API tools faq
paste
paladin316

Docs_9eafb0bbfd910c927cb107d0ccf1168a_doc_2019-07-09_08_30.txt

paladin316
Jul 9th, 2019
2,094
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 182.99 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_9eafb0bbfd910c927cb107d0ccf1168a.doc"
  7. * File Size: 267400
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "558bdda4a50b496b097d9b538a5fe385de26f2157ebd86fe9f112f7ae528e090"
  10. * MD5: "9eafb0bbfd910c927cb107d0ccf1168a"
  11. * SHA1: "36f04237bdca95f6a97d12d7a7283cf76db7d4ec"
  12. * SHA512: "d12a4063e0bc16b1b6f8aa3a9ac867831fbd5a1f9b6b63d41a89b9e27d0a8cf8ac2db95844b686eb3e1044dec414f765bde809ae0498297c7538f17a4e3ba5ce"
  13. * CRC32: "DFFEE972"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLefpFFlPa2KVv9XaiuQY3EzejLexZnwnH26i/wm:sxxQW3yxUlW3Z2WH2MT03eTuCcnYyL"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2308"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  33. "Details":
  34.  
  35. "IP": "69.192.108.32:443"
  36.  
  37.  
  38. "IP": "23.15.4.32:80"
  39.  
  40.  
  41. "IP": "104.18.24.243:80"
  42.  
  43.  
  44. "IP": "104.93.33.19:443"
  45.  
  46.  
  47. "IP": "52.109.6.6:443"
  48.  
  49.  
  50. "IP": "152.199.4.33:80"
  51.  
  52.  
  53. "IP": "72.21.91.29:80"
  54.  
  55.  
  56. "IP": "52.109.16.4:443"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  62. "Details":
  63.  
  64. "ioc": "quations.dotx"
  65.  
  66.  
  67. "ioc": "ontent.inf"
  68.  
  69.  
  70. "ioc": "gosttitle.xsl"
  71.  
  72.  
  73. "ioc": "gostname.xsl"
  74.  
  75.  
  76. "ioc": "nline.xsl"
  77.  
  78.  
  79.  
  80.  
  81. "Description": "Performs some HTTP requests",
  82. "Details":
  83.  
  84. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  85.  
  86.  
  87. "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
  88.  
  89.  
  90. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  91.  
  92.  
  93. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  94.  
  95.  
  96. "url": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl"
  97.  
  98.  
  99. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  100.  
  101.  
  102. "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"
  103.  
  104.  
  105. "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D"
  106.  
  107.  
  108. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  109.  
  110.  
  111. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  112.  
  113.  
  114.  
  115.  
  116. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  117. "Details":
  118.  
  119. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$i\\xab;\\xd4\\xc5\\xc7\\xcb\\x95e\\x017\\xf8\\x18h\\x06\\x85iuj\\x9c\\x0e\\x023\\xb3\\xd6\\xc3\n#\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  120.  
  121.  
  122. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\xa8\\x19\\xa5\\x19y\\x99\\x07\\x8d\\xb8\\xa7\\x16i\\xa4\\xd1m\\xefr\\x8ca\\x88\\x87\\xbf\\x00\\x93\\xbf5\\xbe\\x03c\\x7f\\xc3b.\\xbb\\xea\\xdc\\xe5\\xfe\\xe0m\\xc79\\xe3\\xa0\\xd0\\x90bx\\xa3\\x7f\\xec\\xeb\\xde\\xfan\\xa1\\x12*f\\x1b\\xb9q\\x1d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x0e\\xca$\\x8f\\x06;\\xbe\\xbfw6\\x8f\\x07sv<\r\\x91g\\x1b\\x0b\\xf8\\xfc\\xdcl\\xabe\\xb0\\xf9.\\x9ft\\xbe7u6\\xf4\\xd1\\xa3\\x92\\x91c\\xe97\\x80\\xaa\\xd7x"
  123.  
  124.  
  125. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p&\\xfa\\xf7\\x14\\xcc`\\xa3\\xe0=\\x16&\t\\xdbe\\xb5v\\x1d\\xf0\\x92\\x19\\xfd\\xa7\\xb0e\\xb7\\xd2\\xe1\\xa6\\xc4|-i/\\xc0\\x05\\xde\\xf6\\xe5$\\xcb=\\x0cf\\xd5\\xb6\\xf2:m`\\xcb\\x93\\xe9\\x05\\xea\\xe4\\xfd\\x14\\x13\\xa3\\x0bff\\xc2d\\xb5w2r\\x08\\x94\\xc5\\xbc\\xbe\\x9f\\xe7)\\xa0\\xe8\\x05\\xb0\\x9e\\xb0\\x86\\xc3\\x8c?n\\xde\\xa2n\\xa2\\\\xa6cr\\xdb\\xf5\\xcdd\\xf0 \\x04v0\\xd5:cq\\xea\\xcf\\x86\\xabe1\\xce\\xdc\\xbf<\\xa2\\x1d\\x81\\xec~x\\x1e\\xf3\\xb63jtw\\x19a\\x8b\\x8b\\xeb2\\x92\\xcf@o\\x96/m\\xe2k\\xcf,\\xda\\x1d\\x8e.,(\\x8a\\xb2\\x89@\\x8b\\x98\\x16\\x0fux.d\n1i\\xeb\\x0f|\\xa7v\\x89p+\\xde\\x18\r1%\\xf2\\xe6\\xd1\\x1eg70\\x0c\\xaahe\\x1do\\x82l\\xea\\x82\\xb2m/\\x9a\\xc8/\\xc8\\xb2\\xdcfm\\xad\\xcc\\x96@b\\x0e(\\xd3\\xd6\\x86\\xb7f6i\\xf5\\xff\\xd9\\x13k\\xc8?s\\xa6l\\xb1n\\x83\\x0f\\xfc\\xc7\\xb4x\\xf4g\\xa8\\xe2e"
  126.  
  127.  
  128. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$i\\xac9\\x83\\xf9\\xe5\\x97\\x0b\\xbb\\x86qe\\xc5t)\\xf8\\xe7\\xd1\\xe6\\xce`k\\x915\\x11\\xcao\\x06\r\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  129.  
  130.  
  131. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)\\x18md~\\xcc\\xa2t\\x14\\x1fa\\xe4/\\xb2)'\"\\xa8\\xb8\\xad\\xc0\\x00\\xaf\\xdd\\xaf\\xc9q\\xc1\\x15\\x12\\x15v\\xd5\\x92\\xe4\\xc5='\\xda\\xbdi\\x80\\x1du\\x9do\\xe2\\xf15\\xfb\\x00\\x189+\\x1c`p\\xd6\\xce0\\xd6kf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8\\x9d\\xcd\\xbb\\xa0\\xffrtv\\xf3m\\xfeo\\xf4_\\xa8\\xcbu\\xaer\\xe6\\x8e\\xcdx\\xc4\\xc2\\xa6\\x14\\x8be\\xb3c9\\xee\\x15i`\\xe6\\xb0vx\\xa9\\xf5\\xc7\\xcd\\x18"
  132.  
  133.  
  134. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  135.  
  136.  
  137. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  138.  
  139.  
  140. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$i\\xb1\\xd1\\xf7zr\\x07\\x83\\x80\\x90\\x89\\x08f\\xda\\xda\\xd8\\xe1x\\xac\\xdea\\x14\\xd6\\x01\\xbdi/\\xcc\\xb8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  141.  
  142.  
  143. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\x96\\x8bd\\xf2yz\\xa1\\x8e\\x14\\xf7fa`\\x90@\\x89\\x961\\xcfuo\\xc6\\xa11\\x85\\x7f\\xd9|\"\\xf9\\xf6\\xb6e\\x96\\xbc\\xb0\\xb3l1\\xfa\\xda\\x1b\\x1b\\x1cb\\x89\\xdbd\\x19\\x05\\x07\\xdf\\xff\\xb3\\x00tb\\x8b^\\xdby\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000zh\n\\xa5(\\x1dou>+z\\x83\\x8a/x\\x1e\\xcf\\xe6n\\xcc\\xe5_j\\xd9\\xfb\\x92y\\xa05\\x04or\\xd0\\xf2\\xed\\xf6\\xea\\x1ady\\xf4l3\\xb5\\x83*\\x1d\\xc5"
  144.  
  145.  
  146. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa9t.\\xd6%3\\x9e\\xec\\x01\\x13e\nxgc\\xd9b\\xb5\\xca\\xc5f+&y\\xdd\\xe7\\xe4b\\x05\\x9ar.\\xc9\\xae6\\xd3p,8\\xde\\xd0zf\\xfc\\x87bl*\\x19\\x9b\\xb0\\x02\\x03/\\x8bl\\x14\\xd6\\xb3\\x07\\xd80\\x95\\xf9\\xdc\\x91u\\xf2u\\x03\\x88\\x07\\x0ci-\\xef\\x1ao\\xa6\\x96~=\\xc6\\xd7\\xf9\\x10uu\\xc0\\x88\\x16\\xccz,\\xd3\\xbf/\\xdc\\x96<\\xa2\\xe9v\\x83\\xe1\\xd5\\x86\\x86,\t\\x95ps\\xc8weo\\xbdl\\xbb\\xfac\\x1a\\xc1xo\\xd7\\x9e\\xba\\xb4on\\x17t\\xb1\n\\xff0$\\x81p\\x8d+\\xba\\xb2`\\x06\\xa9v#4\\xe8i\\xce\\xa9n\\x1a+\\xaeu<v7s\\xb9m>\\xc0\t\\x1f\\xb3(\\xe8\\xb2\\xa9\\x9b\\x92\\x8f\\xc6?\\x01\\xd1\\x1d\\xf7\\xed\\xa1\\x9b\\xec\\xfcgq\\xd0\\x01<\\xa8k\\x12\\x18\\xdel\\xf65\\xbc\\x8a^u\\xa3\\x9bady\\x07(\\x84k\\x81\\xea\\x90n\\x7f\\xf9?`\\x9fb\\x88\\x85%\\x03fm9\\xd9q\\xbb\\x80q\\xd2\\x9b@+y\\xf77"
  147.  
  148.  
  149. "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: mscrl.microsoft.com\r\n\r\n"
  150.  
  151.  
  152. "http_request": "winword.exe_WSASend_\\x06\\x01\\x01\\x00\\x01\\x00\\x00y\\x03\\x01$i\\xd3\\x17tx5dy\\xb9dd\\x90sn\\xf0f\\xc7\\x7fq\\x17p\\xce\\x92\\xc1a\\xa20\\xe8\\xfa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  153.  
  154.  
  155. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe7\\x0b\\xeb\\x91\\x9e\\x03|\\x93#\\x18gl2\\x02\\xc7\\xa3\\x96\\xef\\xbcapx\\xcd\\x8a\\xe6\\xc2^b\\x17\\xd6!\\xf5z\\xfd\\xa1\\xf0\\x8e$\\x12<\\xde\\x96\\x06\\x9d\\xa2\\xc2lh\\xf2\\xb8\\xbd\\xe3i9\\xe0\\x9fl\\xe6\\x89\\xa0^n_\\x8d\\xeaf\\x10m\\x0b\\xbf\\xe9\\x841gso\\xc3\\xf5\\xfd\\x1d\\x06\\xf0\\xc0\\x97\\x85\\xd6m\\xd6\\xf2r:\\x03\\x8c\rgpa\\xa0\\\\xe4\\xa4\\xff\\xffu\\x10h\\xfcn\\xf8\\x84?\\x89\\x82\\x92\\x0b\\xc3i\\xc6\\x93\\xf2\\xc5\\x14\\xdd4\\xd8\\xec\\xc3^\n\\xb2\\x02;\\x0b\\xeao\\xe2\\x01\\x84\\xe6\\xef\\x10wx\\xfc\\x9db\\xeb\\xc6\\x93=\\x80\\xba<\\x9f\\x10\\xf8\\xf4\\xb34\\xd2\\xcbhu\\xc3\\x06r\\xa8\\xa9\\xf9\\x95.w/1\\x07\\xe2\\xd6\\x85p*\\xb0\\xf3\\xf2nf\\xca\\xfb\\x89e\n\\xcem#\\x92\\xfa\\xc2\\x91\\n\\x87r\\x90\\x04\\x13\\xd2ve\\x82\\x10\\xbe\t\\x1bo\\x93\\x82h\\xf8#\\x03p\\xd2\\xfc\\x9a\\x93^f\\x95\\x87\\x19\\xe8\\x81\\xd3\\xca\\xb0\\xc1\\x1a<\\x03\\x1e\\x05s>r\\xdf\\xb3\\xb6\\xbf"
  156.  
  157.  
  158. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 v\\xcc^z\\xbf\\xe9\\x1ct2b\\x942\\xd0\\xfe\\xa0\\xcf\\xf1x\\xb8\\x9d\\xc8\\x02\\xd7\\xa0\\x8a\\xea\\xb8y\\x94h\\xb6\\x8fe\\x85\\x9b\\x97\\x7f\\x95\\xb6\\x8c\\xc5;6\\x93\\xf7r\\xdd\\x14\\xcetn\\x0cj\\xf8\\xb5\\xb87\\x1d\\xb6\\xa6\\xc4\\xee\\xf2\\xee\\xe0\\xa8g\\xa3\\x8c\\xdct\\x8d\\xa3\\xc2\\x92c5\\xfe\\x18\\xbc\\xefy9\\xfb~\\x85\\xdcm\\x16\\xff\\x87\\x8e\\xb5y6\\xca\\xf3p\\xbf\\xea\\x9dt\\xef\\xe0%o%\\xc9'6\\x0bf\\xa1\\xc2\\x01\\xb5\\xc4\\xaal\\xd6\\xb6\\x0f.\\xb5\\x0e4\\x1b\\xa2a\\x86\\xa1\\xde\\xb0\\x9d\\x19oq\\x06\\xbe\\xfa\\xb1\\x88g\\x93\\xb3\\xd3d\\xd04\\xe1wqyc\\x13\\xb9:\\xcc\\x0f1\\xe6s\\xed\\xdf\\xbb\\xd9\\x0e\\x8b\\xa7|s\\xe8\\x88t\\x9a\\x13?s\\xe7w\\x8c\\xb2\\xcfw\\xd0i\\xc1\\x89\\xb7\\x80@i\\x14\\xa6\\xc1i9!#&n\\x00\\x15\\x9d\\xcb:<9s\\xec\\xef,z\\xff\\xd11!u\\xa3#e3\\x86a<\\x19e\\x9c\\x8cl\\xa4\\x14\\x17\\xcf\\xf1_\\xfa\\x02i\\xe0\\x93\\x88\\x89\\xf3~\\xb1za\\xbb\\xeb"
  159.  
  160.  
  161. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xab\\xf2\\x10\\xb2\\xd3l0l\\x18\\xec\\xcb\\xf3\\xcd!\\xba\\xd4\\xcd\\xf3\\x1e\\xef^\\x1fb\\xbf\\xc7\\xd6%\\xb3\\x03d\\xa5\\xd61\\xc9\\xb9c\\xb4k\\x16\\xd4x\\xbf\\xdb$sr>\\x89\\x8f\\xaek\\xac\\xd42`\\x1ec\\xe9\\x1bp_9\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0by\\xae--\\x91\\x16\\x97\\xf5j\\xd3g\\x1b\\xc2\\x9d!\\x16?\\xbf6\\x7f\\xcel\\xa4\\xd6\\xb3\\xb6mn\\x87qm\\x90\\x86\\xe1\\x04\\x94~>\\xcf\\xb0\\x81o\\xfd\\xdc\\x9dp"
  162.  
  163.  
  164. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pm\\xfa!+0h\\xa0m\\xcd\\x08\\xf0\\xfa\\xac\\x96 \\xd7\\x99.\\xbd\\x83\\x10\\xd03^\\xc5s\\xf1w\\xef\\xfcom\\xbfv\r\\x99fd\\x1eegd\\x97\\xaf7\\xad>\\xea\\x08(l\\xb8\\xd9\\x0c\\xc7\\xdf\\xef\\xc48\\x0bb\\x17\\xbc\\x93\\xa1) \\xf9\\x0b\\x00\\x0c\\xe0\nw\\xa3@\\xca(\\xa6bj\\xc0\\xed&\\xd1\\x1c\\x02\\xf3w\\xc5\\x93\\xcaiv\\xd7\\x17?5=\\xc5\\x8ft\\x19\\xaa\\x8ech\\xee;q\\xd2c\\xe4q\\xb3i,(\\xc0t\\x13(\\xce\r\\x00j\\x7f\\x88\\x0f\\x04u\\xc0z\\xe8l\\x0c\\xd4\\x9a9\\xaf\\x0b\\x9f\\xe3\\x0c \\x88\\xc9;+\\xd1\\x00\\xd6\\xe4/\\x05\\x15\\x7f\\xa2\\x05\\x90\\xf2\\x94\\x02\\x9e\\x9c\\xeb\\xfa\\xf6\\xd4_o\\x10\\xdb\\x06\\xf2\\xf2b\\xae5v\\xcf\\x8f\\xb7\\xc6\\xd6\\xc2=\\xf0\\xc8\\x1d\\x02\\x9e\\xd8.c\\xf9\\xdb|jy\\x96\\xf5(e\\xad\\xb0&\\x997\\xe9)u\\xdb\\x9a3\\xbb\\xe2\\x98\\xa8\\xe7gg\\x04\\xf9\\xb1\\xfc\\x02\\xa7\\x08\\x1a\\x1b\\x0bxz\\xcd\\x06t\\x87\\x96\\x86?\\x1f?;gu\\xde"
  165.  
  166.  
  167. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xc6\\xd5\\xf3fh\\xb0\\xb0\\xcc\\xd5\\xc4\\xe3u\\xa5\\xe0\\xda\\x10\\x87\\x8dzq\\xebmh\\xc8w\\x1d\\xe2\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  168.  
  169.  
  170. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x87^z\\xa1\\x15\\x07\\x7fv\\xd9\\x0c\\xa9\\xe8\\x10i\\xceco\\x8f1x\\x1ez.\\x1d\\x80~e\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  171.  
  172.  
  173. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7m;\\x1c\\xd6\\xc87n\\xf7\\x88\\xc4\\x1e!\\xb9_@\\xb5\\x01\\xb6k\\xa9:q\\x81.\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  174.  
  175.  
  176. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\\\x85f\\xc5\\x0e\\xe6\\x05b=\\xaa\\xc3\\x02,\\xf5\\xbe\\x80;\\xe5;7.\\x8d\\xb9\\x81\\x80b\\x13\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  177.  
  178.  
  179. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x19\\x10\\xf6\\x8fi\"\\xf2ca?\\xb4\\xa5\\xd8\\xa7\\xb7\\xae\\xe5z\\xddq\\\\xda\\xac\\xab\\x07f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  180.  
  181.  
  182. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x9c\\x14z\\xdd\\xf6#\r\\x94-\\x13\\x9dx\\xd2\\xf0\\xfc\\x14\\xb3gd\\xd8\\xf5\\x1ftb\\xff\\x04k\\x14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  183.  
  184.  
  185. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xfbrj\\x98\\x92w.oyj\\xa4\\x99\\x99?\\xee^v\\x0ey\\xe9\\x87e\\xd38\\xf7\\x7f \\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  186.  
  187.  
  188. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7t\\x91\\xa9m\\xd2\\xbc\\x89\\xdd\\xf0\\xbf\\x9f\\xa8\\x87@\\x0bqh\\x1d\\xa5;\\xcd\\xb5\\x8cmpo\\x11\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  189.  
  190.  
  191. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7q\\x1f\\x06\\xc6\\xac\\x82\\xb2\\xee\\xe1\\xd1qu\\xd0\\x02\\xfbd\\x01\\x0c\\xaea\\xfa\\x81\\x15\\xa2\\xb7b~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  192.  
  193.  
  194. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x95\\xefm\\xd3\\xe4\\xeef|\\xdf\\x9c\\xa7\\xa7.\\xbb\\xfco\\xcbk\\xd1\\xc8d\\xcb\\x17\\x066\\xa6\\x9e\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  195.  
  196.  
  197. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x8f#\\xbb`\\xdb\\xed\\xae\\x9a\\x17\\xad\\xc6\\xe6\\xfb\\xdc\\x97@\r\\x9c\\xfa\\xde0_=\\xee\\xe0s\\x00\\x11\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  198.  
  199.  
  200. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\\\x9bv\\x1b\\xa7\\xba\\xd4\\xc2\\xae\\xee\\x1a\\x12\\x16\\xc7\\x8a\\xea'\\xb1\\xde\\x1f\\x1f\\xa1c\\xaa\\xf6d\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  201.  
  202.  
  203. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7?\\x1f\n\\x92\\x86\\xd0\\xbb\\x05\\xadv\\x05\\x1a\\x03\\x06wr\\xea\\x88\\xead\\x05n^-\\xfc%\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  204.  
  205.  
  206. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x10le\\xfc\\xc8\\xae_\\xd4)f1\\x9c\\xd7\\xba\\x1bch\\x8e\\xfd\\xc1j\\x1f\\xc51a\\xe4\\xbfj\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  207.  
  208.  
  209. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xfa\\xa2k\\x86\\x1b.e\\x0be\\xbc\\xbct)\\x05\\x84y\\xf1\\x8d-\\xa1\\x8a\\xde\\xc4f0r\\xc0\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  210.  
  211.  
  212. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xc0k\\x81egt\\xc2\n\\xeax\\x88\\xbe\\xd0qoa\\xa9m\\xa8f\\xd3\\x13\\xa3 \\xa1\\x1c\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  213.  
  214.  
  215. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xf3\\x8c\\xdbu%vu\\x9cj3\\xd8m\\xf5b\\xfck\\xc6y<\\x82\\x18^\\xc9\\xd5\\x16)\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  216.  
  217.  
  218. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x94\\xae(\\xc2l\\xcc z/\\x89\\x15dd\\xd8\\x99'\\xb6\\xe3|\\xae\\xb15\\xa1w\\xb6\\xdf\\xb9(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  219.  
  220.  
  221. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xbf_\\xaf\\x19\\xb3\\xb9tc\\x98a\\xfe\\x94\\x03\\x94\\xe1nn\\xf11\\xf4\\x01c1\\xdd.\\xb6f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  222.  
  223.  
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xf1\\x94\\xb7\\x85\\xc3g\\x1f\\x8cra\\x9f\t-1j\\x89\\x83j\\xa1\\xd7\\xd3\\xf6\\xde\\x04\\x11\\xc5\\xaae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  225.  
  226.  
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xccb\\xf52ff\\xcb\\xf9p\\x86p\\x08\\x9c\\xc9\\xf5s\\xe5\\x86\\x0e\\x16\\x924\\x0c\\x10\\xf2\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  228.  
  229.  
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xfa\\xefv\\x14\\xb2a\\xae\\xca\\x911\\xa4\\xc1\\xed\\x8c\\x1b\\x08\\xee^\\xf3-b\\xcd\\xbc\\x06\\x84\\xbe0\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231.  
  232.  
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xe7\\xc4i\\xe3\\x88\\x93\\xb1\\x9e6\\x18 \\x99\\xea\\xd3)\\xd7<rl\\x1c\\xba\\xfa5u\\xc6\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234.  
  235.  
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7imh>\\xcd\\x1c\\xd0fv\\xe6\\xe4\\x10\\x99\\xc4\\xa6\\xec\\x91`\\xac\\x1cz\\x12u\\x81\r\\xe5\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  237.  
  238.  
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x1d\\xda\\x7f\\xe0\\x11\\x8d\\x18h\\xe3\\xcfz`m\\xdba\\x1b)\\x8e\\xb1<\\xeb\\xac\\xe2\\xd7\\x17\\x87\\x8a\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  240.  
  241.  
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd73\\x1fa\\xfb\\xd3\\xc7tn\\x00h\\xa8f\\xecr\\xc7\\xd4\\xcats\\x1b@\\xc7\\xdd\\xf4\\x80h\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243.  
  244.  
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\x7f\\xaa!%\\x9b2\\xb2\t-\\x8dah\\xd8z\\xca\\xb8_l\\x0e\\xc5\\xeb\\x1b+\\xf6\\xec\\xfa\\x18\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  246.  
  247.  
  248. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xb1v(\\xa4\\xa6z\\xb22\\xfd\\xe9\\xfa\\x1b^\\xea\\xce:\\x0b\\xf1\\xca\\xdbax\\x9e\\x00\\x91\\x95\\xed\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  249.  
  250.  
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7y\\xbd\\x9c\\xd7h\"\\xe0\\xef\\xab\\xf3y\\x11\\x8a6\\xa1\\x0f\\x02\\xc0\"\\x9bs\\xa7\\xf6\\x82\\xc4\\xb8\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  252.  
  253.  
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd7\\xeb\\xfe\\xb7p\\xfd\\x7f\\x96\\xb49\\xee\\xe2\\xf3\\xc3\\xe6\\x04\\x99\\xc6w\\x8c\\x8er\\x87\\xd8\\xea\\xcf\\x00\\xe9w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  255.  
  256.  
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xe7\\x99\\x95vm\\xc6\\xab\\xb6\\xab&\\xba\\xf6i\\x17ce\\xc7\\xf3<$\\xef\\xe6\\xff\\xe4\\xce\\xe2\\2\\x90\\xf9-py\\xce\\xd0u\\xa6\\xc3\"\\x8a\\xfc!\\x16\nmo\\xca<\\x0e\\xda\\xea\\xa2s\\x86\\xf1`4~q\\x83\\x12\\x9a\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0007\\x19\\x81p\n<t\\xcf\\x85!j,$\\x9f\\xc8\\x1di\\x1e~n\\xb1\\x8c/\\xf1\\xc6\\x9aw\\xa5\\x0b\\xe7k<6\\xd8\\x8cro\\xa4p\\x85s\\xba\\xc5\\x9b\\x9fp\\x8ez"
  258.  
  259.  
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x83r\\xa2:v\\xe3\\x87\\xe8n\\xe2_:z\\xcd\\xe1bh\\xb3.?\\xe8#m\\x97\\xe6&\\x98d\\x05\\xa6@\\xc7\\xfe\\xef\\xe0rlt\\xb6\\xff\\x11/\\xf2\\xb5\\xf4\\xa1of\\x86\\xac\\xa4e\\xe1\\xcd\\xbf\\xfe\\xe2\\xd6\\xbf\\xb8/\\xa87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s\\x99h+\\x82\\x82wqc\\xa9\\xa1\\xac1\\xd2\\xb3\\xc4\\xd4\\xc8\\xea\\x9c\\xdb\\xbe\\x8a\\x83\\xe4=\\xe9#c\\x03\\xca!\\x16agy*(2zs\\x18c,\\x94\\xe7"
  261.  
  262.  
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04'\\xbe\\xe8\\xc0\\xa5=f\\x9d\\x8d\\x9a$q\\xe8f\\xf0b\\x9d\\x94\\xdc^ g\\x8bz7\\xc7d\\x0eb4wt\\x99f\\xb8)\\x98v\\x86h\\x7fn\\x01\\xcf:\\xa3\\x1el-\\x19\\x9at\trf\\x94\\x0f\\xae\\xe3\\xa5o\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcf\\\\xe8\\xd0\\x10h\\xe8\\xda\\xa1\\x1e\\x10\\x80\\xfc\\x89f\\xc7\\x81\\xe8\"l\\xe8\\x1d\\xf5\\x04\\xfdv\\xfa\\xd8\\x9c#\\xfbf\\xd6p\\xee\\xa9@kgv\\x90dcuy/\\x0f\\xc5"
  264.  
  265.  
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04bd\\xf8-\\xbb\\x05\\x9c\\xce\\x81\\xb3\\x88\\xa5'\\xb6+f\\xd41*\\xb0p37\\xa5c\\x9e\\x8cb'\\xc1\\xa9\rkl\\x8f\\x16mj\\xd6\\xbc\\xace\\xc3\\xf5\\x80\\xc4!da\\xd7\\x9dc\\x1a\\x8d\\xcc\\xddd\\xd1\\xfb\\xe2!\\x82\\x90f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.r\\xe1i/\\xee\\xda,\\x16w\\xf8\\xaf4cx\\xa3\\xc8e\\x1e\\x80\\xd0\\x11\\x0b\\x87\\xfdu\\xa7\\xe8vs\\xf8l\\xf78\\x92b\\xe6\\x8a\\x86\\xb3\\xbe\\x9c\\x11m&rf"
  267.  
  268.  
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9h\\xf9\\x82\\x19\\xb4j\\xb9x\\x07l\\x90\\xf4\\xa8n\\x9a\\xf7\\xecr\\x9a\\x1e\\x04\\xf8\\x9f\\x11\\xb0\\xad\\xda6j\\x8b\\xcean&\\x17\\xb1z\\x02y\\xda\\xf7b\\xf3\\xb1/\"ji\\x0c\\x19mv,l5\\x01\\xc2\\xe6\\x82\\xd3@\\xbb\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000y\\x0c_\\xa2\\x8f\\xc6\\xac\\x1d\\xa8g\\xf1\\xbe5\\xf9\\xae~\\xe7\\xc9m\\xa1g\\xb0\\xc2\\xb8dg\\xf7\\x05\\x1e>\\x1d>\\xc1m<\\xf9w\\xe8\\xed\\xf8f\\x1f\\xa6=\\xb3x\\x9b"
  270.  
  271.  
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa5(\\x1fa\\xe0\\x12a\\xef\\xb9ho\\x1c\\x88&e\\x13\\x82,\\x82\\x95\\xec#*\\x8f\\xd6\\xedz\\xc4n6\\x18\\x11\\x1e\\x87rw=+\\xcf3zh\\xb7\\xf2s\\xc1\\x1bf\\xe7^\\xbe\\x9ei\\xc3\\xe1\\x18\\xc4\\x83\\xd2r\\x0cx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xa2\\x9a\\xd8\\xa9\\x9em*\\xf0)qok\\xbe\\x8f0\\xabo\\x17\\x167\\x05\\x16<\\xa0\\xd5\\x15k\\xee\\xb2\\xfd\\xd6\\x1e\\x1a\\xf9\n\\xd0\\xe8\\x8f\\x93\\x1c\\xf2\\xab\\x96v\\xcfc\\xd0"
  273.  
  274.  
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\x07y%9/5\\x9b\\xeb\\x06y\\x863\\xae\\xf8s.l\\xb59\\x11\\xa8*\\xca)\\xdc\\x03p\\x86s\\x13p\\xf0\\xdf\\xb6\\x14\\xcb\\xa7m'&~\\x84\\xb2\\xf0\\x11\\xd4t#\\x90i\\xf6pt\\xd0\\x04\\xa9o\\xa7\\x9f\\xb1fg\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004\\xab\\xf6\\x14\\xeb2\\x18\\xa7\\x12j\\xad\\xa5\\xe1\\xf8\\xe6x\\x97f\\x1c\\xae\\xcd\\x9ak\\x97\\x04\\xfe\\xaa\\x10\\xb8\\xd5\\xf8\\xa6w\\xca\\x1d\\xf5\\xf8_\\xc7\\x01c\\xc3\\xb5\\x8f\\x0fk"
  276.  
  277.  
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\xf3o\\xab\\xb4\\xbe\\x03:k\\xf0*\\x1d:\\x83\\xa1\\x01\\xad18&;\\xfa\\xa6\\x87-\\xe8\\x04\\xb2\\x9f\\x9ax(\\xcc\\x88\\xc4\\x8d\\xadv\\xe5x\\x16\\xc2\\xa2\\xe3\\xec\\x0c|\\x98g\\xbb#\\xfen\\xf2\\x8f\\xe8@'\\x9ao\r\\xbas\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc\\x82\\xf5l\\x05\\x1dih\\x0e,\\xe3\\xab\\x84\\xc7\\xf4\\xc9\\x13m9z&q9\n|\\x03\\xe3vf\\x16g\\x01\\xc7<\\xef\\xffl\\x91\n(d.\\xd1\"\\x8b\\x19"
  279.  
  280.  
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z%\\xf7o\\xc5\\xe3\\xce\\xf9\\xc4&)\\xa0\\xe8\\x17\\x1e\\xef\\xa1\\xfe<\\x0f\\x86=o2\\x9c\\x94\\x93\\x90\\x9b/*\\xdbs\\xee\\x0e@\\xb4\\xadb\\xc1\\xbe\\xfea$\\x07.\\xd9gl\\x00%_x\\xd9\\x06\\xc7\\xe8gt\\x1f\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf4\\x19\\xe5\\xce\\xa6cr<\\xe6z `\\x19k\\xa1\\x99\\xaf7dwh\\xb7r_\\xe4\\xe5fr\\xbckf,\\xb3\\zs\\x7f\\xacw\\xc7`0\\xa1\\xb1\\xc4\\xe3\\x91"
  282.  
  283.  
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a,\\xea\\x00\\xdd!pws\\xf0\\x9d\\xc9\\x1c\\xab\\xb4\\x10\\x1ax\\x1b\\x86\\x9b\\xe3 \\xc7\\x1fz=\\x9d\\xf7\\x11(u\\xc4\\xcf\\xb1\\xf2\\x90\\xc8\\xc1\\xf5i\\x07p\\xa2\\x8f\\x83\\xc5\\xd8\\xaai\\x04\\xf9\\xd2\\x1d\\xef\\xc8\\xb9n9)63\\xe8\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\\\x8c%p\\xc9e\\xe4\\xa3\\xa0jf\\xdd\\xfansg\\xd1\\x93\\xc6\\x9d\\xdb\\xce\\xb0\\xb5\\xfb t8\\x87zh\\xe2\\xa7j\\xd9\n\\xcd>u\\xd0\\x8d\\xce\\x05/\\x80\\xae\\x9a"
  285.  
  286.  
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcfb\\xab\\xf2*\\x0f\\xbe\\xa3g\\z\\xf3\\xce\\xbcfz\\xdc\r\\x9d\\xd8#\\x83\\xc1\\xa8\\xbc<\\x9f9\\xa9\\xfb9\\xa1\\xbc\\xd6\\xf8\\xa5 \\x05\\xcb\\xb7f2\\x03n\\\\xce\\x08\\xe4\\sc\\xc0\\xa0>\\xa1e\\x96\\xe7:,\\xe8\\x07\\xee\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\xbc\\xd7\\x01\\xf9\\x17p\\xef\\xff^4\\xb3\\xb1'\\xe5\\xebsg\\xfe\\x1ca\\x9b\\xe7\\xe8\\x8aq\r/\\xbe ?\\xe7\\xa8s5\\x9b!r\\xfd%78\\xd0\nu\\xbb"
  288.  
  289.  
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\x00\\x1evdu\\xb6g\\xd8?\\xc2\\x0f\\xfa\\xa4^\\xab\\x19\\x1an\\x87\\xa8\\xf7\\x13\\xc9\\x8cn/+\\x08\\xfa\\xdb\\xa7\\xac\\x818^r\\xbel\\xc8ye\\xe9\\xe8\\xa8\\x94\\x8bg\\xa2\\xe6\\x85q^\\xda)\\xf5\\x7f\\xefy\\x14w\\x1f\\xc5a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfc\\xa2\\x98_\\xae\\xa3\\x16<\\xfdc\\x80\\x10\\xec\\x0bc*\\xdc\\xc6\\xa5\\xb3cma\\xc23\\xcb\\xe0\\xab\\xe5\\x8a\\xa4\\xef_\\xedh\\x84\\x1a\\x81\\x0c\\x188\\xfb\"\\x14\\xd6\\x7f"
  291.  
  292.  
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x90&a\\xf8~\\xe0\\xb2a\\x1bi$\\xe5\\x8cj\\xc2\\xb0\\xc3\\xedx\\xb9i7tqq\\x10fm\\xdfh)\\x96\\xfag\\x99\\x9e|n\\x88>\\xb8t\\x8e\\xbcv|\\x0c\\x8a\\xedu\\x01\\xd6>\\x18\nkw\\xd8\\x1e+'\\xfb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\x00\\xa8\\xf2\\xcc\\xf7\\x00\\xeb\\xd6g\\x93u%\\xae\\x1bd\\xa1y\\x11\\xe2\\x995t\\xe9@y\\x91\\xe6\\xafj\\x8cu\\xc0m\\xd6\\x9d\\xd1\tk4\\x0b\\x17\\xae\\x89::\\xc5\\x11"
  294.  
  295.  
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d#\\x1c/bo\\x822\\xf1\\xc0o,\\xba\\x1f*\\x8734xc\\x1f\\xff<c\t\\\\x17\\xd8\\xf5y\\x92u)\\xc3\\x9b`\\xf6\\xdd\\xaf\\xda\\xe6\\xc7\\xf2q\\x86\\xef\\x8b\r.q\\xac\\xe3f\\\\xab\\x80\\x13/hi\\xc8=t\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0\\xedd\\x02\\\\x0e\\xad2\\x8b\\xad\\x00\\x96m\\xfa\"\\xa2\\x07\\xdf\\xbc$sy\\xc1\\xb4\\xa66\\xa3\\xdb8\\xd3\\xf9\\xa6\\xc0=_<pi\\xafg\\xa2'\\x17$f\\xbb\\xa3="
  297.  
  298.  
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xcbc\\xbb\\x90!f\\xb6\\xee\\xc2\\x89a\\x87mw;\\xa7\\xd7\\x91j\\x01;s\\xac\\xa4jkm\\xc13\\xd1\\x0c\\xf4l\\xce~\\x8a\\x8a4\\xd30\\xa5\\xcde\\xd7d\\x00\\xc9>l!\\x0c\\x16f\\xdd\\x00\\xb1\\xcd\\xc2\\xfa\\xcd\\xdc\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdc\\xbe\\xdb*+\\xb5\\x10w\\x9a\\xfbp^\\xcd\\t\\xbb\t\\xd2me\\xb1\\xeb\\xb5\\x17d\\xf3\\xc5z\\xccf\\xf6\\xc3s^\\xfe^\\xec\\xc5r\\xf1\\x15?\\x94-\\01\\x86"
  300.  
  301.  
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfe\\xdb\\xe2=\\xc9\\xf5\\x84\\x1elq\\x04\\x87\\x12\\x1061\\x03l+r\\x9c\\xd0\\xcd>w\\x05\\xd2\\xc2\\xf5kb2\\xd7\\x9a\\xf1\\xcc\\xa2\\x8b\\xf0\\!\\xff\\xc2\\xcd\\xef\r\\xfd\\xfe\\xefe\\xa0\\xea|\rn\\x0f\\xd3kf.q\\xc9\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\x92\\x07\\xdbd\\x0c\\x93\\x81k/\\x86\\xbb\\x0e?\\xcbo\\xc5\\xf0\\x8e\\x7fwf\t\\xb8>\\x83\\x0bk\\xd8\\x91\\xad\\xf8\\x1dg\\xde\\x9b\\xfe\t\\x08\\x19\\x1b\\x88\\x1e\\x1a\\x00\nm"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8\\x02\\xea\\xc6\\xc6\\xdb\\xd7\\x81;\\x8efw\\x81j\\x90k$\\x9au\\xfdt\\xa7\\xcf?d\r=w!\\xc9n\\xf3\\x9c\\se\\xa5\\xa1l\\xb7\\xe9\\xa4\\xb4\\xaf\\x1fk\\xd6\\x06\\x0f\\xf3\\x98^\\xca\\xba\\xae\\xa3\\xf5\\xa6\\xeca\\xcb\\xb2\\xb1\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\xe7\\xe4\\x1b\\xf0\\x04q*\\xac\\x9c\\x9c\\xd7swr\\x89u\\xcc\\x88\\x95\\x05\\xa3#=~\\x9d|;\\xc6\\xd3\\xa6\\xc9y$\\x8f\\xb8_\\xb5n&i: \\x0c\\xfb\\x8cv\\xe3"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3\\xcc\\x9c\\x10\\xe5\\x91\\x88\\xf6\\xff\\x03\\xb6\n\\xcb\\xd4\\xa8,\\xeb\\xef\\x12\\x10\\xb7\\xd0s4\\xb0\\x96\\xb7i.\\x9fj\\xe1\\xda\\xcb\\x03\\x0e\\x8e\\xa7\\xf5c#f\\x0cv\\x83\\x01\\xa4\\x99\"\\x11(\\xb4\\xad\\x90\\x83\\xcc\\x11!\\xa3\\x9e\\xb7_\\xe1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x05\\xf6\\x92)\\x89\\xf0\\xdf\\x8as&\\xdfi\\x89\\xc4\\x08\\xe1(jj\\xf4l@\\x05\\x0f\\xec$\\xd2h\\xdaaa\"k\\xe1\\xa3\\xb7>\\xb5\\xdd\\xd6r\\x0f4\\xab\\xe3\\x95\\x90f"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e\\x04i\\xc5\\xf3\\xf5im\\x14\\xbar\\x02\\xde\\xc2pt:u\\xf8\\x9b\\x8b9\\x08\\xcb\\xbd\\x95b\\x9el\\xff\\xff<\\xdf\\x0bzrx\\xd3\\x1b\\xe3\\xd5\\\\xc1\\x15d\\x9c~\\x90\\xa8d6\\x14v\\xa4\\xeee\\x9dq\\xe3\\x9b\\xcb\\x0c%\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000,\\x8cz\\xc2\\xe3#\\xe2\\x8dv\\xb6\\x86\\x14@g\\xb1\\xc78?\\xa6\\x1c\\xe8\\x84\\xf2\\x0e\\xf5e\\xf0ze\\xc59m\\xcc\\x884\\xdc\\xcd\\xb8\\x0em\\xa1\\xeb4\rot\\x85f"
  312.  
  313.  
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t\\xfe/\\xe2\\xd4+\\\\xf8\\xb55z*\\xfb\\xe3\\xf5\\xbd\\x97t\\xb6\\xf8\\x94\\xe1\\xc8\\xfc\\xc6\\xc4j\\x9b$p\\xa5(\\x81\\x15m\\xde\\xcf\\xd7\\x8c3\\xdd\\xfb\\x7fq\\xe4\\xa1\\xa2\\x8dh\\x84\\xa6\\x9en\\x081\\x11h\\xb1\\xa1\\xb6\\xbf\\xa9\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\xf9\\x98\\xa3\\x01\\xfcr\\xc1\\xc4\\xa0\\xd9\\x01\\xc6er\\xc2\\x1c\\xeb\\x0b\\x11l*h\\xe1.\\x90\\x88dy'adk\\x91\\xac\\x965\\x90\\x8a\\xc8\\xa1j\\x89\\xe2#x"
  315.  
  316.  
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\xb4\\x137\\xee\\xca\\xbd/\\xb9\\xe8\\xc0\\x92ou2\\x84f\\x01\\xc8\\xf7;pw\\x90bv\\xe0`-9\\x8c\\x86\\x9b\\xce\\xcc\\x83\\xfb2i*xs\\x05w\\x14p\\x08>\\xfe\\xdd\\x90\\xcc\\x08\\xaf,\\x10\\x0b\\xcb\\xe3k\\x9b\\x07\\xc3w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2 \\xe7v\\x10\\xf2z.\\xa5\\xabchd?lp\\xba\\xfc\\x00\\xff\\xc8\\x03\\xb1a\\xd4\\x0em\\xca-\\xaeeb)vlz\\x8eg\\x184r\\x82\\x1b\\xfdw\\x7fp\\xdb"
  318.  
  319.  
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\r\\xb6\\x82\\x92\\xe6s\\xaf!f\\x1fx\\xec3\\xfbu\\xa7v\\x1d\\xef\\xbei\\xe9\\xe2\\xa21\"\\xea\\x91\\xdds\\xdd\\x1e\\xbd:\\x1d\\x88\\x84\\xbb\\xbf\\x98\\xbf\\x96\\xc2\\x7fi\\x81gm\\xd6\\x1dz6\\x83\\x0f\\xd4\\xe6~p\\xd77\\x9bf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nqpb\\xf5\\x91e\\xe4\\xc5\\xc3\\xa0\\xecg\\x8c\\x8020\\x8d=:t\\x84\\xf2\\x88\\x1b\\x92z\\xa4\\xe0,\\xde\\x81\\xfb\\xffum\\xb9\\xff\\xc7\\x18\\xae\\x9ae\\xb0k9\\xf7\\xa9"
  321.  
  322.  
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i\\x17\\\\xd1\\xc76\\xfa\\xa0\\x88r\\xa8\\xbcg\\xf6\\x01\\xc9-d';\\xf5\\xae\\xb1vja\\xb0\\xab\\x0bfc\\xbajq\\x8c1a\\x8a\\x03s\\xd1j5.\\xb2ej\\x03\\x97\\xf1b\\xc8\\x0f(\\xf6\\xb4\\x11;\\xd6\\x08\\xfa\\xbf\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000`g\\x9d\\xf2\\x1afr\\xd0d=^\\xe1la\\x1b\\xb7^o1pn?\\xb6\\xa8\\x87?\\xd4o\\x8e\\xe4\\x04x\\x1f\\xd9jf\\x18\\x18;^n\\x8fa\\xf2\\xe0\\x0cm\\xe4"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\x140\"\\xb1\rq\\xcc\\xdc\\x8c\rt\\xb8\\xf3\\xa9t\\x13\\x99o\\xb3\\xf3\\x94>|\\xcb\\xea\\xfc\r\\xc6\\x80\\xce6\\xecz\\xd3ae\\x13\\x06z\\xe2\\xf0\\x8ce*\\xf4a\\xd9\\xf9\\xaaw\\xa87\\xacy\\x14qa\\xe1\\x19;\\xc8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\xcf\\x7f\\xf5!\\xeb\\xe9t\\xa9=\\xb8\\xf5\\x82\\xc4q\\x06\\xd82\\xa6\\xef\\x98\\xd8y\\xd5\\x1av\\x16\\\\x10\\xda\\8cm\\x87\\xe5f\\xe8\\xb8dq\\x0e\\xaai\\x10\\xccr\\xb1"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x043\\x9fx0q\\xfc*d\\b\\xd6\\xe3\\x054\\x95\\xcb\\xfa\\x9a\\x89\\x16\\x0c\\xeb\\xde\\xe8\\x11\\xad\\xfa\\xfe\\x0cg\\xd6\\x9d\\xa9\\x8d\\xca\\xc1d\\xe3%\\x04\\xdd\\xe9q\\x8c\\xd8\\\\xa0\\x92\\x11\\xa8\\xcb\\xe3\\x91f\\x90\\x97\\xe2\\xe7\\xdbq\\xc4a\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xad^\\x80\\xffz|\\xf0\\x0f\\x89\\xfa\\xa1\\x12\\xe4\\xde\\xf2\\xc2\\xbf6\\x13x\\xd5\\x9f\\xb1\\xfc2m\\xa1^\\xfa@\\x82\\xca\\xe0h\\x96\\x98q\\x90-:r\\xb0\\x92\\x10k\\xb7\\x95p"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\x83\\x87k<\\x17\\xef\\xfa<\\x04|y~\\xfd'\\xc9\\xc5\\xa0\\xb3&\\x9fz\\xab,\\xf9\\xd8\\xacd\\x9b\\xa3z\\xe7d\\x84\\x85=\\x85\\x1af\\x96'\\xf3\\x8c\\x00~\\xca\\x04\\x8d\\xd5\\xbb3v\\xde<\\x89t-\\xdcg\\xd5\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\x19t\\x17\\xf7e\\xeb\\xc5\\xb8=\\x88\\xb1\\xafp!\\xe8\\x8c,\\xa5|\\xc0\\xf0\\xc7\\xc3\\xdc\\xddg\\x18x\\xee\\xa7l\\x11\\xcd\\xb8\\xda\\xe6y\\xae\\x05x\\xc4r\"\\x80$"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3zx\\x98\\x16jtu\\xc7\\x94 <b*fh\\xf2\\xe8\\\\x14$2\\xcc\\xed\\xc5\\xf9\\xea\\xa2\\xa4\\xd3`\\xc4\\x15\\x8c\\xdf/\\x14\\xd55\\xf0\\xdc~\\xae\\x0f\\xa9f_\\x97\\xf4-\\xect\\x1b\\xb6\\xb5\\xf1:\\xe0pp\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-=!\\xaf\\xa3\\xe3\\xee\\xc8#\\xc8k\\x98\\xf0\\xbfr+\\x14\\xe4\\x85|\\xbb \\xb2\\xe0g2\\xb03\\xd8kv\\xf6.b\\xb9\\xc6\\x8ai\\x85\\x1d\\xe5s\\xc9:\\x97d"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04d\\xd5\\x9fg`z.>\\xb9~\\xbek\\x93\\xb3k\\xfd\\xa9\\x81\\x9d1\\xb45h\\xf5@/u\\xfa\\xe2t\\x0c\\x1c\t\\x00\\x17\\x9c^\t\\x9d\\xec iq\\x12\\xef\\xfa\\x9f\\xd6\\xa8f\\x02mh\\x89\r%\\xdbe)\\x19\\x87>?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\\xb6\\xb2/\\x93g\\x04\\xb4u\\xeb\\xee\\x07\\x94yl\\x8a\\xf1\\xe21\\x84h\\x19\\xee2\\xcd\\xb3\\x87\\xd2(7\\xf1\\xe1q\\x95\\xbf\\x9e\\x01<b)t\\xcd\\x1c\\xbf\\xc1\\xd1"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xdb\\xce\\xd731\\xf2\\x83\\xc4yf\\x04\\x11\\xdbp\\xf9\\x84\\xa8-:^\\xc3_\\x81\\xeca\\xf5\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7w\\x89\\xc0\\xf2\\x90en\\x08\\x00\\xb1\\xcc?k\\xed*\\xbbp%\\x82\\xb3\\x7f\\x19|\\xa2\\x08\\x14\\xa7\\xd2\\xdd\\xfb\\xdc\\xde\\x1e\\xb6\\xbb\\x1cr\\x16\\xc8\\xab\\x06'p\\xc4t\\xc2~\\xea\\\\x8f\\xf3)\\xcbh\\x93|\\xf1\r\\xfa\\x9d\\xbe#h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_\\x81\\xe2r\\x9fbwh\\x00c\\x0c\\x98l>+uf.\\xe6\\xb3/\\xec7\\x82\\x14\\x12\\xbf\\xa1\\xb7\\xe0\\x85\\x13\\xcf\\x8b!\\xe3(\\xcf\\x17\\xf8uy\\xf9\\x01\\x06\\x01"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xab\\xc3\\xf5\\xe2\\xa1\\xdd+\\x1a\\x97\\xedj8*x\\x1f\\xe7\\x81\\x04\\xb2g\\x86\\x06?\\xdbm\\x91\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xa2\\x0ek\\xd1\\x12w?8l\\xe0gj\\xfde\\x1d\\xe0\\x18\\xce\\x8a@\\x97\\xc5sp\\xae\\x93k\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xfe\\xa5\\xf0\\xd3`k\\xdc\\xf6\\xdb\\x90\\x8by|\\xb0\\x19\\xa5\\xd9\\x08\\xaci\\xe0\\x84gr\\x08_&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xa7o\r\\xcc%b\\x9e\\x9e&\\x90\\xfa\\xf7\r\\xe2\\x12\\x1b\t\\xde3uv\\xcc#\\xc1'y\\xf5\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8:v1\\xba\\x1f\\xc5z\\x82\\xe8\\x07bm\\x80\\x87~.\\x8cm\\xb2\\x8d&t \\x19p\\x1b\\xf7\\xb3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\x17\\xc9\\x810\\xb6p\\xfb\\xb2\\xe7q\\xaa\\x14\\xf4\\xcdr\\xe0t\\xc5\\x1d\\x1b\\xfb\\x80\\xd9\\xeds\\xf6y\\xf8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x14po;\\x99d\\xe1\\xb3\\xda\\xf8<t\\x11\\xe0\\xec\\x8d\\xeecm\\xe0=1\\xe0!8e\\xedd\\x93$\\x02\\xae\\xf1\\xe3m\\xe4\\xbff\\xe0\\x92\\xf9\\x04\\xb4\\xd7li\ni\\xc7\\x8d\\xde\\xa2h5-\\x90&\"e|1\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\x19\\xf7\\xd7f\\xed\\xba\\xb1g\\x02:\\xeb(+m\\x18\\x90\\xab\\x94k7\\xa3\\xff\\xa6(=dv\\x14s\\x01g\\xb0\\xf5\\xfe(\\xa9$y\\x0ecxba\\xe2\\x83\\xf6"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xd3\\xc1\\xe7\\xd1\\x8d\\xc9\\x9f\\x10q\\xd2\\xb3f2\\xc1\\xe6\\x04,\\xb5\\xb0\"\\xbc\\xe4.\\xa4rlb$\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\x8f\\xe7\\xab\\xfa\\xbf\\xac\\x98\\x08\nn\\x89\\xc9\\xdc\\x88g0\\x0b\\xf41x\\x0b\\xcb5\\x8fy\\x14i~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1p\\xf4fm~\\x1c\\xe4w\\x9a$\\xc5i\\xb2!e \\x0c\\x90:\\x18\\xeb\\xda6n\\x02\\xdcd\\x113ac\\x0e\"\n\\xe0\\xc0h\\xa0\\x08\\xb3\\xe4\\x05\\xc2\\xd3\\xbe\\xd2\\xb5\\xc0\\xc4\\xdc\\x9e\\xff\\x91f\\x89<w6\\x13\\xf4\\xc1\\xd3\\x87\\xcb\\x02'b \\xec\\x00\\xb2\\xac\\x1f \\x9a\\x80\\xe5\\xd7\\x9b\\xd6\\xc6\\xd4\\xc1\\xc4\\xe8\\x8fax\\xbf_y\\x13\\x03\\x80\\x8fm\\x96m\\xa3\\xb1\\xd93\\xa3c!\\x81m\\xa5\\x1d\\xbd\\xdc\\xc1\\xe1\\x97\\xe0\\xe8\\xb6\\x06\\9p\\xed\\xd4=<\\xe4r\\x8b\\xca\\xfd\\x04\\x0bm\\x18y>.4\\x01\\xb2\\x17\\xcfq\\xc0.$\\xb3>\\xea\\x91\\x00q\\x9bbnsp\\xd9\\xb8\\xa5\\x00\\x8a\\xfa\\xdf\\x1fe\\x85\\x86\\x92x\\xf6h\\xe8h\\xa6qh\\xbc\\xb0\\xfd\\xfe\\xe3\\x1f:\\x0c\\xfa\\x08d\\xa7\\xa2\\x031\\xb7s\\xd2\\xber\\x02k\\xd6\\xa4\\xed\\xdfd\\xc6ih\\x8at+\\x1adw\\x81\\xf9\\xde\\x90\\xaash\\xb2\\xa4\\xf0\\x93z\\x87\\xc28\\xc9\\xe4\\x92>\\xa0g\\xb1n\\xe4\\x81%a\\xf6\\xc7m\\x95\\x8bl6\\xe6\\xa7"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1f\\xad\\xdc\\xd1!\\xec\\xf0\\xb9q\\x9d~\\xa9b\\xearr\\x91e\\x18:2\\xc7\\xd4\\xad\\x992=s\\xfd\\x92\\x1fd\\xf3\\xe5>l@\\xf2+\\x04v\\xbd\\xe1\\xd8\\xf3\\x95`\\xbf\\x08e\\x8d$n\n\\xd3\\xc3p>\\x18\\xf3r\\xda\\xcb\\x1d?\\xd0i\\xce\\x91rm\\xba\\x01\\x10cq\\xfel\\xa4\\xf2\\xc3\\xff\\x1d|\\xc9w\\x99%r\\xfa\\xed\\xf03lc%\\xc1\\xcf\\xd4\\x99c\\x078i\\xcd\\xafi\\x99\\xec\\xf3\\x89\\x96\\x94~\\xd1c\\xf9\\x1d\\xd1\\xd0\\x0cv\rou\\xfe>\\xd9\\xe5,\\xbb\\xd7\\x07p|\\xab\\x9b\\xc9\\xb6\\xac\\xe4\\xbc\\xc7\\xd21e\\xe8e\\xd9\\xe2n\\xfawe\\x17\\x99\\xc0\\xbc\\xcf~\\xd50d\\x91\\xab#\\xb3\\xe3n\\x03\\xe1\\xb2\\xda\\xc3\\xf1\\xb0\\xb5\\xc2\\x02&f\\x02c\\xce.\\xf4\\xde\\xdd\\xdd\\x90\\xf5\\xc3\\xf3(\\x05bd\\x0c\\xbd\\xe1\\xdar\\x1a\\xe7=\\x01cnv3\\x04&\\xa8\\x08\\xfe\\xb6\\xc0(m\\x07:\\xd3s\\xd1\\xd3k\\xdb\"\\x0fr=\\ea\\xbd\\x85\\x08\\xd8\\xf3\\xa0\\x83a\\x11_\\x1cc2\\xbag"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8i\\x83\\xb1\\xce\\xdb\\x9ae\\xcd.\\x0b\\x13\\xf5\\xaeo\\xc7tq\\xa1\\xae\\xe5z\\x82h\\xab\\xcf\\x10\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8j\\xb7\\x1b%\\x13\\xf1!d!\\xf3\\xcco\\x97\\x0c\\xd7\t\\xd5\\xe0\\x12ly\\xf2\\xe5\\x15\\xda\\xcd\\xfa\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xdf\\x91\\x03\\xa5\\x8f\\x0e\\xaa\\xc4j\\xce\\x11\\x08\\xd3s!l\\xe0\\xcd\\xae\\xde\\xacf\\x90q\\xb9o\\xecu\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xff:z\\xffi\\xea\\xa0~\\xd7\\x93v\\x96\\xc1\\xbd\\xc1\"\\x85!\\x83.\\x9a\\xdax\\xdb\\x98\\xfd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\t\\xd9n\\xa6\\xd1\\x94\\x1d\\x8e\\xdb\\xc4\\x0ct\\xba~\\xf0\\xf4n\\x12b\\x8c>\\xd1\\x8c\\xca\\x95\\xbc3xp\\x0brzh\\xa4\\xdf\"\\x06\\xfc\\#/d\\x1c\\\\xab\\xbf83l\\xeb\\x830\\x02\\xf6?\\x08\\<\\x7f\\x07c\n\\x8e\\x1c'\\x86\\xfe\\x0f\\xb3\\xeb\\xd7d\\xe6\\xf3|\\xcf\\xcb\\x8d\\xf6\\x1f\\xda\\x0b\\x02d\\xc2\\xde\\xe6\\xd9\\xcd\\x0b\\x86\\xd0\\xf1\\x0f\\x00\\xb9)\\xdc\\xe0x\\xc6\\x1b\"\\x9e`;\\x1b\\xcf\\x87j\\xd4\\x9f\\xd9\\xa7\\xa4\\xa40\\x85\"\\xf4\t\\xdc\\x96=j\rej\\xf1\\x97vd\\xf2\"\\x9a\\xc8d\\x96\\x80\\x0eux\\xb3#\\x83r\\xb3\\xf6\\x9e\\xd1<\\xbfu\\xe4\\x84\\xf7\\xb1\\xe6\\x97\\xb9\\x1d# \\xe9\\xfe_\\xbc`\\xeb(|\\xf4t\\x88\\xaf\\xfdf\\x93x\\xdfm\\x8a\\x92\\x7f\\xc7+=\\xe3\\xb3o\\xcen\\xe6\\x1f\\x13\\xa7ff\\xdf\\xdd\\xff\\xdb\r\\x91wq\\xab\\xecz\\x0b\\x99\\x8a\\x8a\\xc8x&\\xc6&$a_ko\\xdf\\x1fp\\x03q\\x12\\x8b\\\r|m\\xf07\\xf0\\xf21\\xf5\\x83\\x0f\\x8b\\xca"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\xdd\\x95\\xba\\xa8\\xc3%q\\x8d/\\xea\\x04s\\x12y\\x06h\\x8a\\x0ctgu\\xbd\\xde\\xb7r\\xde\\xed\\x8f\\x16\\xbb\\x85\\xbbc\\xc8\\x0f\\xb2\\xa9\\xee\\xc9\\x87\\xcf+\\x7f\\x92\\x13\\xd3y\\xd6cwncz\\x1f\\xe1\\x8a\\xefi\\x14\\xde\\xd2\\xfb\\xb7\\x10\\xfa\\xc6)\\xa27v\\xb1\\x95\\x8a~\\x85g\\x9d\\xf0\\xc0\\xe1\\xcb\\x12\\xb5>5\\xccs\\xe3\\x9c\\xbd&cj\\x80s8\\xbb\\xfd\\xb2r\\xb1p\"\\xa2\\x81p`\\x8b\\xfe\\x10:\\xb7\r\\x1b\\xa8\\xff:\\x15\\x9b\\xd3\\xf6st\\x9b\\xb56\\xd8\\xf3\t~q\\x98\\xb5\\xd4q\\x1d\\x1fp&\ts\\x80rt?\\x1d~\\x91\\xfc\\x9di\\x1bi-n\\xd1\\x14s\\xf0\\x82nj@\\xd4\\xc8%j\\xfa\\xd3\\xc0\\x12\\xad/m\\xc5\\xadx\\x9b\\xd0k\\x95\\xa2\\xc2\\xea\\xbb\\x02u \\xdb\\xabx\\xc2\\xfc\\xec\\xcf\\xfb\\xac\\xbe\\x99\\xee\"\\xa2\\xb1eam\\x89\\xc4\\xbe+a_~\\x95bu\\xda\\xa6m\\x05\\xe0:\\x86u\\xcc\\x16\\xc6\\xa0q\\xe4\\e\\xc7\\x05em\\x04\\x9e\\xc9bg\\x94i\\xf6\\xed\\x83w\\xa0\\x80"
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2\\xb2\\x90\\xf026\\xdc\r\\xb4\\xbe\\xb2\\xeb\\xe7\\x1a3$\\xff\\x96\\x89\\xd8\\xba\\xa6\\\\xdd\\x0f\\x8c\\x8d\\xa6!\\xf5\\x05\\xe9\\xe1\\x03~\\xdb\\xdc\\x11\\xf8\\x11\\xf5s\\xe3`!\\xa2\\xe7\\x1e#\\x86\\xf5\\xbc\\xab\\x7f\\xf5\\xff\\x18\\x9e\\xf8\\x17h\\x8c\\xcb\\xc1@\\xc3t\\xe3\\xf1\\\\x7f\\xf5$k\\x00<\\x7f\\x18\\xdc\\xc1\\xf8\\xa1n\\x9e\\xa5\\x8ez\\x86\\x0f\"\\x91\\xeep\\xaf:\\xf3\\xb1c\\xbbt\\x00u\\x03\\xe8\\x8b8\\xf3d\\xa3\\xf5qp|\r\\xee\\x95h\\x11\\xd3\\xf8\\x1439\\xa3\\y\\xfe\\xad#$ij\\x95\\x0cko:0<\\xa2\\xd9\\x83*\\x19\\x9br\\xe7o\\xa3\"=\\x835\\x03\\x9el\\xdb\\xcb\\xad=\\xb1s\\xb9\\x9f@\\x84\\x08\\x93j\\xf4\\xe3\\xec\\xb1\\x10z\\xb8\\xce\\xf5lrz0\\x8ap#\\x7f\\xc1\\xa6\\xb0yi\n\\xe0\\x9c\\x8a\\x02\\x8c\\x96a\\x16\\x05(\\xd5\\x8ar\\x96\\x85\\x88\\xfc\\x03\\xb2\\x82<\\xdb/\\x9c\\x0e\\x82\\xe7\\x0e\\xdcs\\xe5\\xea\\xf7\\xec?\\xb7\\xe6\\xead\\xc5sw\\xa0j\\xc1\\x8f\\xd3\\xbd\\x99\\x0f\\xd5\\xa3\\xce"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb7j\\x94\\xeat4#\\xf9\\x8e\\x17\\x96\\xc8'\\xe9\\xa6n\\x85\\xe1\\x05mp\\x96\\xa5\\xe6\\x90\\xb1\\x8a\\xae\\x93\\xabe\\xf5\\xef\\xc51\\x80\\x0bp\\xc1a\\xbf\\xf1\\x9cg\\xb0\\xa0\\xf1\\xaa\\xb0<\\xe0\\x0cv\\x87f\\xdc\ny\\x9f>\\xae\\xe0\\xb6\\xa5+\\xc90\\xc6\\xf4\\x84|\\x97\\x03\\x1d\\x1e\\xee\\x9f\\xa6\\x96\\xaa\r\\xa6\\xa6s\\x93\\x1as\\xfbd\\xaa\\xb5k^5\\xf7\\xeea\\x83w\\xe4\\xc3\\xfc\\x8b\\xbeeh\\xb8\\x8ex\\x00\\x8cja\\xa3\\x12!\\x1f \\x96\\xa2w\\xf3(\\x99\\xd9\\x05d\\xd4v\\x9c5\\x16\\x8b\\xc5d\\xa2@#\\xb4\"sjy\\xc0\\x88\\xec\\x1e\\xdf\\x90gc\\x1b_0\\\\xfb\\x17\\x9ft\\xc8\\xf8\\x96\\x0c\\x1f\\x0c\\x1c=\\x9c\\xef\\xba\\xd6/\\x0c\\x9a\\x9e\\xcc\\x1f\\x17\\xe3y\\x94\\xa9r\\xa8\\xf8\\xdd\\x08\\xd7\\x17y\\xda\n\\x90\\xa0h;\\xf7\\x0b\\xef|\\xad\\x98\r\\x7fg\\x9d\\xff@\\xa5\\xe1?t\\xe3t\\x97w\\xd7\\x08\\xba)\\xdb7b\\xbb\\x030\\xdb\\xf2$\\xfenu\\xab\\xd1\\xe0\\xd0\\xa3q\\x82\r\\xd3%\\xdb\n\\xd0\\x9c\\xe5"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j#\\x80\\x1d\\x077\\xf0\\xbd\\xff|g\\xad\\xb9\\xac\\x7f\\xb9p\\x1c\\xccxz\\xe7\\x18\\x9e\\xd01\\x07if\\xf9\\x84\\xcbc\\x07fl=\\x7fi-7i\\x9f\\x0c/\\xfd\\xd0n\\xc0k:\t\\xee-e\\x9b`v\\xf2\\x02\\x8f\\xcc\\x0bi\\xfev5us\\x18v\\xecq\\xf9\\x81\\x99\\x02\\xb5`\\x1f\\x9eo\\xd6\\xf8\\xec9ur\\x0bq\\xa2\\xa2\\x1c\\x12\\x18\\x93\\xe64\\xbbj\\x19\\xc3\\xf9t\\x8cr\\x143-\\xb8&\\xc5\\xfb\\xa4n\\xca\\xf4\\xa3\\x19\\xc6\\xa5\\x86\\xfb\\x02\\xb0u\\x19\\xb7\\x03\\x80\\xf59\\xa0\\xbe\\xa8\\x7f4w.\\x9c\\x1d\\xc7\\x84\\xb3\\xf7ze\\x16\\xe6\\x11c\\xe9\\x9f\\xdas?2\\xae\\x9dz1\\x13\\x17m2\\xa3u\\xb5\\xc6\\x88\\xa1\\x8coj\\xc2\\xe3g\\xa8d\\x04\\x14\\xc6$\\x9c\\x82\\x88*\\xb6.k\\xce\\x84\\x0c)u\\xb8\\xc4\\x81\\xa6\\xdd\\xf06\th\\xb3\\xf5\\x05\\xba\\xb1g^g\\x96\\xbf\\xfb!^\\x90/\\xfe\\x8a\\xbf\\x9awv\\x1d\\x10\\xe1\\xb7@s\n\\xeb\\xa5\\x87q\\xe1\\x1b%\\x8b\\x14\\xe8e"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108\\x89h\\x1a\\x10\\xad\\x17\\x85\\x17\\xc0g\\x0e\\x93\\x7fm \\x91\\xe7\\xeez\\xeez\\xda\\x1b>f\\x1a\\xcd\\xcbo\\xa9om\\x11\\x06!\\x06\\xd6\\x8e\\x98\\xe9das\\xd9\\x0cn?\\x95\\xdb\\xb7:$a\\xcc\\xa3\\x0c5\\xb2w\\x1b\\x11\\x1dua\\xb1r>\\xd1\\x8a)\\x93\t\\xea\\xdb9zvh)\\xbd\\x97 \\x18ym\\xe4\\x9e<\\x174\\xc9z\\x7f9\\xfcj.6f\\x93-\\x11\\xa9\\x82\\xfd\\x12\\x92\\x08\\xfc\\x912b\\xf1\\xdc\\xb4\\xe9\\xf7$r\\xce\\x93\\x9c\\xeew\\x86|\\xf7\\xc4\\x1a0r\\x90\\x14\\xa5'\t\\xe9)\\xa3nh\\xc0i^p\\xb8u\\x8c\\x9a\\xbc\\xfb\\xa6\\xb3\\x9f\\xa3\\xc7\tt\\xe7@\\xaa\\xe2dy;\\xc3m\\xc9\\xdc\\x80f\\xdd\\xe8\\x1dp\\x8c\\xd1\\xeb\\x1dj\\xb2\\xbe\\xa9!ca\\x89\\xf7\\x02\\x87fo\\x11\\xa9p8 d\\x05$m\\x94\\xf4\\xd59\\xc2\\x84\\xa6\\xce\\x19d\r\\x04\\xf5*\\xc3\\xa8\\x9c\\xb9\\x90\\x06\\xf5\\xc6\\x10\\xd0+\\x13c\\xa6\\xad\\xbc\\xeb\\xf6:\\xcfmcg1rc\\x7f\\x0f"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b%\\x04\\x1e~ig.\\xbe\\xa5\\xd8\\xf9\\xd9\\xe0k\\xec+\\xc3\\x95\\xcb\\x8a\\x085\\x85\\xd0\\xf3~\\xcd\\xd1!\\xa1w\\x04d\\x93viii\\x05\\xd5\\x044\\xe0.\\xdc\\xbc\\x8e\\xbbq\\xba\\xa3+\n\\x08\n\\xd6\\x89\\xc4\\xe9@\\x08l\\x10%\\x18+\\xea\\x1a,x\\x04l\\xc5\\xf5\\xfd`_e\\x04\\x07\\x85y\\x06\\x12&n\\xde\\x16\\xb3^\tmbtb\\xe0\\x85\\xd1\\x0ea\\x96\\xf5_\\xcb^1\\xd7\\xa48\\xf4:9\\xf5\\xc6\\x83z1i\\xd1\\xb9\\x89k\\x9b\\x10\\x91\\xb6:s\\xab\\xb5\\xd9\\xbf+\\xd8ke3g\\x0ed\\x12\\x1e\\x81\\x97\\x81\\x85\\x96\\xc8e\\xfdi\\x7ft\\xfb\\x07\\x13\\x1f\\xcd\\xda\\x0b\\xfdt\\xfc\\x043\\x82g\\x8a=-*\\x8b\\x89u8q-\\x18\\xf89\\xac\\x9ag\\xdcg5?\\xc5\\x9d\\x05\\xc4i\\xa6u\\xb6\\x93\\xf3#x\\x82\\xaah\\x18\\x1e\\x8a\\x1b\\xb4dba r\\xf4\\xe9\\xd8j\\x17/\"\\xc7\\x16\\xd8s\\xff_q\\xc2\\xbdfz8\\x90\\x14\\xc2\\xcd&\\x0b\\xd7\\x1d\\x17iv*\\x14\\xb4v\\xb4"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\x1f\\xa2\\xa9\\x84\\x91)^\\x8f\\xba\\x92o\\xb0\\x99\\xff\\xe7\\xc8\\xf2\\xe4ie\\x1c\\xc3\\xdb\\xd6\\x1cr\\xc9t\\x97\\xb4\\x8d\\xbb\\xa5>o\\x0e\\xae\\xffa:\\xcd\\xdf\\x84\\x95z?.wa\\x94z\\xe0\\x067\\xeefq\\xab\\x1f\\xf1\\x87x\\xd4\\x1b-el\\xc2t\\xf9\n\\x0f\\x80n\\xf1\\xc4e\\x06q\\x0c=v\\xcc\\x1a\\x11d\\x1c\\xa5\\x01\\xdf\\xba\\xcag\\xfa\\xcar\\xcd\\x95\\x05\\x8f\tgi'p\\xc6\\x00\\x02\\xa7!?f\\x966\\xc1\\x89ik-z&\\xc6\\xf2\\xf7p\\x9f\\xc1\\x05\\xb6\\x010\\xf3\\xfa\\x94tt\\x1d*\\xae\\xf7)\\xec#\\x9e)\\x85\\xbb\\xbc\\x07\\xa25\\xd2\\xa7\\xac3\\xf6\\xac\\xb0\tm\\xbaoh\\xe0\\xa8w7\\xb3\\x13\\x0c\\xdf!j\\xa7\\x93\\x83m\\xfesq\\xbf-7\\xb6 ^\\x87\\x04=\\xd3\\x01n\\xbai\\xb1\\xa03\\xd7\\xdar\\x04b\\x05\\xfe\\xf2 b\\x14 \\xe60\\x9e\\x9b\\xee\\xe1\\xcf\\x81#\\xeb\\xf9\\xed8\\xd4\\x07q\\xd7b)\\x1b\\x1fp`\\x97\\xc2\\x1b\\x13g :qi\\x1f\\xe4=v2d"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab~\\x9a\\xc8\\xe7f\\x99t\\xef\\x87w\\x04\\x8a\\x04f\\xa4\\x7f\\x84\\xe2\\x96\\x1c\\xf3x\\xa7\\x05\\xdd^\\x1b6\\xef\\x04\\y\\x08\\xffp\\x9a\\xef\\xa9\\xe5\\xf8\\xee\\xd7\n&\\x95\\xeb\\xca\\xc3\\x18!\\x82gp. y\\xcbpb\\x07\\xc0l\\xa9\\xa7pc\\x05\\xbbk\t\\xabxu\\x88-~;\\xa6v\\x98q\\xeddv\\xca\\x19,ni\\x89|&x6\\xb9(\\xc6\\xbaawez\\x9c\\xd7n\\x80\\xd8\\x00\\x18\\xed\\x94h\\x0b\\xa8\\xb1\\xce\\x82\\xf6f\\x18\\x98\\xc6\\xdf\"8\\xef\\xf1\\x94\\xb4cv\\xcc\\xef \\x88u\\xb9\\xff\\xb42*n\\xf5\\xeb\\xd8\\xf0\\x07\\xa7g\\x86\\x81\\xd5\\xc8\\x9b\\xcb\\xc4\\xd8\\xd5y\\x98-s\\xc4\\xac\\xc9\\xa8\\xed\\xe6\\x9a\\xdc\\x00\\xb8\\xec\\xa1\\xfe\\xd7\\xf5\\x9fi\\x18)v\\x94\\x00\\x7f\\x05\\x06\\xec\\x1f\\xac\\xe69\\x98\\xf2h1j\\xfev\\x80*=,\n\\x1ehb\\x8e\\x9f\\x81\\xcb\\x92\\x9f\"m.\\x8f\\xdb\\xea\\xdc\\xc7\\xb5\\x13h\\xd6jfd\\x0f\\xb0\\xacf\\x00\\x13\\x18\\xebj\\x7f\\xb5p\\xd2vq\\xa2\\xb4$"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe2 \\xb7\\x87\\xb20\\x88\\x9f\\xc9\\xfd\\xb1\\x95h\\xde\\xff\\x02\\xd2\\xbc\\xc0a\\xa0\\x85\\x10\\xc2\\x8d\\xe8\\xe0y\\x8c\\xd9`\\xba\\xa6\\xe8hp\\x7f\\x14\\xdd\\xc0\\x80;z8\\xb7\\xe6|\\xc2\\xcf\\xc9\\xdd\\xb3\\xd50fr\\xb8a\\xec`\\x1d!\\xff\\xe3\\xba\\xc5\\xda:\\xf1t\\x00\\x8c\\xcb\\xb6\\xe2\\xbb\\x06\\xa4b\\x8d\\xa3\\xb9\\xa8\\xcf\\xce\\xf9\\x92\r.\\xf2\\x84~\\xe0\\x8a\\xce\\x8f\\x8a\\xee\\x16(y\\xc20\\x9f\\x94t\\xe5\\x13\\xf4\\x8a\\x05\\xe4\\xdc=\\xf7\\xe9\\xc1vf\\x83-\\x93'iw\\xd8\\xf3\\xc8\\xef\\x99\\xf8q\\xdd7a\\xfe\\xdc71eg\\x9a\\xfb\\xb17\\xd9\\xf8\\x8a\\xday\\x8f\\x1a\\xb3\\x1d\\xc3`\\x13a%\\xac9\\xf6l>\\xed\\xd4\\xf9^\\x04;\\xb8\\xdb\\\\x9940\\xf3\\x007\\xa8\\xabp\\x03\\x0c\\x13bb\\x16\\x0f\\x05\\xa21b5\\xc1\\xb5\\xe2\\x135\\xd6\\xa5\\xb2\\x0c6o\\xdd\\xaf\\xce\\x08\\x94\\xa9\\xd6\\x8f\\xcci\\xfar\\xbe+\\xa0h\\xbc\\xb6\\xb9\\xe3%c\\xd3je82y'\\xed\\x86a\\xde\\l\\xb3\\xac\\xa2\\xa7t\\x0f\\xe34"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\x82\\xaf\\xc5\\xe1\\x0b\t3\\xbal\\xd3\\xa1bs\\x08\\xa7\\xc3\\x8b\\xdf\\x13\\xa1\\\\xc7_\\x98\\x14\\xc9\\xf2u\\x9f\\xa46\\x84\\x98\\xa0\\x7fp\\xccf`\\x16g\\xb7fg^h\\x13\\xccq\\xbe\\x968\\xb5b\\xb3j\\xb6\\x88a+d\\xcb\\x8d\\x0eu(:crx\\x13 \\xe5\\xfc\\x7ft\\x96\\xb1\\xf8\\x1fob\\x0b\\x89\\x1e\\x0f\\x1a\\xdae\\xa6\\xb8\\xb4\\x04\\xf5v\\xb8\\x11:u\\x11\\xc5l'\\xcehc\\x1f\\x90\\x07\\x93-\\xfak\\x8ew \\xc8\\x0c_e>-\\x1cn\"!g\\x12q\\xc7\\xa0\\xc7\\xf0\\xfe\\x96\\xb2\\xdd\r\\xecx\\xa0\\xae\\\\xdc\\xd6\\x15<^\\xd5\\xbe1w\\xdb\\xe3\\xff\\xccz\\x15\\xba\\xbf\\xad!\\xba\\xb8b\\xdaa\\xabxp*o|\\x9a\\xcf\\x02\\x0e`r\\x89\\xc8os-\\xc0\\xdf\\x82\\xcc\\xb9\\x8cu\\xd8\\x9e\\xf2\\xa4f\\xcdj\\xec)y\\x11w\\xb7\\xe9+\\xca\\xd0o\\x9b\\x0b5w\\xcc\\xd2\\xbb\\xa1\rk\\xda\\xc4\\xe6\\xa1\\xfe\\xf1\\xfc\\x9c\\xc7j18+\\xe8\\xf3\re\\x9df1\\xef\\xf2cn\\x94\\x17"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010pa\\xcd\\x86\\x8d\\x9d\\xd5\\x0b\\x82\\xff\\xeb\t\\xb8\\xee\\x18_g\\xd3\\x17\\x0f\\xd1\\xf0\\xc7\\xdem+\\xf2\\x05\\xd0\\x7f'igb\\xf6\\x13\\xee\\xdez\\x93`*6\\xff\\xa0\\xb1\\xe8\\x1e\\xa8a\\x112\\x11\\xa2z\\xe6\\x98fq\\x91p\\x82\\xcb\\xbe\\x91\\xf6y\\xda|u\\x88cvc\\xb3'|\\xc6\\xdcj\\x80\\x82z\\xee\\x05\\xf1 \\x93\\xe0\\x92\\xecyr\\xfd_1\\xedu\\xd8>\\x18\\xbbe\\x06^ \\xda\\x10\\xb4d\\x17\\x8b?\\x01d\\xfe\\x00\\xd6\\xd0 \\xa6\\xb1\\x041\\xa5y\\x9bd\\x1a\\xd6:\\xcbk9\\x1e\\x9d\\xf4\\xa7|a8.\\xa3\\xcf\\xf5q\\xfa.d\\xf3$s\\xb8\\xc0-u\\xdau\\x91\\xeb2\\xf8\\x9bj\\x80\\x9c\\x9ci\\xd2\\xba\\xef\\xf3\\xf5\\xbdn\\xe5\\xbb\\xa3ub\\x0e\\x84\\x8d\"\\xd2\\xd6-i\\x8f\\xdfk`+f>=\\xfe\\xa9\\xdf\\xfc+_u\\x91\\x89\\xdc<\\x17\\xae\\x81\\x10\\x92\\xfd\\xf6v\\xca\\xe1\\x9a,c\\xf2\\xc3\\xbe.\\xa2k\\x1al@\\xeayr\\xfe\\x8a\\xb1\\xefa\\xdf\\xfch\\x91\\xa8\\x92z\\xe0\\xabi\\xb8"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeb\\xb6\\xd0\\xc1\\xd8\\xcb\\xc7\\xf4\\x04\\xb0\\xee$\\xfa\\xf4\\x98\\xd1\\xbb\tj\\x9b&\\x00\\xee\\xf7\\xd0\\x15\\xc8\\xe4\\xd7j\\x11(\\x7f)\\xd8\\x18\\x979\\x0f/-\\xa5lg\\x98\\x0f\\xfbhb\\x8c\\x97\\xe7\\x13\\xb9\\x7f*a\\x08y\\x92v\\x15<\\x98n+\\x91\\x96\\x97\\x8b\\x13`\"\\x80\\x01\\x83\\xdd2\\xec\\xce\\xa9\\x98f)\\xa2\\x97w\\xda\\x00\\xb2\\x99\\xa3o\\x18\\xb3\\xb5\\xdc\\xb6 <\\xf7\\x06\\xdb\\xd5\\x17r`\\xc2\\xbf\\xacuya\\x9f?\\xed\\xed\"\\xa3\\xc5\\xcc\\xc6\\x8c\\xf6\\xa5v\\xa5y\\xeem\\x04\\xd2\\xa7-\\x9ep\n\\x9ch\\xceo;\\xc0q\\xf2\\xcf\\xc8k\\xbag\\x9e_+\\x82\\x93\\xcc\\xc5\\x19<4\\x1f\"\\x9d\\x9a\tu'\\x86\\xaekg\\xd4\\xca\\xa8t7p&\\x15\\xeb\\xe4\\xb5\\xd5\\xcd7|6p\\x9c\\xd2\\xcf\\xe1\\x06j\\xdeq\\xbay\\x93g(\\xec\\x1cc\\xd4q\\xde\\xbd5\\xd2\\xc0\\x0cn\\xf4\\xc9\\xd7\\x04r\\xb2w\\xee\\x9e\\x92x_vu|0s?z\\x19\\x97\\xbe\\xa6\\xe58\\x83pmy?26\\xc3\\x17\\xbf"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w>`0\\x04\\xe0\\xc1\\xe0\\x19h\\xa1\\xeb\\xff\\x86b%\\x94\\xa2\\xa4\\x0f\\xe0\\x94\\x10\\x02\\xc3\\xc0y\\x01\\x05\\x8f\\xf0\\xe8\\xd0\r\\xf4\\xf1_\\xdaq4\\xfc\\x94\\xeb\\x05yam\\xf8\\x87\\x97\\x9e\\x899\\xb7\\xbc\\x13\\xc6\\xb1\\x06 !\\xee\\x1dx'\\xf7\\xf3\\x11\\xc5\\x93\\xe7=\\x04!\\xb7qt\\xdd\\x08\\x17\\xa2\\xad\\xa7f\\x92\\xbc\\x82x\\xe3\\x0f rc\\xf90/\\xfc\\xa6\\x9f\\xa8\\x9c\\x01\\xfay\\x9d\\x98\\xe9u\\xd25\\xc9>q\\xae\\xe4\\xf8\\x90\\xba\\xfd\\x1c \\xcb\\xec87_\\xfdt\\xa1h\\x86\\xc6w\\xf1\\xb4\\xf6\\xfe\\x03.\\xd2\\x1d\\xdf\\x9c\\xe4\\xee\\x87\\xb9\\x17\\xd2\\x12\\xd6!e\\xcc\\x89`g\\xc9oalj\\xc6\\xcf\\xfb\\x00\\xe6\\xef\\x941\\x10\\xc8\\x18`\\x9b\\xc6\\xbe\\xd0\\\\x9c\\x0bg\\xca\\xfet\\xd2\n0\\x9a\\x06\\xe0\\x8f\\xf9 \\x1a\"\\xb7\\xc6\\xbeu3#\\xbd\\xd3-o\\x84\\xef\\x1du\t\\xb8w\\xfbt\\x8b\\xfa\\xf4oc\\x164\\xb4f\\xb2*\\x82\\xd2%\\x11z\\xaf\\xe0\\xf5\\xb9\\xda<\\xc1\\xe9\\x97b\\x90kg\\xb6\\xfd\\xb8`\\xf9"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9\\x9bp9|\\xff\\xd6\\xb7\\xc15p\\x1c\\xcd(\\xc9l\\xe6\\xfd\\xbf\\x0b:\\xa2%\\x83\"\\xa28\\x95\\x12c\\x8b\\xff\\xc4z\\xbbj\\x94z\\x02\\xf9\\xa3\\xce\\x1e\\xc9\\xc8\\x94zgfr\\x95\\x9b\\t\\xadm\\xee\\x17\\x87b\\x96kc\\xc8g\\xf0\\ns\\xfdb\\xc6%\\x92\\xf9\\x1b\\x1ar\\xa9i\\x82\\xbd\\xd2\\xf4\\xae\\x9c/o\\x13q\\xcft2\\xc0\\xf6wbb./\\x94\\x99_\\xedp@7\\xcfxu\\x98\\xb4\\x85f5\\xd9 \\x1a\\x8c\\x1b\\x0c\\xdb2\\x84\\x10\\xc7\\xb0\\x02\\xb2@\\xb9\\xe0s\\xd6\\xe4\\xbe\\x04\\xb1h\\x98^$q\\xfb\\x02s\\xf5z\\x1bfd\\x11\\x8d\\x11m3\\x02\\x1b\\xaav\\x83\\x1b\\x9c\\xd6\\x1b\\xc9\\x85)n\\x9a\\xa3\n\\x96;\\x13\\xf4k|\\x17\\xb6\\x8a1k\\x1c\\x8f\\x83\\xeb3r\\x92\\x96\\x84>\\xf2\\xcd\\x19l\\g\\xf0\\xf4\\xa0\\xec\\x96s\\xc5\\xa1\\x84\\x97\r\\x94\\xec\\xfd\\xac\\x7f\\xeb\\xfc)\\xb4\\xab\\xc4\\x91\\xa2u\\xc3\\xd7r\\x0bb\\x98\\x935w#\\xcdb\\x12\\xf7w\\xbaq\\x8bdq"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010(k*\\xfc\\x1dr\\x7f1\\xf9>\\xe5!mn;iu\\xba\\x1b5\\xbd\\xae\\x86\\x80\\xc7\\xa7,%\\xab^;\\x96ut6*\\xf7\\xc1\\x12c\\x1caat\\xf8\\xc9\\xd4\\x06*\\xf9\\x06\\x08\\x972b\\xe8\\x95t$\\xbc&\\xb0\\xf8g\\xe5\\xa2ft\\xe8\\xff\\x0b\\xd0\\xf4r\\x89,\\x00ce\n,\\xfez\\xd4;\\x8b\\xc9v\\x7f\\xea\\x9ch`v\\xbb\\xe5\\xea\\xbd0\\x14\\xcf\\xe9\\xf5:\\xf7\\x8c\\x02\\xdb\\x08\\xdd\\x8b\\x0f\\xc7\\x1a(\\xd9\\x1avl\\x89\\x91\\xab+\\x93\r\\xd2\\xc1\\x90\\xd2\\x8d\\xe2/\\x95\\x1b|\\xf3>\\xcex\\xcbs\\x0e\\xa7j\\\\x9f\\x9e\\x11\">\\xccj\\xabq;\\xb9\\xbe\\xcb\\x85\\x87_\\xd5\\x17\\x14\\xd2\\xd6\\xf3$4.<\\xefn\\xdf\\x18\\x12\\xe3p\\xf7?\\x1ei\\xbe\\xc8\\x16\\xc5\\x11fh\\x8e\\xa0-\\x84q\\x9e\\xb3\\xc76\\xc5\\xfc\\x84\\x0e`\\x1a\\x08b\\xb0\\xbd\\xe4\\xc4\\x81\\xa7\\xc5p\\xdd\\xf6\\xef\\xb3\\xacl\\xcc\\xa3\\xbf\\xee\\xff\\x95\\xc7c\\xe1ds~\\x9d\\x1c\\xdf\\xaas$\\x91\\xe4\\x8e\\x1f<\\xc1\\xb9\\"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\xe0y\\x1c\\xf6q\\xcfg\\xaaml\\x9eix\\xd9\\x9d_q\\x7fk#\\x15\\xcf#\\xc4\\x87z\\xec\\x18,6\\x93u\\xb7\\xcd\\xa8\\x86\\xc6\\xee\\x82o\\x96\\x06\\x8e\\xc7~v\\x19di_\\x0e\n2\\xb0z\\x0bl\\xb4\\xb8p\\xcf\\xaa\\x9a\\xb9#\\xe2>\\xbd\t\\xe9\\xd8\\xe3s\\xe0u!\\xfc\\xf2(hs0qe\\xe1\\x034~$\\x06|\\x99d!gb\\x9a\\x06\\xbd\\xe9\\xcfa\\x9e\\x05b\\xd6\\x85%q\\x1fzy\\x8apz\\x8c\\xecu\\xd0\\x07\\x9au!-\\x99\\x9d\\xb1o\\xc0\\xf0a\\xc4\\xc3\\xa2\\x95r\\xbe(\\xd1\\xa1b\\xa2\\x96\\xdbx\\xf1q,ba\\x9a^2\\x06\\x9b\\xfav\\xcd\\xac\r\\xb7\\x9d\\xf2\\x95\\xfc\\xf8\\xe5\\x81\\xb5<ne\\x15\\xd5\\xff`\\xf9;k\\x1co\\xdb\\xc6\\x8e6\\xeb\\x82\\xd6\\xe8n\\x16\n\\x1fx\\xed\\xfc\\xaau\\xf4\\xb3oo\\xdem\\xd8\\x11\\x19\\xc0\\xc8w'\\x98\\xe2\\xd2\\xdae*\\xcd_pgjw\\xdef\\x9am\\x87(+g\\xaf\\xba\\x8f\\xc3_\\x83d\tv\\xe6\\xcc\\xf1y\\x9f\\xb2"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f&\\x14\\x92m\\x0b_e/ol\\xe0\\xd0p?\\xe5\\xba\\xcd\\xca\\xfa\\xd7\\xaf\\x14m\\xe6\\xecx\\x83\\xadi\\xe6\\xdbn\\xf5v\\x86\\xb5\\x00~\\xc8\\x91x$\\xc1\\xf5\\x1e\\xc2,\\x0b?e\\xa0q\\xfd\\xe3\\xfc\\x15\\xd0\\xa20u\\xebns\\x87\\xa3\\xd3\\xa3g\\xf8\\x81\\xe8\\x80\\x92\\xea\\xba4\\x9c\\x17\\x0c1^\\x9fw\t\\x90\\x8ee1x-\\x16<\\x10\\x9c(\\xc5\\xaf\\xae\\\\x0e\\x8f\\xf9(v\\xf99\\xf8_\\x18\\x02\\xceo:\\xab\\xe1\\x89\\xa0\\x1f\\xff\\xf9\\x91\\xa5\\xe5\\xc8\\xcf\\xbc\\xb0\\x91\\x87>\\x16n0\\x00\\xc2\\xb6\\xcb\\x93\\xc9ynu\\x9em\\x1e\\x12p4\\xaaei\\xcf\\x03\\x9f\\xfb@!\\xa81\\x11e\\xa3b\\x8d\\xf5cg\\xb2xa\\xce\\xeczbrl\\x05\\xd3\\xba\\xd0vqg\\x8b5\\xadd\\x0f\\x92\\xb1wn5\\xf0t\\xa199!\\xb3\\x99_\\x0e\\xcf\\x7f< \\xa1\\xb6q\\x92:u\\xff\\x19\\xe2b\\x85_\\x99q\\xf7un%q\"y\r\\xf0\\xed8ia \\xd4\\xc0\\xb3kjo\\xea\\xdd\\x1cn\\x0f\\xbc\\xeb\\xfd"
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010@\\x87\\xa8\\x0e\\x00\\xfb\\xbcd\\x9a\\xae\\xf7\\xd5\n\n\\xa91\\xd2\\x18\\x1b\\xef\\xfd\\xf7\\xcebo\\xc9,\\xc9\\x7f\"\\x8f$\\xb5\\xa9\r\\x7f;\\\\xe7\\xd3\\x07\\xbd\\xfcp\\xce\\xa4\\xd5\\xd7t\\xed\\x80e\\x7f\\xbfj\\xa6x\\xc6ox \\x08\\x0b\\xc0\\x04\\xdfz\\x0f\\xe2\\x08_%!5\\x99\\xe3\\xcc\\xa1\\xbb\\xcf\\xbd\nhe\\xf79\\x81\\x16hb\\x8akd\r\\xd1\\x89g\\xd5\\x93\\xc7\\xdd\\x10i\\xb4r\\x96\\xd2\\x08\\xf6\\x1f@\\x88r0\\x88=\\xe5\\x80<\\xc7\\x93\\xc6\\xf7\\xa3\\xaa\\xa0\\xc0\\xfa\\xd0\\xa8\\x07\\xd6\\x0e*\\x8er\\x1a\\xad\\xe0\\x9b\\xb2\\xc7\\xe4\\xf8t\\xe3\\xbd\\xc8\\xcd7\\x10\\xeezw\\x05z\\xa6\\xa4\\xd4\\xd72uv\\xd6\\x9b\\xfd\\x7fh\\x9b\\xb3\\xc8c\\xb0ap\\xd4\\x9f\\x19\\xe7\\xd25\\x96z\\x88c@\\xd0\\x9dw\\x15jv\\xe0\\xad\\xdc@\\xfe\\xc3\\xe2\\x8a\\x12\\x1b\\x1eif\\x07\\xd7\\xc0t\\xb8|q\\x94\\x9d\\x04,)\\x99\\x8er\\x068\\xad\\xb4\\xae7\\x0e\\x84=\\xa8\\x9f\\xe8_\\xc8\\xd3ox?\\xc5s\\x16\\x0b\\x0f\\xa5\\x0f"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;u\\xa3\\x9ci\\xd8v\\xdf\\x96\\b$/\\xe9cw\\x14z\\xd8\\xa9\\xe3\\xf1\\x84j\\x1c\\x18\\xb6a\\xa0\\x10r<\\x11n\\x892\\xc6\\xb0\\x81=\\xf1\\xd1lm\\xd3?eu\\xf2n\\x8a\\x86#\\x87%o\\xde\\\\xbb\\xc3)ex\\xa2\\xa3\\xcb\\x91\\x7f\\x9d\\xc6\\xa7q\\xd8\\xb3fgktl\\xc7g\\x12\\x85\\x06\\xc8\\xdf\\x93k\\x01\\xdew\\xbd\\x8a\\xebz\\x81\\x8e\\x7fmcp\\x11\\xdb\\xd7\\xeac\tj8\\x83`x\t\\xad\\xaf\\xa2l\\x02\\xacv\\xa3>\\x8e'\\x1f.\\xca\\x88\\x99\\x8e~\\x91\\x9f/f\\x99l\\xa3x\\x97\\xb0~\\x8fd#\\xca\\xc2\\xe6\\x98\\x15\\x18\\xdc\\xb5\\x92q\\xd2p\\xb1\\xb1\\xbcp$\\xa4\\x19ib'^\\xe6\\xa0\\x1bw\\x95\\xbct\\xf3@t&\\x1dh\\xe0_\\xe2\\xf6\\xfc\\xb2\\xd5n\\xd7\\xf8\\xf1\\x1d\t\\xfd\\xa1\\x06\\b\\xfbs\\xedx8aa\\x9d\\xdc\\xbd\\x8f\\xa6\\xc5\\xc3\\x82\\xf7 \\xc3\\xe6\\xe6\\x0b:\\xecl#\\x98\\x8c\\xb3\\x1d\\xeah\\x0e\\xd5\\x7f\\x81\\xaf-\\x11\\xc7k\\x8a\\xa9\\xae\\xfd\\xcc "
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\x02\\x88\\xa1\\xb6d\\x1c%\\xf9\\xdel\\xac\\xa0\\x83d\\x06i\\xb2\\x0c<\\x91yq\\x802\\xab\\xf9\\x16\\xb6\\xcb\\xea\\x9f\\xfb$\\x18\\x04rge\\x16\\\\x937\\xad\\xbe\\xcdp<\\xbc\\x0e0\\xb7\\x02\\xe3\\xe8\\xaa\\x91lg\\xb9\\x97\\x18\\x8edf\\x8aw\\xd7\rc\\xdd\\xd4\\x80\\xef~\\x1a\\x8do\\x841#\\x8a\\xf7+\\x93\\xc3qs\\x0b\\xcb\\xb0\\x1c(2l\\x9e\\x13\\xc55c\\xce\\xb1$\\xb0\\xfd&\\x92um\\xb5\"r\\x83\\x14o\\xa8\\$\\x07\\xc0\\xbe\\xd0\\x18=\tf=w\\xb1\\xdd\t\\xfc&j\\xac3\\xc2\\xb2/\\x93\\xc5\\x1a\\xe7\\xe7\\xd11\\xa7\\xd0-\t\\x83*\\xcdct\\x92\\x91z\\x00er\\xf1\\xab\\xbe\\xe9\\xe6u\\xb0\\xbb\\xd0\\x0e:\\xcb\\xf9e\\x96\\x04\\x0b\\x9f\\x0c\\x8att\\xe0p\\xc9l\r;'\\x17\\xa3>\\x92z\nk`\\xdc\\xc9+!\\xc4\\xdacyk@\\x89\\xd8\\xf8j \\xc2\\x0f\\xf7\\x81rw\\x04^\\xb7\\xd5\\xbc\\x82\\xa0#\\xd1s\\xa3\\x97\\xa6q\\x0fn;\\xaf\\x16\\x8d$lt\\xd4\\xbff"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\x9e\\x9a$\\xe0\\x1fmo\\xae\\x06\\x8b-\\xf2\\xbfq\\x15\\xeb\\x8f\rn\\x1b\\xbeu\\x8f\\x9e\\xa0\\x84\\xa5-%\\xb7\\x16lud\\xd6\\xf6t\\xca\\xd4ow-\\x04>\\x96&\\xbf\\xc0\\xa4ik\t\\xc5\\xad\\xf8\\x15\\xe4\\x98\\xf4\\xdc\\xf7 \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xd1#\\x0c\\xff\\xab\\x83\\x8c6u\\xe1\\xb3h\\xe3\\xec9\\xc6\\xbcr!\\x9c\\xbc\\x98\\x9f\r\\xfct\\xd8\\x08\\xf2\t\rv\\x9c\\xc2':\\xe8\\xe5\\xb1\\xde\\xee\\x82\\xfb\\xd4.\\xadn"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x85\\xdd\\x11\\xd3\\xbe\\xc0\n\\xcdml0\\x02_\\xd9\\xc1\\x0b9\\xcc/v\\x9d\\xa59k\\xf8\\xcc\\x19\\x81\\x8a\\x9d\\x90\\xe2(\\xfd\\x14\\x81\\xc0\\xfec\\x01\\xb9ze\\x9d$\\x1d\\x89\\x85\\xac\\xdf\\xf3\\xfeh\\x95\\x91\\xa9\\xa3\\x96)\\xdd\\xf2\r\\xfbb\\xc5\\xd4:fa\\xcb\\x11>&\\x0f\\x9ba\\xc9\\x98\\xf5+\\xc9\\x88/y\\xc7a\\xbe\nw\\xfc\\xdb\\xfen\\x0e\\x17 \\xb2\\xf4\\xdd\\x08un\\x07\\xf5\\x8f\\x8e\\xcb\\x15\\xea\\xca\\xd3\\xfcz\\x9fb\\xd1y\\xc3@\\xafmn\"\\xe9\\xd2\\x14\\xfb\\xc1\\xfd.jq\\xa7\\x16/\\xa7\\xb9\\x04\\x11&w\\xd9\\x06:\r\\xd3\\x9d\\xcf\\x8dbf\\x0b\\x87\\x13\\xf9\\xb5\\xdb\\xef2z\\x0b\\xd6\\xd9j\\x16\\x8f\\x072\\xc9\\xc6 amvu\\xfa\\xaeg\\xc3\\x8c?sm\\xd5\\x8c\\x18\\x82\\x8c*\\x12\\x1b\\xa8\\x89k\\xf9z\\x9a,\\xcb\\xfb\\x8c\\xf5\\x19j\\x93\\xc2\\x8aj\\xc8\\x1f\\xd7l-=\\xee\\xad\\x13w\\xf8\\x10\\x93p\\x00 \\xd0\\xce\n\\x11o\\xef%\\xdd\\x0c8\\x04\\x0b\\xd6\\x05\\x9a\t5\\xf2\\xc1\\x1c\\x9c\\xdekhz\\xe4"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcb+\\xbfilhw\\x80p\\x06~\\x845|\\xae\\xf4\\xf7r\\xf2\\x1a\\xa9\\xab\\xa2\\x96\\x91&\\xdb\\x056 \\xfa\\xa1\\x86\\x02!e\\xeba\\xcf\\x86c\\xae\\x89\\xfb\\x9f\\xf0b3w\r\\x93\\x9b\\xa80\\x85\\x96\\x8c\\x1fr\\xd0\\x1c\\x06\\xf1_qve\\xc3g\"_\\xeb\\x83\\x83\\xe5<`\\xf1\\xc6\\xa5c\\xf6kj\\x1a\\xc8\\x1b\\x97\\xd4\\xdaa\\xf1\\xb6\\xceotf\\xe9\\xad\\xd3i.4p\\xecb\\xd5\\xd8z\\xb0q\\xf3n9\\x85u\\xaf\\xa8t\\xff\\xe3\\xb5\\xb3z\\xb99y^xa\\xb8\\xb7\\x1c\\x06\\x7f\\xd8y\\x96n\\xd2\\x1a/\\x91\\xad\\xc2\\xae`m_\\xfd'\\xd9\\x92\\xb0\\x99-\\xac\\x11\\xb8\\xa4\\x97\\xd5'\\xc9x\\x8f\\x07k\\x05\\x9b\\x92u\\xa5\\xc1)\\xb3h\\x930\\x1b\\xadi*\\xb0\\xb8\\xb3\\xe7|$k/5\\xcf~pfqla\\xdf!\\xa6/\\x80\\x98\\xb1\\x0b\\xdc\\xa1muuf\\xc7\\xbe?\\x8f\\x95\\x18\\xec\\xc9\\x0e\\xd9\\xb3t\\xfc\\xcc<\\xc6\\xb6\\xef\\x90\\x1f\\xf3\\x94\\xb4\\xc9\\xab_\\xc7\\xe7\\x94\\x9a\\x9dk\\xab"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b,b\\xfdg\\xd9+\\xeb\\xa8\\x9cq<#\\x88s~\\xb7\\x7f\\x99\\x94\\xe6\\xb6\\x95c>,\\xd9\\x19\\xe8`k\\xbbz\\xb7\\xc3w\\xfe\\x91\\xcb\\xc2\\x97\\x10\\xf8m4\\xf8\t\\x02\\xfa9a\\x07\\x8f\\xc1\\xc6qg\\x9ev\\x8c\\x8c\\x16d\\xba\\xa8\\xe5\\x0e\\xb5q\\xaeq'.\\x1e\\xeb\\xd5\\xe2\\x065\\xb2u\\xa5l\\x08b\\x08\\x89c\\xd3\\xeb\\xc0\\xf3\\xfa\\xab>q\\x11\\xf2n'h\\x98x<q\\x88\\x9c\\xb2\\x7f\\x12o\\x03\\x0bo\\xe7jz\\xd1\\xd7\\xd2\\x91\\xb0\\xfd`w\\x90\\xd7\\xd8:\\xafuplc\\x13q\\xect\\x85\\x19\\xfa\n+\\x0b\\xe6\\xf3\\x03\\xd9i<\\xaf\\xc2\\x15w\\xbfu\\xe0\\x99\\x0f\\xfa\\xa7\\xcb\\xcf\\xea\\xb4\\x9f\\x86\\xc0\\xc0~\\xbds\\xfb\\x1f\\xd7\\xc6\\xf5\\xcfe'\\x867\\x87\\x7f\\x10n\\xaa\\x04\\xa7\\x10\\xbc\\xac'e:\\x84\\xc9q^\\x9dqr\\xbfov\\xb2\\x00\\xe0dgpb\\x95u\\xb1\\xaf\\xf3\\xa1\\x7f\\xb3'*\\xfao\\xbb4\\xfa6-\\xa4\\x00\\xd4\\xf1*\\xa8\\x8b\\x1a\\x1es\\x08\\x06q\\xe0inck"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5\\x07o(\\x0e\\xd4b\\x08pu#\\x9ew\\x9a\\x83\\xea\\xff\\x8d~\\x03\\x14\\xef\\xc6b\\xf4\\x0fu\\x94.\\x03\\xf4\\x9c\\xbf+\\xc5#\\x90^\\xba\\xf0\\xbb)\\xcd\\xa06\\\\xf8?\\xad\\xc4\\x0e\\x07\\xaay\\x1bwv-\\x7f\\xf5:\\xc4\no\\xef\\x83\\xad\\x9e9i\\x1e\\xff\\x17~8\\x01\\x97\\xda\\xb8\\x1d4g6d\\xac\\x189ws\\xf1k\\xb2a\\x0bk\n#\\\\x04*u\\x15\\xda\\xe5$\\x0b\\x99\\xf3\\xe5g\\xa9\\xe6a\\x9bod\\xb1\\xba\\xd3\\xdek\\x13\\x9a\\x8b\\xc9p+\\xcf1c')\\x1az\\xaef`\\xd7<\\x0f\\xe1\\x01#\\xc2k\\x08\\xee>\\xac\\x8e\\xfbk\\xefk\\x94\\xe5'\\xca\\x85\\xe7m\\xa3ol7\\xb9\\x8b\\xe4\\x17e\\x07c\\x10\\xd4\\xbel\\\\x03\\xba\\xb3l\\x90\\xc1\\x87p\r8\\x07=u\\xb9<9\\xcd\\x17\\x88\\xc2l-b\\x9d(p5\\xb6vd\\xf6\\xddo\\xa7\\xffr,m\\x1cxj\\xd6\\xfb\\xb4\\xc9`\\xc8\\x12\\xe0h\\xe5\\x14\\x04\\x86-\\xe9\\xda\\xfdx\\x9d\\xf6\\x0fu\\x90\\xdd\\xa69\\x8d\\xa0\\x93\\x08"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\xdd\\x1ch\\x13f\\xb6\\xadw\\x97\\x8b\\xb3\\xe8|\\xe7m (6s4\\xdeu\\xf3\\xaa\\xa6\\x16\\xa6ll\\x7f\\xd3\\xeel\\x85\\x8c\\xf0\\x16\\xb4\\x0e\\xf4ds\\x8b=\\xf7\\xbf\\xb1j\\x99\\xc9\\xdd\\x1f\\xce\\xa4/\\xb9\\xa6\\xc5rk\\x14\\x97\\xb2\\xee\"z\\xc1u\\xc8\\xd1k|w\\x14o\\xa2\\x82\\xc4y\\xcc\\x03c\\x84\\xce+&\\x8b\\x08\\xdag\\xc3_'\\x9f\\xcd\\xe6o\\x02\\xb6\\x13<9\\x06\\xfd\\xb47\tgsz\\xc0\\xc6\\xac\\x9ew\\x1c\tz\\xc1\\xf197\\xc6;_d\\xcd\\x93\\xc6\\x9e\\xe1_\\xc9\\xce4\t\\xbc\\xcd\\xd5i;\"\\x1a.l\\xc1\\xbb-p#o\\xd4\\x12\\x13\\x8a(@\\xabev\\xe8=\\xf7vd3\\xea\\xb8\n\\x07\\xe8\\x95z#>\\x86s0\\x91r~\\x02j\\x9ef-x\\xbbg\\x8b\\xa4\\xb9\\x99\\x81\\xf3\\x98\\xc2\\x18$\\xc0\\x84\\xf8\\x93\\xa54b\\xba\\x1d\\xd2\\xf9b\\xba\\xb1\\xc7\\xcfe\\xb7oa\\xe2&\\xd7l\\x84\\xbb\t\\xadm\\xd8\\x8d;z\\xb3\\xd3\\xcf\\x8c\\xac\\xd9%\\xf6r\\xa6o\\xa6b"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe4\\x9a\\x12\\xb3\\xad!w\\xc9\\xd6r\\xd7ur\\x89\\x04\\x18\\xa2\\x0f\\xee\\xc2\\xd6xdq\\x84\\xcd\\xe9t\\xddp\\xf7?o\\xbbs\\xabrr>\\x81\\xaa\\x06\\xf5\\xb7x\\xb6\\xeds\\x90~_\\xd2\\xbby\\x07\\xd7,\\x8be\\xf9\\x90r\\xaa/l\\xf5\\xb7<\\xe1\\xf2=\\xd3v\\xfcn\\x11\\xea\\x8e\\x14+,\\xe8\\x9a!\\x9b8\\x15q\\xfc\\xda.\\x18\\xa3\\x03\\xfea?\rfy\\xedh\\xc5\\xa9\\x11k\"l\\x97.\\xc6lk\\xf8\\xdd\\xe3\\xcd\\xf8\\x17\\xf4\\x84m\\x85\\x96\\xa1\\xa8\\xad\\x01\\xef\\x8ehsqe\\x9c\\xf7\\xed\\x9d\\x1ej\\x88\\x1b\\xc0\\xdel\\x83=i\\x95\\x17\\xd2\\x93h\\xe1homu\\xa0\\xdc\\xfb5u\\xa4\\xa4\\x07\\x88op\\xeeo\\xaa(`\\x0e\\x08\\xb11\\x08+\\xf7\\xd4\\x16\\x7fy\\x95\t\\xaf9\\xb2\\xa9\\x12%\\xda\\xc9;\\x83\\xads\\xca\\x94\\xdf9\\x1dlr\\x90n\t\\xfb\\x07\\xba\\x92\\xe9\\xcc\\xa3\\xb8\\x1d\\xce*\\x08\\xaaq^\\x0cj\\xb1f.\\x12\\xd2il\\x8f\\x10\\xcf\\x94>c\\xff\\xd4\\x16\\x8a\\xe6\\x93\\xfb\\xa6n"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xa2\\x08*\\x9c\\xfd\\x1d\\xa2\\xa0\\xe9\\x12e\\xd4\\x81\\x8dvb\\xff\\xd9\\xe4\\xd9e\\xb1?\\xd9\\xbbf\\x16\\x03\\x17\\xb7`>t\\x86~\\xef\\xfadj\\xc9\\xc1\\xbb\\xfe\\xde\\xcc\\xe9\\xde\\x80\\xb4ocr\\xd6k;d\\xe4x\\x9c\\x97\\x11\\xc0\\xd1)d\\xa3b\\x1cqa>\\xd3\\x88\\x95\\xdc~\\x14zqk\\x0e\\xa7\\xe3ps \\x9b\\x02,\\x8c\\xc8g\\xe7hn;\\xc8\\xf2\\xe5\\xf8\\xf8\\xab\\x85\\x80\\xae\\x13\\xad\\x8d\\x82\\x05\\x89\\x85\\x87p6\\xc1(\\xe1\\x16\\x14\\x84ckly_\\x8c\\x04\\xcc>k%\\xbdhc\\x8f\\xc4\\xb1od\\x99^\\xc4y9\\xdf\\xa5\\x8a\\x05\\xf7\\x03b\\xa21\\x96\\x99+\\x06\\x0c\\xc1\\xb5\\xf2et\\x1bu\\xa5@\\xb8\\x112mpy\\x81\\x1c\\xf0\\xe2\\xc0?\\x91f\\x10\\xb8w\\xc8\\xd5\\xdc\\xa9\\xb4t\\xb7\\xa8\\xb5k=!\\xa4\\x01.k\\x99\\xec\\x7f\\xe3\\x84\\xadz\r9+\\x87\\x93,\\x90gs\\xeaq\\x1cp?\\xf1\\x14\\xc1al\\xc3\\xa4\\x81\\xbdy\\x06\\x84\\xa0\\x83s\\x02\\xef\\x9d\\xd9\\xf8c\\x02\t\\x1f\\x9e#"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xad\\xfe\\xc5@*\\x80\\xefr\\x0e&\\xc0o\\x18\\xf5\\xf3\\x8f\\x89\\xf3\\xaf_z\\xe2t\\x17\\x12a$\\x9a\\x04rgf\\x9b\\x9b\\xce\\xc1^#\\x19\\x00l:>\\x9e\\xbb\\xc9\\x06\\xe8\\xea\\x7f\\x9b\\x86\\xaf\\xd9\\xa2\\xe0o\\xc5\\x84&\\xa0/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_=d\\x92j\\x9b\\x90\\xe7\\x1f\\x1a\\x13\\x98\\xb8t\\xe6\\xbb\\xd7\\x80\\x9a\\x00.0\\xf1e\\xf7\\x0f\\xb0\\xdej;\\xab\\xbf\\xbe\\xd4\\xe0\\x84\\xa4u\\x95&\\x17\\xf8\\xaa\\xc4\\xcb\\xe9'"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r/\\x89\\xcd\\x98*~p|\\xb7\\x92y2\\xe0\"\\xfb\\xf9v\\xa6\\x92\\xfa>\\x93rc\\xbc\\xd1l.u\\x83\\xb5,\\xa1tog-\\xd5\\xd1\\xc4\\x1b\\xb3$;\\x943\\x8d\\xb59*p1\\x00\\xa0&o\\xf0\\x82\\xaa\\xd9b\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x89o\\x0b\\xc1\\xfa\\xe1\\xf11b\\x80\\x03tse\\xa4\\xe1\\x0c\\xf3\\x7ft\\x05\\x9d\\x86\\x19\\x90w\\xb6\\xf2e\\xc9\\xc1\\xe4\\xba5m\r\\xf8\\xd8\\x84\\xee|\\xe0\\xf8%\\xc6\\xcd\\x13\\x8e"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xdf\\xae+\\xcb\\xbej%\\xebs\\xb6s\\xd0\\xf7'd\\xf4\\xd7\\xa3\n\\x86\\xf6>-hd\r\\xa2\\x13\\xe6\\xc3&\\xce2/\\xd0\\xe3\\xec\\xbbg\\xaf\\xd3f\\xbd\\x9d\\xbf\\x96|3oy\\x7fcykef\\x93\\xf2\\xa6\\xd7\\xdf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xf4'/h\\x13\\xa8\\x0b\\x9f\\x85m\\xe1\\xe9|\\x01\\xdby\\xc9\\xb3\\x1bsq*\\xc3\\xd7\"u\\xac1\\x18\\xe04\\x96)\\x9ean\\xb7\\x104\\x95\\x1e\\xd6\\xc8`\\xf7\\xe3\\x98"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xc0\\xa9\\x8enq+\\xc4\\x87\\x95gs^\\xe9>\\xaf\\xa2\\x16\\x89y\\xc6%e\\xaf\\x97\\xe2\\x8bz\\x1b6t\\x0b\"\\xae\n\\x84:r\\xf7\\r\\x01_\\xdf\\xbc\\x83v\\xbc\\xa87oe\\xdbu\\x02\\xd8\\x0c\\xa3.\\xb1b\\x9b\\xe0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x9c\\xfda\\xf4\\w\\xbe \\x94\\xb1\\xa8\\x96v\\xaa\\xbd\\xfd&\\xa1\\xa4w\\xbd\\xb2\\x96qu\\x18\n\\xb7\\xbf\\xd4b\\x06maa\n\\x0be\\x85\\xd6\\xa2#\\x9e\\xe3\\xe4"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0bj\\xb6;\\x0f\\xb0s\\xf5\\x81\\x9d\\x0e\\xf3\\x8e\\x8e9\\xadf\\xb5\\xf4h\\xaa\\x83\\xa5\\xf8\\xda/=\\xf2\\x15\\xb2\\xf3\\x99\\xf7h\\x1d\\xa0\\x97\\xec\\x1c\\xc4\\xbe\\xf1\\xec\\x8dqm\\xe8\\x16\\x85`)\\x87\\xf8j\\x8b\\x07w\\x92\\xdbnx\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\xc2c\\x8c\\xb9q#\\xc0\\xea|\\xad\\xb5i\\x0b\\xd0\\x9b \\xc4p\\xbe\\x9a\\xa3\\x9a\\xd0\\x04k\\x06\\xf8\\x13\\x05\\x1a\\x84\t\\xa5\\x95v#d\\xb7\\xe8\n\\xa8\\x16\rs2\\xf3"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04e\\xa4\\xe1\\xcb\\xdb=\\xb0%\\x8a1\\xd3,\\xa6\\x10e\\x9cbx\\xb7ik7l\\xc4i\\x1c\\xf3\\x19<\\d\\x8e$:$\\xa9z\\xa1\\x14\\xe7\\x16\\xd7\\x86\\xd3\\xa5g\\x9f\\x07v\\x11\\xf9\\xde\\xffev\\xfb/\\x97g\\x16\\xc0>nb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11;\\xfc\\xc6\\xef\\xa9m\\x8b\\x89\\x84\\xb2\\xa9 \\xc8\\x82\\x83c\\xaew\\xe2`\\x0b1\\xb1h\\xe7\\xef\\xac\\x06yr\\xc3\\xe0\\x7f\\x0b\\x1e\\x94li\\xf9zf\\x17<4\\x97"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xba:d\\xf8gya\\xb3\\x96q\\x9f\\xa9\\x190\\x86\\xf8=\\x06t\\xc1\\x03\\x0c\\x9ad<\\x07\\xed\\xaeh\\xcb\\x0e\\xeb\\x83\r\\xee0\\xf6\\x06\\x19\\xf8\r+\\x1b\\x9bu\\xae\\xad\\x9f3l\\x00ee\\xc6\\xdf\\xc0\\xacedkp\\xb8\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)\\xff;\\xa9;\\xa1|\\xa5\\xd4qpt\\xb2\\xbd\\xde\\xd7\\xc2\\x13\\x1c\\xf3\\xdb\\x01xd\\xb4\\x18\\xacn\\xe1\\xdd\\xe9\\xa2j\"\\xdc\\xce\\xfe\\x15\\x1b\\x97ju\\x1d\\xd1\\x19x"
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1a\\xf3~\\xc33ue\\xe7;\\xe4\\x04\\x8d\\xc2\\xee\\x93\\xf7\\xaf\\xccx\\xa0c\\x98\\xf6\\xd7\\x95\\xcf\\xf7\\x14p8(\\xfa\\xf0\\xe8\\xcb\\xb0\\xbdr\\x92\\xf1s1\\xd9\\xa9,\\xfb\\x901\\xec\\xe9\\x96\\xe4\\xad\\\\x9c\\xfe:\\x16c\\xd5\\xa0\\xed\n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xc0i#\\x90\\xd6`\"\\xf2\\x99\\x87:\\xa1\\x1a\\x15\\xc7<\\x10\\xba\\xa9\\xc0zy\\xc9)\\xab\"o@\\xe8\\x1e;b\\xd2z7#^_w\\x03\\xe9\\xd9\\xc5n\\x8e\\x9c"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4\\xd2!\\x04\\xea\r\\xb7x\\xed\\xbb\\xd1\\xed\\xfc\\xf2\\x98\\x19\\x8f\\x82\\xdd\\xb7\\xbbaf\\x1cb\\x9e\\xefn2\\xd5\\xa6\\xfc\\x116\\\\xe5\\xedhtq\\\\x85;9\\x92jn\\x83\\x9a\\xd0\\xfe;'\\xed,\\xcb\\x053\\x12:u.\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x83\\xb9\\x93\\xd5\\x02\\x94\\xd8\\x1a\\xe59r\\x98\\xc6\\xde\\x0b:\\x16\\x93\\xd5c7\\xc1\\x9a\\xb0u\\x8e\\xa5^#q\"r\\x10+6m\\xe3>\\xcb\\xcai\\xa1\\x8eq\\xb8\\xf2:"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\x80\\x91j \\xa4\\x07\\xba\\xea\\x18\\\\xd4b\\xfd\\xe6\\xa2\\xfd'g\\xd9\\xff\\x14\\x93x\\xec\\xae\\xf6\\x1a\\xb9\\xdf\\x7ff\\xfbc\\x18b\\xe3\n\\xf0\\xe4\\xc8\\xb3\t\\xd4;o\\x04\\xa3m\\x98\\xe1\\xc6\\x01\\x93\\xc9!z1\\xc2<\\xe1\\xacd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000iw\\x03\\xa0iy\\xdfs\\xac\\x8e\\xf9\\x8b\\x8f\\xe0\\xf0?\\xa4c\\xfc\\xfd\\xc2\\xc3\\xcc\\x97i\\x00q\\xb5\\xa5\\xdd\\x8e\\xd0`\\xe7\\x02\\xa5\\xeb7\\x9e29\\xb7\\x8c^\\xbfd\\x03u"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\xdc\\xabr\\xf3\\x1e:\\x99\\x16\\xec\\xcavj\\x80\\x8c\\xa0$\\xf0\\x99\\xa2\\xb5\\xb1\\x11\\xd5_o\\xd6\\x80\\xca\\xfd\\x1b'(\\xf5#\\x08\\xf1b\\x04>\\x8d\\xd1\\x9d\\x1cy\\x0b\\x99\\x01g\\xa0\\x1cz\\x16\\xe2\\xc0\\xda0yp\\xf3\\xc9s@\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x00\\x17\\x17\\xb2f\\x1c\\xa2\\x19+\\x97\\x8cw5\\xa5\\xf32\\x80\\x83w\\xbdo\nnk\\x90\\x02|\\x8e 2\\xda\\xf5\\xb0|`/-\\xe0v<\\x87\\x05\rdyc\\x89\\xe8"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\x1b\\x94q\\xf7h\\x94~\\x8f\\xcd\\xb5\\x8a\\x01`r-\\xcf\\x00\\xc0\\x00\\xb3\\x81\\x90g\\xcb\\x8e:7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\t\\xf0\\xb7\\xf4\\x08\\xb3\\xb5\\xd9\\xdeb\\x1b\\xdf@\\x03\\x066\\x99\\xea~fz\\x81\\x8ag\\xa6\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xbc\\x89\\xbb\\xe9\\xbd~\\xa64h:\\x06p\\xd2ca*1\\xfa\\xa9/q\\x1f\\x83!\\\\xd2\"/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\x05\\x07\\xed\\x03\\xfd\\x80\"a(\\x17\\x88\\x1f\\xc2il\\x9a'zg\\x19\\x81\\xd7\\xc6r\\xc1mr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xefg\\x8c\\xfcc\n\\x0c9\\x8d\\x0f\r\\xf8\\xebd\\xf5:%\\xfa\\x80\\xa1b\\x98bqc\\xd3\\x93j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xff\\x90\\x86\\xa5\\xa5\\xf5vt\\x82jctd\\x15<\\xc6r\\xae\\xf1!\\xa2\\x00\\xeb5\\x91\\xfbq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xf8\\xef\\xe4\\xae9k\\x80\\xb2*\\xdd\\xa8\\x0cr\\x08xj\\x1f\\x04\\x19c\\x7f\\x02\\xbc\\\\x10\\xa4hq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8\\xc5\n\\xfd\\xc0\\xc5\\x9a\\xadrw\\xd7\\xcf\"\\xfa\\xf6\\xb5a|@nr\\xac\\xbd\\xd2\\x0e&!\\x08c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8p-\\xcf\\x17\\x98\\\\\\xeb\\xb8:u\\x01\\xde\\xd7x\\xe2\\x1e\\x94lh\\xd0\\xd1\\x06zg\\x11\\xea\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8s\\xd7@\\xd5dsp\\xca\\xae\r\n\\x80\\xd4q\\xfb\\x1aw*\\xec\\x06s\\x80w@x\\xdd\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04`\\xf1\\x899q\\\\xba\\x06\\xff\\x95\\xfaui\\xdc,\\xd7 \\xa1\\x05`\\xcd\\x06\\x99o\\xffe|\\xe0+\\xf9\\xf2=\\x16\\xf6h!w\\xed\\xe7\\xa2\\x18\\x14\\xf2e\\xc8go\\xaa\\x15\\xda\\x97\\xf1\\x16\\x00\\x7f=@\\xf9\\xd6s\\x8f\\xbf\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\x96\\xcbslnj\\xd7k\\xcc@\\x07\\x88\\x98\\x1d\\x16\\x88&\\xads\\xc6\\x03(,<\\xb34\\xd9>\\xa6\\xd7\\xe4lv\\xaaw\\x8f\\x1d\\xdf\\x0c\\xfao\\xe3o\\xb6\\x83\\xc9\\xde"
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8a\\xa7\\xa4\\x08fjq\\xa8^+r\\x1e`\\x01q\\x8ebqab:\\x83\\x95\\xa4\\xfebf\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$i\\xd8a\n\\x8b\\xdf\r\\xb8\\xdc\\x106\\x11a$z\\x98y:!k\\x19\\x1f\\xa0\\x03\\xa1\\xecq&\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  549.  
  550.  
  551. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd\\xa3\\xb8\\xb2\\xa7*\\x05c\\x7f\\x93\\x93\\xab\\xf5\\xa6\\x81r/\\xec\\xd1\\xd6\\x88d\\xe3o\\xec\\xb2\\x90\\x98\r\\xc7k\\x0fd\\x806t<w\"\\xf2\"\\xba\\x9b\\x92\\xacf\\x14\\xbbb\\x02\\xbb\\xd4\\xcf\\xe3>\\x99.w\\xe7yt\\xaa\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\x8d\\x06\\xd2\\xa4\\xa0&\\\\xf8>< \\x1e\\xa4d\\xca\\xde\\xed\\x80z\\xef&\\x08\\x98y\\xc7+\\xcd\n\\x0c\\x8e\\xdcc,k\n\\xb3\\xe7,u\\xb7\\xc1\\x93r\\xc3\\xe97\\xd3"
  552.  
  553.  
  554. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff?\\x18\\x90\\xa1\\xb8\\xeb\\xa2:\\xe2\\x05\\xe3\"=h\\xc8\\x81\\x90\\xcf\\x19\\xa6\\xb9s\\x8f\\x9c\\x93\\xc8t\\xde\\xe8\\xb3\\x80\\x03\\xcd\\xf5\\xeed\\x04\\xbe\\x07\\xd1\\x87|u,\\xe5\\x18q\\xc7p\\xc2\\xda\\xde\\x88v\\xe0e\\x19\\xa9m\\x07\\xb2\\x1b\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\xef\\x14\\xfc.e\\x07\\xad\\xf5\\xe0<\\xdc7`\\xc39\\xc4@\\x87v\\xd0\\xb8\\x0f\\x02oa\\xe5\\xc2\\xb3c\\xa7\\x93\\x7ff\\xfc\\x85\\xd8\\x85e\\x85\\xf4\\xcas\\x86\\xef\\x7f "
  555.  
  556.  
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\\\xcd\\xbfa^\\xd56\\xcf\\xe8\\xe8\\xe4m>\\xe2 8\\xabx\\xa4\\x91\\xbe\\xf9\\xa3rg3~\\xa8\\x07t\\x8f\\xc3\\xf7wv\\xe3$\\xbda\\x12\\x92\\xf6(xd@\\x07\\x987\\x1e\\x15m\\xfe\\xf8\\xcdd\\xa7y\\xab/3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe9h\\x11)\\xda<\\xc5\\x183\\x03\\xbd;ki\\x05jq\\xe5s\\x8a\\xd8j*\\xb6\\x8d\\xf2\\x1c:\\xa9\\xec\\xad\\x9f\\xce\\x9eg\\x08\\xbf\\x12\\xccw\\xf1,v\\x18\\x90\\x94\\xa0\\x9f"
  558.  
  559.  
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6\\xd31\\xb9\\xb2\\xe8\\x97\\x82\\xad\\xa2,\\x8bu\\xbd\\x04\\x0cx\\xac\\xaa\\xd4u\\x05t\\x88)\\x98\\xec\\x7f`\\xa34\\xe6\t&\\xa3\\x01\\x1c\"\\x1c\\x88\\x8d\\x96\\xf8l\\xcf\\xa5:1\\xffh\\\\xc4l\\x99\\xe1\\x9b9r\\xa6:\\xf1\\xd5\\xd8\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10~0s\\x9f\\xe6\\xfdp\\x13\\xdd\\x08i\\x96;\\xc5\\x94a\\xd1\r\\x1c\\i=cop\\xed l\\xd0\\xda\\x9dy\\x1e\\+d\\xcf\\xcb\\xc6\\x14\\xd1\\xd86~\\xe8\\x0fo"
  561.  
  562.  
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1\\xb5)\\xba\\xa3\\x01,\\xd3\\x9c'\\x00\\xf3\\xe8\\x17_jc=\\x95\\x1a\\xae\\\\x07\\xaa\\xdd\\xc1\\xbb\\xeah\\xc8nu\\x1e\\xb7#\\x9a\\xe9\\xfc&\\x10\\xd7\\xde\\xfd\\x05;\\xf4\\xab\\x87\\xbbh\\xaei6\\x19\\x04:\\xf8~\\xda\\xde\\x82a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81si.\\x89!tk\\xa7m\\x93|\\xa1\\x0c\\xd7\\xc2\\x91j\\xbd\\xa5s\\xd0\\xe6=\\xde\\xd0\\x17z4\\xe5.\\x97?fg\\x0b\\x80w\\xeaz\\xe7*i\\xb6\\x19p\\x83="
  564.  
  565.  
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049j\\xea&\\xd2z\\x94\\x90n\\xefz\\xafh\\x91\\x03e\\xfdq\\xa7 \\x9cr\\x80\\x88c@\\xe4\\xec\\x0f\\xde\\xb0`\\xae\\qqhex\\x1e\\xa3\\x051\\xc8i&\\x99\\x1c\\xdfd\\xf4e\t\\x96hu\\xad\\xd4\\xd4\\x9be\\xde(f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6m\\x17\\x96\\x9e\\xbf0!\\x07\\xfde\\xd0\\xf2\\xe4q-o9n\\x9d\\xc2m2\\xb2t:\\x05\\xc23\\xe5\\xdc^\\x10\\xb8\\xad\\xa0a\\xc4\\xc0\\x90\\xae\\xc1\\xc5\\x10\\xf9\\xda\\x83\\xcd"
  567.  
  568.  
  569. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3\\xd2\\xd7\\xc6\\xef8\\xf5\\xfc&\\xda|\\xb4`u\\xdc\\x86\\xff\\x13tr\\xd7)\\xad\\xd6\\xd7sh\\x15\\xdac\\x05-\\xf7zr3\\xdb\\x1dk\\x8a\\xf7\\xbb\\xbe\\xe7\\x9fd\\xb6\\x8d\\xe2uo\\xba\\xbb\\x95\\xe2\\x16ob\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\x11\\xba\\xa2j0\\xd8\\x80\\xb2\\xee\\xef\\x19\\xd68\\xb6r\\x9e\t\\x06?t\\xfei3\\x11k\\xbfys\\x1a\\xbc\\x80\\xeb\\x04\r\\x9du\\xdf,<\\x88\\xec\\xeaf\\x08\\xae5"
  570.  
  571.  
  572. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd6\\x16\\x8e\\xc9\\xf5f!3\\xa2\\x9f@\\xbfb\\x148\\xc8b\\x11\\xa7\\x17`3\\x1c\\xaf^\\xcawed\r\\xb0\\xca\\xb6:\\x82;x\\xcc?\\x8d\\xb3e\\x95\\x0e!\\xff\\xbf\\x06\\xd5\\xcf\\x90\\xab\\xd47\\x14\\x16\"\\xfc&91\\x85\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000@\\xad\\xcf\\xf3\\xab\\x10\\x14\\x8f\\xf7\\xa5/)q\\xb6\\xd9<\\xa3\\xb1\\xcamk\\xec\\xc9b\\xd7\\x89\\x85\\x0e\\xb1\\xbb\\xd6\"\\x85\\xd2 \\x96nl\\x02`m\\x89\\x06\\x86\\xf9y\"\\x13"
  573.  
  574.  
  575. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89x\\x13d#\r\\xc4t@\\x7fu\\xc9olw\\xcf\t\\x96;\\x80\\xe0\\x19\nm\\xa7\\xd8\\xec\\xd5\\x05\\x9b\\x7f\\x81\\x9c\\xb8\\x11\\xca\\xbb\\x92\\x87\\xcbap!\\x95\\x03k\\x87\\xc0\\xd6t\\x92\\xf1u\\xf7w\\x89i\\x964?\\xaa|a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\xf3~\\x01w\\xab\\x1b\\xb8sg\t\\xd5\\xc5\\xfaju\\xf1~a\\xf0\\xc0\\x8b\\x9f\\xdc\\x1c\\x0c\\x85\\xd17\\x07\\x03\\xce\\x0cb\\x192x\\xb5s\\xb13\\xb9\\xb1\\xc1s$jy"
  576.  
  577.  
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\x19fz9\\x81\\x9cv\\xf9\\xe3!.+\\xcf>\\xb4\\xeet\\x84\\xe4\\xfe\\xfa\\xdb\\xf2\\x1b\\xaac5\\xd8d\\xa0\\x86\\xaa\\xd7\\x1ew\\xa9\\xba\\xb9n\\xe8g\\x05\\xeas\\xe8#\\xb2\nks\\x9ap\\xf0\\xde@\\xadx\\x08%d\\x10\\xc8rk\\xde\\x005\\xd1\\xa5re\\xf9\\xb4#\\xbb\\xc2\\x992\\xd0\\x14\\xad\\x00,x\\x1d\\xb1\\xc8\\xbc\\xad\\xdc@.\\xae\\xd0\\xe3\\x18\\xd5z\\xd4\\x07\\x8d?5\\xb8\\xc3dn\\x13s\\xa7\\x96z\\xbe\\xadg\"\\xa0w\\xf8\\xe29\\xe9\\x10'\\x04\\\\xa7`\\xbb\\xd6\\x8d4ic\\xd1\\xddmg\\xcd\\xe9\\xa3u\\xb0\\x0e\\xf9\\xed\\xda\\xd1u4p\\xed\\xcd\\x06\\xf7\\xebsw\\x95w\\x1bc8\\xb4\\x19\\x7f7\\x8e\\xf9q\\xc4\\xc3;>|\\xc3\\xfa\\xaa\\x10\\xbc\\xf9\\xbf6\\xc4l)^i\\xd4o\\xc4\\x90^\\x04\\xc4\\x8dd*p\\x05;;\\xf7\\xbf\\xb5\\xear\\xb5lp8.\\x1bfp\\x83*\\xe6\\xda\\\\x9ej\\x15?h\\x851\\x9f\\x902w\\xf8\\xe6\\xd2\\xd3\\x80\\xd5\\xc3b0\\xc7\\x1a\\x93\\xd3\\xe2"
  579.  
  580.  
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf7\\xff\\xe7q\\x97\\xb0\\xd7\\x10\\xec8\\xbf\\xcf\t+\\x10<~\\xdd\\xa0\\xac\\xb3wk\\xf4\\x8f\\xd7po\\x03\\xa9\\xb7n\\xbdt\\xc5\\x1b2\\xf8\\xa8g\\xd5\\xa3\\xed\\xf5:y\\xe0\\x94\\xd9\\x00a\\xdc\\xcb\\xb3a\\x92h'f9l|\\x90\\xefrq\\x08\\x9d\\x17\\x81\\x96\\x94\\xf5\\xe3\\xdf@\\x1c\\x0b\\x86\\x82\\x8a\\x9a\\x17\\x10\\xf0\\xce \\x96\\xd8x\\xc5h\\x08\\xf9\\xb4\\x10\\xb2\\xa4\\x9dm\"\\x97\\xa8z\\x0f\\x1d\\x88x\\x1f\\xb6\\xae\\x9bu\t\\x91\\xda\\xe4\r\\x85\\xf7\\xf6\\xf1\\xdc\\xa8\\x1ae\\xe6\\xc9\\xc1\\xbaem9\\x188\\x1c\\x10\\x9e\\xfb\\xcd\\xe5\\xc1\\xe1\\x921\\x00\\x12c\\xb8\\xa4\\xf8\\xc1\\x1ar\\x84\\x01\\x16\\xf5b.?d_t\\xd3\\x0b\\xb5\\xd8b\\x83\n\\x93\\xf1\\xf5\\x96,\\xfa\\x9d\\x062\\xb7\\xa1\\x83\\x1a\\x9ddw\\x0b\\xe2d\\xa4j\\xcf\\x86\\xef\\xa9..j\\x00\\xb5w\\xc9;w\\xa4\\xd7\\xf9\\x99\\x808\\xd0dr\\xec\\xb1\\xfc2\\xb9@\\x04\\x95c:t\\xaeq\\xab\\x1f\\x15,!\\xf7m>*^\\xbb\\x9fp\\x1a\\xb1\\x12h\\xa1\\x05\\xa7\\x19\\xcd"
  582.  
  583.  
  584. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  585.  
  586.  
  587. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  588.  
  589.  
  590.  
  591.  
  592. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  593. "Details":
  594.  
  595. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  596.  
  597.  
  598. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  599.  
  600.  
  601. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  602.  
  603.  
  604. "McAfee": "Exploit-CVE2017-11882.ah"
  605.  
  606.  
  607. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  608.  
  609.  
  610. "Symantec": "Bloodhound.RTF.12"
  611.  
  612.  
  613. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  614.  
  615.  
  616. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  617.  
  618.  
  619. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  620.  
  621.  
  622. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  623.  
  624.  
  625. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  626.  
  627.  
  628. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  629.  
  630.  
  631. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  632.  
  633.  
  634. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  635.  
  636.  
  637. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  638.  
  639.  
  640. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  641.  
  642.  
  643. "TrendMicro": "Possible_SMBCVE20170199"
  644.  
  645.  
  646. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  647.  
  648.  
  649. "Sophos": "Exp/201711882-P"
  650.  
  651.  
  652. "Ikarus": "Exploit.CVE-2017-11882"
  653.  
  654.  
  655. "Cyren": "CVE-2017-11882!Camelot"
  656.  
  657.  
  658. "Avira": "HEUR/Rtf.Malformed"
  659.  
  660.  
  661. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  662.  
  663.  
  664. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  665.  
  666.  
  667. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  668.  
  669.  
  670. "GData": "Exploit.RTF-ObfsStrm.Gen"
  671.  
  672.  
  673. "AhnLab-V3": "RTF/Malform-C.Gen"
  674.  
  675.  
  676. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  677.  
  678.  
  679. "Zoner": "Probably RTFObfuscation"
  680.  
  681.  
  682. "MAX": "malware (ai score=81)"
  683.  
  684.  
  685. "Qihoo-360": "susp.rtf.objupdate.gen"
  686.  
  687.  
  688.  
  689.  
  690. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  691. "Details":
  692.  
  693. "target": "clamav:Rtf.Dropper.Agent-7008927-0, sha256:558bdda4a50b496b097d9b538a5fe385de26f2157ebd86fe9f112f7ae528e090, type:Rich Text Format data, version 1, unknown character set"
  694.  
  695.  
  696. "dropped": "clamav:Rtf.Dropper.Agent-7008927-0, sha256:558bdda4a50b496b097d9b538a5fe385de26f2157ebd86fe9f112f7ae528e090 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Docs_9eafb0bbfd910c927cb107d0ccf1168a.doc, type:Rich Text Format data, version 1, unknown character set"
  697.  
  698.  
  699.  
  700.  
  701. "Description": "Attempts to create or modify system certificates",
  702. "Details":
  703.  
  704.  
  705.  
  706. * Started Service:
  707. "osppsvc"
  708.  
  709.  
  710. * Mutexes:
  711. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  712. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  713. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  714. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  715. "CicLoadWinStaWinSta0",
  716. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  717. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  718. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  719. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  720.  
  721.  
  722. * Modified Files:
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_9eafb0bbfd910c927cb107d0ccf1168a.doc",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_9eafb0bbfd910c927cb107d0ccf1168a.doc",
  725. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF32B4A1D3-35A0-4C78-8AA0-1F94C5E8F5AE.tmp",
  726. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB9C633DD-D79F-4B20-9572-0DFA8090148C.tmp",
  727. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3E111DC7-5614-426A-A482-97053B097849.tmp",
  728. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  729. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  730. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  731. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  732. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  733. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F52EFD459704E23E98B5C774A45162",
  734. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C1F52EFD459704E23E98B5C774A45162",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1BED.tmp",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1BEE.tmp",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4531.tmp",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E5A.tmp",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCF.tmp",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD28.tmp",
  741. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD31.tmp\\gosttitle.xsl",
  743. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD31.tmp\\Content.inf",
  745. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  746. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  747. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D8D.tmp\\gostname.xsl",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D7C.tmp\\Equations.dotx",
  750. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  751. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D8D.tmp\\Content.inf",
  753. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC7777150-4B9D-4DDE-8E32-0EAF8EB5187D.tmp",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D7C.tmp\\Content.inf",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FFF.tmp\\APASixthEditionOfficeOnline.xsl",
  756. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FFF.tmp\\Content.inf",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  759. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl"
  760.  
  761.  
  762. * Deleted Files:
  763. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  764. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab1BED.tmp",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar1BEE.tmp",
  767. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475fn=Frame.eftx",
  768. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475fn=Frame.xml",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430fn=Banded.eftx",
  770. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430fn=Banded.xml",
  771. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475fn=Frame.xml",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496fn=Parallax.eftx",
  773. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434fn=Wood Type.eftx",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033927fn=Main Event.eftx",
  775. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001103fn=Headlines.eftx",
  776. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496fn=Parallax.xml",
  777. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430fn=Banded.xml",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434fn=Wood Type.xml",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033917fn=Berlin.eftx",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033919fn=Circuit.eftx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104fn=Feathered.eftx",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929fn=Slate.eftx",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937fn=Vapor Trail.eftx",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001106fn=Badge.eftx",
  785. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496fn=Parallax.xml",
  786. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033917fn=Berlin.xml",
  787. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033927fn=Main Event.xml",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434fn=Wood Type.xml",
  789. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921fn=Damask.eftx",
  790. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105fn=Crop.eftx",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001103fn=Headlines.xml",
  792. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033917fn=Berlin.xml",
  793. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033927fn=Main Event.xml",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929fn=Slate.xml",
  795. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444fn=Basis.eftx",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033919fn=Circuit.xml",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937fn=Vapor Trail.xml",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104fn=Feathered.xml",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921fn=Damask.xml",
  800. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515fn=View.eftx",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033925fn=Droplet.eftx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001106fn=Badge.xml",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444fn=Basis.xml",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510fn=Savon.eftx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001103fn=Headlines.xml",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105fn=Crop.xml",
  807. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104fn=Feathered.xml",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033919fn=Circuit.xml",
  809. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937fn=Vapor Trail.xml",
  810. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929fn=Slate.xml",
  811. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485fn=Mesh.eftx",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444fn=Basis.xml",
  813. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503fn=Quotable.eftx",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515fn=View.xml",
  815. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464fn=Dividend.eftx",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001106fn=Badge.xml",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503fn=Quotable.xml",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491fn=Metropolitan.eftx",
  819. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921fn=Damask.xml",
  820. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510fn=Savon.xml",
  821. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515fn=View.xml",
  822. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105fn=Crop.xml",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464fn=Dividend.xml",
  824. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033925fn=Droplet.xml",
  825. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503fn=Quotable.xml",
  826. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464fn=Dividend.xml",
  827. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485fn=Mesh.xml",
  828. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510fn=Savon.xml",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485fn=Mesh.xml",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491fn=Metropolitan.xml",
  831. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033925fn=Droplet.xml",
  832. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491fn=Metropolitan.xml",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_9eafb0bbfd910c927cb107d0ccf1168a.doc",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD31.tmp",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D8D.tmp",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D7C.tmp",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAD31.tmp\\gosttitle.xsl",
  838. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  839. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSC7777150-4B9D-4DDE-8E32-0EAF8EB5187D.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FFF.tmp",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D8D.tmp\\gostname.xsl",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4531.tmp",
  843. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB9C633DD-D79F-4B20-9572-0DFA8090148C.tmp",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E5A.tmp",
  845. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS3E111DC7-5614-426A-A482-97053B097849.tmp",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3D7C.tmp\\Equations.dotx",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\cabBCF.tmp",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3FFF.tmp\\APASixthEditionOfficeOnline.xsl",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD28.tmp",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRA370.tmp.cvr"
  851.  
  852.  
  853. * Modified Registry Keys:
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\q:,",
  855. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\86DA3B",
  874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\86DA3B\\86DA3B",
  875. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  876. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\\Blob",
  877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1178. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1198.  
  1199.  
  1200. * Deleted Registry Keys:
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\q:,",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ +",
  1203. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\86DA3B\\86DA3B",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1261.  
  1262.  
  1263. * DNS Communications:
  1264.  
  1265. "type": "A",
  1266. "request": "koirado.com",
  1267. "answers":
  1268.  
  1269. "data": "46.105.57.169",
  1270. "type": "A"
  1271.  
  1272.  
  1273.  
  1274.  
  1275. "type": "A",
  1276. "request": "apps.identrust.com",
  1277. "answers":
  1278.  
  1279. "data": "192.35.177.64",
  1280. "type": "A"
  1281.  
  1282.  
  1283. "data": "apps.digsigtrust.com",
  1284. "type": "CNAME"
  1285.  
  1286.  
  1287.  
  1288.  
  1289. "type": "A",
  1290. "request": "ipapi.co",
  1291. "answers":
  1292.  
  1293. "data": "104.25.210.99",
  1294. "type": "A"
  1295.  
  1296.  
  1297. "data": "104.25.209.99",
  1298. "type": "A"
  1299.  
  1300.  
  1301.  
  1302.  
  1303. "type": "A",
  1304. "request": "ocsp.comodoca4.com",
  1305. "answers":
  1306.  
  1307. "data": "t3j2g9x7.stackpathcdn.com",
  1308. "type": "CNAME"
  1309.  
  1310.  
  1311. "data": "151.139.128.14",
  1312. "type": "A"
  1313.  
  1314.  
  1315.  
  1316.  
  1317. "type": "A",
  1318. "request": "vemvemserver.duckdns.org",
  1319. "answers":
  1320.  
  1321. "data": "205.185.125.42",
  1322. "type": "A"
  1323.  
  1324.  
  1325.  
  1326.  
  1327.  
  1328. * Domains:
  1329.  
  1330. "ip": "205.185.125.42",
  1331. "domain": "vemvemserver.duckdns.org"
  1332.  
  1333.  
  1334. "ip": "104.25.209.99",
  1335. "domain": "ipapi.co"
  1336.  
  1337.  
  1338. "ip": "46.105.57.169",
  1339. "domain": "koirado.com"
  1340.  
  1341.  
  1342. "ip": "151.139.128.14",
  1343. "domain": "ocsp.comodoca4.com"
  1344.  
  1345.  
  1346. "ip": "192.35.177.64",
  1347. "domain": "apps.identrust.com"
  1348.  
  1349.  
  1350.  
  1351. * Network Communication - ICMP:
  1352.  
  1353. * Network Communication - HTTP:
  1354.  
  1355. "count": 1,
  1356. "body": "",
  1357. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1358. "user-agent": "Microsoft-CryptoAPI/6.1",
  1359. "method": "GET",
  1360. "host": "ocsp.digicert.com",
  1361. "version": "1.1",
  1362. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1363. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1364. "port": 80
  1365.  
  1366.  
  1367. "count": 1,
  1368. "body": "",
  1369. "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
  1370. "user-agent": "Microsoft-CryptoAPI/6.1",
  1371. "method": "GET",
  1372. "host": "apps.identrust.com",
  1373. "version": "1.1",
  1374. "path": "/roots/dstrootcax3.p7c",
  1375. "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
  1376. "port": 80
  1377.  
  1378.  
  1379. "count": 1,
  1380. "body": "",
  1381. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1382. "user-agent": "Microsoft-CryptoAPI/6.1",
  1383. "method": "GET",
  1384. "host": "www.download.windowsupdate.com",
  1385. "version": "1.1",
  1386. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1387. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  1388. "port": 80
  1389.  
  1390.  
  1391. "count": 1,
  1392. "body": "",
  1393. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1394. "user-agent": "Microsoft-CryptoAPI/6.1",
  1395. "method": "GET",
  1396. "host": "ocsp.msocsp.com",
  1397. "version": "1.1",
  1398. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1399. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1400. "port": 80
  1401.  
  1402.  
  1403. "count": 1,
  1404. "body": "",
  1405. "uri": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1406. "user-agent": "Microsoft-CryptoAPI/6.1",
  1407. "method": "GET",
  1408. "host": "mscrl.microsoft.com",
  1409. "version": "1.1",
  1410. "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  1411. "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: mscrl.microsoft.com\r\n\r\n",
  1412. "port": 80
  1413.  
  1414.  
  1415. "count": 1,
  1416. "body": "",
  1417. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1418. "user-agent": "Microsoft-CryptoAPI/6.1",
  1419. "method": "GET",
  1420. "host": "ocsp.usertrust.com",
  1421. "version": "1.1",
  1422. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  1423. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  1424. "port": 80
  1425.  
  1426.  
  1427. "count": 1,
  1428. "body": "",
  1429. "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1430. "user-agent": "Microsoft-CryptoAPI/6.1",
  1431. "method": "GET",
  1432. "host": "ocsp.comodoca4.com",
  1433. "version": "1.1",
  1434. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
  1435. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  1436. "port": 80
  1437.  
  1438.  
  1439. "count": 1,
  1440. "body": "",
  1441. "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
  1442. "user-agent": "Microsoft-CryptoAPI/6.1",
  1443. "method": "GET",
  1444. "host": "ocsp.comodoca4.com",
  1445. "version": "1.1",
  1446. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D",
  1447. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQAU7Bfe6xSRj1%2Bo83zCN%2BY2wTgIAQU1LD0%2FU%2BcQqRs3D0u7ltBGMmtA%2FYCEGbZBgaEG1afQkxO0Kqs%2FzU%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
  1448. "port": 80
  1449.  
  1450.  
  1451. "count": 1,
  1452. "body": "",
  1453. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1454. "user-agent": "Microsoft-CryptoAPI/6.1",
  1455. "method": "GET",
  1456. "host": "crl.microsoft.com",
  1457. "version": "1.1",
  1458. "path": "/pki/crl/products/microsoftrootcert.crl",
  1459. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1460. "port": 80
  1461.  
  1462.  
  1463. "count": 3,
  1464. "body": "",
  1465. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1466. "user-agent": "Microsoft-CryptoAPI/6.1",
  1467. "method": "GET",
  1468. "host": "crl.microsoft.com",
  1469. "version": "1.1",
  1470. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1471. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1472. "port": 80
  1473.  
  1474.  
  1475. "count": 1,
  1476. "body": "",
  1477. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  1478. "user-agent": "Microsoft-CryptoAPI/6.1",
  1479. "method": "GET",
  1480. "host": "ocsp.thawte.com",
  1481. "version": "1.1",
  1482. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  1483. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  1484. "port": 80
  1485.  
  1486.  
  1487. "count": 1,
  1488. "body": "",
  1489. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1490. "user-agent": "Microsoft-CryptoAPI/6.1",
  1491. "method": "GET",
  1492. "host": "ocsp.digicert.com",
  1493. "version": "1.1",
  1494. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1495. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1496. "port": 80
  1497.  
  1498.  
  1499.  
  1500. * Network Communication - SMTP:
  1501.  
  1502. * Network Communication - Hosts:
  1503.  
  1504. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!