#7163",
  3399. "mso.dll.#333",
  3400. "mso.dll.#1785",
  3401. "mso.dll.#5919",
  3402. "mso.dll.#1283",
  3403. "mso.dll.#5973",
  3404. "mso.dll.#2014",
  3405. "mso.dll.#9668",
  3406. "mso.dll.#8472",
  3407. "mso.dll.#2294",
  3408. "mso.dll.#2968",
  3409. "mso.dll.#2281",
  3410. "mso.dll.#2628",
  3411. "mso.dll.#1401",
  3412. "mso.dll.#3425",
  3413. "mso.dll.#5291",
  3414. "mso.dll.#1718",
  3415. "mso.dll.#4777",
  3416. "mso.dll.#1914",
  3417. "advapi32.dll.RegDeleteKeyW",
  3418. "mso.dll.#235",
  3419. "mso.dll.#4416",
  3420. "mso.dll.#9398",
  3421. "mso.dll.#1442",
  3422. "mso.dll.#4388",
  3423. "mso.dll.#8022",
  3424. "mso.dll.#8757",
  3425. "mso.dll.#237",
  3426. "mso.dll.#4214",
  3427. "mso.dll.#884",
  3428. "mso.dll.#121",
  3429. "mso.dll.#1712",
  3430. "mso.dll.#9344",
  3431. "mso.dll.#4203",
  3432. "mso.dll.#3974",
  3433. "mso.dll.#4882",
  3434. "mso.dll.#2449",
  3435. "mso.dll.#2767",
  3436. "mso.dll.#9199",
  3437. "mso.dll.#7948",
  3438. "mso.dll.#3209",
  3439. "mso.dll.#4083",
  3440. "mso.dll.#292",
  3441. "mso.dll.#795",
  3442. "mso.dll.#8349",
  3443. "mso.dll.#8796",
  3444. "mso.dll.#3930",
  3445. "mso.dll.#9105",
  3446. "mso.dll.#2427",
  3447. "mso.dll.#8116",
  3448. "mso.dll.#6156",
  3449. "user32.dll.UnregisterClassW",
  3450. "user32.dll.UnhookWindowsHookEx",
  3451. "mso.dll.#7002",
  3452. "mso.dll.#186",
  3453. "user32.dll.PostQuitMessage",
  3454. "mso.dll.#591",
  3455. "mso.dll.#2272",
  3456. "mso.dll.#4284",
  3457. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3458. "mso.dll.#4426",
  3459. "mso.dll.#8473",
  3460. "mso.dll.#8106",
  3461. "mso.dll.#8876",
  3462. "mso.dll.#4210",
  3463. "mso.dll.#8586",
  3464. "mso.dll.#8004",
  3465. "mso.dll.#6078",
  3466. "mso.dll.#815",
  3467. "mso.dll.#187",
  3468. "mso.dll.#5625",
  3469. "mso.dll.#8316",
  3470. "mso.dll.#7598",
  3471. "ws2_32.dll.#116",
  3472. "user32.dll.RemoveClipboardFormatListener",
  3473. "user32.dll.UnregisterPowerSettingNotification",
  3474. "powrprof.dll.PowerSettingUnregisterNotification",
  3475. "shell32.dll.#155",
  3476. "advapi32.dll.EventUnregister",
  3477. "user32.dll.UnregisterClassA",
  3478. "gdiplus.dll.GdiplusShutdown",
  3479. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3480. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3481. "mso.dll.#2482",
  3482. "mso.dll.#5458",
  3483. "advapi32.dll.UnregisterTraceGuids",
  3484. "comctl32.dll.#321"
  3485. ]
  3486.  
  3487. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!